EmailRSS

Category Archives: Group Policy

This category contains any Group Policy related posts.

KList Purge and GPUpdate Security Group Members

Posted on by

Security Group membership changes require a reboot before a computer can apply them. This prevents any newly filtered and scoped GPOs from applying as well. A past article showed how to use the built-in Klist tool to refresh the machine ticket and avoid that reboot.

But what if you need to KList Purge a bunch of computers? The script, below, will purge/refresh the system ticket and run a GPUpdate on all computers in a security group.

You could string together the psexec commands into a single line or call the commands as a batch file to make it more efficient. For simplicity of sharing, I left it as two separate commands.

Enjoy!

Write-Host "This script will refresh the system token and gpupdate all computers in a group."
$GroupName = Read-Host "What is the group name?"

$ADGroup = get-adgroup -Identity $GroupName

if ($? -eq $true){

    $Computers = Get-ADGroupMember -identity "$GroupName" -Recursive  | Where ObjectClass -eq computer

    Write-Host $GroupName contains $Computers.Count devices. Press enter to refresh the token and gpupdate this group.
    pause

    foreach ($Computer in $Computers){
        $ComputerName = $Computer.Name
        write-host $ComputerName
            &psexec.exe \\$ComputerName -accepteula -d -h -s -n 2 "c:\windows\System32\klist.exe" -li 0x3e7 purge
            &psexec.exe \\$ComputerName -accepteula -d -h -s -n 2 "c:\windows\System32\gpupdate.exe"
    }
}

What port am I connected to? CDP / LLDP for Windows.

Posted on by

You are fixing a flakey network connection and you suspect the switch port is messing up. How do you find the port that it is plugged into? Trace the cable? Use exquisitely detailed network maps? Be blessed enough to have properly labeled wall jacks? If you are still reading this, those options are not available or you want a better way. Well, read on!

LDWin is an open source link discovery tool that brings Cisco Discovery Protocol (CDP) and Link Layer Discovery Protocol (LLDP) to Windows. It displays the name, IP, VLAN, and port of the switch that you are connected to. You can download LDWin from here.

Using Group Policy Preferences, I deploy LDWin to all of my computers. I use a file preference to stick it in a local tools folder.

I then use a shortcut preference to add a link to Windows Administrative Tools. This provides quick access from the Start Menu for any administrator (as UAC will be triggerred when LDWin is opened).

By using LDWin and distributing it with Group Policy, I can quickly find what port any computer is using. A big thanks to Chris Hall for this tool. Now, if only I had a program that could find the other end of my cable tester. Those dang dongles disappear!

How to Make Teams Silently Install and Auto Login

Posted on by

Installing Microsoft Teams is easy. Getting Teams to silently install, auto login, and customized for your environment is a bit more work.

By using Group Policy or SCCM, you can have Teams auto starting, running in the background, and visible in the notification areas for all users. Let’s start with deployment.

Deploying Microsoft Teams Silently

Download the x64 machine-wide installers from here: https://teams.microsoft.com/downloads/desktopurl?env=production&plat=windows&arch=x64&managedInstaller=true&download=true

Using Group Policy Software Installation or SCCM, deploy the MSI. The only MSI parameter that I use is ALLUSERS=1 . This installer is a little weird. It will copy a couple of files into ProgramFiles(x86)\Teams Installer.

Teams is installed to the Teams Installer folder in ProgramFiles (x86).

Out of the box, Teams will try to auto start for every user that logs in to a computer by running the \Teams Installer\Teams.exe file. There are a few ways to stop this.

You can use the installation parameter OPTIONS=”noAutoStart=true” . If you did this, your installation command might look like: msiexec /i Teams_windows_x64.msi OPTIONS=”noAutoStart=true” ALLUSERS=1 .

You can also use Group Policy. The Group Policy method provides an easy on/off switch in case you change your mind about autostarting in the future. Download and import the latest Office365 ADMX files into your Group Policy Central Store. And then enable the Prevent Microsoft Teams from starting automatically after installation under Administrative Templates\Microsoft Teams.

I went with a slightly modified Group Policy method because I do not let programs start automatically from the default Run list. Instead, I use a Group Policy Registry Preference Item. This item adds a run once key that starts the Teams Installer executable on logon.

Setting Teams to Auto Login and Open in the Background

Most user settings for Teams, including the Open Application in Background setting are stored in %APPDATA%\Microsoft\Teams\desktop-config.json.

Open your desktop-config.json file[note]I use Visual Studio Code, but any basic text editor will work[/note] and find the appPreferenceSettings section. Set openAsHidden, openAtLogin, registerAsIMProvider [note]This will set Teams as the default IM app for office and let users see presence information (like online, away, busy, etc.) in Outlook[/note], and runningOnClose as true.

