Mick's IT Blogs

Building Out My SafeSend API and Webhook Repository

2026-03-05T01:53:00.001-06:00

Over the past few days, I have been building out a new GitHub repository focused on interacting with the SafeSend developer platform. The goal of this project is to document and implement the API functionality described in the SafeSend developer documentation while also laying the groundwork for webhook integrations.

The repository is available here:

https://github.com/mickpletcher/SafeSend

This project started as a way to turn the SafeSend developer site into something more practical. I rarely like to stop at reading documentation alone. I prefer to build working examples that show how APIs actually behave in real scenarios. In my experience, turning documentation into executable code is one of the fastest ways to truly understand a platform.

What the repository currently contains

At this stage, the repository is a structured proof of concept focused on several core components:

Initial API integration framework
Authentication handling and environment configuration
Example requests for interacting with SafeSend endpoints
Documentation and notes based on the SafeSend developer site
Early groundwork for webhook processing

The intent is for this repository to serve as both a learning reference and a starting point for real automation workflows built around SafeSend.

Anyone who works with modern APIs knows that documentation rarely tells the full story. Implementing against live endpoints often exposes edge cases, required headers, authentication nuances, and response structures that are not immediately obvious when reading the docs alone.

Webhook integration work in progress

One of the most interesting parts of the SafeSend platform is its webhook capability. Webhooks allow external systems to receive event driven notifications whenever something happens inside SafeSend. Instead of repeatedly polling an API, the platform can push updates directly to an endpoint you control.

That makes automation far more efficient.

That said, the webhook implementation in this repository has not yet been tested end to end. The scaffolding and framework are in place, but I have not yet completed full validation of webhook events in a live workflow.

Once that portion is fully wired up and tested, it should support automated processing for events such as document status changes and workflow updates.

Why I built this repository

I tend to approach new developer platforms the same way every time. Rather than passively reading documentation, I build a working implementation that forces direct interaction with the system.

That process usually reveals things like:

Authentication quirks
Required headers that are easy to miss
Rate limits and error responses
Data formats that behave differently than expected

By building a repository like this, I end up with a reusable reference that can be expanded over time and used in future automation projects.

Current status

This project is still under active development. The API examples are functional, but more endpoints will be added as I continue exploring the SafeSend developer platform.

The webhook component is structurally in place, but it has not yet been tested or validated. Once that testing is complete, I plan to update the repository with working examples and documentation that show how to handle incoming webhook payloads.

What comes next

Over the next phase of development, I plan to:

Expand the API examples to cover additional SafeSend endpoints
Complete and test the webhook listener implementation
Add more structured documentation inside the repository
Build automation scenarios that demonstrate real use cases

The long term goal is to turn this repository into a practical reference for developers who want to integrate with SafeSend and automate workflows using its API and event system.

If you want to follow the project, you can check out the repository here:

https://github.com/mickpletcher/SafeSend

More updates will be coming soon as the webhook testing is completed and additional API integrations are added.

HomeKit Stops working with Meross, Kasa and other IoT devices

2024-05-28T12:00:00.001-05:00

HomeKit Broke After iOS 17.3? Here’s How I Fixed Meross & Kasa

Symptoms: Devices show “No Response,” automations fail, and hubs appear fine.

I run HomeKit across Meross, Kasa, and others. After updating to iOS 17.3, multiple devices went dark. Firmware updates and re-pairing didn’t help. The root cause was my TP-Link Deco mesh blocking device-to-hub traffic.

What Didn’t Fix It

Updating device firmware (Meross, Kasa, etc.)
Re-adding devices to HomeKit
Rebooting hubs and access points
Waiting for “the next update”

Diagnosis
Wireshark showed devices attempting to reach my Apple TV (HomeKit hub) but packets were blocked. That tells you it’s a network policy problem, not a HomeKit or device firmware problem.

Fix (TP-Link Deco) — Step by Step

Put devices on the same SSID
Keep HomeKit devices on one SSID (the main network). A separate isolated “IoT” SSID can block hub discovery.

Deco → Wi-Fi → Ensure affected devices use the main SSID.
Force 2.4 GHz for devices that require it
Many plugs/switches are 2.4-only. In Deco, explicitly assign them to 2.4 GHz so they don’t roam incorrectly.

Deco → Device details → Network Preference → 2.4 GHz.
Disable Device Isolation Key step
This allows devices to reach your Apple TV/HomePod hub for HomeKit. After turning this off, everything came back immediately.
- Kasa and Mysa needed isolation off
- Meross worked with isolation on, but I recommend off for consistency
Deco → Wi-Fi or IoT Network → Advanced → disable Device Isolation.

Note on the hub
Your Apple TV/HomePod can be on 5 GHz or 2.4 GHz. Once Device Isolation is off and all devices share the same SSID, the hub will communicate with 2.4-only devices without issues.

TL;DR

Symptom	Devices “No Response” after iOS 17.3
Cause	Router policy (Deco) blocked device-to-hub traffic
Fix	Same SSID + force 2.4 GHz for 2.4-only devices + disable Device Isolation

Troubleshooting Checklist

Devices and hub on the same SSID
2.4-only devices forced to 2.4 GHz
Device Isolation disabled on the SSID they use
Power-cycle the affected devices and the hub
Re-test discovery; if still failing, check packets (mDNS, TCP) between device and hub

Brands in my tests: Meross (OK with isolation on), Kasa (needs isolation off), Mysa (needs isolation off). Your mileage may vary, but the network policy was the blocker.

Trigger Windows Update in ConfigMgr without PowerShell

2023-04-07T10:05:00.001-05:00

I've been meaning to share this blog post for some time now, and finally got around to it. If you need to trigger a Windows update without using PowerShell, there is a way to do it. In newer versions of Windows 10, usoclient.exe is used to initiate an update scan. However, most of its parameters no longer work except for startinteractivescan. The issue I faced was that it had to be executed as the system account or as the end user in ConfigMgr. Although ConfigMgr runs installations with the system account, it did not work with usoclient.exe. The solution was to use psexec.exe with the -s parameter to trigger it. I ran it as a task sequence, but you can also execute it under a package. I had already pushed psexec.exe to all systems in my environment, but you may need to include it in the package and run it from there. Don't forget to use the -accepteula parameter; otherwise, it will hang if it has never been executed on a machine before.

If you observe the Check for Updates window while executing the package in Software Center, you can see it initiate the update scan, as demonstrated below.

Imaging using MDT with Autopilot

2022-09-06T13:32:00.003-05:00

If you have a system that has been infected or the drive had to be replaced, you'll need to lay down a new bare OS and then have autopilot finish up the configuration of the machine. For this, we are using MDT as it is easy to maintain and very fast at imaging.

I used this as a template to come up with the solution we are now using. The first thing I did was to use everything verbatim from the section of the blog named "How to get the Windows Autopilot payload". It is the next section How to customize the MDT Task Sequence for Autopilot that I diverged from. I could not get that section to work. The main problem was the task sequence. The blog says to use a custom task sequence when in reality, you must use a Standard Client Task Sequence.

The first thing I did was to disable Postinstall and State Restore groups as we will not be joining a domain and the task sequence needs to stop in Postinstall mode. The next thing was to create a new Postinstall group as shown below.

The next thing was to create the CustomSettings_Autopilot.ini as described in the referring blog. The Gather uses the CustomSettings_Autopilot.ini file as described in the blog.

The Apply Autopilot Profile also uses what is described in the other blog.

xcopy %SCRIPTROOT%\AutopilotConfigurationFile.json %OSDisk%\Windows\provisioning\AutoPilot\ /c

The next stip is to delete the unattend.xml file as shown below:

The next task places a file named autopilot.txt in the root directory of the c: drive. This is a flag to run the Intune package that will delete all MDT associated files and registry keys to terminate the MDT build.

The next task will delete most of the MDT files on the system.

Finally, the Restart task reboots the system at which point it will come up to the Autopilot user signon page.

As far as the SetupCompleteAutopilot.cmd file, here is what I have inside it. I changed some of the script to use environmental variables and I added the deletion of the c:\autopilot.txt file and the creation of the same file under c:\windows\temp to signify the script executed and the system has been cleaned up so the Intune package registers the execution as a success.

@echo off

:: // ***************************************************************************

:: //

:: // File: SetupComplete.cmd

:: //

:: // Version: 1.0

:: //

:: // Purpose: Cleanup after MDT Autopilot deployment

:: //

:: // ***************************************************************************

:: Copy to windows setup folder for application verification purposes in Intune

copy /V /Y \\prodfs01\All\ProdApps\Waller\SetupComplete\SetupCompleteAutopilot.cmd %WINDIR%\Setup\SetupCompleteAutopilot.cmd

:: Workaround for incorrectly-registered TS environment

reg delete HKCR\Microsoft.SMS.TSEnvironment /f > nul 2>&1

rmdir /Q /S %OSDisk%\MININT

rmdir /Q /S %OSDisk%\_SMSTaskSequence

del /Q %OSDisk%\LTIBootstrap.vbs

del /Q %OSDisk%\autopilot.txt

echo Test > %WINDIR%\Temp\autopilot.txt

In Intune, I created the app called MDT Cleanup. Here is the program page. I used a dummy delete.cmd file as that part is not needed.

That is all that is to the Intune package. Now the system will build a bare-bones OS and then transfer the rest of the build process to Intune.

Find Programs and Features Uninstall Registry Keys with PowerShell

2022-08-03T12:41:00.002-05:00

I am working on a new package to upgrade one of the applications. This time, it requires I uninstall the old app first before installing the new version. There are two different versions, so I needed to retrieve the uninstall strings for both. That is when I decided to write this script that will scan the registry for the application and list the key values as shown below. It scans both the x86 and x64 Uninstall registry entries. The script was also written to be able to scan for wildcard values if there is more than one entry you are looking for.

You can download the script from my GitHub.

