windows-admins / configmgr Goto Github PK
View Code? Open in Web Editor NEWLicense: GNU General Public License v3.0
configmgr's People
Stargazers
Watchers
Forkers
thereal-configmgr allanpedersen lennyvaknine43 psychodata sysbehr danjpadgett dane-gauthier jesverdugo felixcruz3 evilgrinuk fishmanpet jones948 teslasysa ersatyle tharajan motorhead018 vpmanske hebnerhyde theaquamarine viveksengar3112 therealdeomax rowdychildren ecajas76 commbatboots hoorge techkonnect ievsantillan jeredkendall mrjoeg colinblackman jshackelford9375 tiagojferreira thuanv chriskibble qu4dz1ll4 james-von-detroit tstolswo paulvill76 desjani mphenley codymathis123 azureandsecurityotaku elgrunt0 zakgodwin craigz1992 trumby cyberjames vexingcode tunnelofsludge thamielis zerixlh 0xsteini szymczakpiotr gerwintr laenderm l2g2hconfigmgr's Issues
ModularOSD Task Sequence needs to be recreated
The modular OSD Task Sequence needs to be recreated in 1806 and reuploaded due to a bug in the version of ConfigMgr it was created in that causes issues with policy merge.
--reported on slack by @TeslaSysA
CI for local accounts
Disable all local accounts and randomize passwords
Add MP finding to Driver Script
You can get the MP from (Get-CimInstance -namespace ROOT\ccm -Class SMS_LookupMP).Name
Reporting on GPO Baselines
Need to build a PowerBI report for this.
Might break this into 3 different ones, for NIST/CIS, Microsoft, and DoD.
Fix DP collection
Doesn't have Pull DPs in it
select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.ResourceNames in (Select ServerName FROM SMS_DistributionPointInfo where SMS_DistributionPointInfo.IsPullDP = '1')
OSD - Modular - bios config processor_architecture
processor_architecture variable doesn't exist by default
should add a step at the start of the TS Set Task Sequence Variable
name : processor_architecture
value : %processor_architecture%
Add ability to convert non regular GPO items to DCM
Currently we can easily convert most GPOs to DCM because they are reg keys. But anything in the Security section does not currently get converted.
SCCM Server CI Copy/Pasta error
hellphish [3:22 PM]
the remediation script for CoreFileServer and BITS is the same
Enable-WindowsOptionalFeature -Online -FeatureName BITS -All
not sure if that is by design or was a copy-paste error
shouldn't it be
Enable-WindowsOptionalFeature -Online -FeatureName CoreFileServer -All
DCM Conversion for Windows configuration in Modular OSD
Look at lifting and shifting the configuration done in Modular OSD into DCM
Improve the Disk Cleanup
Find and add more logs, files, etc to disk cleanup for a more heavy clean up
Add Dell BIOS Detection Method
If version is a number like 1.2.3, then prepend with [VERSION]
If version starts with A, then leave it a string
CHANGE ME
$TargetBIOSVersion = [VERSION]"1.6.4"
CHANGE ME
$BIOSVersion = (Get-WmiObject -Query "select SMBIOSBIOSVersion from Win32_BIOS").SMBIOSBIOSVersion
If ($BIOSVersion -like 'A*')
{
$BIOSVersion = $BIOSVersion -replace "A", ""
}
else
{
$BIOSVersion = [Version]BIOSVersion
}
if($BIOSVersion -ge $TargetBIOSVersion)
{
Write-Host "Installed"
}
PoSh Gather
Windows 10 Master Task Sequence - Mouse Enab
In the "Windows" Group
Step: Disable Mouse Cursor Surpression
Command line reads:
reg import ".\Registry_Windows10\DisableMouseCursorSurpression.reg"
Should read:
reg import ".\Registry_Windows10\DisableMouseCursorSupression.reg"
There's an errant letter "R" in the word Supression that causes the line to fail.
Technically, the word should read "Suppression", but I'm not too picky so long as it works. :)
(Renaming the files would be a pain, too.)
Thank you!
VHD Application Install
Line 1: Function 'Remove-RegistryKey' has verb that could change system state. Therefore, the function has to support 'ShouldProcess'.
