When I first started the project, I was hoping that my script would run prior to showing the desktop. This is important because if it runs while the user has access to the desktop, that user may start using files that would prevent the script from running correctly (file locks). I had no luck; if anyone has an idea on how to do this, let me know. Otherwise, I created a .NET application that covers the entire screen on the primary monitor (if more than 1 monitor, then the second one is still visible).

BlankScreen

The BlankScreen application is written in VisualStudio .NET 2008 using .NET Framework 2.0 if I remember correctly. There are some changes you may want to make on this application to tailor it for your environment. The first change would be to put your logo on the application form. The second change, and really the more important change, is to change the ProcessPath variable to point to the UNC path of where you plan on putting the desktop.vbs file. This application just runs the VBScript.

So you might be thinking, why would you have an application that is capable of much more advanced programming run a VBScript? Well, I wrote the script first and didn’t feel like porting it to VB.NET. If you feel like spending the time, go for it.

desktop.vbs

Enough chatter about the other stuff, on to the real product of this blog post, the VBScript.

The VBScript has four basic functions that it completes one after the other based on the success of the previous function. Step 1 is to get the username of the logged in user. Step 2 is to create the folders in the user’s My Documents location and copy the files into that new folders (nothing is moved). Step 3 is to update the registry for the Desktop and Favorites locations to the newly created folders. Step 4 renames the old folders in the C:\Documents and Settings\[user]\ folder to DesktopOLD and FavoritesOLD. I feared losing user files, so I did not make the script perform anything that couldn’t be reversed.

Just as you had to change a string variable in the BlankScreen application for your specific server, you also have to change the location of your user’s folder on the network. In my case it was \\fileserver\users\.

The migration will change the registry keys:

HKCR\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, Favorites
HKCR\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, Desktop
HKCR\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, Favorites
HKCR\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, Desktop

The new locations will look something like this:

Desktop: \\[server]\[share]\[username]\Desktop-[username]
Favorites: \\[server]\[share]\[username]\Favorites-[username]
e.g. \\fileserver\users\aaron\Desktop-aaron\ would be my desktop folder.

Conclusion

Implementing this solution is fairly easy. First modify the VB.NET application and compile it. Place the .exe file in a shared location that your login script for users has permissions. Place the VBScript file in a similar location, as you specified in the VB.NET application, and modify the serverpath variable and email variables. Test with your user account in your login script batch file using something similar to below:

if %USERNAME% == yourusername (
 rem lets make sure the user has a my documents folder prior to trying to migrate their desktop
 if exist "\\[server]\Users\%USERNAME%" (
  if exist "C:\Documents and Settings\%USERNAME%\Desktop" (
   rem lets make sure they have the 2.0 Framework installed.
   if exist "C:\Windows\Microsoft.Net\Framework\v2.0*" (
    start "Desktop Migration" "\\[server]\[share]\blankscreen.exe"
   )
  )
 )
)

As a disclaimer, the application AND script are provided without any warranty and is only for educational / informational purposes. If you choose to use it in your environment, production or not, the outcome is your responsibility.

desktop.vbs Code

On Error Resume Next

'alert user of what is happening...
MsgBox "Please click OK to begin the backup process for your Desktop and Internet Explorer Favorites.  This process could take a few minutes, please be patient and Do NOT Cancel anything, otherwise data could be lost!" & vbCrLf & vbCrLf & "If you have Administrator privileges, your computer will restart after all of your files have been copied!"

'get the current user
user = getUser()
'set the server location, the following \ is required!
serverpath = "\\[server]\Users\"
'if you have a helpdesk solution with email capability:
useemailnotify = 0
smtpfrom = "email@domain.com"
smtpto = "email@domain.com"
smtpserver = "smtp.domain.com"

'create folders
m_cf = createFolderscopyFiles(user)
If m_cf <> 1 Then
	'update the registry and reboot
	m_ur = updateRegistry(user)
	If m_ur <> 1 Then
		'rename the old folders so it does not use them anymore!
		m_rof = renameOldFolders(user)
		'reboot
		Set WSHShell = WScript.CreateObject("WScript.Shell")
		WshShell.Run "C:\WINDOWS\system32\shutdown.exe -r -t 0"
	End If
End If

Function getUser()
	'get the current user environment variable.
	Set oShell = CreateObject( "WScript.Shell" )
	user = oShell.ExpandEnvironmentStrings("%UserName%")