 <#  
      .SYNOPSIS  
           Uninstall Finder  
        
      .DESCRIPTION  
           This script will retrieve the x86 and x64 uninstall registry key(s) for a specific applicaton. This is very helpful for Configuration Manager admins when needing to create packages, especially uninstall packages.  
        
      .PARAMETER ApplicationName  
           Name of the application as it appears in Add/Remove Programs  
        
      .PARAMETER Like  
           Select this if using a partial name or wanting multiple listings to appear  
        
      .NOTES  
           ===========================================================================  
           Created with:     SAPIEN Technologies, Inc., PowerShell Studio 2022 v5.8.209  
           Created on:       8/3/2022 11:44 AM  
           Created by:       Mick Pletcher  
           Filename:         FindRegistryUninstall.ps1  
           ===========================================================================  
 #>  
 [CmdletBinding()]  
 param  
 (  
      [ValidateNotNullOrEmpty()]  
      [string]$ApplicationName,  
      [switch]$Like  
 )  
   
 If ($Like.IsPresent) {  
      Get-ChildItem -Path REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall | Get-ItemProperty | Where-Object { $_.DisplayName -like ('*' + $ApplicationName + '*') }  
 } else {  
      Get-ChildItem -Path REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall | Get-ItemProperty | Where-Object { $_.DisplayName -eq $ApplicationName }  
 }

Configuring Wake-On-LAN for Dell Systems

2022-08-02T14:10:00.004-05:00

The firm I am at has recently upgraded all systems to the newest model Dells. In doing so, some of the settings for configuring WOL have changed in the BIOS. I have rewritten this script to cover all changes to the OS, BIOS, and NIC. The script uses the DellSMBios PowerShell module to configure the BIOS settings. Thanks to these sites for pertinent information that helped with writing this tool:

And yes, I do realize I could have consolidated some of the code into a function that would have worked repetitively against each setting.

The things that must be done to get this to work are:

BIOS: Disable CStatesCtrl
BIOS: Enable Wake-On-LAN either LanWlan or LanOnly
BIOS: Disable DeepSleepCtrl
BIOS: Disable BlockS3
NIC: Disable Energy Efficient Ethernet
NIC: Turn on Wake on Magic Packet
OS: Turn off Hibernation
OS: Enable Allow the computer to turn off this device is configured

This is a screenshot of the script after it successfully ran against a Dell 7090 machine.

Here is the script that I wrote and works in our environment on Dell Optiplexes and Latitudes.

You can download it from my GitHub site.

 <#  
      .SYNOPSIS  
           Wake-On-LAN  
        
      .DESCRIPTION  
           A description of the file.  
        
      .PARAMETER ConsoleTitle  
           Title for PowerShell console  
        
      .PARAMETER BIOSPassword  
           A description of the BIOSPassword parameter.  
        
      .NOTES  
           ===========================================================================  
           Created with:      SAPIEN Technologies, Inc., PowerShell Studio 2022 v5.8.209  
           Created on:       8/1/2022 8:16 AM  
           Created by:       Mick Pletcher  
           Filename:          WOL.ps1  
           ===========================================================================  
 #>  
 param  
 (  
      [ValidateNotNullOrEmpty()]  
      [string]$ConsoleTitle,  
      [string]$BIOSPassword  
 )  
   
 function Set-BIOS {  
 <#  
      .SYNOPSIS  
           Configure WOL in BIOS  
        
      .DESCRIPTION  
           Configure WOL in BIOS  
        
 #>  
        
      [CmdletBinding()]  
      param ()  
        
      #Import Dell BIOS Provider PowerShell Module  
      Try {  
           Import-Module -Name DellBIOSProvider  
      }  
      catch {  
           Find-Module -Name DellBIOSProvider | Install-Module -Force  
           Import-Module -Name DellBIOSProvider  
      }  
      #Set Wake-On-LAN to LanOnly  
      $BIOSItem = "PowerManagement\WakeOnLan"  
      $NewValue = "LanWlan"  
      #Check if LanWlan is available  
      If ($NewValue -notin ("DellSmBios:\" + $BIOSItem).PossibleValues) {  
           $NewValue = "LanOnly"  
      }  
      If (Get-Item -Path ("DellSmBios:\" + $BIOSItem) -ErrorAction SilentlyContinue) {  
           Write-Host ("BIOS" + [char]32 + $BIOSItem.split('\')[1] + ":" + [char]32) -NoNewline  
           If ((Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -ne $NewValue) {  
                If ($BIOSPassword) {  
                     Set-Item -Path ("DellSmBios:\" + $BIOSItem) -Value $NewValue -Force -Password $BIOSPassword  
                } else {  
                     Set-Item -Path ("DellSmBios:\" + $BIOSItem) -Value $NewValue -Force  
                }  
                If ((Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -eq $NewValue) {  
                     Write-Host $NewValue -ForegroundColor Yellow  
                }  
                else {  
                     Write-Host (Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -ForegroundColor Red  
                }  
           }  
           else {  
                Write-Host $NewValue -ForegroundColor Yellow  
           }  
      }  
        
      #Disable CState Control  
      $BIOSItem = "Performance\CStatesCtrl"  
      $NewValue = "Disabled"  
      #Test if CState exists  
      If (Get-Item -Path ("DellSmBios:\" + $BIOSItem) -ErrorAction SilentlyContinue) {  
           Write-Host ("BIOS" + [char]32 + $BIOSItem.split('\')[1] + ":" + [char]32) -NoNewline  
           If ((Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -ne $NewValue) {  
                If ($BIOSPassword) {  
                     Set-Item -Path ("DellSmBios:\" + $BIOSItem) -Value $NewValue -Force -Password $BIOSPassword  
                }  
                else {  
                     Set-Item -Path ("DellSmBios:\" + $BIOSItem) -Value $NewValue -Force  
                }  
                If ((Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -eq $NewValue) {  
                     Write-Host $NewValue -ForegroundColor Yellow  
                }  
                else {  
                     Write-Host (Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -ForegroundColor Red  
                }  
           }  
           else {  
                Write-Host $NewValue -ForegroundColor Yellow  
           }  
      }  
        
      #Disable Deep Sleep  
      $BIOSItem = "PowerManagement\DeepSleepCtrl"  
      $NewValue = "Disabled"  
      #Test if Deep Sleep exists  
      If (Get-Item -Path ("DellSmBios:\" + $BIOSItem) -ErrorAction SilentlyContinue) {  
           Write-Host ("BIOS" + [char]32 + $BIOSItem.split('\')[1] + ":" + [char]32) -NoNewline  
           If ((Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -ne $NewValue) {  
                If ($BIOSPassword) {  
                     Set-Item -Path ("DellSmBios:\" + $BIOSItem) -Value $NewValue -Force -Password $BIOSPassword  
                }  
                else {  
                     Set-Item -Path ("DellSmBios:\" + $BIOSItem) -Value $NewValue -Force  
                }  
                If ((Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -eq $NewValue) {  
                     Write-Host $NewValue -ForegroundColor Yellow  
                }  
                else {  
                     Write-Host (Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -ForegroundColor Red  
                }  
           }  
           else {  
                Write-Host $NewValue -ForegroundColor Yellow  
           }  
      }  
        
      #Disable Block S3  
      $BIOSItem = "PowerManagement\BlockS3"  
      $NewValue = "Disabled"  
      #Test if Block S3 exists  
      If (Get-Item -Path ("DellSmBios:\" + $BIOSItem) -ErrorAction SilentlyContinue) {  
           Write-Host ("BIOS" + [char]32 + $BIOSItem.split('\')[1] + ":" + [char]32) -NoNewline  
           If ((Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -ne $NewValue) {  
                If ($BIOSPassword) {  
                     Set-Item -Path ("DellSmBios:\" + $BIOSItem) -Value $NewValue -Force -Password $BIOSPassword  
                }  
                else {  
                     Set-Item -Path ("DellSmBios:\" + $BIOSItem) -Value $NewValue -Force  
                }  
                If ((Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -eq $NewValue) {  
                     Write-Host $NewValue -ForegroundColor Yellow  
                }  
                else {  
                     Write-Host (Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -ForegroundColor Red  
                }  
           }  
           else {  
                Write-Host $NewValue -ForegroundColor Yellow  
           }  
      }  
        
      #Disable C States  
      $BIOSItem = "PowerManagement\CStatesCtrl"  
      $NewValue = "Disabled"  
      #Test if CStatesCtrl exists  
      If (Get-Item -Path ("DellSmBios:\" + $BIOSItem) -ErrorAction SilentlyContinue) {  
           Write-Host ("BIOS" + [char]32 + $BIOSItem.split('\')[1] + ":" + [char]32) -NoNewline  
           If ((Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -ne $NewValue) {  
                If ($BIOSPassword) {  
                     Set-Item -Path ("DellSmBios:\" + $BIOSItem) -Value $NewValue -Force -Password $BIOSPassword  
                }  
                else {  
                     Set-Item -Path ("DellSmBios:\" + $BIOSItem) -Value $NewValue -Force  
                }  
                If ((Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -eq $NewValue) {  
                     Write-Host $NewValue -ForegroundColor Yellow  
                }  
                else {  
                     Write-Host (Get-Item -Path ("DellSmBios:\" + $BIOSItem)).CurrentValue -ForegroundColor Red  
                }  
           }  
           else {  
                Write-Host $NewValue -ForegroundColor Yellow  
           }  
      }  
 }  
   