Line 36: Function 'Update-RegistryKey' has verb that could change system state. Therefore, the function has to support 'ShouldProcess'. | Update-RegistryKey
Line 21: File 'PackagingHostConfig.ps1' uses Write-Host. Avoid using Write-Host because it might not work in all hosts, does not work when there is no host, and (prior to PS 5.0) cannot be suppressed, captured, or redirected. Instead, use Write-Output, Write-Verbose, or Write-Information.
Line 60: File 'PackagingHostConfig.ps1' uses Write-Host. Avoid using Write-Host because it might not work in all hosts, does not work when there is no host, and (prior to PS 5.0) cannot be suppressed, captured, or redirected. Instead, use Write-Output, Write-Verbose, or Write-Information.
https://dille.name/blog/2017/08/27/how-to-use-shouldprocess-in-powershell-functions/
Start building out user object health checks
Level 5 Security Standard GPOs
Detecting UEFI/BIOS config in WinPE
Please look into the detection of UEFI/BIOS config while in WinPE.
Level 4 Security Standard GPOs
Grouper2 Output
COMMANDO Sat 04/13/2019 5:46:45.80
C:\Tools\Grouper2>Grouper2.exe -g
Switching output to pretty mode. Nice.
Running as user: CORP\LabAdmin
All online checks will be performed in the context of this user.
Trying to figure out what AD domain we're working with.
Current AD Domain is: corp.contoso.com
Targeting SYSVOL at: \\corp.contoso.com\sysvol\corp.contoso.com\
I found all these directories in SYSVOL...
#########################################
\\corp.contoso.com\sysvol\corp.contoso.com\DfsrPrivate
\\corp.contoso.com\sysvol\corp.contoso.com\Policies
\\corp.contoso.com\sysvol\corp.contoso.com\scripts
#########################################
... and I'm going to find all the goodies I can in all of them.
6 GPOs to process.
Starting processing GPOs with 10 threads.
6/6 GPOs processed. 100% complete.
Processing SYSVOL script dirs.
Errors in processing GPOs:
{
"\\\\corp.contoso.com\\sysvol\\corp.contoso.com\\Policies\\PolicyDefinitions": "System.IndexOutOfRangeException: Index was outside the bounds of the array.\r\n at Grouper2.Grouper2.<>c__DisplayClass0_1.<Main>b__0()"
}
.,-:::::/::::::.. .. ... ::::::::::::..,::::::::::::.. ,;'``;.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Default Domain Policy
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
GPO Properties
##############
┌──────────────────┬──────────────────────────────────────────────────────────────────────────────────────────┐
│Display Name │Default Domain Policy │
├──────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤
│UID │{31B2F340-016D-11D2-945F-00C04FB984F9} │
├──────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤
│Distinguished Name│CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=corp,DC=contoso,DC=com │
├──────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤
│Created │11/27/2018 1:16:55 AM │
├──────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤
│GPO Status │Enabled │
├──────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤
│ACLs │┌─────┬─────────────────────────────────────────┐ │
│ ││2 │┌─────┬────────────────────────────────┐ │ │
│ ││ ││SID │AU │ │ │
│ ││ │├─────┼────────────────────────────────┤ │ │
│ ││ ││Name │NT AUTHORITY\Authenticated Users│ │ │
│ ││ │├─────┼────────────────────────────────┤ │ │
│ ││ ││Type │Allow │ │ │
│ ││ │├─────┼────────────────────────────────┤ │ │
│ ││ ││Flags│CONTAINER_INHERIT │ │ │
│ ││ │└─────┴────────────────────────────────┘ │ │
│ │├─────┼─────────────────────────────────────────┤ │
│ ││9 │┌──────┬────────────────────────────────┐│ │
│ ││ ││SID │AU ││ │
│ ││ │├──────┼────────────────────────────────┤│ │
│ ││ ││Name │NT AUTHORITY\Authenticated Users││ │
│ ││ │├──────┼────────────────────────────────┤│ │
│ ││ ││Type │Allow ││ │
│ ││ │├──────┼────────────────────────────────┤│ │
│ ││ ││Rights│Extended Rights ││ │
│ ││ │├──────┼────────────────────────────────┤│ │
│ ││ ││Flags │CONTAINER_INHERIT ││ │
│ ││ │└──────┴────────────────────────────────┘│ │
│ │└─────┴─────────────────────────────────────────┘ │
├──────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤
│gpoPath │\\corp.contoso.com\sysvol\corp.contoso.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}│
└──────────────────┴──────────────────────────────────────────────────────────────────────────────────────────┘
Findings in Machine Policy
