By default, SCCM collections update once a week. this may or may not be sufficient for your needs. When you create a new Collection in Powershell, you can pass a -RefreshSchedule parameter.
Set-CMUserCollection and Set-CMDeviceCollection accept the -RefreshSchedule parameter though this doesn't appear to be documented anywhere - Google suggests long scripts to do this.
We wanted to set our user collections to update every 4 hours. It proved to be quite simple. First we created a new schedule object
$sched= New-CMSchedule -recurinterval Hours -recurcount 4
Then we passed it to each user collection.
foreach ($x in Get-CMUserCollection){Set-CMUserCollection -name $x.name -RefreshSchedule $sched}
Tuesday, August 23, 2016
Monday, March 14, 2016
Make Applications Run Without Administrator rights, despite prompts to elevate
This post will Attempt to consolidate everything I know about making applications under windows work as a user, once administrative rights have been revoked. This is based on my experience with windows 7, So YMMV for windows 8 and 10.
In this case, Permission the Applications Folder so the pcname\Users group has modify rights. The Permissions should propagate, down to files and subfolders, and this will clear up your issues. if you have many installs of an application, you can deploy a script to Change the permissions.
We simply use a bat file that calls ICACLS. This gets deployed Via SCCM to the System
The options at the end Specify
(OI) - object inherit
(CI) - container inherit
M- Modify
So the command ends up looking like:
Full ICACLS documentation can be found on technet. Always use the local group - frequent calls to AD for application permissions can slow the system down.
Simply deleting the key can cause the application to work. I have also seen this key below used, though much less commonly.
and example manifest file is shown below:
I have had luck simply deleting the file, though manifest files can also point to older versions of DLL's. In that case, You may have better luck replacing RUNASADMIN with ASINVOKER
(From: http://msdn.microsoft.com/en-us/library/aa905330.aspx)
You can turn off Installer Detection by modifying the EnableInstallerDetection Registry Key
and setting the value form 1 to 0.
This Can also be done Via GPO enterprise wide. The UAC Policies can be found in Computer Settings\Policies\Window Settings\Security Settings\Local Policies\Security Options
The User Account Control: Detect application installations and prompt for elevation policy setting controls the behavior of application installation detection for the computer.
The options are:
1. File and Folder Permissions.
Users do not have rights to write to C:\Program Files or C:\Program Files(x86) Folders. Many applications will have a local database or logfile stored with the application. Typically you get a permission Denied, or cant write to file error, rather then a UAC prompt.
In this case, Permission the Applications Folder so the pcname\Users group has modify rights. The Permissions should propagate, down to files and subfolders, and this will clear up your issues. if you have many installs of an application, you can deploy a script to Change the permissions.
We simply use a bat file that calls ICACLS. This gets deployed Via SCCM to the System
ICACLS <folder Path> /grant <group>:(OI)(CI)M
The options at the end Specify
(OI) - object inherit
(CI) - container inherit
M- Modify
So the command ends up looking like:
ICACLS "C:\Program Files (x86)\PFC6000" /grant Users:(OI)(CI)M
Full ICACLS documentation can be found on technet. Always use the local group - frequent calls to AD for application permissions can slow the system down.
2. AppCompatFlags
Some Applications can be flagged in the registry to run in compatibility mode. You can use AppCompat Flags to specify an application to run in XP mode, and require admin access. Just because an application prompts for admin, doesnt mean it Requires it. HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Simply deleting the key can cause the application to work. I have also seen this key below used, though much less commonly.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
3. Manifest Files
EXE's can use a manifest file to require an application to run as admin. The manifest file will be found with the EXE, and will be the name of the exe with the .manifest extension. So notepad.exe would have notepad.exe.manifest.and example manifest file is shown below:
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0"
processorArchitecture="X86"
name="Myobp.exe"
type="win32" />
<description>Manifest for Premier</description>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="RUNASADMIN"
uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
I have had luck simply deleting the file, though manifest files can also point to older versions of DLL's. In that case, You may have better luck replacing RUNASADMIN with ASINVOKER
4.Invoke Installer
The UAC can be prompted if it thinks you are about to run an installer. You may or may not be running one, but if the following conditions apply, you will get prompted.(From: http://msdn.microsoft.com/en-us/library/aa905330.aspx)
Installer Detection only applies to:
Before a 32 bit process is created, the following attributes are checked to determine whether it is an installer:
- 32 bit executables
- Applications without a requestedExecutionLevel
- Interactive processes running as a Standard User with UAC enabled
- Filename includes keywords such as "install," "setup," and "update."