	If Err.Number <> 0 Then
		'we have failure!
		getUser = 1
		Err.Clear
	Else
		getUser = user
	End If
End Function

Function createFolderscopyFiles(user)
	Set objFSO = CreateObject("Scripting.FileSystemObject")

	'lets only do the folder create and file copy if that folder doesn't already exist. Otherwise, its just gonna set the registry and reboot.
	If Not objFSO.FolderExists(serverpath & user & "\Desktop-" & user) Then
		'Create the new Desktop and the Favorites folder.
		objFSO.CreateFolder(serverpath & user & "\Desktop-" & user)
		objFSO.CreateFolder(serverpath & user & "\Favorites-" & user)

		Set oSHApp = CreateObject("Shell.Application")

		'Copy the Desktop files
		Set fromDFolder = oSHApp.Namespace("C:\Documents and Settings\" & user & "\Desktop")
		Set toDFolder = oSHApp.Namespace(serverpath & user & "\Desktop-" & user)
		toDFolder.CopyHere fromDFolder.Items, 16+512

		'Copy the Favorites files
		Set fromFFolder = oSHApp.Namespace("C:\Documents and Settings\" & user & "\Favorites")
		Set toFFolder = oSHApp.Namespace(serverpath & user & "\Favorites-" & user)
		toFFolder.CopyHere fromFFolder.Items, 16+512
	End If

	If Err.Number <> 0 Then
		'we have failure!
		SendEmail user,"failed at createFolderscopyFiles",Err.Description
		createFolderscopyFiles = 1
		Err.Clear
	Else
		createFolderscopyFiles = 0
	End If
End Function

Function updateRegistry(user)
	'lets work on the registry now
	Const HKEY_CURRENT_USER = &H80000001
	Const HKEY_LOCAL_MACHINE = &H80000002

	'update the registry for Desktop and Favorites (User Shell Folders)
	'set Favorites
	Set oFReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & "." & "\root\default:StdRegProv")
	strKeyPath = "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
	strValueName = "Favorites"
	strValue = serverpath & user & "\Favorites-" & user
	oFReg.SetExpandedStringValue HKEY_CURRENT_USER,strKeyPath,strValueName,strValue
	'set Desktop
	Set oDReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & "." & "\root\default:StdRegProv")
	strKeyPath = "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
	strValueName = "Desktop"
	strValue = serverpath & user & "\Desktop-" & user
	oDReg.SetExpandedStringValue HKEY_CURRENT_USER,strKeyPath,strValueName,strValue

	'update the registry for Desktop and Favorites (Shell Folders)
	'set Favorites
	Set otFReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & "." & "\root\default:StdRegProv")
	strKeyPath = "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"
	strValueName = "Favorites"
	strValue = serverpath & user & "\Favorites-" & user
	otFReg.SetStringValue HKEY_CURRENT_USER,strKeyPath,strValueName,strValue
	'set Desktop
	Set otDReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & "." & "\root\default:StdRegProv")
	strKeyPath = "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"
	strValueName = "Desktop"
	strValue = serverpath & user & "\Desktop-" & user
	otDReg.SetStringValue HKEY_CURRENT_USER,strKeyPath,strValueName,strValue

	If Err.Number <> 0 Then
		'we have failure!
		SendEmail user,"failed at updating registry",Err.Description
		updateRegistry = 1
		Err.Clear
	Else
		updateRegistry = 0
	End If
End Function

Function renameOldFolders(user)
	Set objFSO = CreateObject("Scripting.FileSystemObject")
	objFSO.MoveFolder "C:\Documents and Settings\" & user & "\Desktop", "C:\Documents and Settings\" & user & "\DesktopOLD"
	objFSO.MoveFolder "C:\Documents and Settings\" & user & "\Favorites", "C:\Documents and Settings\" & user & "\FavoritesOLD"

	If Err.Number <> 0 Then
		'we have failure!
		SendEmail user,"failed at renaming old folders",Err.Description
		renameOldFolders = 1
		Err.Clear
	Else
		renameOldFolders = 0
	End If
End Function

