Skype for Business unable to set Call Forwarding

Scenario: Call forwarding used to work fine.

Fault:  Attempting to set the call forwarding fails.  The Skype client briefly flashes but does not explain the reason for the failure.

Solution:  User was logged into two workstations with two Skype for Business apps running.  Exiting the second Skype for Business instance allowed the first one to correctly accept a call forwarding state.

Addin LoadBehavior values

https://docs.microsoft.com/en-us/visualstudio/vsto/registry-entries-for-vsto-add-ins?view=vs-2019

LoadBehavior values
The LoadBehavior entry under the Root\Software\Microsoft\Office\application name\Addins\add-in ID key contains a bitwise combination of values that specify the run time behavior of the VSTO Add-in. The lowest order bit (values 0 and 1) indicates whether the VSTO Add-in is currently unloaded or loaded. Other bits indicate when the application attempts to load the VSTO Add-in.

Typically, the LoadBehavior entry is intended to be set to 0, 3, or 16 (in decimal) when the VSTO Add-in is installed on end-user computers. By default, Visual Studio sets the LoadBehavior entry of your VSTO Add-in to 3 when you build or publish it.

The following table lists all the possible values of the LoadBehavior entry. Some descriptions in this table refer to loading a VSTO Add-in manually or programmatically. To load a VSTO Add-in manually, select the check box next to the VSTO Add-in in the COM Add-Ins dialog box in the application. To load a VSTO Add-in programmatically, set the Connect property of the Microsoft.Office.Core.COMAddIn object that represents the VSTO Add-in to true.

Value (in decimal) VSTO Add-in status VSTO Add-in load behavior Description
0 Unloaded Do not load automatically The application never tries to load the VSTO Add-in automatically. The user can try to manually load the VSTO Add-in, or the VSTO Add-in can be loaded programmatically.

If the VSTO Add-in is successfully loaded, the LoadBehavior value remains 0, but the status of the VSTO Add-in in the COM Add-ins dialog box is updated to indicate that the VSTO Add-in is loaded.
1 Loaded Do not load automatically The application never tries to load the VSTO Add-in automatically. The user can try to manually load the VSTO Add-in, or the VSTO Add-in can be loaded programmatically.

Although the COM Add-ins dialog box indicates that the VSTO Add-in is loaded after the application starts, the VSTO Add-in isn't loaded until it is loaded manually or programmatically.

If the application successfully loads the VSTO Add-in, the LoadBehavior value changes to 0, and remains at 0 after the application closes.
2 Unloaded Load at startup The application does not try to load the VSTO Add-in automatically. The user can try to manually load the VSTO Add-in, or the VSTO Add-in can be loaded programmatically.

If the application successfully loads the VSTO Add-in, the LoadBehavior value changes to 3, and remains at 3 after the application closes.
3 Loaded Load at startup The application tries to load the VSTO Add-in when the application starts. This is the default value when you build or publish a VSTO Add-in in Visual Studio.

If the application successfully loads the VSTO Add-in, the LoadBehavior value remains 3. If an error occurs when loading the VSTO Add-in, the LoadBehavior value changes to 2, and remains at 2 after the application closes.
8 Unloaded Load on demand The application does not try to load the VSTO Add-in automatically. The user can try to manually load the VSTO Add-in, or the VSTO Add-in can be loaded programmatically.

If the application successfully loads the VSTO Add-in, the LoadBehavior value changes to 9.
9 Loaded Load on demand The VSTO Add-in will be loaded only when the application requires it, such as when a user clicks a UI element that uses functionality in the VSTO Add-in (for example, a custom button in the Ribbon).

If the application successfully loads the VSTO Add-in, the LoadBehavior value remains 9, but the status of the VSTO Add-in in the COM Add-ins dialog box is updated to indicate that the VSTO Add-in is currently loaded. If an error occurs when loading the VSTO Add-in, the LoadBehavior value changes to 8.
16 Loaded Load first time, then load on demand Set this value if you want your VSTO Add-in to be loaded on demand. The application loads the VSTO Add-in when the user runs the application for the first time. The next time the user runs the application, the application loads any UI elements that are defined by the VSTO Add-in, but the VSTO Add-in is not loaded until the user clicks a UI element that is associated with the VSTO Add-in.

