• Spending time and resources downloading it when you then delete it.
• Checking if email spam really is spam.

The more employees you have, the more time is wasted on these activities!

Would you like a system to manage spam so that you don’t need to see it or handle it any more?

• One option is to invest in IT staff (and software and hardware) to run and maintain an email spam filtering system. This is costly!
• A better option for SME business is to invest in spamtrap. This is a service Echo10 provide for you (a managed service to handle spam and anti-virus too).

Be more efficient today! Find out more about Spamtrap and how you can remove spam handling from your business.

Without an IT infrastructure to force compliance, how do you make sure that EVERY email sent by everyone on behalf of your organisation follows the same rules?

Email Legal Disclaimers

Disclaimers help show that your business takes email seriously and understands the possible threats of email transmission. Using disclaimers can help show that you have taken reasonable steps to comply with legislation.

Marketing and Branding Consistency

It takes time to build a brand and no time at all to destroy brand integrity. Making sure that all company emails use the same fonts and logos and that the images are up to date helps ensure your business is recognisable.

Exclaimer

Echo10 offer exclaimer. Professional email management without a large IT infrastructure.

Call today 0333 888 4050 to find out more about Exclaimer

This creates a problem whereby administrators invariably logon to a domain controller using a domain admin account because their ‘ordinary’ account does not have the necessary rights to log on locally to a server.

This article explains how to allow those non-admin user accounts assigned to administrators for everyday use, to connect to a domain controller, helping to enforce the ‘least privilege’ philosophy by encouraging administrators to use elevated accounts only when they need to.

We also manage servers on our internal network using Remote Desktop. Again, by default ordinary non-admin accounts do not have the necessary rights to access a domain controller using RDP.

We operate a two account system for our domain administrators.

One account has minimal privileges and is a non-admin account; the other has admin privileges.

The admin accounts are created without any ‘bells and whistles’. They are members of a minimal number of groups and are not mail-enabled, nor do they have roaming profiles. Folders such as My Documents are not redirected. The idea is to create an environment where they can use their everyday accounts most of the time, and only use elevated accounts when necessary.

Using Group Policy combined with security group membership we have implemented a system where administrators can log on to a domain controller (either locally or via Remote Desktop) using their everyday account and then elevate to their admin account when performing specific administrative tasks, such as creating an account or modifying group membership.

Our OU Structure

In AD, we have created the following OUs:

Admins OU – This is where we create the accounts which are members of the Domain Admins group.

This allows us to manage them and easily exclude them from other GPOs, for example, one which locks down the desktops for non-admin company employees and disables access to regedit, etc.

People OU – This is where we create non-admin user accounts.

Groups OU – This is where we create groups

In the Admins OU, create a user account and make it a member of the Domain Admins group.

Follow your naming convention, but append _admin to the user logon name. For example, if the naming convention is <First Initial><Surname>, for John Smith create an account called jsmith_admin.

In the People OU, follow your naming convention to create a non-admin user account if you do not have one. For example, if the naming convention is <First Initial><Surname>, for John Smith create an account called jsmith.

In the Groups OU, Create a Global Security Group called DC-LogonLocally.

Creating The GPO

On your Domain Controller, Open Group Policy Management. Expand the Forest node, the Domains node, your Domain node and right click Group Policy Objects and click New. Give the policy a meaningful name. In this example, we’ll use DC-LogonLocally.

Under Group Policy Objects node, right click DC-LogonLocally and Edit.

Expand the following:

Computer Configuration > Policies > Windows Settings > Security Settings >Local Policies >User Rights Assignment > Allow log on locally.

Open Allow log on locally, tick Define these policy settings: and add the following groups:

Administrators

<YourDomain>\DC-LogonLocally

<YourDomain>\Domain Admins

Click OK

Next, expand the following:

Computer Configuration > Policies > Windows Settings > Security Settings >Local Policies >User Rights Assignment > Allow log on through Remote Desktop Services

Open Allow log on through Remote Desktop Services, tick Define these policy settings: and add the following groups:

Administrators

<YourDomain>\Administrator

<YourDomain>\DC-LogonLocally

<YourDomain>\Domain Admins

Click Ok

Next, expand the following:

Computer Configuration > Policies > Windows Settings > Security Settings > Restricted Groups.

Right click Restricted Groups > Add Group… >Browse.

Type the name of the security group Remote Desktop Users, click Check Names, and then OK and OK again to add the group. In the Remote Desktop Users Properties, click Add.. (the top button) to add Members of this group.

In the Add Member box, click Browse… and type the name of the security group <YourDomain>\DC-LogonLocally, click Check Names, and then OK to add the group. In the Add Member box, click OK and then Apply before clicking OK.

The Restricted Groups node should display Remote Desktop Users in the Group Name column and <YourDomain>\DC-LogonLocally in the Members column.