Here is a snippet from my JSON showing those settings:

"appPreferenceSettings":{"disableGpu":false,"openAsHidden":true,"openAtLogin":true,"registerAsIMProvider":true,"runningOnClose":true}

Copy your edited JSON to a network location and deploy it to your user’s roaming appdata. I use Group Policy File Preferences to do this and I have the preference action set to Update.

While you are working in Group Policy Preferences, create an item to delete the Microsoft Teams shortcut that is created on the desktop. Without this, a new Microsoft Teams shortcut is created on every computer that you login on.

If you prevent programs from starting automatically on logon, add %APPDATA%\Microsoft\Windows\Start Menu\Programs\Microsoft Corporation\Microsoft Teams.lnk to your Run these programs at user logon allow list.

Stop Teams Firewall Prompt and Add Notification Icon

There are two final customizations to make. First, let’s get rid of the firewall prompt that can appear when someone starts a Teams call or screen share.[note]Teams will still work if the user cancels the Firewall prompt but I still do not want them to worry about this prompt.[/note]

Copy the below PowerShell script and make it run as a logon/logon PowerShell script in Group Policy. Most of my staff will not jump into Teams on the first logon so I set it as a logoff script as it isn’t a big deal if it runs multiple times.

new-netfirewallRule -name ${UserName}-Teams.exe-tcp -Displayname ${UserName}-Teams.exe-tcp -enabled:true -Profile Any -Direction Inbound -Action Allow -program ${LocalAppData}\microsoft\teams\current\teams.exe -protocol TCP

new-netfirewallRule -name ${UserName}-Teams.exe-udp -Displayname ${UserName}-Teams.exe-udp -enabled:true -Profile Any -Direction Inbound -Action Allow -program ${LocalAppData}\microsoft\teams\current\teams.exe -protocol UDP

Because you set Teams to automatically start and run in the background, you may want it to always appear in the Notification Area (clock location in the bottom right). This gives users an easy way to see notifications and open Teams. To do so, use this PowerShell script:

<#
Set the $ProgramName to the program that needs to stay visible. Tea is the correct program name for Microsoft Teams

Source: https://4sysops.com/archives/forcing-notification-area-icons-to-always-show-in-windows-7-or-windows-8/
#>

$ProgramName = "Tea"
$Setting = 2
$encText = New-Object System.Text.UTF8Encoding
[byte[]] $bytRegKey = @()
$strRegKey = ""
$bytRegKey = $(Get-ItemProperty $(Get-Item 'HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify').PSPath).IconStreams
for($x=0; $x -le $bytRegKey.Count; $x++)
{
$tempString = [Convert]::ToString($bytRegKey[$x], 16)
switch($tempString.Length)
{
0 {$strRegKey += "00"}
1 {$strRegKey += "0" + $tempString}
2 {$strRegKey += $tempString}
}
}

[byte[]] $bytTempAppPath = @()
$bytTempAppPath = $encText.GetBytes($ProgramName)
[byte[]] $bytAppPath = @()
$strAppPath = ""

Function Rot13($byteToRot)
{
if($byteToRot -gt 64 -and $byteToRot -lt 91)
{
$bytRot = $($($byteToRot - 64 + 13) % 26 + 64)
return $bytRot
}
elseif($byteToRot -gt 96 -and $byteToRot -lt 123)
{
$bytRot = $($($byteToRot - 96 + 13) % 26 + 96)
return $bytRot
}
else
{
return $byteToRot
}
}

for($x = 0; $x -lt $bytTempAppPath.Count * 2; $x++)
{
If($x % 2 -eq 0)
{
$curbyte = $bytTempAppPath[$([Int]($x / 2))]
$bytAppPath += Rot13($curbyte)
}
Else
{
$bytAppPath += 0
}
}

for($x=0; $x -lt $bytAppPath.Count; $x++)
{
$tempString = [Convert]::ToString($bytAppPath[$x], 16)
switch($tempString.Length)
{
0 {$strAppPath += "00"}
1 {$strAppPath += "0" + $tempString}
2 {$strAppPath += $tempString}
}
}

if(-not $strRegKey.Contains($strAppPath))
{
Write-Host Program not found. Programs are case sensitive.
break
}