##########################
Registry Values
~~~~~~~~~~~~~~~
┌─────────────────────────────────────────────────────┬─────┐
│Key │Value│
├─────────────────────────────────────────────────────┼─────┤
│MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash│1 │
└─────────────────────────────────────────────────────┴─────┘
System Access
~~~~~~~~~~~~~
┌────────────────────────────────────────┬─────┐
│Invalid password attempts before lockout│0 │
└────────────────────────────────────────┴─────┘
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Default Domain Controllers Policy
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
GPO Properties
##############
┌──────────────────┬──────────────────────────────────────────────────────────────────────────────────────────┐
│Display Name │Default Domain Controllers Policy │
├──────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤
│UID │{6AC1786C-016F-11D2-945F-00C04fB984F9} │
├──────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤
│Distinguished Name│CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=corp,DC=contoso,DC=com │
├──────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤
│Created │11/27/2018 1:16:55 AM │
├──────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤
│GPO Status │Enabled │
├──────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤
│ACLs │┌─────┬─────────────────────────────────────────┐ │
│ ││2 │┌─────┬────────────────────────────────┐ │ │
│ ││ ││SID │AU │ │ │
│ ││ │├─────┼────────────────────────────────┤ │ │
│ ││ ││Name │NT AUTHORITY\Authenticated Users│ │ │
│ ││ │├─────┼────────────────────────────────┤ │ │
│ ││ ││Type │Allow │ │ │
│ ││ │├─────┼────────────────────────────────┤ │ │
│ ││ ││Flags│CONTAINER_INHERIT │ │ │
│ ││ │└─────┴────────────────────────────────┘ │ │
│ │├─────┼─────────────────────────────────────────┤ │
│ ││9 │┌──────┬────────────────────────────────┐│ │
│ ││ ││SID │AU ││ │
│ ││ │├──────┼────────────────────────────────┤│ │
│ ││ ││Name │NT AUTHORITY\Authenticated Users││ │
│ ││ │├──────┼────────────────────────────────┤│ │
│ ││ ││Type │Allow ││ │
│ ││ │├──────┼────────────────────────────────┤│ │
│ ││ ││Rights│Extended Rights ││ │
│ ││ │├──────┼────────────────────────────────┤│ │
│ ││ ││Flags │CONTAINER_INHERIT ││ │
│ ││ │└──────┴────────────────────────────────┘│ │
│ │└─────┴─────────────────────────────────────────┘ │
├──────────────────┼──────────────────────────────────────────────────────────────────────────────────────────┤
│gpoPath │\\corp.contoso.com\sysvol\corp.contoso.com\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}│
└──────────────────┴──────────────────────────────────────────────────────────────────────────────────────────┘
Findings in Machine Policy
##########################
OS Privileges
~~~~~~~~~~~~~
┌────────────────────┬───────────────────────────────────────────────────────────────────────────────────────────────┐
│SeAssignPrimaryToken│┌────────────────────┬───────────────────────────────────────────────────┐ │
│Privilege ││S-1-5-80-344959196- │Failed to resolve SID. │ │
│ ││2060754871- │ │ │
│ ││2302487193- │ │ │
│ ││2804545603- │ │ │
│ ││1466107430 │ │ │
│ │├────────────────────┼───────────────────────────────────────────────────┤ │
│ ││S-1-5-20 │NT AUTHORITY\NETWORK SERVICE │ │
│ │├────────────────────┼───────────────────────────────────────────────────┤ │
│ ││S-1-5-19 │NT AUTHORITY\LOCAL SERVICE │ │
│ │├────────────────────┼───────────────────────────────────────────────────┤ │
│ ││S-1-5-80-3880718306-│Failed to resolve SID. │ │
│ ││3832830129- │ │ │
│ ││1677859214- │ │ │
│ ││2598158968- │ │ │
│ ││1052248003 │ │ │
│ │├────────────────────┼───────────────────────────────────────────────────┤ │
│ ││Description │Required to assign the primary token of a process. │ │
│ │└────────────────────┴───────────────────────────────────────────────────┘ │
├────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│SeBackupPrivilege │┌────────────┬───────────────────────────────────────────────────────────────────────────────┐ │
│ ││S-1-5-32-549│Server Operators │ │
│ │├────────────┼───────────────────────────────────────────────────────────────────────────────┤ │
│ ││S-1-5-32-551│BUILTIN\Backup Operators │ │
│ │├────────────┼───────────────────────────────────────────────────────────────────────────────┤ │
│ ││Description │This privilege causes the system to grant all read access control to any file. │ │
