EmailRSS

Monthly Archives: December 2017

Syncing the Bing Image to the Logon Background with PowerShell

Posted on by

No matter how many cool things I do at work, everyone thinks that the Bing image syncing script is the coolest. By using PowerShell to download the Bing image and Group Policy to distribute it, the default logon (sign in) background rotates each day. Several years ago, I wrote about that process in this post.

Last week, I was asked (yet again) where the picture of the day came from. I normally point people to Bing where they can look in the bottom right for the picture caption. On that day, I was feeling particularly automatous and thought it would be awesome to paste the picture title over top the downloaded image. Thanks to PowerShell, that is what I did!

Enlightening…

To use this script, set the $saveLocation and $saveLocationWithDescriptionAdded variables at the top of the script.  Keep the file name (backgroundDefault.jpg) the same.

Set the script to run daily and then to repeat every hour in case the image changes during the day. Make sure that the user running the script has write permission to the path specified in your two variables. The Group Policy settings can be found below the script.

#Location to store original image 
    $saveLocation = ‘\\SERVER\SHARE\Bing Background\WithoutText\backgroundDefault.jpg’
#Location to store image with title added to it. Group Policy should point to this image.
    $saveLocationWithDescriptionAdded = '\\SERVER\SHARE\Bing Background\backgroundDefault.JPG'

#Height From Bottom in Pixels. This controls how far up from the bottom that the next is written. Should not be lower than 21. Set to 75 for the text to appear above taskbar if used as desktop background.
    $HeightfromBottom = 45

#Download Bing Image to SaveLocation
$uri = “https://www.bing.com/HPImageArchive.aspx?format=rss&idx=0&n=1&mkt=en-US”
[xml]$BingImage = Invoke-WebRequest -Uri $uri -SessionVariable Bing -ContentType "text/xml; charset=utf-8" -Method Get
$CurrentImage = $BingImage.rss.channel.item

#Microsoft provides several different resolutions. This script grabs the 1920x1080. Remove the .Replace* to keep the 1366x768 version.
$ImageURL = "https://www.bing.com" + ($CurrentImage.link).Replace("1366x768.jpg","1920x1080.jpg")
Invoke-WebRequest $ImageURL -OutFile $savelocation 


#Get Bing Image Title
$Title = Invoke-WebRequest -Uri $uri -SessionVariable Bing -ContentType "text/xml; charset=utf-8" -Method Get -OutFile C:\Users\Public\title.txt
$Title = (Get-Content C:\Users\Public\title.txt -Encoding UTF8)
$Title = $Title -split '>' 
$Title = $Title.Item(12)
$Description = $Title.Replace('</title',"")
Remove-Item C:\Users\Public\title.txt -Force


#Find Rough Description Pixel Length. 8.35 is average pixel size of a letter a 14 Ariel font.
[int]$DescriptionPixelLength = ($Description.Length)*8.35
[int]$MiddleStartingPoint = 960 - ($DescriptionPixelLength/2)


#Get Average Color of bottom left corner of picture
Add-Type -Assembly System.Drawing
$filename = "$saveLocation"
$BitMap = [System.Drawing.Bitmap]::FromFile((Get-Item $filename).fullname) 

$Colors = @()
Foreach($y in (($Bitmap.Height-$HeightfromBottom)..($BitMap.Height-($HeightfromBottom-20)))){ 
        Foreach($x in ($MiddleStartingPoint..(($MiddleStartingPoint+$DescriptionPixelLength)))){ 
             
             $Pixel = $BitMap.GetPixel($X,$Y) 

                $R = $Pixel | select -ExpandProperty R
                $G = $Pixel | select -ExpandProperty G
                $B = $Pixel | select -ExpandProperty B
                $A = $Pixel | select -ExpandProperty A

                $Color = New-Object -TypeName psobject -Property ([ordered] @{
                                R = $R
                                G = $G
                                B = $B
                                A = $A
                                })