Next, expand the following:

Computer Configuration -> Policies -> Administrative Templates > Network > Network Connections > Windows Firewall > Domain Profile > Windows Firewall: Allow inbound remote administration exception.  Click The Enabled button and in the Options  under Allow unsolicited incoming messages from these IP addresses: add your subnet to the above entry, ie 192.168.1.0/24.

Click OK

Close the Group Policy Management Editor.

Click DC-LogonLocally . Click the Scope tab.

Then do the following:

Security Filtering > Add… > Object Types… > tick Computers > OK . Under Enter the Object name to select:, type the names of the Domain Controllers to which you want this policy to apply, separating each server with a semi-colon. Click Check Names, and then OK.

Find the Domain Controllers node > right click > Link an Existing GPO… > Under Group Policy objects: select DC-LogonLocally and click OK.

Now in the Scope tab of the policy, under Location, the Domain Controllers OU should be listed. In the Security Filtering section, the Domain Controller computers should be listed.

Click Authenticated Users and click Remove

In Active Directory Users and Computers, add the non-admin accounts of the administrators to the DC-LogonLocally group.

Refresh the group policy on the domain controller(s).

Gpupdate /target:computer /force.

Launch an RDP session and connect to the DC.

Supply the credentials of a non-admin account which is a member of the DC-LogonLocally group.

You should be able to connect and see a desktop.

Now, if you wish you can start Active Directory Users and Computers and supply your admin credentials to use the elevated privileges.

Some reasons when this does not work so well

Mostly, problems arise when you have to save something. For example, if you export the contents of an OU to My Documents, it will be the elevated admin account’s My Documents by default. Similarly, the behaviour is the same when you’re working with the Security and Analysis tools.

About RDP

Some organisations allow RDP connections directly across the Internet. For Domain Controllers, we do not (We use other tools for remote administration, or connect via VPN). Please bear this is mind when setting the Allow inbound remote administration policy and restricting it to your local network. I haven’t tested it by trying to connect from outside of my own LAN.

Do you need some help with your IT? Computers may be easier to use but there are still a lot of decisions to make when defining a computing strategy for your business.

Think you don’t need a strategy? Well can you answer these questions:

• PC or Mac?
• Desktop or server?
• Virtual server or managed server?

How about these:

• Is your email legally compliant?
• Have you taken account of the data protection act

Or these:

• Do your backups work?
• Is your software and hardware correctly licensed?
• What would you do to recover from a disaster?

Your IT strategy covers all these questions and more. And IT and computer support services should cover all these too. There’s little point having a IT support that only reacts to problems – the best IT support services also advise on strategy and help you take the right decisions at the right time – not when it’s too late!

We know the IT support service we provide covers all these areas and more. So here’s a final question:

• Would you like to try out our IT Support Service for free, for 30 days?

We think you’ll be surprised how much you need to know – and how well we can support you. Contact us today and ask for more details: 0333 888 4050

You’re logged on as your Domain Admin account (not the default Administrator account), and you keep getting this output:

C:\Library>csvde -i -v -f newusers.txt

Connecting to “(null)”

Logging in as current user using SSPI

Importing directory from file “newusers.txt”

Loading entries

2: cn=Peter Graham,OU=People,DC=echo10,dc=net

Add error on line 2: Insufficient Rights

The server side error is “Access is denied.”

0 entries modified successfully.

An error has occurred in the program

No log files were written. In order to generate a log file, please

specify the log file path via the -j option.

You need to start the Command prompt by right clicking it and choosing Runas administrator.

Click Yes when prompted.

Notice the title of the window is Administrator: Command Prompt.

Now run CSVDE again:

C:\Library>csvde -i -v -f newusers.txt

Connecting to “(null)”

Logging in as current user using SSPI

Importing directory from file “newusers.txt”

Loading entries

2: cn=Peter Graham,OU=People,DC=echo10,dc=net

Entry modified successfully.

1 entry modified successfully.

The command has completed successfully

Yet how often do we consider the enormous risk we take when we don’t manage our email with professionalism and the right expertise.

• Do you have problems with email?
• Do your team members lose email?
• Do you sometimes wonder how mail messages can just disappear?
• If you had to defend yourself in a court case or if your professional indemnity insurer asked you for evidence, would you struggle to find the relevant messages?
• Are you fed up of spam?
• Would you like your compliance issues managed for you?

If you answered ‘yes’ to any of these questions – or even if you just don’t want to have to deal with it at all, then you probably need some extra IT support.

Echo10 understands that every business has different needs. Some businesses only ever need email access in a fixed location. Some businesses are more mobile with a workforce needing access to email on mobile phones, office computers and laptops. We know that finding the best solution means working out what you need now and what you may need in the future then delivering a service which is cost effective for you now whilst still allowing growth in the future.

