EmailRSS

Category Archives: Quick Tip

These short posts show how to do something very simply!

AD Documentation and Health Checks with PowerShell

Posted on by

I started looking for a streamlined way to perform routine Active Directory health checks. I stumbled across a PowerShell module, TestIMO, that is able to generate health check and best practice reports that look like this:

Image Source

On the blog post linked above, the author just casually mentions another module that he wrote – one to automate Active Directory Documentation. This module, PSWinDocumentation.AD, when paired with an output module (that the author also wrote), can create HTML dashboard documentation that looks like:

Image Source

Or fancy looking Word documents that look like:

Just the type of documentation needed in your DR plan.
Image Source

Here is a super quick start guide to using both of these tools!

Get Started with the AD Health Check PowerShell Tool

In PowerShell, install the module from the PowerShell Gallery by running: 

Install-Module TestIMO -scope CurrentUser

If this is your first time installing a PowerShell module this way, you’ll likely be prompted to install a few dependencies first.

Once the module is installed, run the following command to perform an AD health check within the PowerShell window:

Invoke-TestIMO

    or

Invoke-Testimo -showreport

To see these same results but in the pretty pie-chart version that was pictured earlier, go to the author’s page and scroll down to the Testimo – Extended Report section to view his script. You will need to install the PSWriteHTML module (same steps as above).

Get Started with the AD Documentation PowerShell Tool

In PowerShell, install the module from the PowerShell Gallery by running: 

Install-Module PSWinDocumentation.AD -scope CurrentUser

While you could technically run the new Get-WinADDomainInformation or Get-WinADForestInformation cmdlets that you have now, it would be a lot more useful to export results to a Dashboard or Document.

Scripts to export both of these can be found on this page.

You will need to install a few extra modules to run these scripts (Dashimo, PSWinReportingV2, and Documentimo).

Good luck on your health checks and enjoy that pretty AD documentation! A big thank you to Przemysław Kłys for these modules and scripts!

An Award and a New Job

Posted on by

Things have been quite busy this last month or so. Two awesome things have happened and I wanted to take a few minutes to share them.

First, I was awarded an MVP award for Cloud and Datacenter Management! Microsoft has done a ton of work to improve the MVP community these last couple of years and I am incredibly honored to still contribute to it.

Second, I started a major new job! I am now the proud dad to this little cmdlet[note]I have always liked the word cmdlet – sounds like a baby command[/note]. Right now, she only has three parameters but I hear their functions expand with age.

Sorry for the bad PowerShell puns…

I hope everyone has had a great summer so far! Feel free to give me your best dad advice or just let me know how your summer is going in the comments below.

Who can shutdown your servers?

Posted on by

Have you accidentally shut down a server or your own workstation? While you meant to just reboot, that device is now shutting down. It is even worse if it was a physical machine – at a remote location.

Not that I’m speaking from personal experience or anything…

Your task today is to prevent accidental shutdowns for your important machines. Let’s control who can shut down the system, using Group Policy[note]not to be confused with shutting down the system using Group Policy[/note].

I could have sworn I hit restart…

Often, every user that can log on interactively to a server also has permission to shut that server down. Open gpedit.msc on a server and browse to Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment. If you have any shared client machines (such as a jump machine/management VM), you will see Users listed. On a server OS, you won’t see Users listed by default. But ask yourself, do you really trust all of your administrators not to hit the wrong button? 🙂

Don’t edit the local computer policy. First, decide what accounts should have access to shut down[note]Does anyone else feel that shut down should be a single word? Like shutdown.[/note] a server. I limit this to the domain admin account, elevated admin accounts, and a few service accounts. Add these users to a security group named something like Security – URA – Shut down the system

Next, make your changes in the Group Policy Management Console. There are two common approaches to take. Either:

  • Create a new GPO named something like Security – URA – Shut down the system ; edit the setting pictured above, and link it to your servers / domain controllers OU.
  • Edit an existing general server GPO to restrict the shutdown permissions. If you do this route, make sure any server OUs with blocked inheritance and your domain controller OU is included.

Either way, be sure to comment why these changes were made, who made them, and when they were made. That is all that you need to do! With accidental shutdowns stopped, you won’t have to make the drive of shame to turn on that remote server.[note]Not that I’m speaking from personal experience or anything… [/note]

A Better Way to Remotely Reboot or Shutdown Computers on a Schedule

Posted on by

In the past, I have always used PSShutdown to restart a machine remotely or to schedule a reboot. An SCCM MVP introduced me to Coretech’s free shutdown tool. This tool is PSShutdown on steroids.

A restart prompt created by Coretech’s Shutdown Tool

First, you can download the tool from here. Extract the compressed folder to a share that authenticated users can read from. Later, you can use Group Policy to copy the folder down to local clients (if needed).

Read the arguments.txt file or run shutdowntool.exe /? to see how flexible this program is. To see a quick example, try running:

.\ShutdownTool.exe /t:7200 /m:1440 /r

To get rid of the background image, rename shutdowntool.exe to shutdowntool.exe.with_a_background. Rename ShutdownTool_NoBack.exe to shutdowntool.exe.[note]Or just run shutdowntool_noback.exe instead.[/note]

To change the description that appears in the popup, rename ShutdownTool.txt to ShutdownTool.txt.old. Rename ShutdownTool_NoBack.rtf to ShutdownTool.rtf and edit the RTF document. Finally, replace ShutdownTool.png with your logo or rename it to remove the logo.

Try rerunning this command and you should have a much cleaner shutdown tool that prevents your users from getting angry at a forced restart.

.\ShutdownTool.exe /t:7200 /m:1440 /r

To be safe, I like to add a registry check to ensure that the tool is only running on a client OS.

.\ShutdownTool.exe /t:7200 /m:1440 /r /er:"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallationType"=="Client"

To provide one more example, you may want to skip a restart if a certain application is running. For example, we would never want to restart a machine if it is providing a standardized test to a student.

.\ShutdownTool.exe /t:7200 /m:1440 /r /eps:"DRCInsight.exe!="

Finally, I also use this tool for two other scenarios. First, all of our client computers are set to restart if they have been online for more than a week. While automatic restarts do make for a smooth day, some of our admin staff [note]Myself included.[/note] need a bit of a prompt to reboot. Second, we use this tool when a piece of software needs updating, and a reboot will be required. This tool can be used at the beginning of that process as a way to get the user to close the application and again at the end to let the user know that they need to restart.

If you have any bright ideas on how to use this tool, leave a comment as I would love to see them!

Creating a Find Printers in the Directory Shortcut for Users

Posted on by

We give our staff instructions on adding printers to their computer by using the Find Printer in the directory, based on location or feature Control Panel tool. Because all of our printers have a location attribute set, our users see just the printers in their building or in their department.

After years of using this method, I just found out that I can create printer searching shortcuts for my staff!! With one click, they see the printers available to them. To create a Find Printers shortcut, copy this code and save it as Printers.qds

[CommonQuery]
Handler=5EE6238AC231D011891C00A024AB2DBBC1
Form=70F077B5E27ED011913F00AA00C16E65DB
[DsQuery]
ViewMode=0413000017
EnableFilter=0000000000

Double click on the Printer.QDS file and the Find Printers window should open. Add any custom searches (location, duplexing, etc.) and then select File – Save Search.

You should then be prompted to save a new .QDS file. Generate as many of these as you need and then make it easy for your users to find them. For example, deploy site-specific ones to the default Programs directory so that users can quickly see it in the Start Screen/Menu.