                $Colors += $Color

        }
}

#Big thanks to Andrew for finding this out the used by another process bug.
$BitMap.Dispose()

$AverageColor = New-Object -TypeName psobject -Property ([ordered] @{
                                R = $Colors.R | Measure-Object -Average | select -ExpandProperty Average
                                G = $Colors.G | Measure-Object -Average | select -ExpandProperty Average
                                B = $Colors.B | Measure-Object -Average | select -ExpandProperty Average
                                A = $Colors.A | Measure-Object -Average | select -ExpandProperty Average
                                })


#Set Font RGB values for image title text
if ($AverageColor.R -lt 128){$FontColorR = 255} 
if ($AverageColor.G -lt 128){$FontColorG = 255} 
if ($AverageColor.B -lt 128){$FontColorB = 255} 

if ($AverageColor.R -ge 128){$FontColorR = 0} 
if ($AverageColor.G -ge 128){$FontColorG = 0} 
if ($AverageColor.B -ge 128){$FontColorB = 0} 


#Converts Font Color to Black or White
if (($FontColorR + $FontColorB + $FontColorG) -ge 510){$FontColorR = 255; $FontColorG = 255; $FontColorB = 255} 
if (($FontColorR + $FontColorB + $FontColorG) -lt 510){$FontColorR = 0  ; $FontColorG = 0  ; $FontColorB = 0  } 


#Add Bing Image Title to lower left corner of image. Orignal code from http://www.ravichaganti.com/blog/?p=1012
Function Add-TextToImage {
    [CmdletBinding()]
    PARAM (
        [Parameter(Mandatory=$true)][String] $sourcePath,
        [Parameter(Mandatory=$true)][String] $destPath,
        [Parameter(Mandatory=$true)][String] $Title
    )
 
    Write-Verbose "Load System.Drawing"
    [Reflection.Assembly]::LoadWithPartialName("System.Drawing") | Out-Null
     
    Write-Verbose "Get the image from $sourcePath"
    $srcImg = [System.Drawing.Image]::FromFile($sourcePath)
     
    Write-Verbose "Create a bitmap as $destPath"
    $bmpFile = new-object System.Drawing.Bitmap([int]($srcImg.width)),([int]($srcImg.height))
 
    Write-Verbose "Intialize Graphics"
    $Image = [System.Drawing.Graphics]::FromImage($bmpFile)
    $Image.SmoothingMode = "AntiAlias"
     
    $Rectangle = New-Object Drawing.Rectangle 0, 0, $srcImg.Width, $srcImg.Height
    $Bottom = $srcImg.Height - $HeightfromBottom
    $Image.DrawImage($srcImg, $Rectangle, 0, 0, $srcImg.Width, $srcImg.Height, ([Drawing.GraphicsUnit]::Pixel))
 
    Write-Verbose "Draw title: $Title"
    $Font = new-object System.Drawing.Font("Arial", 14)
    $Brush = New-Object Drawing.SolidBrush ([System.Drawing.Color]::FromArgb(240,$FontColorR,$FontColorG,$FontColorB))
    $Image.DrawString($Title, $Font, $Brush, $MiddleStartingPoint, $Bottom)
    
    Write-Verbose "Save and close the files"
    $bmpFile.Save($savelocationwithdescriptionadded,[System.Drawing.Imaging.ImageFormat]::JPEG)
    $bmpFile.Dispose()
    $srcImg.Dispose()
}

Add-TextToImage -sourcePath $savelocation -destPath $savelocationwithdescriptionadded -Title $Description

Before continuing to the Group Policy portion, manually run the script once. You should see the current image from Bing.com saved to the file path specified in the first variable. You should see that same image along with the image description saved to the file path specified in the second variable. The text title color will change to contrast with the average color behind it.

