Some Notes on the Machines

Reportedly in February 2016, Microsoft began to automatically upgrade all Office 365 customers to version 2016. One has to search for the words “February” and “automatic” in the page below to see it:

https://support.microsoft.com/en-us/kb/3097292

Among many others, this can cause major problems for users of QuickBooks of all versions before 2016; all integration with Excel fails, and we can expect other problems (e.g., Outlook integration) as well. There is no easy revert procedure, we just have this:

https://community.office365.com/en-us/f/172/t/409681

There is a method to prevent the upgrade via Group Policy:

https://support.microsoft.com/en-us/kb/3097292

To create a shortcut on client desktops by group policy, browse here in GPMC:

User Configuration, Preferences, Windows Settings, Shortcuts

Having studied lots of reference material:

https://support.apple.com/en-us/HT202944
http://stackoverflow.com/questions/10688852/ip-address-ranges-for-apns-servers
https://support.apple.com/en-us/HT200149
https://discussions.apple.com/thread/5226424?start=0&tstart=0
https://www-01.ibm.com/support/knowledgecenter/SSKTXQ_9.0.0/admin/config/config_proxy_mobile.dita

it is very clear that the true situation is not very clear. However, a few things appear consistent.

First of all the IP range. Apple has 17.0.0.0/8 reserved to itself, that’s every IP4 address starting with 17. So if you were to configure your firewall to allow everything outbound to that gigantic range, it appears you’re done. That is a huge range though, and although it appears to be controlled by Apple, it is not clear that Apple is vetting all data at all of those IPs.

So we have the DNS hostnames. *.apple.com seems to cover everything, as long as “*” is multilevel in its reference, i.e.., as long as the rule refers not only to a.apple.com, but a.a.apple.com as well. If your firewall is one of the better ones which allows FQDN rule lookups, this is a much better choice than that huge subnet.

Thirdly, the ports. Apple gives this unbelievably huge list of ports, including (for just one example of strangeness) the long-obsolete “finger” protocol port. This writer will not consider opening that entire list. Happily, other references (when combined!) suggest that the following list should do nicely, in TCP only:

80
443
8088
2195
2196

Here is a great web site for these:

http://www.qtools.com/qbupdates.htm

If you see these in event logs, you are seeing the result of a mismatch between the running drivers in your machine and something in Microsoft’s cloud-based driver database. Do this:

1. Control Panel
2. search for Device Installation
3. Change device installation settings
4. No, let me choose what to do
5. Never install driver software from Windows Update.
6. uncheck Automatically get the device app and info provided by your device manufacturer

At this registry location:

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Executive

create or modify “AdditionalCriticalWorkerThreads” and also “AdditionalDelayedWorkerThreads”, both DWORDs.

For a 32-bit system, I have come to prefer decimal values of 6 times the number of gigs of RAM. So a 1/2G RAM system gets 3, a 4G system gets 24. For a 64-bit system, I use 3 times the number of gigs of RAM.

The above include statements that the maximum value actually used by Windows for these entries is 16. However, the pages are old enough that they do not discuss 64-bit environments; and the second page, the more recent of the two, states that the registry entries exist by default, which they do not.

A major software vendor (which shall now go unnamed) had a page, now taken down, which seemed to at least leave the possibility open that higher numbers may be viable, 64 being recommended by them for a third item otherwise apparently undocumented:

HKLM\SYSTEM\CurrentControlSet\Services\RpcXdr\Parameters\DefaultNumberofWorkerThreads

But just today, I learned of this page:

https://blogs.technet.microsoft.com/josebda/2010/08/27/performance-tuning-guidelines-for-windows-server-2008-r2/

which references this page at Microsoft:

https://msdn.microsoft.com/en-us/library/windows/hardware/dn529134

which contains references for all current Windows Server versions. These touch all of the above and a lot more! Haven’t read them all yet, but will, am thinking to learn lots of interesting things. A quick peruse did reveal that the old hard max of 16 no longer applies, 64 is mentioned, at least in the Server 2008R2 document.

Below is a VBscript, not been updated in a while, which attempts to give an all-around tweak set for the above. Will be working on this soon from that Microsoft page.

' ***************************************
' ******* Optimize Worker Threads *******
' ****************** 2.0 ****************
' ***************************************
' ********* Jonathan E. Brickman ********
' ********* jeb@ponderworthy.com ********
' ***************************************
' ***************************************

' ********** Set up environment *********

Option Explicit

Dim HKEY_LOCAL_MACHINE, strComputer, CPUarch
Dim Return
Dim AddCriticalWorkerThreads, AddDelayedWorkerThreads, DefaultWorkerThreads

HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."

