Well our log on script is set to run and complete before the desktop loads, so because the desktop hasn’t loaded yet you never see the pop up message asking you to confirm to install the printer driver. So the PC just sits there with a blank screen waiting for you to click yes or no on a pop up box that you can’t see!

The solution? Log onto the PC using a local account or a network account that doesn’t have a log on script (maybe the network administrator), add all the network printers you need. Log back off and log on as normal. Solved!

Go to Start> Run> regedit

Go to HKLM> Software> Policies> Microsoft> Windows> WindowsUpdate> AU

To turn off Windows Updates completely, change NoAutoUpdate to 1.

To select one of the other 3 options change AUOptions to either 2, 3 or 4 (Notify=2, Download=3, Automatic=4).

Close and you’re done!

You can find the policy setting in Administrative Tools> Domain Security Policy> Local Policies> Security Options> Network security: Force logoff when logon hours expire

Alternatively you can set it from GPO: \Computer Configuration\ Windows Settings\ Security Settings\ Local
Policies\ Security Options\ Network Security: Force logoff when logon hours
expire

I’m not sure which takes preference though so you’ll just have to try it and find out.

Sender Policy Framework (SPF) is basically an email validation system used to prevent spam. If you own a domain, you create an SPF record in your DNS records detailing which machines are allowed to send mail as your domain (i.e. your exchange server and possibly your ISP too). Then, when an email server receives an email, it can check on the DNS records of the domain and see if the computer who sent the email is really allowed to send email as that domain. If it’s not, the the email will be marked as spam. It will help cut down the amount of spam you get that’s addresses from yourself!

If you need help creating an SPF record, check out this excellent SPF wizard.

I’ve also just been looking at Windows Exchange Server 2003 possibly being an open relay. Will do a post on that soon.

The only extra thing you need to do is open the ports in the firewall to allow the connection. Windows VPN by default uses PPTP, which uses port 1723. We have a Juniper firewall which comes set up with lots of predefined services so you can quickly and easily open all the right ports for the application you are using. Great. So I allowed the PPTP service for the mapped IP address the server uses. Done. Or so I thought.

It just wouldn’t connect. I turned off the firewall, tried it again, and it worked straight away. So why wasn’t it working?! After a quick search on the internet I read that you also need to pass GRE. Quick check on the Juniper, GRE was listed on predefined services, added that to the policy for the VPN server. Bingo, it works!

Not sure if that applies to other firewalls. I’ve set this up before and never encountered this problem. Maybe it’s just on the Junipers?

If your firewall doesn’t have predefined services, for GRE you need to open protocol 47 on any port, or ports 0-65535 (all ports).

However, I also found out that if your 32bit CPU has PAE, you could possibly have up to 64GB RAM. Sweet