│ │└────────────┴───────────────────────────────────────────────────────────────────────────────┘ │
├────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│SeLoadDriverPrivileg│┌────────────┬────────────────────────────────────────────┐ │
│e ││S-1-5-32-550│Print Operators │ │
│ │├────────────┼────────────────────────────────────────────┤ │
│ ││Description │Required to load or unload a device driver. │ │
│ │└────────────┴────────────────────────────────────────────┘ │
├────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│SeMachineAccountPriv│┌───────────┬────────────────────────────────────────────────────┐ │
│ilege ││S-1-5-11 │NT AUTHORITY\Authenticated Users │ │
│ │├───────────┼────────────────────────────────────────────────────┤ │
│ ││Description│Required to create computer accounts in the domain. │ │
│ │└───────────┴────────────────────────────────────────────────────┘ │
├────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│SeNetworkLogonRight │┌────────────┬───────────────────────────────────────────────────────────────┐ │
│ ││S-1-5-32-554│BUILTIN\Pre-Windows 2000 Compatible Access │ │
│ │├────────────┼───────────────────────────────────────────────────────────────┤ │
│ ││S-1-5-11 │NT AUTHORITY\Authenticated Users │ │
│ │├────────────┼───────────────────────────────────────────────────────────────┤ │
│ ││S-1-1-0 │Everyone │ │
│ │├────────────┼───────────────────────────────────────────────────────────────┤ │
│ ││Description │Required for an account to log on using the network logon type.│ │
│ │└────────────┴───────────────────────────────────────────────────────────────┘ │
├────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│SeRestorePrivilege │┌────────────┬────────────────────────────────────────────────────────────────────────────────┐│
│ ││S-1-5-32-549│Server Operators ││
│ │├────────────┼────────────────────────────────────────────────────────────────────────────────┤│
│ ││S-1-5-32-551│BUILTIN\Backup Operators ││
│ │├────────────┼────────────────────────────────────────────────────────────────────────────────┤│
│ ││Description │This privilege causes the system to grant all write access control to any file. ││
│ │└────────────┴────────────────────────────────────────────────────────────────────────────────┘│ └────────────────────┴───────────────────────────────────────────────────────────────────────────────────────────────┘
Registry Values
~~~~~~~~~~~~~~~
┌────────────────────────────────────────────────────────────┬─────┐
│Key │Value│
├────────────────────────────────────────────────────────────┼─────┤
│MACHINE\System\CurrentControlSet\Services\Netlogon\Parameter│1 │
│s\RequireSignOrSeal │ │
├────────────────────────────────────────────────────────────┼─────┤
│MACHINE\System\CurrentControlSet\Services\LanManServer\Param│1 │
│eters\RequireSecuritySignature │ │
└────────────────────────────────────────────────────────────┴─────┘
Grouper2 took 0:0:2:525 to run.
COMMANDO Sat 04/13/2019 5:46:54.49
Client Health Check KMS
The current field checked seems to be a lazy property and does not get updated. Query below will check for all the various KMS fields that should be being used.
select SYS.ResourceId, SYS.ResourceType, SYS.Name, SYS.SMSUniqueIdentifier, SYS.ResourceDomainORWorkgroup, SYS.Client, SMS_G_System_SOFTWARE_LICENSING_PRODUCT.IsKeyManagementServiceMachine, SMS_G_System_SOFTWARE_LICENSING_PRODUCT.DiscoveredKeyManagementServiceMachineName, SMS_G_System_SOFTWARE_LICENSING_PRODUCT.KeyManagementServiceLookupDomain, SMS_G_System_SOFTWARE_LICENSING_PRODUCT.KeyManagementServiceMachine, SMS_G_System_SOFTWARE_LICENSING_PRODUCT.IsKeyManagementServiceMachine from SMS_R_System as SYS left join SMS_G_System_SOFTWARE_LICENSING_PRODUCT on SMS_G_System_SOFTWARE_LICENSING_PRODUCT.ResourceID = SYS.ResourceId where SMS_G_System_SOFTWARE_LICENSING_PRODUCT.PartialProductKey is not null and not (SMS_G_System_SOFTWARE_LICENSING_PRODUCT.DiscoveredKeyManagementServiceMachineName is not null or SMS_G_System_SOFTWARE_LICENSING_PRODUCT.KeyManagementServiceLookupDomain is not null or SMS_G_System_SOFTWARE_LICENSING_PRODUCT.KeyManagementServiceMachine is not null or SMS_G_System_SOFTWARE_LICENSING_PRODUCT.IsKeyManagementServiceMachine = 1)
Add validation and health checks before import is run
Check to see if driver is in database, but source path is missing.
