Computer last logon in Active Directory

A very useful way to check when a computer last logged on to Active Directory, done via PowerShell:

http://www.oxfordsbsguy.com/2014/04/28/powershell-get-adcomputer-to-retrieve-computer-last-logon-date-part-1/

Relevant commands:
Import-Module activedirectory
Get-ADComputer -Identity computer -Properties *

Command line tools for Group Policy

From Technet:

https://technet.microsoft.com/en-us/magazine/gg277500.aspx

Monitor user logons to domain

Again, thanks to Reddit user www.reddit.com/u/Jeff-Netwrix and the www.reddit.com/r/sysadmin subreddit.

• Configure logons auditing: Run gpedit.msc → Create a new GPO → Edit it: Go to "Computer Configuration" → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Logon/Logoff: Audit Logon → Define → Success And Failures.
• Adjust size of security logs: Go to Event Log → Define: Maximum security log size to 4gb Retention method for security log to "Overwrite events as needed".
• Link GPO: Link the new GPO to OU with Computer Accounts: Go to "Group Policy Management" → right-click the defined OU → choose Link an Existing GPO → choose the GPO that you created.
• Apply GPO: Force the group policy update: In "Group Policy Management" right click on the defined OU → click on "Group Policy Update".
• Check Security logs: Open Event viewer and search Security log for event id’s 4648/4624 (Audit Logon). It's also possible to use powershell to dig logs.

Detect who deleted file from file server

Thanks for this tip goes to Reddit user www.reddit.com/u/Jeff-Netwrix and the www.reddit.com/r/sysadmin subreddit.

•  Configure File System Auditing: Navigate to the required file share, right-click it and select "Properties" Select the "Security" tab → "Advanced" button → "Auditing" tab → Click "Add" button: Select Principal: "Everyone"; Select Type: "All"; Select Applies to: "This folder, subfolders and files"; Select the following "Advanced Permissions": "Delete subfolders and files" and "Delete".  
• Configure Audit Policy: Run gpedit.msc, edit "Default Domain Policy" → Computer Configuration → Policies → Windows Settings → Security Settings → Go to Local Policies → Audit Policy: Audit object access → Define → Success and Failures. Configure Advanced Audit Policy: Go to "Advanced Audit Policy Configuration" → Audit Policies → Object Access: Audit File System → Define → Success and Failures Audit Handle Manipulation → Define → Success and Failures.  
• Configure Event Log Size: Go to Event Log → Define: Maximum security log size to 4gb. Retention method for security log to Overwrite events as needed.  
• Check Security log: Open Event viewer and search Security log for event id 4656 with "File System" or "Removable Storage" task category and with "Accesses: DELETE" string. "Subject: Security ID" will show you who has deleted a file.

Trust relationship between machine and AD failed

I've run into this problem only a couple of times and Technet has quite a few possible solutions - the one that worked for me was using Netdom.

Slow network share browsing

I recently had a couple of new computers with Windows 7 (64 bit Professional) in an AD environment experience seriously slow browsing of network folders with JPEG files. Windows Explorer would slow to a crawl, often crashing outright. Googling the problem provides many, many supposed solutions, mostly centering around the network adapter properties (disabling remote Differential Compression, disabling Autotuning, disabling Flow Control, etc), none of which worked.

As of this writing, disabling SMB2 (and SMB3) on the client side seems to have worked (speaking to the former admin this was already disabled on the Win2K8 server).