[UPDATED 05/04/18]

This script now:

  • Centers the text
  • Accurately finds average background color of text regardless of text length.
  • Chooses either black or white for text font. Disable the two lines under #Converts Font Color to Black or White to restore funky colors
  • Able to write special symbols now. No more strange ?? symbols.
  • Able to run script multiple times in the same window. Thanks for Andrew for finding that problem!
  • Images and titles are now pulled directly from Bing instead of a 3rd party RSS feed.

Using Group Policy to Sync the Bing Image

Create a new GPO for your Bing Image configuration and link it to an OU containing computers. Under Computer Configuration\Policies\Windows Settings\Security Settings\File System, add a new entry for %SystemRoot%\Web\Wallpaper\Windows\img0.jpg and copy the permissions from the picture below.

Next, navigate to Administrative Templates\Control Panel\Personalization and enable Force a specific default lock screen and logon image. Set the value to: C:\windows\system32\oobe\info\backgrounds\backgroundDefault.jpg

In the same GPO, create three new File Preferences under Computer Configuration. The first preference uses a Create action and the second preference uses a Replace action. For both, the source should point to the JPG location that you entered for the $saveLocationWithDescriptionAdded variable. The target location for both preferences should be: C:\Windows\System32\oobe\info\backgrounds\backgroundDefault.jpg .

The third preference also uses a Replace action. The source should be C:\Windows\System32\oobe\info\backgrounds\backgroundDefault.jpg and the Target should be C:\Windows\Web\Wallpaper\Windows\img0.jpg .

Finally, configure a Registry preference under Computer Configuration matching the image below. This registry key is only need for Windows 7 clients so use an ILT to applies this key to just that operating system.

With all of that done, run a GPUpdate and reboot the computer. You should now see your Bing image (with the description) set as the logon and default background. If you have any questions or suggestions, let me know in the comments below!

01/22/18: Updated to fix ‘ symbol issues in the description text.

*Script Improvements to do (in case anyone else has a bit of spare time)

  • Figure out why script keeps withouttext\defaultBackground.jpg opened after completion
  • Figure out how to get pixel width of description instead of assuming 600 pixel width value.

Blogs that I Follow – (an early) 2018 Edition

Posted on by

Finding a mentor is one of the quickest ways to become an expert! Following technology blogs, either through email notifications or a service like Feedly, can give you access to experts around the globe. The collection below, organized by technology, lists any blogs that I follow. Items in blue are new as of the last update. Items crossed out are off my list. This list changes depending on the content of the blog, if the blog is still active, and what I am currently trying to master.

Of course, you can also subscribe to DeployHappiness by email (top right corner of any page) or through RSS: http://feeds.feedburner.com/Deployhappiness. If I missed any great blogs, let me know in the comments below!

Active Directory/Group Policy:

Desktop Management and Deployment:

Scripting/PowerShell:

Servers:

System Center:

Tech Information/Other:

  • Windows for IT Pros

A Year with Adaxes – Object Lifecycle Management

Posted on by

In part one of this series, we talked about the too many cooks in the kitchen problem. Any multi-management application has to deal with this; Active Directory is no different. On the mundane side, this can include attribute misspellings, missing group memberships, and misplaced users. On the catastrophic side, it can cause domain wide outages through accidental modifications or deletions!

Many organizations adopt a draconian response to this problem. They simply restrict all changes to a single (or few) administrator(s). Ironically, these AD administrators still use a domain administrator account for everything – greatly increasing the risk of an accidental slip or exposing permissions to malicious actors. The solution shouldn’t be draconian but it isn’t an egalitarian environment either. Instead, a nudge, role, and rule based approach is needed.

Nudging Away Problems

Nudges, or cues, push people toward correct choices. For example, the username field of a website may be populated with someone@YOURDOMAIN.com to instruct users to use a certain format. Introducing these nudges into Active Directory management can go a long way to fixing the problems above. In Adaxes, Property Patterns provide that nudge.