 Function Set-AdvancedNIC {  
        #Get the Ethernet NIC  
      $NIC = Get-NetAdapter | Where-Object {($_.PhysicalMediaType -eq '802.3') -and ($_.Status -eq 'Up')}  
        #Disable Energy Efficient Ethernet setting so NIC does not go to sleep  
   #Two variants of Energy Efficient Exist on different Dell models  
      #Check if Energy-Efficient Ethernet Exists  
      If (Get-NetAdapterAdvancedProperty -Name $NIC.Name -DisplayName 'Energy-Efficient Ethernet' -ErrorAction SilentlyContinue) {  
           Write-Host 'NIC Energy-Efficient Ethernet: ' -NoNewline  
           Set-NetAdapterAdvancedProperty -Name $NIC.Name -DisplayName 'Energy-Efficient Ethernet' -DisplayValue 'Disabled'  
           If ((Get-NetAdapterAdvancedProperty -Name $NIC.Name -DisplayName 'Energy-Efficient Ethernet').DisplayValue -eq 'Disabled') {  
                Write-Host 'Disabled' -ForegroundColor Yellow  
           }  
           else {  
                Write-Host 'Enabled' -ForegroundColor Red  
           }  
      }  
      #Check if Energy Efficient Ethernet Exists  
      If (Get-NetAdapterAdvancedProperty -Name $NIC.Name -DisplayName 'Energy Efficient Ethernet' -ErrorAction SilentlyContinue) {  
           Write-Host 'NIC Energy Efficient Ethernet: ' -NoNewline  
           Set-NetAdapterAdvancedProperty -Name $NIC.Name -DisplayName 'Energy Efficient Ethernet' -DisplayValue 'Off'  
           If ((Get-NetAdapterAdvancedProperty -Name $NIC.Name -DisplayName 'Energy Efficient Ethernet').DisplayValue -eq 'Off') {  
                Write-Host 'Off' -ForegroundColor Yellow  
           }  
           else {  
                Write-Host 'On' -ForegroundColor Red  
           }  
      }  
      #Turn on Wake on Magic Packet  
        #Check if Wake on Magic Packet Exists  
      If (Get-NetAdapterAdvancedProperty -Name $NIC.Name -DisplayName 'Wake on Magic Packet' -ErrorAction SilentlyContinue) {  
           Write-Host 'NIC Wake on Magic Packet: ' -NoNewline  
           Set-NetAdapterAdvancedProperty -Name $NIC.Name -DisplayName 'Wake on Magic Packet' -RegistryKeyword '*WakeOnMagicPacket' -RegistryValue 1  
           If ((Get-NetAdapterAdvancedProperty -Name $NIC.Name -DisplayName 'Wake on Magic Packet').DisplayValue -eq 'Enabled') {  
                Write-Host 'Enabled' -ForegroundColor Yellow  
           }  
           else {  
                Write-Host 'Disabled' -ForegroundColor Red  
           }  
      }  
      #Shutdown WakeOnLAN  
      If (Get-NetAdapterAdvancedProperty -Name $NIC.Name -DisplayName 'Shutdown Wake-On-Lan' -ErrorAction SilentlyContinue) {  
           Write-Host 'NIC Shutdown Wake-On-Lan: ' -NoNewline  
           Set-NetAdapterAdvancedProperty -Name $NIC.Name -DisplayName 'Shutdown Wake-On-Lan' -DisplayValue 'Enabled'  
           If ((Get-NetAdapterAdvancedProperty -Name $NIC.Name -DisplayName 'Shutdown Wake-On-Lan').DisplayValue -eq 'Enabled') {  
                Write-Host 'Enabled' -ForegroundColor Yellow  
           }  
           else {  
                Write-Host 'Disabled' -ForegroundColor Red  
           }  
      }  
 }  
   
 function Set-PowerManagement {  
 <#  
      .SYNOPSIS  
           Enable Power Management  
        
      .DESCRIPTION  
           A detailed description of the Set-PowerManagement function.  
        
      .EXAMPLE  
                     PS C:\> Set-PowerManagement  
        
      .NOTES  
           Additional information about the function.  
 #>  
        
      [CmdletBinding()]  
      param ()  
        
      #Turn off Hibernation  
   Write-Host ("OS Hiberboot:" + [char]32) -NoNewline  
   If ((Get-ItemProperty -Path REGISTRY::"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power").HiberbootEnabled -ne 0) {  
     Set-ItemProperty -Path REGISTRY::"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power" -Name HiberbootEnabled -Value 0 -Force  
   }  
   If ((Get-ItemProperty -Path REGISTRY::"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power").HiberbootEnabled -eq 0) {  
     Write-Host "Disabled" -ForegroundColor Yellow  
   } else {  
     Write-Host "Enabled" -ForegroundColor Red  
   }  
   
      #0 = Option 1 & 2 checked  
   #10 = Option 1 checked, 2 & 3 cleared  
   #24 = Option 1 unchecked  
   #256 = Option 1, 2, & 3 all checked  
   #264 = Option 2 & 3 Checked  
   #272 = Option 1 checked  
   #280 = Option 2 & 3 checked  
   $PNPValue = 256  
      $Adapter = Get-NetAdapter | Where-Object { ($_.Status -eq 'Up') -and ($_.PhysicalMediaType -eq '802.3') }  
      $KeyPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\'  
      foreach ($Entry in (Get-ChildItem $KeyPath -ErrorAction SilentlyContinue).Name) {  
           If ((Get-ItemProperty REGISTRY::$Entry).DriverDesc -eq $Adapter.InterfaceDescription) {   
                $Value = (Get-ItemProperty REGISTRY::$Entry).PnPCapabilities  
                If ($Value -ne $PnPValue) {  
                     Set-ItemProperty -Path REGISTRY::$Entry -Name PnPCapabilities -Value $PnPValue -Force  
                     Disable-PnpDevice -InstanceId $Adapter.PnPDeviceID -Confirm:$false  
                     Enable-PnpDevice -InstanceId $Adapter.PnPDeviceID -Confirm:$false  
                     $Value = (Get-ItemProperty REGISTRY::$Entry).PnPCapabilities }  
                If ($Value -eq $PnPValue) {  
                     Write-Host 'Allow the computer to turn off this device is configured' -ForegroundColor Yellow  
                } else {   
                     Write-Host 'Allow the computer to turn off this device Failed' -ForegroundColor Red  
                     Exit 1  
                }  
           }  
      }  
 }  
   
   
 #Set Console Title  
 $host.ui.RawUI.WindowTitle = $ConsoleTitle  
 Set-BIOS  
 Set-AdvancedNIC  
 Set-PowerManagement

MECM System Cleanup

2022-07-28T13:50:00.001-05:00

Recently, we started a cleanup of AD. Once the cleanup was completed, I wanted ConfigMgr cleaned up right away too. It is set to clean up old items, but it was not quick enough for me so I wrote the following tool that will query the All Systems collection via SQL and then reads the attributes in AD to see if the system is disabled. It will delete each disabled system from ConfigMgr at the end. Below is an example of it displaying a list of machines, to clean up, the count, and where it is deleting them.

Before executing this script in your environment, I highly recommend commenting out the Remove-CMDevice cmdlet and verifying it is deleting the correct systems from ConfigMgr.

You can download the script from my GitHub site.

 <#  
      .SYNOPSIS  
           ConfigMgr Cleanup  
        
      .DESCRIPTION  
           This script will compare the All Systems list in ConfigMgr to systems in AD and delete systems from ConfigMgr that are disabled in AD. It will also report a list of systems that are greater than 30 days old since the last activity in AD.  
        
      .PARAMETER SQLServer  
           ConfigMgr SQL Server
        
      .PARAMETER SQLDatabase  
           Name of the ConfigMgr SQL Database
        
      .PARAMETER PSHCfgMgrModule  
           Path to ConfigurationManager.psd1 module  
        
      .PARAMETER Sitecode  
           Three character ConfigMgr site code  
        
      .PARAMETER SiteServer  
           FQDN of the Configuration Manager server  
        
      .PARAMETER DeleteSystems  
           Select to automatically delete systems from Configuration Manager  
        
      .NOTES  
           ===========================================================================  
           Created with:     SAPIEN Technologies, Inc., PowerShell Studio 2022 v5.8.208  
           Created on:       7/26/2022 8:00 AM  
           Created by:       Mick Pletcher  
           Filename:         MECMADCleanup.ps1  
           ===========================================================================  
 #>  
 [CmdletBinding()]  
 param  
 (  
      [ValidateNotNullOrEmpty()]  
      [string]$SQLServer,  
      [ValidateNotNullOrEmpty()]  
      [string]$SQLDatabase,  
      [string]$PSHCfgMgrModule,  
      [string]$SiteCode,  
      [string]$SiteServer,  
      [switch]$DeleteSystems  
 )  
   
 function Get-PSHModule {  
 <#  
      .SYNOPSIS  
           Import Module  
        
      .DESCRIPTION  
           Import specified module  
        
      .PARAMETER Module  
           Name of PowerShell Module  
        
      .PARAMETER NoInstall  
           Import only. Typically used for modules that are not in the PowerShell Gallery  
        
      .NOTES  
           Additional information about the function.  
 #>  
        
      [CmdletBinding()]  
      param  
      (  
           [ValidateNotNullOrEmpty()]  
           [string]$Module,  
           [switch]$NoInstall  
      )  
      If ($NoInstall.IsPresent) {  
           Import-Module -Name $Module  
      }  
      else {  
           Try {  
                Import-Module -Name $Module  
           }  
           Catch {  
                Find-Module -Name $Module | Install-Module -Force  
                Import-Module -Name $Module  
           }  
      }  
 }  
   