When the application successfully loads the VSTO Add-in for the first time, the LoadBehavior value remains 16 while the VSTO Add-in is loaded. After the application closes, the LoadBehavior value changes to 9.

Viewing Group Policy Templates

The Group Policy Management Console reads ADMX files from the central store typically
 \\<domain.com>\sysvol\<domain.com>\Policies\PolicyDefinitions

which on a DC is

C:\Windows\SYSVOL\domain\Polices\PolicyDefinitions

If you want to view ADMX files before placing them in the central store, copy them to C:\Windows\PolicyDefinitions.  Copy the language files ADML files to the suitable subfolder.

Change this key to 1 then launch GPMC.  Editing a policy will read from the local ADMX files not the central store.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\EnableLocalStoreOverrideType: REG_DWORD
Values:
0 - Use PolicyDefinitions on Sysvol if present (Default)
1 - Use local PolicyDefinitions always

Updating central store

Install a downloaded MSI containing the ADMX/ADML files which may install to 

e.g. C:\Program Files (x86)\Windows Server 2022 August 2021 Update\Policy Definitions

On the DC

Copy the required ADMX policy template files to 

C:\Windows\SYSVOL\domain\Polices\PolicyDefinitions

Copy the the required ADML policy template files from the language specific folder e.g.

C:\Program Files (x86)\Microsoft Group Policy\Windows Server 2022 August 2021 Update\PolicyDefinitions\en-US

to 

C:\Windows\SYSVOL\domain\Polices\PolicyDefinitions\en-US

The Policy options provided by the templates will now be visible in Group Policy Management Editor

Mapping to Sharepoint folders

Useful article about mapping File Explorer and/or OneDrive to Sharepoint Folders

https://docs.microsoft.com/en-us/sharepoint/support/administration/troubleshoot-mapped-network-drives

Start Menu Locked grrrrrr

Why some sysadmins lock the start menu I don't know.  It just reduces productivity when users are unable to customize the area designed to allow quick launching of favourite apps.

So if you suspect there is a group policy locking this down try this.

1. Set this key to 0
   
   HKCU\Software\Policies\Microsoft\Windows\Explorer
   LockedStartLayout   REG_DWORD    0
   
   As a user you probably won't have permissions.  Elevate then edit the user key below the appropriate SID in HKEY_USERS
   
2. Use the task manager to End Process on explorer.exe
   
3. Then in task manager use File_Run New Task to re-launch explorer

You can now "Pin to Start" for as long as the GPO has not affected the current explorer session.  You would likely have to carry out the procedure again before you could "Pin to Start", after a reboot for example.

administrator has blocked you from running this app

Oh no! That's terrible.  It looks very serious.

I doubt just running it in an elevated command window would make much difference. Oh, it does!

Process Mitigation / Exploit Protection

Process Mitigation (PM)
Win 10 Exploit protection settings are displayed/controlled in Update & Security_Windows Security_App & browser control_Exploit protection settings.

Depending on the GPOs used the settings may or may not be visible or changeable within the user interface.

The powershell cmdlet Set-ProcessMitigation -system can be used to control the settings.  The results of these commands modify a registry key value

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\MitigationOptions

Settings for applications are stored here
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<AppName.exe>\MitigationOptions

Using get-processmitigation -system
Many of the PM settings display as NOTSET.  This means that they are at the OS default settings and may be ON or OFF.  Using the -RegistryConfigFilePath to export the settings to an XML file will not include any default system settings, only ones that have been specifically set.

Once Set-ProcessMitigation is used for any settings e.g. to set ON for a given setting, the only way to return to the original NOTSET state is to delete the MitigationOptions key above.

Set-ProcessMitigation only enables or disables settings, it cannot be used to return to the original OS default setting state NOTSET

In Windows 10 1803 and 1809 these are the OS default settings

Control Flow Guard (CFG)
Use default (On)

Data Execution Prevention (DEP)
Use default (On)

Force randomization for images (Mandatory ASLR)
Use default (Off)

Randomise memory allocations (Bottom-up ASLR)
Use default (On)

High-entropy ASLR
Use default (On)

Validate exception chains (SEHOP)
Use default (On)

Validate heap integrity
Use default (On)