Call us today and we can talk about the options. We provide a free survey and recommendations and even a free one month trial of our network support services. 0333 888 4050

1. 1. Do You Have a Data Backup Plan?
   How often is your company data backed up? Many people use external hard drives to back up their data – but happens if that hard drive fails? What happens if a disaster affects your premises – then possibly that backup is gone too.
2. 2. Is Your Backup Plan Working?
   It’s possible that you have an automatic backup plan – every week or day or month (or whenever) something kicks off a process that backs up your data. When was the last time you checked that actually happens –and if it does happen that the results are successful?
3. 3. When Was Your Last Recovery?
   Recovery is as important as backup. When was the last time you went to your backup and tried to recover the data? It is possible that all seems well yet the backup doesn’t restore properly.
4. 4. What do you back up?
   If you don’t know or you know what it used to be but you’re not sure any more, then it’s time for a review.
5. 5. Are you happy with your risk level?
   It may be that you’re happy taking a risk. That if all your data disappeared it wouldn’t be a complete disaster – but maybe you should consider some of these disaster facts.

There are many backup options available, from a simple external hard drive, kept off-site through to duplicate copies of data being stored in the cloud and automatically replicated to other machines in your organisation.

Consider all your options and if you’d like help to review the best option for you or to perform a disaster recovery test, then call Echo10 for help.

An even larger majority of business owners do complete disaster recovery drills, and that puts organisations at risk. Just consider these grim statistics:

• half of all companies who experience a disaster and lose access to their data for 10 or more days will file for bankruptcy.
• 93% of firms affected by a severe disaster and a permanent loss of data will file for bankruptcy within a year of that data loss.

With so much at stake, it is time to stop making excuses, and start making plans for an offsite data backup and disaster recovery system for your small or midsize business. By making these plans now, your firm can avoid becoming just another grim statistic when disaster strikes.

Backup and Disaster Recovery

Disasters take many forms, and it is important for business owners to be aware of, and prepare for many possibilities. For example:

• Natural disasters, from fires and floods to tornadoes and hurricanes. Even if you’re not based in a flood zone, your company is at risk from flooding, either from an unexpectedly heavy rainfall or from a malfunctioning sprinkler system or air conditioning unit. If a flood, or another natural disaster, were to strike this weekend, would you be prepared to recover your data and be up and running by Monday? The answer to that question could impact the future of your business – and your future as the owner of that business.
• Then there are the manmade disasters, including employee theft of data, direct sabotage, and industrial espionage from a hacker breaking into your system. If you have a business rival, or if you have ever dismissed an employee, you are at risk from these types of events. A disgruntled employee could potentially sabotage your company’s network, and a smart saboteur could plant a time bomb in your network that might not go off for months, or even years. Unless you are skilled at finding such deception, you would not know about it until it is too late.

But if you have a disaster recovery, system monitoring and data backup plan in place, you will be prepared for any eventuality, no matter what its cause or severity. By preparing for disaster, you will be able to recover and continue in business.

Contact Echo10 today and we’ll help you review your backup and recovery procedures, minimising the impact of any disaster.

Common Business Problems

• Where is your workforce ? When do they work?
• Where is your business information? Can everyone access it all the time? Is it kept up-to-date all the time?
• Documents are taken onto laptops and changed then sent out – how do you make sure the most recent version is stored in the right place?
• Customers and suppliers change address and emails (and names!) – how do you make sure that your mobile staff always have the up-to-date details.
• When you’re working on a major project for a client and you have people on client premises, how do you make sure the documentation is accessible from your head office for billing?
• With a global workforce, how do you make sure everyone can access the systems they need?

The Solution is a Collaboration Server

The answer is a collaboration server, managing business information for everyone:

• Availability and Calendars
• Email systems, including standard signatures and archiving
• Contact databases
• Automatic re-syncing of documents from PCs and mobile phones to servers in the cloud and also to head office.
• Iphone, blackberry
• Ipads
• Home PCs and Laptops

True collaboration can free up hours of wasted time. And it can all be handled seamlessly with the right technology and a simple explanation of how it works – and the ‘how it works’ isn’t how the technology works, it’s how to find things!

Echo10 can he you to take advantage of the technology that’s available right now to solve collaboration problems. Start today and call for a chat 0333 888 4050.

1. Improved Productivity

Think about some of the problems you face with your XP machines and imagine some of those problems are gone.

Evidence suggests that a move to Windows 7 could gain 43 hours per year for every PC.

That’s a true productivity improvement!

2. Return on Investment

“Customers deploying Windows 7 achieve an average ROI of 375% and payback in around 7 months.”

Microsoft

That means an investment now will pay for itself quickly and give more than a three-fold return on investment.

You can even estimate your own ROI of course we can do that for you if you prefer.

3. Current Technology

When to move deserves consideration. Not everyone wants to be at the leading edge of new technology; however using old, dated technology has business risks too.

Research suggests that 78% of Small and Medium enterprises plan to upgrade to Windows 7 within two years.

Do you want to be so far behind your competitor that the only choice is a large investment in technology?

Implementation Options

There are a number of ways to implement Windows 7. Investigate the options that suit your business now and your future business needs with help from Echo10.