- Keywords in the following Versioning Resource fields: Vendor, Company Name, Product Name, File Description, Original Filename, Internal Name, and Export Name.
- Keywords in the side-by-side application manifest embedded in the executable.
- Keywords in specific StringTable entries linked in the executable.
- Key attributes in the resource file data linked in the executable.
- Targeted sequences of bytes within the executable.
- Note: The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies.
You can turn off Installer Detection by modifying the EnableInstallerDetection Registry Key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
and setting the value form 1 to 0.
This Can also be done Via GPO enterprise wide. The UAC Policies can be found in Computer Settings\Policies\Window Settings\Security Settings\Local Policies\Security Options
The User Account Control: Detect application installations and prompt for elevation policy setting controls the behavior of application installation detection for the computer.
The options are:
- Enabled. (Default for home) When an application installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege.
- Disabled. (Default for enterprise) Application installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies such as Group Policy Software Installation or Systems Management Server (SMS) should disable this policy setting. In this case, installer detection is unnecessary.
5. Application Compatibility Tool Kit.
Pending - Please see TechRepublic Article @ http://www.techrepublic.com/blog/windows-and-office/selectively-disable-uac-for-your-trusted-vista-applications/Tuesday, November 10, 2015
Try out time - SCCM 2016
Todays the day I build the SCCM 2016 Virtual Lab.
The Plan:
VM1: AD/DNS/
VM2: SQL 2014
VM3: SCCM 2016
Lets see how this goes.
PXE Boot to run task sequence from shared NIC
Microsoft offered this post on Reusing the same NIC for multiple PXE initiated deployments in System Center Configuration Manger OSD
http://blogs.technet.com/b/configurationmgr/archive/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd.aspx
Monday, November 9, 2015
Tuesday, October 27, 2015
AD and SCCM Device Cleanup
This Script Removes devices from AD and SCCM that have not been logged onto in 90days, and have not reset thier device password in 120.
It then goes on to check the User device affinity to ensure Devices are sorted to the same OU as the Primary owner. (Unless that user is a member of the service desk, then leave as is.
it Also maintains a complete log of all changes.
$log="C:\temp\sorter.log
$date=get-date
$oulist=Get-ADOrganizationalUnit -LDAPFilter '(name=*)' -SearchBase 'OU=DEPT,DC=Domain,DC=com' -SearchScope OneLevel #get-oulist
########################################Cleanup Stale PC's##################
$t="Starting Purge on $date"
$t|out-file $log -append
#Collect Stale devices.
Foreach ($x in Get-QADComputer -NotLoggedOnFor 90 -PasswordNotChangedFor 120 -searchroot Domain.com/Dept/){
$t="$x.name was Purged on $date"
$t|out-file $log -append
Write-host $t
#Remove from AD/SCCM
remove-cmdevice -devicename $x.name –force –confirm:$false
remove-qadobject $x.DN –force –confirm:$false
}
$t="Purge complete on $date. "
$t|out-file $log -append
############################################## Object Sorter
$t="Starting Sort on $date"
$t|out-file $log -append
#get all computers
foreach ($z in Get-qadcomputer -searchroot "Domain.com/Dept/"){
$t=""
$x=get-cmdevice -name $z.name
if (!$x.username){ #check for Assigned user. If none log, and move on.
