Here's an odd one.

Promote Windows Server 2016 to a domain controller.

Using Group Policy Management, edit the Default Domain Controllers Policy as follows:

Computer Configuration - Policies - Windows Settings - Security Settings - Local Policies - Security Options - Network security: Configure encryption types allowed for Kerberos

Choose
AES128_HMAC_SHA1
AES256_HMAC_SHA1
Future encryption types

Restart your domain controller.

Using Group Policy Management, edit the Default Domain Controllers Policy as follows:

Computer Configuration - Policies - Windows Settings - Security Settings

Notice that an IP Security Policy Management error appears.

A directory service error has occurred - (80072095)

Also notice that no "IP Security Policies" can be created, under "Security Settings".

This must be a bug, right?

If you add RC4_HMAC_MD5 as a Kerberos encryption type, the error goes away and everything works.

Using MD5 is not recommended, of course, so bascially you can't define Kerberos encryption types?

Thank you.

Is it possible to ensure a way of communicating with the person who is using my excel sheet? I was just about to open the file I created and one of my colleques seems to use it already. Unfurtunately it is urgend and the excel notification that states that I can open a copied version until my excel sheet is available again leaves me only with the option to get myself notified when the sheet is available again. It would be amazing to allow to send a message to that person using my file, unfortunately the person who is using my excel sheets is not named, so I can not call the person. Maybe some one else has experienced this situation as well? It would be amazing if that kind of option would be possible too

function SomeFunction
{
Write-Host "SomeFunction calling SomeOtherFunction"
$ht = SomeOtherFunction
Write-Host "Hash Table Returned"
for ($i=0; $i -lt $ht.length; $i++) {
$arrayEntry1 = $ht[$i][0]
$arrayEntry2 = $ht[$i][1]
Write-Host "($arrayEntry1, $arrayEntry2)"
}

Write-Host "SomeFunction calling SomeOtherOtherFunction"
$ht = SomeOtherOtherFunction
Write-Host "Hash Table Returned"
for ($i=0; $i -lt $ht.length; $i++) {
$arrayEntry1 = $ht[$i][0]
$arrayEntry2 = $ht[$i][1]
Write-Host "($arrayEntry1, $arrayEntry2)"
}
}

function SomeOtherFunction
{
Write-Host "SomeOtherFunction added one entry into the hash table"
$myHashTable = @()
$myHashTable += ,@(1,0.99)

Write-Host "This is what the hash table looks like before being returned."
for ($i=0; $i -lt $myHashTable.length; $i++) {
$arrayEntry1 = $myHashTable[$i][0]
$arrayEntry2 = $myHashTable[$i][1]
Write-Host "($arrayEntry1, $arrayEntry2)"
}
return $myHashTable
}

function SomeOtherOtherFunction
{
Write-Host "SomeOtherOtherFunction added one entry into the hash table"
$myHashTable = @()
$myHashTable += ,@(1,0.99)
$myHashTable += ,@([int32]::MinValue,[int32]::MinValue)

Write-Host "This is what the hash table looks like before being returned this time."
for ($i=0; $i -lt $myHashTable.length; $i++) {
$arrayEntry1 = $myHashTable[$i][0]
$arrayEntry2 = $myHashTable[$i][1]
Write-Host "($arrayEntry1, $arrayEntry2)"
}
return $myHashTable
}

When using the startmenu in fullscreen mode, the start menu won't open anymore after a restart. When you disable and re-enable fullscreen mode, it works once again until the next restart.

It seems to be the ShellExperienceHost:

Name der fehlerhaften Anwendung: ShellExperienceHost.exe, Version: 10.0.14393.447, Zeitstempel: 0x5819bf85
Name des fehlerhaften Moduls: StartUI.dll, Version: 10.0.14393.447, Zeitstempel: 0x5819be04
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000b96b0
ID des fehlerhaften Prozesses: 0xa50
Startzeit der fehlerhaften Anwendung: 0x01d2ecced8231441
Pfad der fehlerhaften Anwendung: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
Pfad des fehlerhaften Moduls: C:\Windows\ShellExperiences\StartUI.dll
Berichtskennung: 563781c7-6fab-49ae-b3de-e0dd30c1c08c
Vollständiger Name des fehlerhaften Pakets: Microsoft.Windows.ShellExperienceHost_10.0.14393.447_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

It's also possible that this happens only to local admins.

Derived from this thread:
https://social.technet.microsoft.com/Forums/windows/en-US/5703e7b0-433a-4347-a572-a6da7938f35d/startmenu-wont-open-if-fullscreen-is-enabled?forum=ws2016

In https://msdn.microsoft.com/en-us/library/aa394378.aspx

Warning Win32_Product is not query optimized. Queries such as "select * from Win32_Product where (name like 'Sniffer%')" require WMI to use the MSI provider to enumerate all of the installed products and then parse the full list sequentially to handle the “where” clause. This process also initiates a consistency check of packages installed, verifying and repairing the install. With an account with only user privileges, as the user account may not have access to quite a few locations, may cause delay in application launch and an event 11708 stating an installation failure. For more information, see KB Article 794524.

Querying installed applications is basic.
This should be optimized without side-effects.

Scheduled Tasks should have the ability to verify a file’s authenticity prior to executing. For example, if a Scheduled Task is executing a PowerShell script that is being run with an account that has Domain Admin rights, anyone that has access to modify the PowerShell script on the server essentially has Domain Admin rights.
If there was an option added to the Scheduled Task setup where the owner could input the file hash of the PowerShell script and Task Scheduler checked the hash prior to executing the script, it would eliminate unauthorized changes.
One example where this would stop malicious changes:
1. Admin creates schedule task with service account that has Domain Admin rights.
2. Scheduled Task executes a script file.
3. Malicious person has admin access to the server, but not Domain Admin rights, modifies script.
4. Scheduled Task executes modified script with Domain Admin rights and malicious changes are made.
5. Malicious person then reverts script back to its original version.