Sub SendEmail(user,contnt,contntB)
	'if the setting is to send an email, then do it, otherwise...nada.
	If useemailnotify = 1 Then
		'send an email!!
		Set objEmail = CreateObject("CDO.Message")
		objEmail.From = smtpfrom
		objEmail.To = smtpto
		objEmail.Subject = "Desktop and Favorites Migration Issue for " & user
		objEmail.Textbody = "User had a Desktop files migration error." & vbCrLf & vbCrLf & contnt & vbCrLf & vbCrLf & contntB
		objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
		objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = smtpserver
		objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
		objEmail.Configuration.Fields.Update
		objEmail.Send

		If Err.Number <> 0 Then
			'we have failure!
			MsgBox "Your Desktop migration didn't go very well."
			Err.Clear
		Else
			'YAY!
		End If
	End If
End Sub

Downloads

BlankScreen.zip – VB.NET application

desktop.zip – VBScript

So, why write this article? Well, we wanted to make sure that user data was not accessible by anyone in the organization except that user and the backup process. This required custom permissions for the user folder, permissions that are not typical.

We used the GPO settings for My Documents redirection, setting the My Documents location to %HOMEPATH%. Obviously this required that the home path must be set for each and every user in Active Directory. The common way to accomplish this is to modify the users and set the home path to the desired server path. This would create the folder automatically for each user and assign full permissions to the user. It also sets Administrators with full permission. Bah.

PowerShell is, well, powerful

The solution that we came up with was to write a PowerShell script that would accomplish the same task as adding a home path in Active Directory. The only difference is that the script sets the folder permissions that we wanted.

The script accomplishes three tasks based on only providing it an Active Directory account, such as domain\user. The first task is to create the user folder on the server defined in the script. The second sets the permissions on that folder, removing Administrators and then adding SYSTEM and the user as Full Control. It also adds the user as the Owner of the folder. Third, it updates Active Directory, modifying the user’s home path to the newly created folder on the server.

The Script

Before I share the script, it comes with a disclaimer. Use at your own risk, the script is merely for informational purposes. You are responsible for your own server and the files and folders on it, and therefore I am not responsible if this script causes any harm.

##################################################################################
#
#
#  Script name: SetHomeFolder.ps1
#  Author:      Aaron and John
#
#
##################################################################################

param ([string]$User, [switch]$help)

function GetHelp()
{
$HelpText = @"

DESCRIPTION:
NAME: SetHomeFolder.ps1
Creates folder and sets permissions for the specified user.
Creates folder if it does not exist. Removes "Administrators" default permission.

PARAMETERS:
-User            User to create folder for and who should have access (Required)
-help            Prints the HelpFile (Optional)

SYNTAX:
./SetHomeFolder.ps1 -User Domain\UserName

Creates \\[server]\Users\[UserName] and sets new permissions for that folder.

"@
$HelpText

[system.enum]::getnames([System.Security.AccessControl.FileSystemRights])
}

function CreateFolder ([string]$Path)
{
#check if the folder Exists
Write-Host "$Path..." -Foregroundcolor Green

if (Test-Path $Path) {
Write-Host "...Already Exists" -ForeGroundColor Yellow
} else {
Write-Host "...Created"
New-Item -Path $Path -type directory | Out-Null
}
}

function SetAcl ([string]$Path, [string]$User, [string]$Permission)
{
#this trap prevents ugly errors on the screen when attempting to update the ACL for the user.
trap [Exception]
{
write-host "  ERROR: $($_.Exception.Message)" -ForeGroundColor Magenta
continue
}

Write-Host "Setting Permissions..." -ForeGroundColor Green

#get ACL on folder and assign as object
$GetACL = Get-Acl $Path

#set up the access rules
$Allinherit = [system.security.accesscontrol.InheritanceFlags]"ContainerInherit, ObjectInherit"
$Allpropagation = [system.security.accesscontrol.PropagationFlags]"None"
$AccessRule = New-Object system.security.AccessControl.FileSystemAccessRule($User, $Permission, $AllInherit, $Allpropagation, "Allow")
$SystemAccessRule = New-Object system.security.AccessControl.FileSystemAccessRule("SYSTEM", "FullControl", $AllInherit, $Allpropagation, "Allow")
$AdminAccessRule = New-Object system.security.AccessControl.FileSystemAccessRule("Administrators", "ReadAndExecute", $AllInherit, $Allpropagation, "Allow")

#check if Access for Administrators already exists - and REMOVE
Write-Host "...Removing Permission For: Administrators" -ForeGroundColor DarkGray
$GetACL.RemoveAccessRuleAll($AdminAccessRule) | Out-Null
#end of Administrators permissions