$t=$z.dn+" no user attached - unable to move."
write-host $t
$t|out-file $log -append
}elseif((Get-ADUser $x.Username -Properties memberof).memberof -like "CN=ISM-ALL*"){ #if member of servicedesk, dont touch
$t=$z.dn+" last used by service desk. Do not move.."
write-host $t
$t|out-file $log -append
}else{
$y=get-qaduser $x.UserName;
$f=$z.name.lenght+16
$G=$y.displayname.length+14
$zdn= $z.dn.substring($f)
$ydn= $y.dn.substring($g)
#write-host $f $zdn
if($zDN -match $ydn){ #if user dn and PC dn match - move on.
write-host $z.name " is properly located"
$zdn=""
$ydn=""
}else{
$zdn=""
$ydn=""
#sort based on DN.
Foreach ($q in $OUlist){
$q.Name
if ($y.DN -match $q.name){write-host "yes";$dept=$q.name}
}
$newou="Domain.com/Dept/"+ $dept +"/Computers"
$t=$z.dn+" moved to "+$newou
write-host $t
$t|out-file $log -append
Move-QADObject $z.dn -NewParentContainer $NewOU
$NewOU=""
}#end move if
}#end no user if
}#end dn match if
Adding Users Devices to a Collection by First and Last Name
Recently I was given a Set of User's Names to exclude from a deployment. Easy. Until I realized the deployment was deployed to devices, not users.
I dropped the user list into a text file. First Last, each on its own line. I read the file and grabbed the username, then performed a User Device affinity check, throwing the associated computer into the exclusion collection.
$collectionname="Exclude Reader DC"
foreach ($x in gc C:\temp\adobe.txt){
$y=get-qaduser $x
$user="DOMAIN\"+$y.samaccountname
$z=Get-CMUserDeviceAffinity -UserName $user
#$q=Get-CMDevice -ResourceId $z.resourceid
#$q.name
$z.resourceid
Add-CMDeviceCollectionDirectMembershipRule -CollectionName $collectionname -ResourceId $z.resourceid
}
Monday, October 26, 2015
De-clouding Adobe Reader DC.
The following reg keys remove all cloud features from Adobe Reader DC. This will remove the Sign-In buttons, Up-sell screens and any prompts to do stuff in the cloud.
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cCloud] "bDisableADCFileStore"=dword:00000001 "bAdobeSendPluginToggle"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cServices] "bToggleAdobeDocumentServices"=dword:00000001 "bTogglePrefsSync"=dword:00000001 "bToggleWebConnectors=dword:00000001 "bToggleAdobeSign"=dword:00000001 "bUpdater""=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cIPM] "bAllowUserToChangeMsgPrefs"=dword:00000000 "bDontShowMsgWhenViewingDoc"=dword:00000000 "bShowMsgAtLaunch"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cSharePoint] "bDisableSharePointFeatures"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cWebmailProfiles] "bDisableWebmail"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown] "bAcroSuppressUpsell"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cIPM] "bAllowUserToChangeMsgPrefs"=dword:00000000 "bDontShowMsgWhenViewingDoc"=dword:00000000 "bShowMsgAtLaunch"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cSharePoint] "bDisableSharePointFeatures"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cWebmailProfiles] "bDisableWebmail"=dword:00000001
Thursday, January 8, 2015
sccm task sequence error 0x80004005
This is a fix for Imaging when getting the following Error
0x80004005. It has to do with the date not being current, to fix this you can
verify in the bios the correct date and run the following command when prompted
with the error while imaging.
When confronted with the above Do the following steps.
-
Press F8 button to bring up a command prompt
-
Enter the command “time” and hit enter.
-
Input the correct time and hit enter.
-
Enter the command “date” and hit enter.
-
Input the correct date and hit enter.
-
Close the failed Task Sequence Wizard (the
command prompt will still be open)
-
Run the following command “tsbootshell” and hit
enter. This will relaunch the Task sequence wizard and you can now image. With
that being said leave the command prompt window open untill the imaing is
prompting to reboot. Closing the command prompt window will close the task
sequence.
Friday, January 2, 2015
Monday, December 22, 2014
Firewall Configuration for Office 365
Microsoft has 2 technet articles that may be of use when Configuring Office 365 to connect through a firewall.
The First, Office 365 URLs and IP address ranges Lists all the IP ranges and URL's Office 365 services need to connect to.
The second, Ports and protocols used by Office 365 lists all the ports.
