"Access Denied" when syncronizing offline files

A colleague of mine was complaining that he was experiencing Access Denied message while synchronizing his folder redirected offline files on his Windows 7 laptop machine with enabled option for encrypting the offline files cache. While he was able to successfully synchronize folder redirected offline files on his Windows 8.1 desktop workstation with disabled option for encrypting the offline files cache.
The reason for this strange behavior is that Windows for encrypting the offline files cache is using native EFS. Also, for testing purposes he tried to encrypt some folder on NTFS file system, but he was unable to do that. So, now it was easy to guess that EFS is not working as should. After checking the Data Recovery Agent in Computer Configuration\Windows Settings\Public Key Policies\Encrypting File System in Default Domain GPO, I have noticed that default self signed Administrator certificate for EFS data recovery agent has expired.
Deleting this expired certificate and generating new EFS data recovery certificate and importing it into Default Domain GPO, has solved all the problems. This new Data Recovery Agent certificate can be self signed and can be generated with cipher /r:cert_file_name, or if there is Microsoft CA in organization EFS recovery agent certificate template can be used.
 

Folder redirected offline folders out of sync

A colleague of mine on his Windows 7 client workstation was complaining about his profile redirected offline folders that were out of sync with folders that were residing on file server. He tried almost everything to get those files and folders in sync, so finally last chance to rescue was to reset offline database and re-initialize the cache of offline files.
In order to do that, following registry entry has to be created:

FormatDatabase  DWORD (32 bit value) : 1

in

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CSC\Parameters

After rebooting the client, redirected offline folders started to work as expected.

Note: Before taking this action please make backup of your files, because unsynchronized changes will be lost.

Quickly archive log files on daily basis

In this case server was creating log files few in a second and by the end of the day there were tons of logs in the folder, and manipulations with those files was painful. So, I decided to make a scheduled task which will archive log files older then one day, and delete them after they were added to the archive. I was using rar as archiving solution, and here is the command for the task:

"C:\Program Files\winrar\rar.exe" a -ag -df -to1d -x*.rar  destinationfolder\archivename- sourcefolder\*.*

• a will add files to archive
• -ag will stamp archive name with current date
• -df will delete files after archiving
• -to1d will process files older than 1 day
• -x*.rar will exclude rar files in archive if any

Archive name will look like: archivename-YYYYMMddhhmmss.rar .

Event ID 27 from W32time in sytem event log

In this case XP client machine was member of domain, and its system event log was filling up with warning event id 27 :

Time Provider NtpClient: The response received from domain controller dcname.domain.name is missing the signature. The response may have been tampered with and will be ignored.

The client machine was configured manually with one of the domain controllers as ntp server, and type parameter in HKLM\SYSTEM\CurentControlSet\Services\W32Time\Parameters\Type was AllSync. After changing type into NT5DS as should be ( since client machine was member of domain ) , and restarting windows time service, there was no warning event anymore in system event log. After restarting the time service there was informational event 35 that time service is synchronizing with one of the domain controllers (and it was not the one that was added manually).

Unable to delete printer driver from Windows 7

In my case user was running on windows 7 x86 sp1, and was complaining that he can't print because printers doesn't exists on his computer. Printers should be installed using group policy preferences, so I have started to troubleshoot the problem. Printer spooler was stopped, and that was the reason why the user doesn't see printers in control panel. Printer spooler was stopping whenever group policy for installing printers was applying. So, I wanted to delete all unnecessary printer drivers that were installed. After opening Print Management mmc there were a lot of printers drivers that were not in use, and I started to remove drivers packages that were not in use. For the most of them removing was running smoothly, but there was one that was refusing to delete complaining that :

"The specified printer driver is currently in use. Failed to remove package ..."

I have tried a lot of the suggested solutions, but none of them helped me to delete the driver package. The only way that I have succeeded to delete the driver package was to rename the print processor from registry in my case HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Print Processors\ , and then delete the driver package from print management console.
Printers defined in GPO have successfully installed, and user was able to print documents.

Unable to reboot remote system

In my case remote workstation was XP and a user was unable to connect using remote desktop client, after disconnecting from the same computer couple of minutes ago. I have decided to initiate reboot of the client workstation using:

shutdown /f /r /m \\computername,

but the machine was hung up, and I tried to initiate same command again but the response was :

A system shutdown is in progress.(1115)

 

After waiting few more minutes the client workstation was not rebooted.

Because there was no one around the client machine to see what's happening on the monitor, and the user desperately needed to establish remote connection to the client workstation I have decided to kill the winlogon process. Using PSKill from PSTools suite I have executed:

pskill -t \\computername winlogon

and the remote workstation was rebooted. Note that killing winlogon process is nearly the same as pulling the plug on the machine.

The processing of Group Policy failed. Event ID 1096

In my case there was a machine with bad sectors on hard disk and group policy settings were failing to apply. In System Event Log there was error event id 1096 :

The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LocalGPO. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

After imaging the hard disk with new one (bad sector free), group policy settings were still failing to apply. Since this machine had bad sectors, there was a problem with local policy file. So, after renaming registry.pol into registry.bak from c:\Windows\System32\GroupPolicy\Machine, and refreshing the policy with gpupdate /force, group policy settings started to apply and error event 1096 was history from System event log.

File is locked for editing by 'another user'

In my case, end user was unable to edit excel file located on network share :

In searching for 'another user', I confirmed that no other user was having this document opened and antivirus real time scanners were disabled on both local and server machines. There is Microsoft KB http://support.microsoft.com/kb/814112 suggesting to avoid setting full control on share and ntfs permission. Unfortunately, the suggested KB didn't change the behavior that the file is locked for editing.
In quest for 'another user' I've ended up that sharing violation was causing Windows Explorer trying to collect file info like size,author,date etc ... So, after turning off :

• Details Pane (Organize -> Layout -> Details Pane)
• "Show pop-up description for folder and desktop items" (Tools -> Folder Options -> View tab)
• Preview Pane (Organize -> Layout -> Preview Pane)

the end user was able to open the document for editing.

How to remove service pack (SP1) backup files on Windows 7 or Windows Server 2008 R2

If you're running out of space on your (virtual) machine with installed Windows Server 2008 R2 and you have installed SP1, and after some time you decide that everything is working fine with installed service pack, you have an option to remove service pack backup created files. One possible way to do that is using DISM :

DISM.exe /online /Cleanup-Image /spsuperseded

More on SP1 about deployment, removal and uninstall on http://technet.microsoft.com/en-us/library/ff817650(WS.10).aspx .

How to decompress files that have been compressed by disk cleanup

If you would like to decompress files that have been previously compressed by disk cleanup, because you have probably replaced (imaged) old small disk with bigger one, and you want to achieve better performance run :

compact /u /s /a /q /i *.*

More on compact command  http://technet.microsoft.com/en-us/library/bb490884.aspx