Check to see if driver source path is outside of listed source path.
Check to see if driver package is outside of listed source path.
Check driver source path length (too long).
ConfigMgr/Scripts/Service_WIM/Service_WIM.ps1
I do not believe this script will work with Windows 11? It will not export a single wim using the /Imagename. I changed the code at line 63-66 so it uses the Index of the wim when exporting (line 82).
63 if (!($WinVersion -in (Get-WindowsImage -ImagePath $SourceImage).ImageName)) {
64 Write-Warning "No such image $WinVersion found in $SourceImage"
65 Exit
66 }else {
67 #Get Image Index
68 $ImageIndex = (Get-WindowsImage -ImagePath $SourceImage -Name $WinVersion).ImageIndex
69 Write-Debug "Image Index $ImageIndex has been found in $SourceImage"
70 }
82 $dism_wait = Start-Process $dism -PassThru -ArgumentList "/export-image /SourceImageFile:"$SourceImage" /SourceIndex:"$ImageIndex" /DestinationImageFile:"$SourceDirectory\install-temp.wim""
Remove OSDFrontEnd reference from modular TS
Just a quick change, please remove the reference to OSDFrontEnd as it cannot run during a TS, it must be run as a prestart command.
Service_WIM.ps1 minor spelling update
While minor, I noticed the lines:
#Command line usage examples:
# Remove Indexes, add update, optimize .wim
# Shrink_WIM.ps1 -SourceImage "c:\install.wim" -MountDir "C:\wim" -DestinationImage "c:\install-new.wim" -WinVersion "Windows 10 Enterprise" -UpdatePath "c:\windows10.0-kb4103721-x64.msu"
# Remove Indexes only
# Shrink_WIM.ps1 -IndexOnly -SourceImage "c:\install.wim" -WinVersion "Windows 10 Enterprise"
Shrink_WIM should be changed to Service_WIM for clarity sake.
SCCM Server Role DCM
SUP role needs to add WID or SQL connectivity (cannot have both). Also needs WSUS Services.
OSD - Modular TS - bios2Uefi Convert disk to GPT won't work when started from WinPe
OSD - Modular TS - bios2Uefi Convert disk to GPT won't work when started from WinPe
as it is the disk is formatted during the first steps of the TS when started from WinPe, thus the mbr2gpt.exe conversion tool won't work and the step will fail
https://docs.microsoft.com/en-us/windows/deployment/mbr-to-gpt
Disk Prerequisites (...)
There are at most 3 primary partitions in the MBR partition table
One of the partitions is set as active and is the system partition
The disk does not have any extended/logical partition
The BCD store on the system partition contains a default OS entry pointing to an OS partition
you can add logic for when the TS_type_new is true you format the disk to prepare for conversion with
TSUEFIDrive variable, reboot and then format again for GPT
Prereq checks
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\State has UEFISecureBootEnabled = 1 in WinPE
Apparently there's also HKLM\System\CurrentControlSet\Control PEFirmwareType but you have to run wpeutil UpdateBootInfo to populate it and that fails in PE for me.
Script to get number of days machine is online
$OBJ_OperatingSystem = Get-WmiObject -Class Win32_OperatingSystem
$BootTime = [System.Management.ManagementDateTimeConverter]::ToDateTime($OBJ_OperatingSystem.LastBootUpTime)
$LocalTime = [System.Management.ManagementDateTimeConverter]::ToDateTime($OBJ_OperatingSystem.LocalDateTime)
$TimeSpan = New-TimeSpan -Start $Boot -End $Local
Write-Output $TimeSpan.Days
ZTIGather.wsf sometimes fails to set IsVM properly
The current ZTIGather script in Task Sequences\Modular OSD\ModularOSD_Files\OSD Configuration\Scripts is 6.3.8443.1000. The issue is resolved in the latest version of the MDT script, 6.3.8456.1000. File attached.