[byte[]] $header = @()
$items = @{}

for($x=0; $x -lt 20; $x++)
{
$header += $bytRegKey[$x]
}

for($x=0; $x -lt $(($bytRegKey.Count-20)/1640); $x++)
{
[byte[]] $item=@()
$startingByte = 20 + ($x*1640)
$item += $bytRegKey[$($startingByte)..$($startingByte+1639)]
$items.Add($startingByte.ToString(), $item)
}

foreach($key in $items.Keys)
{
$item = $items[$key]
$strItem = ""
$tempString = ""
for($x=0; $x -le $item.Count; $x++)
{
$tempString = [Convert]::ToString($item[$x], 16)
switch($tempString.Length)
{
0 {$strItem += "00"}
1 {$strItem += "0" + $tempString}
2 {$strItem += $tempString}
}
}
if($strItem.Contains($strAppPath))
{
Write-Host Item Found with $ProgramName in item starting with byte $key
$bytRegKey[$([Convert]::ToInt32($key)+528)] = $setting
Set-ItemProperty $($(Get-Item 'HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify').PSPath) -name IconStreams -value $bytRegKey
ps explorer | kill
}
}

The script, above, will refresh the Explorer process which makes the screen “flicker” once. I set the script to run through a Scheduled Task that waits for Idle. This allows me to deploy it through Group Policy Preferences and ensure it does not run when someone is using their computer.

That is a lot of work for a single app! Hopefully, this guide made it a bit easier for you. Depending on the route you took, you should now have a Teams setup that is automatically installs, auto starts, runs in the background, and is generally unobtrusive for your users.

Syncing SCCM Collections to AD Security Groups

Posted on by

Building SCCM collections and syncing members to an AD security group opens a multitude of new management options for you. For example:

You can improve Group Policy processing time by eliminating WMI filters.[note]Sync OS version collections to a security group to remove the need for an OS WMI filter or sync a laptop collection to a security group to target offline file/wireless settings without WMI.[/note]

or

You could query information about installed software and add computers to security groups that enforce Group Policy Administrative templates for those applications.

To get started with syncing SCCM collections, open the SCCM console. In the top left, select the down arrow and choose Connect via Windows PowerShell ISE.

A new PowerShell ISE window should open with about 30 lines of code. Scroll to the very bottom and add a few blank lines.

Paste in the following:

#Sync SCCM Collections to AD Security Groups

#YOUR COLLECTION NAME HERE
$CollectionMembers = Get-CMDevice -CollectionId COLLECTIONID| Select -Property Name | Sort-Object Name
foreach ($CollectionMember in $CollectionMembers) {
    $Member = Get-ADComputer $CollectionMember.name
    Add-ADGroupMember -Identity "SECURITY GROUP NAME" -Members $Member.ObjectGUID -verbose
}

Find your collection ID in the SCCM console and add it on the $CollectionMembers line. Put your security group name on the Add-ADGroupMember line. Copy and paste those last 5-6 lines for each collection that needs to be synced to AD.

Setup this script to run as a scheduled task. The computer running this script will need the RSAT Active Directory PowerShell module installed and the SCCM PowerShell module. Be sure that the user running your task can both read the SCCM collection members and write to the specified AD groups. I like saving this script to a Scripts folder on the Primary site and setting it to run every few hours. I also recommend adding a note to the AD security group that members are synced from SCCM – this will avoid a lot of confusion for people later![note]Ask me how I know.[/note]

Let me know how you plan on using this script or if you have any issues when syncing SCCM to AD.

SCCM Device Collections for Primary User Groups

Posted on by

Would you like an automated way to group computers by the role of their primary user? For example, do you want a collection that shows all the primary staff computers and another that shows all shared computers in your environment?

If you already have AD security groups for any group of users, you can quickly create a SCCM collection containing the primary computers belonging to those users. You can also create the inverse for any of these. Here is how the collection query language would look that shows the primary computers for the group DOMAIN\\GROUPNAME

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System    LEFT JOIN SMS_UserMachineRelationship ON       SMS_UserMachineRelationship.ResourceID = SMS_R_System.ResourceId        WHERE SMS_UserMachineRelationship.UniqueUserName IN    (SELECT SMS_R_User.UniqueUserName      FROM SMS_R_User     WHERE SMS_R_User.SecurityGroupName = 'DOMAIN\\GROUPNAME')

To use this, just specify the group name on the very last line.

Let’s say you work in education and want a collection showing all staff computers, all student computers, and computers that are used by generic users/non staff or student users). You would create three collections. The first two would use the collection query language from above. You would set the SMS_R_User.SecurityGroupName value for a staff group in the first collection and a student group in the second collection. The third collection would include all computers and exclude these two other collections.

With those three collections, you could do a couple of extra things like:

  • Export the collection members to AD security groups.
  • Sort computers into sub-OUs automatically based on their primary user.

Because this data updates within SCCM automatically, you don’t have to worry about the administrative overhead of updating them. Hopefully, this type of hybrid collection will make your environment a bit easier to manage!