Each major object type has a builtin property pattern. The Computer Pattern is pictured above. These patterns should be modified to fit the naming convention of your environment and to specify the attributes that you need to fill. I like my computer names to be formatted like this: SITE-ROOM-STATIONNUMBER. For example, TEC-06-01 tells me that this computer is located at the TEC complex in room six and it is the first computer. All teacher machines are given the 01 station number so I also know that it is a staff computer. You can see that regex constraint below:

(TEC)(-)(.+)(-)(\d)(\d+)

A computer name pattern could be applied to the TEC OU and it can enforce all of those parameters. This eliminates mistakes like naming the computer TCE instead of TEC. It keeps everything in sequential order because the station number needs to be two digits long (09 instead of just 9).

Property patterns can also be used to provide drop down list. These lists work really well for departments, titles, and locations.

How many domain administrators should you have?

No user’s primary account should be a domain administrator. Whether you use Adaxes or not, your primary account should be a standard user. Like Microsoft’s Advanced Group Policy Management (AGPM), Adaxes uses a service account to manage content. During installation, this service account should be delegated permission to manage any applicable OUs or domains. This is the one time that you may use the domain administrator account for a specific task.

After delegation, permission changes are stored within the Adaxes configuration. Access to older AD object management tools should be restricted through AppLocker or native AD permission changes. If you have deployed AGPM, you should find these steps familiar. The service account user is made a service administrator – end users (including IT staff) should not use it to launch the Administration Console or to access the web consoles.

Users needing to manage Active Directory should be assigned to Security Roles. These roles group together common individual permissions into a single group like object. It is important to note that Adaxes is a layer on top of Active Directory. When a user is assigned to a security role, they are delegated permissions within Adaxes – permissions inside Active Directory are not modified.

Existing roles can quickly be copied and modified. For example, the Help Desk role works great for our regular IT staff. It provides too many permissions to our Help Desk interns though. By copying the Help Desk role, I can quickly remove the Disable User Account option from the new Security Role.

The Ghost in the Directory

Automation is the key to efficiency but your implementation may have hidden dangers. In our environment, many simple jobs are automated with Scheduled Tasks and PowerShell scripts. If your environment is like mine, ask yourself these questions:

  • Are the scripts ran with least privileged users?
  • Are the scripts designed and signed to prevent tampering?
  • Do the scripts centrally log changes?
  • Are changes and schedules clearly visible to everyone?

By solving all of your individual problems with individual solutions, you have accidentally created a ghost in the directory – a place where changes (good or bad) can happen with little oversight. A bug could cause an essential script to stop functioning without you knowing. A malicious attack could leverage the scheduled task and user account to inflict massive damage.

Business rules solve this problem by putting light onto your automation. These rules can be ran before or after nearly any action that you would take in Active Directory. Think about the three stages of a user object: creation, maintenance, and deletion. Each stage is ripe for a business rule. In fact, Adaxes has a default rule that can run after any user is created. Below, our business rule as a single trigger (after user creation) and five tasks that should run.

Business Rules are designed to bring any every aspect of an action. The After User Creation rule can create a folder on a file server, edit file permissions, configure Exchange settings, and modify Office365. Four difference management consoles are combined into a single action.

To take advantage of business rules, make a list of all actions that you would do during any life cycle stage of any object. For example, user maintenance often occurs when an employee changes positions. A trigger for user maintenance could occur when the user moves OUs. Actions could include attribute updates, emails to managers, and group membership changes.

Adaxes solves a lot of our problems with object life cycle management. It provides a clean way to group AD management, makes automation clearly visible, and nudges actions toward consistency. In our next post, we will look at configuring our web consoles and setting up self service for our staff.

Move Computers to OUs Automatically Based on Name – Redux

Posted on by

Way back in 2013, I put together a script to move computers to an OU based on a name prefix.  This worked really well for my former environment as we enforced a very strict naming convention. It did not work so well for other environments that did not use my naming convention. It didn’t handle multiple matching OUs very well. It also relied on the older Quest AD PowerShell cmdlets.