 #Import SQL Server PowerShell Module  
 Get-PSHModule -Module "SqlServer"  
 #Import AD PowerShell module  
 Get-PSHModule -Module "ActiveDirectory"  
 $Systems = @()  
 #Get All Systems list from ConfigMgr  
 $List = Invoke-Sqlcmd -ServerInstance $SQLServer -Database $SQLDatabase -Query "SELECT NAME FROM dbo._RES_COLL_SMS00001 ORDER BY Name"  
 foreach ($System in $List) {  
      #Filter out built-in accounts  
      If (($System.Name -notlike '*Unknown*') -and ($System.Name -notlike '*Provisioning*')) {  
           #Return a list of all systems either not in AD or that have been disabled  
           Try {  
                $AD = Get-ADComputer $System.Name  
                If ($AD.Enabled -eq $false) {  
                     $Systems += $AD.Name  
                }  
           } catch {  
                $Systems += $System.Name  
           }  
      }  
 }  
 #Display the systems to be deleted from ConfigMgr
 $Systems  
 $Systems.Count  
 If ($Systems.Count -ne 0) {  
      If ($DeleteSystems.IsPresent) {  
           #Import ConfigMgr Module  
           Get-PSHModule -Module $PSHCfgMgrModule -NoInstall  
           If ((Get-PSDrive -Name $SiteCode -PSProvider CMSite -ErrorAction SilentlyContinue) -eq $null) {  
                New-PSDrive -Name $SiteCode -PSProvider CMSite -Root $SiteServer  
           }  
           Set-Location "$($SiteCode):\"  
           $Systems | ForEach-Object {  
                Write-Host ('Deleting ' + $_ + '.....') -NoNewline  
                Remove-CMDevice -Name $_ -Force  
                If ((Get-CMDevice -Name $_) -eq $null) {  
                     Write-Host 'Success' -ForegroundColor Yellow  
                } else {  
                     Write-Host 'Failed' -ForegroundColor Red  
                }  
           }  
      }  
 }

Configuration Manager PowerShell Module: An update to the existing console is available

2022-07-27T08:10:00.000-05:00

I was recently writing a new PowerShell tool to clean up Configuration Manager of old systems. When I ran the import-module cmdlet, I got the message

The module was being imported from the Configuration Manager server. I always keep ConfigMgr up-to-date with the latest version within days of release and I saw the console was 5.2203.1063.2400. Doing a little digging, I found this was coming from the console that was installed on my laptop and not from the server. I also found that even if you import the PowerShell module from the server where it is the latest version, it will revert back to the machine you are working on to import from if the console is installed there. I upgraded the console on my laptop and this message disappeared.

Bitlocker Recovery Password AD Backup and Cleanup

2022-07-01T13:57:00.006-05:00

This PowerShell script not only backs up the Bitlocker recovery password to AD but also cleans out previous backups made that do not match the current password associated with the machine.

The script retrieves the local bitlocker password along with all recovery passwords written to AD. It will then parse through the associated passwords and remove all that does not match the one associated with the local machine. This greatly helps keep AD clean of old passwords. This script can be set up to automatically execute on a machine through Azure Automation, Orchestrator, Intune, or ConfigMgr. It will need to be executed using an account with credentials to both read the bitlocker recovery password on the local machine and modify the AD Objects. You can download the script from my GitHub repository.

NOTE: If you do not want the script to display the recovery password, you can comment out the write-host lines.

 <#       
      .NOTES  
      ===========================================================================  
       Created with:    SAPIEN Technologies, Inc., PowerShell Studio 2022 v5.8.208  
       Created on:      7/1/2022 11:08 AM  
       Created by:      Mick Pletcher  
       Filename:        BitlockerRecoveryPasswordADBackupCleanup.ps1  
      ===========================================================================  
      .DESCRIPTION  
           This script will delete active directory entries that contain the Bitlocker recovery keys which do not match to the current one. It will then push up the new key to AD.  
 #>  
   
 [CmdletBinding()]  
 param ()  
   
 Clear-Host  
 #Get the local bitlocker password  
 $LocalPassword = ((manage-bde -protectors -get ($env:ProgramFiles).split('\')[0] -id ((Get-WmiObject -Namespace 'Root\cimv2\Security\MicrosoftVolumeEncryption' -Class 'Win32_EncryptableVolume').GetKeyProtectors(3).volumeKeyprotectorID)).trim() | Where-Object { $_.Trim() -ne '' })[-1]  
 $BitlockerID = (((manage-bde -protectors -get ($env:ProgramFiles).split('\')[0] -id ((Get-WmiObject -Namespace 'Root\cimv2\Security\MicrosoftVolumeEncryption' -Class 'Win32_EncryptableVolume').GetKeyProtectors(3).volumeKeyprotectorID)).trim() | Where-Object { $_.Trim() -ne '' })[-3]).split(":")[1].trim()  
 #Get all bitlocker entries from active directory  
 $ADEntries = (Get-ADObject -Filter { objectclass -eq 'msFVE-RecoveryInformation' } -SearchBase (Get-ADComputer $env:COMPUTERNAME).DistinguishedName -Properties 'msFVE-RecoveryPassword')  
 #Number of recovery key entries stored in AD  
 $EntryCount = 0  
 #Parse through all active directory entries removing ones that do not contain local bitlocker password  
 foreach ($Item in $ADEntries) {  
      If ($LocalPassword -ne $Item.'msFVE-RecoveryPassword') {  
           Remove-ADObject -Identity $Item.DistinguishedName -Confirm:$false  
      }  
      else {  
           $EntryCount += 1  
           If ($EntryCount -gt 1) {  
                Remove-ADObject -Identity $Item.DistinguishedName -Confirm:$false  
           }  
      }  
 }  
 $ADEntries = (Get-ADObject -Filter { objectclass -eq 'msFVE-RecoveryInformation' } -SearchBase (Get-ADComputer $env:COMPUTERNAME).DistinguishedName -Properties 'msFVE-RecoveryPassword')  
 #Backup the bitlocker password to active directory if it is not in any AD entries  
 If ($LocalPassword -notin $ADEntries.'msFVE-RecoveryPassword') {  
      #Backup recovery key to active directory  
      $Switches = "-protectors -adbackup c: -id" + [char]32 + $BitlockerID  
      Write-Host "Backing up to AD....." -NoNewline  
      $ErrCode = (Start-Process -FilePath $env:windir'\system32\manage-bde.exe' -ArgumentList $Switches -PassThru -Wait).ExitCode  
      If ($ErrCode -eq 0) {  
           Write-Host "Success" -ForegroundColor Yellow  
           $ADEntries = (Get-ADObject -Filter { objectclass -eq 'msFVE-RecoveryInformation' } -SearchBase (Get-ADComputer $env:COMPUTERNAME).DistinguishedName -Properties 'msFVE-RecoveryPassword')  
           Write-Host  
           Write-Host " Bitlocker ID:" -NoNewline  
           Write-Host $BitlockerID -ForegroundColor Yellow  
           Write-Host "Local Password:" -NoNewline  
           Write-Host $LocalPassword -ForegroundColor Yellow  
           Write-Host "  AD Password:" -NoNewline  
           Write-Host $ADEntries.'msFVE-RecoveryPassword' -ForegroundColor Yellow  
           If ($LocalPassword -eq $ADEntries.'msFVE-RecoveryPassword') {  
                Exit 0  
           }  
      }  
      elseif ($ErrCode -eq "-2147024809") {  
           $Status = [string]((manage-bde.exe -status).replace(' ', '')).split(":")[16]  
           If ($Status -eq "FullyDecrypted") {  
                Write-Host "Failed. System is not Bitlockered"  
                Exit 2  
           }  
           else {  
                Write-Host "Unspecified error"  
                Exit 3  
           }  
      }  
      else {  
           Write-Host "Failed with error code"$ErrCode -ForegroundColor Red  
           Write-Host  
           Write-Host " Bitlocker ID:" -NoNewline  
           Write-Host $BitlockerID -ForegroundColor Yellow  
           Write-Host "Local Password:" -NoNewline  
           Write-Host $LocalPassword -ForegroundColor Yellow  
           Write-Host "  AD Password:" -NoNewline  
           Write-Host $ADEntries.'msFVE-RecoveryPassword' -ForegroundColor Yellow  
           Exit 1  
      }  
 }  
 else {  
      Write-Host  
      Write-Host " Bitlocker ID:"$BitlockerID  
      Write-Host "Local Password:"$LocalPassword  
      Write-Host "  AD Password:"$ADEntries.'msFVE-RecoveryPassword'  
      Exit 0  
 }

Automating Dell TPM Configuration

2022-06-30T15:22:00.002-05:00

Over the years, we have manually configured the TPM before imaging a system as part of our build process. Dell has since given the ability to automate the entire process after giving the option to automate clearing the TPM. That was always been the big stopper in full automation.

I wrote a series of scripts that I put into the build process that do all of the necessary steps in readying the TPM for bitlocker as shown below. The Smart Reporting, and Wake-On-LAN are additional features I added that do not pertain to the TPM and Bitlocker. The Conditional Reboot is another PowerShell script I wrote that checks if the system is waiting for a reboot and reboots the system if necessary. If interested, this is in another blog of mine.

Here are the files to download. The names correspond with the list shown above so you know what sequence to put them in. I clear the BIOS password at the start and then reset it near the end as setting the PPI TPM Clear requires a BIOS password to be in place to check off that box via a script. These scripts were successfully tested on Dell Optiplex 7070 and Latitude 7420. There was nothing manual that had to be done to ready the TPM for bitocker.

Identify Machines a User is Logged Into using Carbon Black

2022-03-17T09:15:00.001-05:00

If you have Carbon Black in your environment, you can use it to identify which machines a user account is logged into. Carbon Black collects a vast amount of data on machines and reports it to the cloud database. The following is how to use Carbon Black to list the machines:

Log into the Carbon Black Cloud Portal
Click the Investigate tab
In the investigate search field at the top, enter the following:

Enter process_username:<username> in the search field at the top. <username> needs to be changed to the actual username you are searching for.
Change the time field to the right to within one day or less
Click the magnifying glass on the far right to search.

Under the filters field, scroll down to Device and it will show a list of devices the profile is currently logged into.

As you can see in the screenshot under devices, it returned two machines my profile was logged into.

Last Server Reboot Reporting

2022-03-16T08:22:00.002-05:00

Recently, we needed a report of the last boot time of all servers. I wrote this PowerShell script that queries AD for a list of all windows servers and then does a WMI query on each server for the LastBootUpTime. It then calculates the number of days and writes this to an object with the computer name and the number of days since the last reboot. It will write this info to a CSV file.

