@JaredBusch said in Domain Time off for some members: @Donahue said in Domain Time off for some members: found it. It was the individual time for that ESXi member. It was running on it's own time, neither host time or any NTP. It was off by the 6 minutes. So for some reason, VMWare was syncing this setting with the host's ESXi clock, not the hardware clock, even though the settings disallow that. How do you know the VMware tools was doing the sync?. As I said in my earlier post if windows goes and tries to get the hardware clock no matter what your tool says for heartbeat or times are pretty station it’s going to get the Clock from the host. look at the picture I posted above. It was vmtoolsd.exe that was causing it to jump forward and svchost.exe that was correcting it. I found this under event 4616

@wrx7m said in Shared HP Printers - Apply Preferences/Settings to Clients: I figured it out. You have to use the Printer defaults button on the advanced tab. It opens the same window as shown in the OP, but it will apply it to the clients. Yes, that is where you always do it. Remember that when you change printer drivers you need to change it all over.

@obsolesce Right, I am having to add a group of computers to the printers' security permissions with allow printing enabled to get the GPP to actually deploy the printer to the user. UNC pathing to the printer by a member of the PrintersChecksUsers (while the user is logged in) allows them to install and print to the printer. The GPO shows as applied in the RSOP, but with item level targeting, I don't see any info on why it wasn't actually installed/applied. Maybe it shows it somewhere else. The key is the shared printer's security tab on the print server, itself. That is where I have to allow the specific group of computers, as well as the specific group of users. I need both, the computers and users groups to have at least printing allowed.

Thanks.

These are the kind of things you think someone would catch. Not like it's some random 3rd party app on some 3rd party OS on some 3rd party host.

@obsolesce said in Server 2012: PS Get-ADGroupMember: I use a Linux server that is domain joined to see what groups a MS AD user is a member of. It's just way easier and faster. id [email protected] Done. I was just saying how ridiculously cumbersome this is because of Windows.

@thwr said in Flushing GPOs: @dbeato said in Flushing GPOs: You need to setup the settings to Delete or changed to not configured, wait until it applies and then delete the GPOs after confirming they are not applied any longer. Get-Content c:\temp\gpos.txt | foreach { Get-GPO -Name "$_" | Remove-GPO } http://jeffwouters.nl/index.php/2013/08/remove-group-policy-objects-through-powershell/ I bet you could do something like this to set all GPOs to "on delete remove from client" too This assumes a txt file with all GPO names. You could also just use Get-GPO

@momurda said in WSUS preparation for Windows 10 Feature Upgrades: Wow. Definitely not doing that if I have the same problems as you. Ill just go around and install the upgrade manually. Not even sure why MS still has WSUS, it is nothing but problems unless you spend hours a week fixing and maintaining it. I hear ya, this took me an hour to research, make sure to gather correct logs and then do the how-tos.

taskmgr.exe

@jt1001001 said in Unable to get time to sync on Server 2012 R2 DC: are any of your time services running under a domain accoutn instead of Local Service? Sounds like a service does not have permission to update the time Windows Time is set to run under "Local Service" (not local system account)

@dbeato said in AD User Tool: Bulk AD User: @Dashrender Then, he needs to force it with Powershell no just a GUI.... Agreed.

So coming back to this (because I was setting some more stuff up), it seems that Windows DHCP Server does understand the RFC, that is why it actually sees and uses the entire machine ID sent by default. It is other devices like my EdgeRouters that I have to use the MAC address. The only problem with the machine ID scheme is that I have no idea what it is before the machine is created. Granted this is mostly my problem because I always use DHCP reservations instead of static IP addresses (evil fucking things, those). I continue to force the new systems to use the hardware ID, because I want to only track the MAC address hex info.

Since today is patch Tuesday, I'll wait and see what comes down.

I'm currently running an evaluation against a relatively inactive share to see what we could save. Only at 17% complete as of now.