At the prompting of a few readers, I reworked this script to be more versatile and I removed the Quest AD cmdlets requirements. Change the OU location specified in line two to any OU that you want to target. For example, you can enter your New Computers / Unassigned Computers OU to automatically move computers to their appropriate locations. You can also use it to move computers from old sites to new sites after they have been renamed.

This script looks at each computer in the OU specified. It removes one character from the computer name and searches Active Directory for any other computer starting with that prefix. If no matches are found, it removes another character and searches again. You can see that searching in the orange text below.

If a single organizational unit match is found, it will move the computer to that OU. If multiple matching OUs are found, it will list the OUs. It will then cycle through each OU by asking if the computer should be moved there. In the picture above, you can see this process in the yellow, white, and green text.

The only two lines that can modify your environment are at line 30 and line 48. Both of these lines have the -whatif parameter added already. When you run the script with the -whatif parameters, you will be able to see where computers would end up being moved.

After you are comfortable with the end result, remove the -whatif parameters to make it so. If you want to set this script up to run automatically, remove lines 37-55. The script will then move any computer that matches a single OU but leave computers matching multiple OUs alone.

As always, please let me know if you have any suggestions or issues when running this script!

#The variable ($UnassignedComputersOU) should be in the distringuished name formart. EX: OU=Something,OU=SomethingELSE,DC=TEST,DC=local
[string]$UnassignedComputersOU = "OU=New Computers,OU=Sites,DC=TEST,DC=local"


Import-Module ActiveDirectory

$UnassignedComputers = Get-ADComputer -Filter * -SearchBase $UnassignedComputersOU | sort name

foreach ($UnassignedComputer in $UnassignedComputers){
    write-host ""
    $ComputerName = $UnassignedComputer.NAME

    #Filter out specific computer names here. 
    if ($ComputerName -notmatch "MININT"){
    $ComputerNameLength = $ComputerName.length
    
        Clear-Variable OUs -ErrorAction SilentlyContinue
        while ($OUs -eq $Null){
        $ComputerNameLength = $ComputerNameLength - 1 
        $Prefix = $ComputerName.substring(0,$ComputerNameLength)
        
        #Filter Canonicalname attribute by removing everything after last back slash, sorting for uniqueness, and removing the new computer/unassigned computer OU from list.
        $OUs = Get-ADComputer -Filter "Name -like '$Prefix*'" -Properties DistinguishedName | Select-Object -ExpandProperty DistinguishedName | sort
        $OUs = $OUs -replace '^[^,]*,',''
        $OUs = $OUs | Select-Object -Unique
        $Ous = $OUs | Where-Object {$_ -NE $UnassignedComputersOU}

        if ($OUs.Count -eq 1){
            Write-host "Moving $ComputerName to $OUs" -ForegroundColor Green
            Move-ADObject -Identity $UnassignedComputer.ObjectGUID -TargetPath $OUs -whatif | Out-Null
                
                If ($? -eq $True){
                        break
                }
            }

        if ($Ous.Count -gt 1){
        Write-Host ""
        Write-Host "Multiple OUs found for computername $ComputerName using computerprefix $Prefix" -ForegroundColor Yellow
        $OUs | Write-Host
        Write-Host ""

            foreach ($OU in $OUs){
                $Move = Read-host "Move $ComputerName to $OU ? Type YES to move or hit enter for NO"

                if ($Move -eq "YES"){
                Write-host "Moving $ComputerName to $OU" -ForegroundColor Green
                Move-ADObject -Identity $UnassignedComputer.ObjectGUID -TargetPath $OU -whatif | Out-Null
                
                    If ($? -eq $True){
                        break
                    }
                }
            }
        }
       
        else{
            Write-Warning "No matching OU found for prefix:$Prefix" 
        }
        
        } 
        Clear-Variable OUs -ErrorAction SilentlyContinue
    }
}