You can download the script from my GitHub site.

 Import-Module -Name ActiveDirectory -Force  
 #Get list of windows based servers  
 $Servers = Get-ADComputer -Filter * -Properties * | Where-Object {$_.OperatingSystem -like '*windows server*'} | Select Name | Sort-Object -Property Name  
 #Create Report Array  
 $Report = @()  
 #Parse through server list  
 Foreach ($Server in $Servers) {  
   #Get the computer name  
   $ComputerName = ([String]$Server).Split("=")[1].Split("}")[0].Trim()  
   #Check if the system is online  
   If ((Test-Connection -ComputerName $ComputerName -Count 1 -Quiet) -eq $true) {  
     #Query last bootup time and use $Null if unobtainable  
     Try {  
       $LastBootTime = (Get-CimInstance -ClassName win32_operatingsystem -ComputerName $ComputerName -ErrorAction SilentlyContinue).LastBootUpTime  
       $LastBoot = (New-TimeSpan -Start $LastBootTime -End (Get-Date)).Days  
     } Catch {  
       $LastBoot = $null  
     }  
     #Add computername and last boot time to the object  
     If ($ComputerName -ne $null) {  
       $SystemObject = New-Object -TypeName psobject  
       $SystemObject | Add-Member -MemberType NoteProperty -Name ComputerName -Value $ComputerName  
       $SystemObject | Add-Member -MemberType NoteProperty -Name DaysSinceLastBoot -Value $LastBoot  
       $Report += $SystemObject  
     }  
   } else {  
       $SystemObject = New-Object -TypeName psobject  
       $SystemObject | Add-Member -MemberType NoteProperty -Name ComputerName -Value $ComputerName  
       $SystemObject | Add-Member -MemberType NoteProperty -Name DaysSinceLastBoot -Value 'OFFLINE'  
       $Report += $SystemObject  
   }  
   $ComputerName = $null  
 }  
 #Print report to screen  
 $Report  
 $OutFile = "C:\Users\Desktop\LastRebootReport.csv"  
 #Delete CSV file if it already exists  
 If ((Test-Path -Path $OutFile) -eq $true) {  
   Remove-Item -Path $OutFile -Force  
 }  
 #Export report to CSV file  
 $Report | Export-Csv -Path $OutFile -NoClobber -Encoding UTF8 -NoTypeInformation -Force

Configure SQL Server Firewall Ports with PowerShell

2022-03-07T12:28:00.002-06:00

I recently had to rebuild the Configuration Manager server. As I was running the prerequisite tool, it showed it could not communicate with the SQL server that is separate from the Configuration Manager Server. The issue ended up being ports needed to be opened up.

This PowerShell script will configure the correct ports. It also adds to the description as to what services the port is opened up for in Configuration Manager. If the rule is already present, it skips over. If you open up a rule after the script is executed, you will see it says This is a predefined rule and some of its properties cannot be modified. This was caused by me adding the rule to the group Configuration Manager. If -Group is removed from the cmdlet, this message disappears.

You can download the script from here.

 If ((Get-NetFirewallRule -Name "ConfigMgr Port 135 UDP" -ErrorAction SilentlyContinue) -eq $null) {  
 New-NetFirewallRule -Name "ConfigMgr Port 135 UDP" -DisplayName "ConfigMgr Port 135 UDP" -Description "Site Server" -Group "Configuration Manager" -Profile "Domain" -Protocol UDP -LocalPort 135 -Enabled True  
 }  
 If ((Get-NetFirewallRule -Name "ConfigMgr Port 135 TCP" -ErrorAction SilentlyContinue) -eq $null) {  
   New-NetFirewallRule -Name "ConfigMgr Port 135 TCP" -DisplayName "ConfigMgr Port 135 TCP" -Description "Site Server" -Group "Configuration Manager" -Profile "Domain" -Protocol TCP -LocalPort 135 -Enabled True  
 }  
 If ((Get-NetFirewallRule -Name "ConfigMgr Port 1433 TCP" -ErrorAction SilentlyContinue) -eq $null) {  
   New-NetFirewallRule -Name "ConfigMgr Port 1433 TCP" -DisplayName "ConfigMgr Port 1433 TCP" -Description "Asset Intelligence Synchronization Point, App Catalog Web Service Point, Endpoint Protection, Enrollment Point, MP, Reporting point, Site Server, SMS Provider, SQL Server, SMP" -Group "Configuration Manager" -Profile "Domain" -Protocol TCP -LocalPort 1433 -Enabled True  
 }  
 If ((Get-NetFirewallRule -Name "ConfigMgr Port 4022 TCP" -ErrorAction SilentlyContinue) -eq $null) {  
   New-NetFirewallRule -Name "ConfigMgr Port 4022 TCP" -DisplayName "ConfigMgr Port 4022 TCP" -Description "SQL Server" -Group "Configuration Manager" -Profile "Domain" -Protocol TCP -LocalPort 4022 -Enabled True  
 }  
 If ((Get-NetFirewallRule -Name "ConfigMgr Port 445 TCP" -ErrorAction SilentlyContinue) -eq $null) {  
   New-NetFirewallRule -Name "ConfigMgr Port 445 TCP" -DisplayName "ConfigMgr Port 445 TCP" -Description "Site Server" -Group "Configuration Manager" -Profile "Domain" -Protocol TCP -LocalPort 445 -Enabled True  
 }

Troubleshooting No Task Sequences are available (Tasksequence.xml does not exist, is empty, or is inaccessible)

2022-01-24T15:23:00.002-06:00

I encountered this error when working with MDT right after deleting two old task sequences.

To troubleshoot this, I went to the logs directory in the MDT hierarchy. I specified in the customsettings.ini file to write all build logs to this specific directory:

SLShare=\\BUILD\PRODDeploymentShare$\Logs

SLShareDynamicLogging=\\BUILD\PRODDeploymentShare$\Logs\%ComputerName%

When I went into the logs, I opened up the only log there, BDD.log, and found that it could not find the task sequence specified in the TaskSequences.xml file. I then opened up the TaskSequences.xml file, which is located at %DEPLOYROOT%\Control\TaskSequences.xml. Once I opened up the XML, I searched for the task sequence no found and deleted it. That fixed the issue.

How to effectively add Office updates to the update folder

2022-01-21T08:57:00.001-06:00

If you are still using an on-prem version of office, you know the need to populate the Updates folder so updates get applied when Office is installed instead of having to wait for the updates to download and then be installed. The issue I have run into is some of the updates, once extracted, are named the same. To resolve this, I extract each update from the cab file. Next, I open up the msp file using ORCA. In the MsiPatchMetadata table, you will find the KB number in the Release property. I use that number and rename the msp file to KB4011634.msp for instance. This prevents files from being overwritten. I then copy it back to the Updates folder. Office is able to read the MSP file with no problems.

Installing WinGet via PowerShell

2021-12-20T11:02:00.002-06:00

I wanted to install Winget via PowerShell in an automated process. The first thing I did was to go to the Winget GitHub site and select the latest version of the Windows Package Manager. Under the latest version page, I clicked on the file with the extension of msixbundle and downloaded it to my machine.

Now that it is on your machine, you can automate the installation with a PowerShell one-liner script where the PS1 file resides in the same directory as the Winget installer. The script will search the current directory for a msixbundle file with the cmdlet listed below.

 Add-AppPackage -Path ((Get-ChildItem -Path ((Get-Location).ProviderPath) -Filter *.msixbundle).FullName)

Administrator Reporting Tool

2021-11-19T14:19:00.004-06:00

This PowerShell tool queries AD for a list of machines in the specified administrative admin groups. The list is specified by modifying the script with the groups to be queried. The following example shows how to add groups to the query. When there are multiple groups, they can be divided off by using the pipe character between each group.

Where-Object {$_.MemberOf -match 'Admins|Domain Admins|System Admins|'}

There is the parameter called $Days. This specifies how many days old the account needs to be so it is not displayed in the report anymore.

I wrote this script so that it can easily be used with Orchestrator or as a scheduled task. It exits the script with an error code 0 if there is data to emailed along with the Write-Output statement that puts the list of users in the output of the program once exited. If there was no data to return, it exits with an error code 1 so that Orchestrator knows not to proceed with the email task.

You can download the script from my GiHub Site.

 <#  
      .SYNOPSIS  
           Administrator Report  
        
      .DESCRIPTION  
           This tool is intended to keep staff informed of new administrator accounts. This script queries for a list of users in the specified administrator group(s). It then produces a list of the administrator users that got created within the specified number of days.   
        
      .PARAMETER Days  
           Number of days since the administrator account was created  
        
      .NOTES  
           ===========================================================================  
           Created with:     SAPIEN Technologies, Inc., PowerShell Studio 2021 v5.8.195  
           Created on:       11/9/2021 1:37 PM  
           Created by:       Mick Pletcher  
           Filename:         AdministratorReport.ps1  
           ===========================================================================  
 #>  
 Param  
 (  
      [ValidateNotNullOrEmpty()][int]$Days = 1  
 )  
   
 #Retrieves a list of users from AD and filters them by association with the specied security groups. The match can be associated with multiple groups separated with a pipe  
 #Example: Where-Object {$_.MemberOf -match '|Domain Admins|System Admins|'}  
 $Users = Get-ADUser -Filter * -Properties MemberOf | Where-Object {$_.MemberOf -match 'Super Admins|Domain Admins'}  
 #Filter out all accounts that are older than the specified $Days  
 $Users | ForEach-Object {  
      If ((New-TimeSpan -Start ((Get-ADUser -Identity $_.SamAccountName -Properties whenCreated).whenCreated) -End (Get-Date)).Days -le $Days) {  
           $NewUsers += $_.Name  
      }  
        
 }  
 If (($NewUsers -ne $null) -and ($NewUsers -ne '')) {  
      Write-Output $NewUsers  
 } Else {  
      Exit 1  
 }  
 Exit 0

Installing Printers via ConfigMgr for Non-Admin Users

2021-10-13T09:48:00.007-05:00

KB5005652 resolved the "PrintNightMare" vulnerability, but it also brought many companies to a halt when it came to end-users installing printers if they did not have administrator privileges. During the time since the update, we had our help desk install printers for users on an as-needed basis. There was a workaround by setting the RestrictDriverInstallationToAdministrators to 0 to override the fix, but this would have thwarted the security vulnerability.