New-CMMaintenanceWindow.ps1
Line: 190 Function 'New-CMMaintenanceWindow' has verb that could change system state. Therefore, the function has to support 'ShouldProcess'.
Line: 165 The cmdlet 'Convert-NormalDateToConfigMgrDate' returns an object of type 'System.String' but this type is not declared in the OutputType attribute.
Line: 168 The cmdlet 'create-ScheduleToken' uses an unapproved verb.
Line: 203 File 'New-CMMaintenanceWindow.ps1' uses WMI cmdlet. For PowerShell 3.0 and above, use CIM cmdlet which perform the same tasks as the WMI cmdlets. The CIM cmdlets comply with WS-Management (WSMan) standards and with the Common Information Model (CIM) standard, which enables the cmdlets to use the same techniques to manage Windows computers and those running other operating systems.
Line: 209 The variable 'disposable' is assigned but never used.
https://dille.name/blog/2017/08/27/how-to-use-shouldprocess-in-powershell-functions/
Calling @TeslaSysA since this is your terrible workaround. 🤔
Client Health Drive Space CI
$Volumes = Get-Volume | Where-Object {$_.DriveType -eq "Fixed" -and $env:SystemDrive -like ($_.DriveLetter+"*") -and $_.DriveLetter}
Reporting on Client Health Collections
Need to build a PowerBI report for this
OSD - Modular OSD step report done
in TS \OSD - Modular OSD step "\report done" should point to cscript "%deployroot%\scripts\MDT\ztidone.wsf"
ZTIdone.wsf is missing
Script out some PoSh creating a DIAD structure
SCCM CIs
djc [4:26 PM]
@Ebag333 found a typo in one of your ci items - Windows Features: BITS - the discovery script for BITSExtensions-AdminPack should be State not Stat
Reporting on Security Health Collections
Need to build a PowerBI report for this
IIS logging change
Add DCM to set IIS logging to not be 7000 bajillion gigawatts.
Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.applicationHost/sites/site[@name='Default Web Site']/logFile" -name "truncateSize" -value 5242880
Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.applicationHost/sites/site[@name='Default Web Site']/logFile" -name "period" -value MaxSize
CI's for Health Collection remediation
OSD - Modular TS Logs file upon failure doesn't contain computername
from what I saw upon failure the script creating the zipped log file doesn't add the computername
fix is to modify CopyOSDLogs.ps1
$ComputerNameVariable = "OSDComputerName"
To
$ComputerNameVariable = "_SMSTSMachineName"
https://gallery.technet.microsoft.com/Script-to-Zip-and-copy-c37c4c8e/view/Discussions#content
Written March 09, 2017
Johan Schrewelius
“OSDComputerName” is a commonly (MDT for example) used variable name to hold the machine name in a managed scenario. However so, it’s not built-in nor stipulated in any fashion, hence the possibility to change variable in the config section.
Best solution (keeps script intact) would probably have been to change
$ComputerNameVariable = "OSDComputerName"
To
$ComputerNameVariable = "_SMSTSMachineName"
I will probably update the script so it falls back to the built-in variable in case the configured is missing or empty.
$package can disappear (driver import)
If you mess with the source paths, the $package variable will vanish after the first driver import. You will receive the message:
downloaded content specified in package source directory is in wrong location
We need a check if this happens, then bail out with a warning.
Add health check for active directory system object password reset
HealthCollections.MOF
HealthCollections.MOF has misspelled Health in Client Health: Boot Time
Current unattend.xml leaves devices in an unsupported state
SkipMachineOOBE is no longer supported by microsoft, PR #45 resolves this with a work around to silence Cortana and leave the devices supported.
@LtBehr gets the credit here...I am just opening the issue
Health check
Add health checks for EFI and WinRE sizes
New OS TS Unattend
In the New OS TS, the unattend file is populated as unattend.ini rather than unattend.xml, causing the Applying OS sequence to fail.
OSD Modular TS In Place update Copy CMTrace error
during an in place upgrade the step Copy CMTrace to staging (xcopy x:\sms\bin\x64\CMTrace.exe %_SMSTSMDataPath% won't happen as there is no x:\ at this point.
then the following Copy CMTrace to Windows System32 will error out as there is not cmtrace in %__SMSTSMDataPath% .
This is in the main OSD - Modular OSD.
Implement this
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.