' ********** Find out how much RAM is in machine *******

Dim RAMobj, i, RAMobj2, memTmp1, TotalRAM

Set RAMobj = GetObject("winmgmts:").InstancesOf("Win32_PhysicalMemory")
i = 1
For Each RAMobj2 In RAMobj
	memTmp1 = CDbl(RAMobj2.capacity) / CDbl(1024) / CDbl(1024) / CDbl(1024)
	TotalRAM = TotalRAM + memTmp1
	i = i + 1
Next

Set RAMobj = Nothing
Set RAMobj2 = Nothing

' ******** Get ready for registry operations **********

Dim ObjRegistry, strPath, strValue

Set ObjRegistry = _
    GetObject("winmgmts:{impersonationLevel = impersonate}!\\" _
    & strComputer & "\root\default:StdRegProv")

' ********** Find out whether OS is 32-bit or 64-bit **********

' HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE
' contains either 'AMD64' or 'x86' or other, if not AMD64 presume 32-bit

' ObjRegistry.GetStringValue?...
' http://msdn.microsoft.com/en-us/library/windows/desktop/aa390788%28v=vs.85%29.aspx

strPath = "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"

ObjRegistry.GetSTRINGValue HKEY_LOCAL_MACHINE, strPath, "PROCESSOR_ARCHITECTURE", CPUarch

' CPUarch will be AMD64 or IA64 if 64-bit, otherwise 32-bit

' ********** Calculate values to be used **********

If CPUarch = "AMD64" or CPUarch = "IA64" Then
	AddCriticalWorkerThreads = TotalRAM * 3
	AddDelayedWorkerThreads = TotalRAM * 3
	DefaultWorkerThreads = 64
Else
	AddCriticalWorkerThreads = TotalRAM * 6
	AddDelayedWorkerThreads = TotalRAM * 6
	DefaultWorkerThreads = 64
end if

' WScript.echo "Total RAM: " & TotalRAM
' WScript.echo "Critical Worker Threads: " & AddCriticalWorkerThreads
' WScript.echo "Delayed Worker Threads: " & AddDelayedWorkerThreads
' WScript.echo "Default Worker Threads: " & DefaultWorkerThreads

' WScript.Quit

' ********** Set Additional Critical and Delayed Worker Threads ***********

strPath = "SYSTEM\CurrentControlSet\Control\Session Manager\Executive"

' Create key in case it doesn't exist yet
Return = objRegistry.CreateKey(HKEY_LOCAL_MACHINE, strPath)

ObjRegistry.SetDWORDValue HKEY_LOCAL_MACHINE, strPath, "AdditionalCriticalWorkerThreads", AddCriticalWorkerThreads
If Err <> 0 Then
	WScript.Echo "Could not set AdditionalCriticalWorkerThreads."
End If

ObjRegistry.SetDWORDValue HKEY_LOCAL_MACHINE, strPath, "AdditionalDelayedWorkerThreads", AddDelayedWorkerThreads
If Err <> 0 Then
	WScript.Echo "Could not set AdditionalDelayedWorkerThreads."
End If

' ********** Set Default Number of Worker Threads ***********

strPath = "SYSTEM\CurrentControlSet\Services\RpcXdr\Parameters"

' Create second key in case it doesn't exist yet
Return = objRegistry.CreateKey(HKEY_LOCAL_MACHINE, strPath)

ObjRegistry.SetDWORDValue HKEY_LOCAL_MACHINE, strPath, "DefaultNumberOfWorkerThreads", DefaultWorkerThreads
If Err <> 0 Then
	WScript.Echo "Could not set DefaultNumberOfWorkerThreads."
End If

' ********* End! **********

Set ObjRegistry = Nothing

' Wscript.echo "Done!"

There are now multiple alternatives to the bundled Windows update system. First of all, the original, AutoPatcher, appears to be in the midst of a well-deserved renaissance:

http://www.autopatcher.net/

And we also have WSUSOffline:

http://www.wsusoffline.net/

And there are quite a few more too, not tested by this writer as of yet!

FreeFileSync is a great piece of work, it synchronizes files and folders between local drives, over SSH, and to mobile devices via MTP over USB.

If it’s not working or not working well for you, try this:

1. In the Dashboard, Disable Office 365 integration and Azure integration. It’s two separate steps. If you disable just Office 365 integration you won’t be able to continue.
2. Set up Office 365 integration.
3. See lots of interesting information come up quite quicly, in the Office 365 tab after you restart the Dashboard, to confirm that your integration is working very nicely.
4. If it didn’t work well, open your firewall per Microsoft, and test again.

It can be very helpful to distribute a power plan in Group Policy, especially if there are laptops needing wifi SQL connections which must not ever cut off. The best way I have found, is to use this location in GP:

User Configuration / Control Panel Settings / Power Options

and create a new one there, with a new name, set as default. It may be helpful to do the same under Computer Configuration just in case there are hidden overrides out there.

There is another set of settings using the power plan GUID, but I have not found any way to automatically distribute power plans via group policy and keep the GUID consistent in all machines, even import/export does not do this.