I came up with the fix to install printers using configuration manager since it can install them with a privileged account. The solution in my environment was to use PowerShell to query the print servers for a list of offices and printers in our scenario. After the office is selected, it displays a list of printers in that office for the user to select from. Once that printer is selected, it will check if the printer is already installed. If so, it will delete it and reinstall. If not, it will install the new printer. Finally, it will verify that the printer was successfully installed. I currently have the script read from a text file the list of print servers with the associated city location in CSV format. I did make a last-minute change where I hardcoded the locations into the object creation instead of using it from the text file. I will probably find a better way in the near future and update this with something like using Get-ADObject to get a list of the print servers, but will still need to find where the link to the associated city name is to use that method. For now, this is working great in our environment.

This has to be set up in configuration manager as a package advertisement with Allow users to interact with this program checked. This allows users to install a printer on-demand through Software Center and rerun the package as many times as needed.

NOTE: One last important thing. This script was written for our environment. You will need PowerShell knowledge to modify this script to work in your environment. This is more of a primer to show you how I overcame the limitation in this corporate environment. The script will likely need to be greatly modified for some environments. The size of the company will also make a lot of difference in how this script needs to be modified. The firm I am at is roughly 500 people. A GUI interface may be preferential to some, which I may come back later and implement with PowerShell Studio.

You can download the PowerShell script from my Github repository.

 <#  
      .SYNOPSIS  
           PrinterInstaller  
        
      .DESCRIPTION  
           This script is intended to be used in ConfigMgr as an applicatio advertisement in Software Center. This allows non-admin users to install printers allowing companies to keep the Microsoft print server patch in place. It nwill retrieve all printers from all print servers. It then prompts the user for the office. At that point, it will display a list of printers in that office for the user to select from. Finally, it will check if the printer is already installed. If it is, it will uninstall the printer and proceed to install it, otherwise it will install the printer.  
        
      .PARAMETER PrintServersFile  
           Name of the file which contains a list of print servers  
        
      .NOTES  
           ===========================================================================  
           Created with:     SAPIEN Technologies, Inc., PowerShell Studio 2021 v5.8.194  
           Created on:       10/12/2021 7:40 PM  
           Created by:       Mick Pletcher  
           Filename:         PrinterInstaller.ps1  
           ===========================================================================  
 #>  
   
 [CmdletBinding()]  
 Param  
 (  
      [ValidateNotNullOrEmpty()]$PrintServersFile = 'PrintServers.txt'  
 )  
   
 Clear-Host  
 Write-Host "Retrieving List of Offices..."  
 #Create Printers array  
 $Printers = @()  
 #Get list of print servers that includes the print server and printer location  
 $PrintServers = Get-Content -Path ($PSScriptRoot + '\' + $PrintServersFile)  
 #Get list of all printers from within each print server  
 $PrintServers | ForEach-Object {  
   #Test if the print server is online before querying it  
   If ((Test-Connection -ComputerName $_.Split(",")[0] -Count 1 -Quiet) -eq $true) {  
     #Add all printer from the specified print server  
     $Query += Get-Printer -ComputerName $_.Split(",")[0]  
   }  
 }  
 #Create the object for each printer and add it to the $Printers array  
 $Query | ForEach-Object {  
      $object = New-Object PSObject  
      $object | Add-Member Noteproperty -Name PrinterName -Value $_.Name  
        $object | Add-Member Noteproperty -Name PrinterPort -Value $_.PortName  
      $object | Add-Member Noteproperty -Name PrintServer -Value $_.ComputerName  
      $object | Add-Member Noteproperty -Name DriverName -Value $_.DriverName  
      Switch ($_.ComputerName) {  
     "Printer1" { $object | Add-Member Noteproperty -Name Office -Value "Austin" }  
     "Printer2" { $object | Add-Member Noteproperty -Name Office -Value "Birmingham" }  
     "Printer3" { $object | Add-Member Noteproperty -Name Office -Value "Chattanooga" }  
     "Printer4" { $object | Add-Member Noteproperty -Name Office -Value "Nashville" }  
   }  
   #Add a floor value to the Floor object if the print server is in Nashville  
   If ($_.ComputerName -eq 'Printer4') {  
     $object | Add-Member Noteproperty -Name Floor -Value ($_.Name.Split("-")[1])  
   } else {  
     #Leave the floor object blank if it is any office other than Nashville  
     $object | Add-Member Noteproperty -Name Floor -Value ""  
   }  
   #Add the object to the $Printers array  
   $Printers += $object  
     
 }  
 #Sort the array by Office and then Floor  
 $Printers = $Printers | Sort-Object -Property Office, Floor  
 #Counter for selecting the office  
 $Count = 1  
 #Display each office with a number selection  
 $PrintServers | ForEach-Object {Write-Host ([string]$Count + ' - ' + $_.Split(",")[1]);$Count++}  
 #Prompt for a user selection of the office  
 $Selection = Read-Host -Prompt "Select the office"  
 #Get list of printers for selected office  
 $PrintersSelection = $Printers | Where-Object {$_.PrintServer -eq ($PrintServers[$Selection - 1].Split(",")[0])}  
 #printer counter  
 $Count = 1  
 Clear-Host  
 Write-Host  
 Write-Host "Retrieving list of Printers..."  
 #Display list of printers in the selected office  
 $PrintersSelection | ForEach-Object {Write-Host ([string]$Count + ' - ' + $_.PrinterName);$Count++}  
 #Prompt the user to select the printer  
 $Selection = Read-Host -Prompt "Select the Printer"  
 #Display the selected printer  
 $PrintersSelection[$Selection - 1]  
 #Check if the printer is installed and uninstall it if true  
 If ((Get-Printer -Name $PrintersSelection[$Selection - 1].PrinterName -ErrorAction SilentlyContinue) -ne $null) {  
      Remove-Printer -Name $PrintersSelection[$Selection - 1].PrinterName  
      Remove-PrinterPort -Name $PrintersSelection[$Selection - 1].PrinterPort  
 }  
 Write-Host  
 Write-Host ('Installing Printer' + [char]32 + $PrintersSelection[$Selection - 1].PrinterName + '.....') -NoNewline  
 #Install the selected printer  
 Add-PrinterPort -Name $PrintersSelection[$Selection - 1].PrinterPort -PrinterHostAddress $PrintersSelection[$Selection - 1].PrinterPort  
 Add-Printer -Name $PrintersSelection[$Selection - 1].PrinterName -DriverName $PrintersSelection[$Selection - 1].DriverName -PortName $PrintersSelection[$Selection - 1].PrinterPort  
 #Verify the printer was installed  
 If ((Get-Printer -Name $PrintersSelection[$Selection - 1].PrinterName -ErrorAction SilentlyContinue) -ne $null) {  
      Write-Host 'success' -ForegroundColor Yellow  
 } Else {  
      Write-Host 'failed' -ForegroundColor Red  
 }

PowerShell: Install Fonts

2021-06-29T14:40:00.000-05:00

Font installation using PowerShell has changed since Windows 10 1909. The old way of doing it with PowerShell no longer works. This new script was originally written by Ben Reader who is a fellow Microsoft MVP from Australia. I took the script and modified it by improving on user interface and file tweaks.

This script gets a list of all font files that exist in the same directory. It then parses through each font file getting the font name attribute at which point it copies the file to c:\windows\Fonts. Next, it registers the font by writing the font file name to HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Fonts so that it will show up in a drop-down menu. The script also writes the status of each step to the screen so the person executing it knows if each font install is successful or not.

You can download the script from my GitHub site.

 <#  
      .SYNOPSIS  
           Install Open Text and True Type Fonts  
        
      .DESCRIPTION  
           This script will install OTF and TTF fonts that exist in the same directory as the script.  
        
      .NOTES  
           ===========================================================================  
           Created with:    SAPIEN Technologies, Inc., PowerShell Studio 2021 v5.8.187  
           Created on:      6/24/2021 9:36 AM  
           Created by:      Mick Pletcher  
           Filename:        InstallFonts.ps1  
           ===========================================================================  
 #>  
   
 <#  
      .SYNOPSIS  
           Install the font  
        
      .DESCRIPTION  
           This function will attempt to install the font by copying it to the c:\windows\fonts directory and then registering it in the registry. This also outputs the status of each step for easy tracking.   
        