The First, Office 365 URLs and IP address ranges Lists all the IP ranges and URL's Office 365 services need to connect to.
The second, Ports and protocols used by Office 365 lists all the ports.
Tuesday, December 16, 2014
MS Office 365 - Office Suite Installation
Having recently under gone an Enterprise deployment of Microsoft Office 2013
This post will consolidate all posts Related to the experience. This should hopefully offer guidance and gotchas to be aware of.
This post will consolidate all posts Related to the experience. This should hopefully offer guidance and gotchas to be aware of.
Setup, Packaging and Deployment
Click to Run tool Usage for enterprise DeploymentsTroubleshooting and Issues:
Users Unable to ActivateOffice 365 - office fails to activate, and users cant sign in
We ran into an Issue where users office installs wouldn't activate and the users were unable to sign into portal.office.com. When we looked at the tickets, we noticed all the users had Apostrophies in their last name....
Many People have Special characters, like apostrophes, in their email addresses. Names like O'Neil are common and if your organization uses first.last as primary smtp, You have a problem.While an email address like Paul.O'Neil@contoso.com is perfectly valid in an On Premise exchange environment, Office 365 hates the apostrophe, and as a result, the user can't login. Whats worse is that Office itself wont activate, and puts the user into trial mode - awesome end user experience.
Remember Microsoft Says Primary email must match the Users UserPrincipleName Attribute, the simplest solution is to add a New Primary SMTP address without the apostrophe (Paul.ONeil@contoso.com) , and make the current apostroph'd (Paul.O'Neil@contoso.com) address a secondary.Remove the apostrophe from the UserPrincipleName, trigger a resynch with office 365 and you should be good.
Many People have Special characters, like apostrophes, in their email addresses. Names like O'Neil are common and if your organization uses first.last as primary smtp, You have a problem.While an email address like Paul.O'Neil@contoso.com is perfectly valid in an On Premise exchange environment, Office 365 hates the apostrophe, and as a result, the user can't login. Whats worse is that Office itself wont activate, and puts the user into trial mode - awesome end user experience.
Remember Microsoft Says Primary email must match the Users UserPrincipleName Attribute, the simplest solution is to add a New Primary SMTP address without the apostrophe (Paul.ONeil@contoso.com) , and make the current apostroph'd (Paul.O'Neil@contoso.com) address a secondary.Remove the apostrophe from the UserPrincipleName, trigger a resynch with office 365 and you should be good.
Monday, December 1, 2014
Office 365 - Office 2013 Click to Run Enterprise Deployment.
Office 365 Changes everything you know about Enterprise deployments of applications. The first thing is that Office is licensed per user and will need to authenticate with microsoft. The second
is that the office application itself is actually a self Contained APP-V package - so installation requires the use of a Office Deployment tool to perform local enterprise deployments.
Unfortunately, this tool is unlike any other previous office deployment tool.
Tracking Per user Licensing.
There are 3 methods for tracking licensing. First we can have separate Microsoft online accounts. these work similarly to how a users personal Hotmail account works. Users get a <user>@corp.onmicorsoft.com address and authenticate using that. These exist solely in Microsoft's environment, and users need to sign into office the first time they use it.the Second option is to use Microsoft's Dir Synch tool to Copy your active directory to their directory. This automates things, but as the users domain account and Microsoft online account are different, they must still login to office.
The third and Final option is to use ADFS to federate your active directory with MS. In this case, Microsoft online refers authentication back to your active directory via AD FS, and this allows office users to get single signon, so they are not prompted to sign into office on first use.
Installing Using the Click to Run Tool.
The Office deployment kit includes the clicktorun tool. You can download the Office deployment kit at http://www.microsoft.com/en-us/download/details.aspx?id=30344
The Click to run tool gets passed an XML file that tells it how to configure the Install. The XML File allows you to specify what Products and Languages to install (Or exclude) Below is an example Config.xml . Microsoft offers a reference document as well.