#check if Access for User Already Exists - and ADD
if ($GetACL.Access | Where { $_.IdentityReference -eq $User}) {
Write-Host "...Modifying Permissions For: $User" -ForeGroundColor Yellow

$AccessModification = New-Object system.security.AccessControl.AccessControlModification
$AccessModification.value__ = 2
$Modification = $False
#modify the ACL rule
$GetACL.ModifyAccessRule($AccessModification, $AccessRule, [ref]$Modification) | Out-Null
} else {
Write-Host "...Adding Permission: $Permission For: $User"
# add the ACL rule
$GetACL.AddAccessRule($AccessRule)
}
#end of User permissions

#check if Access for SYSTEM already exists - and ADD
if ($GetACL.Access | Where { $_.IdentityReference -eq "SYSTEM"}) {
Write-Host "...Modifying Permissions For: SYSTEM" -ForeGroundColor Yellow

$SystemAccessModification = New-Object system.security.AccessControl.AccessControlModification
$SystemAccessModification.value__ = 2
$SystemModification = $False
# modify the ACL rule
$GetACL.ModifyAccessRule($SystemAccessModification, $SystemAccessRule, [ref]$SystemModification) | Out-Null
} else {
Write-Host "...Adding Permission: FullControl For: SYSTEM"
#add the ACL rule
$GetACL.AddAccessRule($SystemAccessRule)
}
#end of SYSTEM permissions

#set the owner of the folder to the specified user
$GetACL.SetOwner((new-object System.Security.Principal.NTAccount("$User")))

#this command performs the actual update using the objects as defined above
Set-Acl -aclobject $GetACL -Path $Path
}

function Get-ADUser( [string]$samid=$env:username)
{
#find the user object in active directory and returns the user object to the calling line
$searcher=New-Object DirectoryServices.DirectorySearcher
$searcher.Filter="(&(objectcategory=person)(objectclass=user)(sAMAccountname=$samid))"
$aduser=$searcher.FindOne()

if ($aduser -ne $null )
{
$aduser.getdirectoryentry()
}
}

if ($help)
{
#the user requested help, so let us display that help.
GetHelp
}

#set some global variables per our environment.
$Permission = "FullControl"
$username = $User.substring($User.indexof("\") + 1)
$Path = "\\[server]\Users\$username"

#LET'S BEGIN (sub Main()) - Process folder creation and security changes
if ($Path -AND $User -AND $Permission)
{
#1. create the folder
CreateFolder $Path

#2. set the ACL permissions and ownership for that folder
SetAcl $Path $User $Permission

#3. update active directory with the new path location
Write-Host "Updating Active Directory Home Folder..."
$aduser = Get-ADUser $username
$aduser.homeDirectory = "$Path"
$aduser.homeDrive = "P:"
$aduser.SetInfo()
Write-Host "...$username Updated with: $Path" -ForeGroundColor Green
}

From past experience, I have had issues with the DHCP Server getting too many requests per minute, causing it to eventually fail. The tips below is what I used to temporarily resolve the issue. The real problem was the heavy abuse from something on my network. The specific error for this case was Event ID 1014, error -519.

1. Backup your DHCP database! Obviously, before you start anything, I would recommend making a copy of the entire c:\windows\system32\dhcp\ folder to a remote location. Typically, I like to keep a copy in a dated folder on a network drive just so I can go back to any previous backup and any time.

2. Stop the DHCP Server service. It is not a good idea to try to modify databases without first stopping the services that use them, right?

3. Clear out the old stuff. The next step is to remove the old data files, with the exception of the dhcp.mdb file. If you want an additional backup of your dhcp files, move all files except dhcp.mdb into another folder, such as c:\windows\system32\dhcp\olddhcp\.

4. Rebuild/Repair the database. Now that we only have the original dhcp.mdb file in the dhcp folder, lets rebuild the database using jetpack. Open a command prompt window and change directory to c:\windows\system32\dhcp\. Run the following command “jetpack dhcp.mdb temp.mdb”. This will rebuild the database into temp.mdb and remove dhcp.mdb and then rename temp.mdb to dhcp.mdb and create the neccesary log files.

5. Start the DHCP Server service. After starting the service, verify that the scopes exist and that the service is serving DHCP addresses.

Of course, use this at your own risk.