      .PARAMETER FontFile  
           Name of the Font File to install  
        
      .EXAMPLE  
                     PS C:\> Install-Font -FontFile $value1  
        
      .NOTES  
           Additional information about the function.  
 #>  
 function Install-Font {  
      param  
      (  
           [Parameter(Mandatory = $true)][ValidateNotNullOrEmpty()][System.IO.FileInfo]$FontFile  
      )  
        
      #Get Font Name from the File's Extended Attributes  
      $oShell = new-object -com shell.application  
      $Folder = $oShell.namespace($FontFile.DirectoryName)  
      $Item = $Folder.Items().Item($FontFile.Name)  
      $FontName = $Folder.GetDetailsOf($Item, 21)  
      try {  
           switch ($FontFile.Extension) {  
                ".ttf" {$FontName = $FontName + [char]32 + '(TrueType)'}  
                ".otf" {$FontName = $FontName + [char]32 + '(OpenType)'}  
           }  
           $Copy = $true  
           Write-Host ('Copying' + [char]32 + $FontFile.Name + '.....') -NoNewline  
           Copy-Item -Path $fontFile.FullName -Destination ("C:\Windows\Fonts\" + $FontFile.Name) -Force  
           #Test if font is copied over  
           If ((Test-Path ("C:\Windows\Fonts\" + $FontFile.Name)) -eq $true) {  
                Write-Host ('Success') -Foreground Yellow  
           } else {  
                Write-Host ('Failed') -ForegroundColor Red  
           }  
           $Copy = $false  
           #Test if font registry entry exists  
           If ((Get-ItemProperty -Name $FontName -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Fonts" -ErrorAction SilentlyContinue) -ne $null) {  
                #Test if the entry matches the font file name  
                If ((Get-ItemPropertyValue -Name $FontName -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Fonts") -eq $FontFile.Name) {  
                     Write-Host ('Adding' + [char]32 + $FontName + [char]32 + 'to the registry.....') -NoNewline  
                     Write-Host ('Success') -ForegroundColor Yellow  
                } else {  
                     $AddKey = $true  
                     Remove-ItemProperty -Name $FontName -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Fonts" -Force  
                     Write-Host ('Adding' + [char]32 + $FontName + [char]32 + 'to the registry.....') -NoNewline  
                     New-ItemProperty -Name $FontName -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Fonts" -PropertyType string -Value $FontFile.Name -Force -ErrorAction SilentlyContinue | Out-Null  
                     If ((Get-ItemPropertyValue -Name $FontName -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Fonts") -eq $FontFile.Name) {  
                          Write-Host ('Success') -ForegroundColor Yellow  
                     } else {  
                          Write-Host ('Failed') -ForegroundColor Red  
                     }  
                     $AddKey = $false  
                }  
           } else {  
                $AddKey = $true  
                Write-Host ('Adding' + [char]32 + $FontName + [char]32 + 'to the registry.....') -NoNewline  
                New-ItemProperty -Name $FontName -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Fonts" -PropertyType string -Value $FontFile.Name -Force -ErrorAction SilentlyContinue | Out-Null  
                If ((Get-ItemPropertyValue -Name $FontName -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Fonts") -eq $FontFile.Name) {  
                     Write-Host ('Success') -ForegroundColor Yellow  
                } else {  
                     Write-Host ('Failed') -ForegroundColor Red  
                }  
                $AddKey = $false  
           }  
             
      } catch {  
           If ($Copy -eq $true) {  
                Write-Host ('Failed') -ForegroundColor Red  
                $Copy = $false  
           }  
           If ($AddKey -eq $true) {  
                Write-Host ('Failed') -ForegroundColor Red  
                $AddKey = $false  
           }  
           write-warning $_.exception.message  
      }  
      Write-Host  
 }  
   
 #Get a list of all font files relative to this script and parse through the list  
 foreach ($FontItem in (Get-ChildItem -Path $PSScriptRoot | Where-Object {  
                ($_.Name -like '*.ttf') -or ($_.Name -like '*.OTF')  
           })) {  
      Install-Font -FontFile $FontItem  
 }

Configuration Manager Message ID 11170 Error

2021-01-22T15:12:00.001-06:00

I was in the process of pushing out the Microsoft Windows 10 20H2 upgrade when I had 23 systems that errored out. They reported the error shown below.

After looking at the logs and at Software Center on the target machine, I found the target machine was not seeing the deployment under Operating Systems. The fix was to reinstall the client on the target machine. Once the reinstall completed and the client synchronized with the ConfigMgr server, the deployment appeared in Software Center and successfully completed.

Automating the Deletion of Windows.old

2021-01-11T17:02:00.002-06:00

It is the beginning of 2021 and my first project for the new year is upgrading all systems to Windows 10 20H2. At the end of the upgrades comes the cleanup and there is no clean way to do this for system admins. Cleanmgr.exe is now deprecated as of Windows 10 2004. There is not a PowerShell option for controlling storage sense. Cleanmgr.exe /AUTOCLEAN would open up cleanmgr.exe and then freeze. It never deleted the folder and was stuck at zero CPU usage. I also tried using PSEXEC to execute it with the same results. Another suggestion was using task scheduler. I also tried using Dism.exe /online /Cleanup-Image /StartComponentCleanup. The Windows.old folder was still present. The next option is to delete the folder. Here is a pic of the failure to clean up the Windows.old folder using a domain admin account and cmd.exe run as administrator.

NOTE: There is an issue we ran into when someone had a USB drive connected. The system connected to the wrong drive. and installed the SMSTaskSequence on that drive instead of the bootable C: drive. This caused the system to reboot constantly because it then did not see the Windows.old directory to delete. I fixed this by adding logic that looked for the Windows.old directory. The new code is below

NOTE: Once this folder has been deleted, Windows cannot be reverted back to the previous version.

Once the upgrade has taken place, the Windows.old folder is present. It typically takes up 15+ GB of space. The upgraded OS is still actively using some files in the directory as I learned while exploring how to delete them. I found the files being used were drivers. This prevents you from deleting it while the OS is in memory. The alternative is to load WinPE so the OS is not in memory thereby freeing up the directory for deletion. Once the directory is deleted in WinPE and the system reboots, the OS reassociates the drivers it was using in the Windows.old directory to the Windows directory.

I first tried using PowerShell to delete the directory and there was a constant problem. PowerShell could not delete all files and directories, no matter what I tried. I consistently got the message "No mapping between account names and security IDs was done." Next, I tried RMDIR and it worked perfectly. I was able to use PowerShell to both find the drive in the WinPE environment and then execute the RMDIR command to delete the Windows.old directory on that drive. I tried this as a one-liner, but it was hit and miss with the RMDIR accepting the piped output instead of a variable. I found storing the path to the Windows.old directory in a variable was much more reliable. Here is the two-line code below:

$Drive = (Get-Partition | Where-Object {((Test-Path ($_.DriveLetter + ':\Windows.old')) -eq $True)}).DriveLetter
If ((Test-Path ($Drive + ':\Windows.old')) -eq $true) {
    $Directory = $Drive + ':\Windows.old'
    cmd.exe /c rmdir /S /Q $Directory
}

Here is a screenshot of the task sequence I used to deploy to the systems. The first restart is to load WinPE, the second sequence is the above PowerShell script, and the third sequence reboots the system back into the installed OS.

Check Boot Environment for BIOS or UEFI

2020-09-25T14:32:00.001-05:00

One of my recent projects is to convert our remaining legacy systems from BIOS to UEFI. While setting up the task sequence, I needed to be able to test the system to make sure it was not already UEFI so the task sequence would end if it was.

The PowerShell script reads the setupact.log file and extracts if it is configured as BIOS or UEFI. I have included an unknown message in the event the log file does not exist or is inaccessible, which is what I encountered on one machine. For setting it up in a Configuration Manager task sequence, I set the sequence to look for a return code of 0, else it will return either a 1 or 2, which will fail the task sequence, and allow the admin to know why it failed from the console with the error code being returned.

You can download the script from my GitHub site.

 <#  
      .SYNOPSIS  
           Check Boot Environment  
        
      .DESCRIPTION  
           This script reads the setupact.log file to determine if the system is configured for BIOS or UEFI.   
        
      .NOTES  
           ===========================================================================  
           Created with:     SAPIEN Technologies, Inc., PowerShell Studio 2017 v5.4.142  
           Created on:       9/25/2020 11:59 AM  
           Created by:       Mick Pletcher  
           Filename:         BootEnvironment.ps1  
           ===========================================================================  
 #>  
   
 Try {  
      $Output = (Get-Content -Path (((Get-ChildItem -Path ($env:windir + '\Panther') -Recurse -Filter setupact.log -ErrorAction SilentlyContinue)[0]).FullName) -ErrorAction SilentlyContinue | Where-Object {$_ -like "*Detected boot environment*"}).Replace("Detected boot environment:", "~").Split("~")[1].Trim()  
      If ($Output -eq 'BIOS') {  
           Write-Output 'BIOS'  
           Exit 0  
      } elseif ($Output -eq 'UEFI') {  
           Write-Output 'UEFI'  
           Exit 1  
      }  
 } Catch {  
      Write-Output 'Unknown'  
      Exit 2  
 }

Bitlocker Non-Compliance Reporting

2020-09-24T10:57:00.002-05:00

As part of the suite of security tools I am writing, this will query the configuration manager SQL database for a list of machines that are not Bitlocker encrypted. There are reports in the configuration manager for this, but not everyone in my organization has access to the configuration manager console, and we wanted a detailed report sent out on a regular basis so that it is in their mailbox with high importance, which is also not available through ConfigMgr.

This tool was written to include the computer name, model, chassis, drive letter, bitlocker status, last hardware inventory scan, and last logon time. The last hardware scan and last logon time give the admins an idea as to the accuracy of the system being reported. The tool was written so that it can be used with Azure Automation or Orchestrator, and even with a scheduled task if needed. The output is formatted for a clean appearance in an outlook email.

You can download the script from my GitHub site.

 <#  
      .SYNOPSIS  
           Bitlocker Encryption Reporting  
        
      .DESCRIPTION  
           This script queries the Configuration Manager SQL database for a list of machines that are not Bitlocker Encrypted. It is limited to non-desktop chassis, which can be changed by modifying the SQL query. The script is designed to output the data so that it can be used with Orchestrator, Azure Automation, or a scheduled task.  
        