<Configuration>
<Add SourcePath="\\mg145.contoso.com\pkgsource\Microsoft\Office365\Office\" version="15.0.4641.1003" OfficeClientEdition="32">
<Product ID="O365ProPlusRetail">
<Language ID="en-us" />
<ExcludeApp ID="Access" />
<ExcludeApp ID="InfoPath" />
<ExcludeApp ID="Project" />
<ExcludeApp ID="Publisher" />
<ExcludeApp ID="SharePointDesigner" />
<ExcludeApp ID="Groove" />
</Product>
</Add>
<Display Level="full" AcceptEULA="TRUE" />
</Configuration>
Once you have the Config file created, You need to download the office install to the share you created. the command setup.exe /download <path of Configuration.xml file> will do this.
Actually installing office requires you to call >setup.exe /configure <path of Click-to-Run Configuration.xml file>
Microsoft offers documentation on the Click to Run tool At http://technet.microsoft.com/en-nz/library/jj219422.aspx
Adding Components.
In our above example you will notice we excluded Publisher. We can re-add publisher by calling a separate XML file and choosing the additional product to install. Compare the XML Below to the ProPlus one above. <Configuration>
<Add SourcePath="\\mg145.contoso.com\pkgsource\Microsoft\Office365\Office\" version="15.0.4641.1003" OfficeClientEdition="32">
<Product ID="PublisherRetail">
<Language ID="en-us" />
</Product>
</Add>
<Display Level="full" AcceptEULA="TRUE" />
</Configuration>
At Present you can use the Following Product codes:
- AccessRetail
- ExcelRetail
- GrooveRetail
- InfoPathRetail
- LyncEntryRetail
- LyncRetail
- OneNoteRetail
- OutlookRetail
- PowerPointRetail
- PublisherRetail
- SPDRetail (SharePoint Designer)
- WordRetail
- VisioProRetail
- ProjectProRetail
- VisioStdRetail
- ProjectStdRetail
Uninstalling Office
You can remove everything by calling setup and specifying the following config: <Configuration>
<Remove All="True" />
</Configuration>
You can also remove individual packages by specifying a product id. All the product ID's listed above are also valid here.
<Remove>
<Product ID="PublisherRetail" />
</Remove>
Shared Computers
Shared Computer Activation: http://technet.microsoft.com/en-us/library/dn782860.aspx
Repairing Office.
there are 2 modes for repairing office. the first is online mode and downloads the entire product and installs it. This is bad, because it completely ignores any customizations you may have done.A quick repair will refresh the install. This will not add adtional prodcuts thet were previously turned off.
Both repairs can be done from Programs and Features, Select office, Click Change, and you will be prompted to choose.
It is also possible to issue the commands locally on a system. This is handy if you need to automate a change. For example, If you install office 2013 while 2010 is still on the system, File associations will break if you remove office 2010. to repair them, you will need to run a quick repair. For example - to do a Online repair you can issue the following:
"C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe" scenario=Repair platform=x86 culture=en-us RepairType=FullRepair DisplayLevel=False
Note that the Clicktoruntool path changes based on weather the os is 32 or 64bit.
for 64-bit operating systems:
“C:\program files\Microsoft Office 15\ClientX64"
for 32-bit operating systems:
“C:\program files\Microsoft Office 15\ClientX86"
A full reference is available at http://technet.microsoft.com/en-us/library/jj219426.aspx
Thursday, November 27, 2014
Surface 3 - SCCM task Sequence Spordically Fails.
It will then start recovery, and allow you to choose a Boot device. We choose, usb, and The device reboots into the Task Sequence.
Once running, we noticed that some would randomy fail to go.
On investigation, we discovered that the Date and Time were incorrect, and this was causing the failure.
Press F8
Enter Time - Update the time to Current
Enter Date - Update date to Current.
Click Finish on the tasksequence error Screen, and in the cmd window enter tsbootshell, and press Enter to restart the sequence. (Dont close the window, however)
Friday, November 14, 2014
Remotly Get Group Policy Application on a Device
The Following command will give you a nice HTML Report of all the policy settings which are applying on a remote computer, including which policy the setting comes from in case of a conflict.
gpresult /s COMPUTERNAME /user DOMAIN\USERNAME /h outputfile.html
Make sure the account you specify has rights to the Computer you are running against.
Subscribe to:
Posts (Atom)