      .PARAMETER SQLServer  
           Name of the SQL server  
        
      .PARAMETER SQLDatabase  
           Name of the SQL database  
        
      .NOTES  
           ===========================================================================  
           Created with:    SAPIEN Technologies, Inc., PowerShell Studio 2017 v5.4.142  
           Created on:      9/21/2020 3:35 PM  
           Created by:      Mick Pletcher  
           Filename:        BitlockerEncryptionReporting.ps1  
           ===========================================================================  
 #>  
 [CmdletBinding()]  
 param  
 (  
      [ValidateNotNullOrEmpty()]  
      [string]$SQLServer,  
      [ValidateNotNullOrEmpty()]  
      [string]$SQLDatabase
 )  
   
 $Query = "SELECT ResultTableName FROM dbo.v_Collections"  
 $Collection = Invoke-Sqlcmd -ServerInstance $SQLServer -Database $SQLDatabase -Query $Query  
 #SQL query to retrieve the list of machines  
 $Query = "SELECT DISTINCT Name as ComputerName, dbo.Computer_System_DATA.Model00 AS Model, dbo.System_Enclosure_DATA.ChassisTypes00 AS Chassis, dbo.ENCRYPTABLE_VOLUME_DATA.DriveLetter00 AS DriveLetter, ProtectionStatus00 AS BitlockerStatus, LastHardwareScan, ADLastLogonTime AS LastLogonTime FROM dbo.Computer_System_DATA INNER JOIN dbo.ENCRYPTABLE_VOLUME_DATA ON dbo.Computer_System_DATA.MachineID = dbo.ENCRYPTABLE_VOLUME_DATA.MachineID INNER JOIN dbo.v_GS_ENCRYPTABLE_VOLUME ON dbo.v_GS_ENCRYPTABLE_VOLUME.ResourceID = dbo.ENCRYPTABLE_VOLUME_DATA.MachineID INNER JOIN dbo._RES_COLL_SMS00001 ON dbo.ENCRYPTABLE_VOLUME_DATA.MachineID = dbo._RES_COLL_SMS00001.MachineID INNER JOIN dbo.System_Enclosure_DATA ON dbo._RES_COLL_SMS00001.MachineID = dbo.System_Enclosure_DATA.MachineID INNER JOIN dbo.v_GS_VOLUME ON dbo.System_Enclosure_DATA.MachineID = dbo.v_GS_VOLUME.ResourceID WHERE (((dbo.System_Enclosure_DATA.ChassisTypes00 = 8) OR (dbo.System_Enclosure_DATA.ChassisTypes00 = 9) OR (dbo.System_Enclosure_DATA.ChassisTypes00 = 10) OR (dbo.System_Enclosure_DATA.ChassisTypes00 = 12) OR (dbo.System_Enclosure_DATA.ChassisTypes00 = 14) OR (dbo.System_Enclosure_DATA.ChassisTypes00 = 31)) AND (dbo.ENCRYPTABLE_VOLUME_DATA.DriveLetter00 = 'C:') AND (dbo.ENCRYPTABLE_VOLUME_DATA.ProtectionStatus00 = 0)) ORDER BY Name"  
 $Report = Invoke-Sqlcmd -ServerInstance $SQLServer -Database $SQLDatabase -Query $Query  
 #If the report has no machines, then exit this script with an error code 1 so that the automation tool the link will not continue to the email task  
 If ($Report -ne $null) {  
      $Array = @()  
      foreach ($Item in $Report) {  
           $SysObj = New-Object -TypeName System.Management.Automation.PSObject  
           $SysObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Item.ComputerName  
           $SysObj | Add-Member -MemberType NoteProperty -Name Model -Value $Item.Model  
           $SysObj | Add-Member -MemberType NoteProperty -Name Chassis -Value $Item.Chassis  
           $SysObj | Add-Member -MemberType NoteProperty -Name DriveLetter -Value $Item.DriveLetter  
           $SysObj | Add-Member -MemberType NoteProperty -Name BitlockerStatus -Value $Item.BitlockerStatus  
           $SysObj | Add-Member -MemberType NoteProperty -Name LastHardwareScan -Value $Item.LastHardwareScan  
           $SysObj | Add-Member -MemberType NoteProperty -Name LastLogonTime -Value $Item.LastLogonTime  
           $Array += $SysObj  
      }  
      #Bitlocker reporting fields from the query  
      $Fields = @("Computer Name", "Model", "Chassis", "Drive Letter", "Bitlocker Status", "Last Hardware Scan", "Last Logon Time")  
      #Title row  
      $Output = ($Fields[0] + [char]9 + [char]9 + $Fields[1] + [char]9 + [char]9 + [char]9 + [char]9 + $Fields[2] + [char]9 + [char]9 + $Fields[3] + [char]9 + $Fields[4] + [char]9 + [char]9 + $Fields[5] + [char]9 + $Fields[6] + [char]13)  
      #Add each entry while formatting the computername column as to the width of the computername  
      foreach ($Item in $Array) {  
           If ($Item.ComputerName.Length -le 3) {  
                $ComputerName = $Item.ComputerName + [char]9 + [char]9 + [char]9 + [char]9 + [char]9  
           } elseif ($Item.ComputerName.Length -le 7) {  
                $ComputerName = $Item.ComputerName + [char]9 + [char]9 + [char]9 + [char]9  
           } elseif ($Item.ComputerName.Length -le 11) {  
                $ComputerName = $Item.ComputerName + [char]9 + [char]9 + [char]9  
           } elseif ($Item.ComputerName.Length -le 15) {  
                $ComputerName = $Item.ComputerName + [char]9 + [char]9  
           } else {  
                $ComputerName = $Item.ComputerName + [char]9  
           }  
           $Output += $ComputerName + $Item.Model + [char]9 + [char]9 + [char]9 + $Item.Chassis + [char]9 + [char]9 + $Item.DriveLetter + [char]9 + [char]9 + $Item.BitlockerStatus + [char]9 + [char]9 + [char]9 + $Item.LastHardwareScan + [char]9 + $Item.LastLogonTime + [char]13  
      }  
      #Write the output so it can be collected from the automation tool  
      Write-Output -InputObject $Output  
 } else {  
      Exit 1  
 }

Preventing Windows 10 Apps from Reappearing after an In-Place or Feature Upgrade

2020-09-15T14:37:00.000-05:00

In the imaging process I devised, most of the Windows 10 Built-In apps, such as mail and maps, are removed. My company uses the SAC edition of Windows 10 enterprise. This requires us to perform an in-place upgrade every 6 months. In order to prevent the built-in apps from reappearing, you can add specific registry keys that permanently deprovision the apps.

The first thing you will need to do is to get a list of the apps you want to deprovision. To do so, execute the following PowerShell one-liner to get a list of the apps with the display name on the right with the associated package name on the left. The package name is what will be needed.

 Get-AppxProvisionedPackage -Online | Select DisplayName, PackageName | Sort-Object -Property DisplayName | Export-Csv -Path Apps.txt -Force -Encoding UTF8 -NoTypeInformation

It is best to edit the CSV file in excel. Once you open the generated text file up, delete those items you do NOT want the OS to remove, and then delete the DisplayName column. The CSV file is now ready to be used with the PowerShell script. You will need to rerun the above PowerShell script each time an OS upgrade is available and has been installed to get any new additions.

The script will read the contents of the text file and then adds those as a registry key located under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned. You can find out more information on the registry keys and how they work here.

The following script will only need to be executed once. You can download it from my GitHub site.

 <#  
      .SYNOPSIS  
           Deprovision Specified Windows 10 Apps  
        
      .DESCRIPTION  
           This script will add the appropriate registry keys to deprovision the built-in Windows 10 applications specified in the associated text file, or hardcoded in the script.  
        
      .PARAMETER AppListFile  
           File containing list of Windows 10 files to deprovision  
        
      .NOTES  
           ===========================================================================  
           Created with:     SAPIEN Technologies, Inc., PowerShell Studio 2017 v5.4.142  
           Created on:       9/15/2020 9:56 AM  
           Created by:       Mick Pletcher  
           Filename:         Windows10AppDeprovisioning.ps1  
           ===========================================================================  
 #>  
   
 [CmdletBinding()]  
   
 param  
 (  
      [string]$AppListFile  
 )  
   
 #Get list of Windows 10 Applications to uninstall from text file  
 $Applications = Get-Content -Path $AppListFile  
 #Deprovisioned Registry Key  
 $RegKey = 'REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned'  
 #Create deprovisioned registry key if it does not exist  
 If (!(Test-Path $RegKey)) {  
      New-Item -Path $RegKey -Force | Out-Null  
 }  
 #Add list of Apps from the imported text file to the deprovisioned registry key  
 foreach ($App in $Applications) {  
      #Install registry key if it does not exist  
      If (!(Test-Path ($RegKey + '\' + $App))) {  
           New-Item -Path ($RegKey + '\' + $App) -Force | Out-Null  
      }  
 }

Remotely Pushing Windows Updates via Command Line to Windows 10 Machines

2020-09-09T11:40:00.000-05:00

Normally, windows updates are pushed to machines using Configuration Manager in an enterprise environment. There are occasions though when they must manually be pushed, such as when a system continues to fail via ConfigMgr and troubleshooting is required. The first tool I use is the PSWindowsUpdate PowerShell module. This allows me to remotely push updates via PowerShell and PSEXEC, in which I can watch the results.

To use the PSWindowsUpdate module, it must be installed first. I do so by installing the module on all machines during the build process, but it can also be pushed through ConfigMgr or you can use PSEXEC.exe to install it. The command line I use is:

 powershell.exe -executionpolicy bypass -command "&{Install-Module -Name PSWindowsUpdate -Force -Confirm:$false}"

Once it is installed on the remote machine, I use the following PowerShell one-liner in the configuration manager Scripts section to remotely execute it.

 Install-WindowsUpdate -IgnoreReboot -AcceptAll;Start-Process -FilePath ($env:windir + '\system32\UsoClient.exe') -ArgumentList 'ScanInstallWait StartInstall'

The issue I have seen with just using the PSWindowsUpdate module with 1903 and later versions of Windows 10 is that it will trigger the updates to download, but will not always install them, especially feature updates. The UsoClient.exe will trigger the updates to install. This command-line executable is the same as going to the Check for Windows Updates screen and clicking the button to install updates. You can find more info on UsoClient here.

If you are trying to get a feature update to install remotely, you will need to execute UsoClient.exe ScanInstallWait StartInstall at least a couple of times before it starts to install after the update has been downloaded.