DeployHappiness | Tag Archives: Group Policy

KList Purge and GPUpdate Security Group Members

Posted on January 18, 2023 by Joseph Moody

Security Group membership changes require a reboot before a computer can apply them. This prevents any newly filtered and scoped GPOs from applying as well. A past article showed how to use the built-in Klist tool to refresh the machine ticket and avoid that reboot.

But what if you need to KList Purge a bunch of computers? The script, below, will purge/refresh the system ticket and run a GPUpdate on all computers in a security group.

You could string together the psexec commands into a single line or call the commands as a batch file to make it more efficient. For simplicity of sharing, I left it as two separate commands.

Enjoy!

Write-Host "This script will refresh the system token and gpupdate all computers in a group."
$GroupName = Read-Host "What is the group name?"

$ADGroup = get-adgroup -Identity $GroupName

if ($? -eq $true){

    $Computers = Get-ADGroupMember -identity "$GroupName" -Recursive  | Where ObjectClass -eq computer

    Write-Host $GroupName contains $Computers.Count devices. Press enter to refresh the token and gpupdate this group.
    pause

    foreach ($Computer in $Computers){
        $ComputerName = $Computer.Name
        write-host $ComputerName
            &psexec.exe \\$ComputerName -accepteula -d -h -s -n 2 "c:\windows\System32\klist.exe" -li 0x3e7 purge
            &psexec.exe \\$ComputerName -accepteula -d -h -s -n 2 "c:\windows\System32\gpupdate.exe"
    }
}

How to Make Teams Silently Install and Auto Login

Posted on November 2, 2020 by Joseph Moody

Installing Microsoft Teams is easy. Getting Teams to silently install, auto login, and customized for your environment is a bit more work.

By using Group Policy or SCCM, you can have Teams auto starting, running in the background, and visible in the notification areas for all users. Let’s start with deployment.

Deploying Microsoft Teams Silently

Download the x64 machine-wide installers from here: https://teams.microsoft.com/downloads/desktopurl?env=production&plat=windows&arch=x64&managedInstaller=true&download=true

Using Group Policy Software Installation or SCCM, deploy the MSI. The only MSI parameter that I use is ALLUSERS=1 . This installer is a little weird. It will copy a couple of files into ProgramFiles(x86)\Teams Installer.

Teams is installed to the Teams Installer folder in ProgramFiles (x86).

Out of the box, Teams will try to auto start for every user that logs in to a computer by running the \Teams Installer\Teams.exe file. There are a few ways to stop this.

You can use the installation parameter OPTIONS=”noAutoStart=true” . If you did this, your installation command might look like: msiexec /i Teams_windows_x64.msi OPTIONS=”noAutoStart=true” ALLUSERS=1 .

You can also use Group Policy. The Group Policy method provides an easy on/off switch in case you change your mind about autostarting in the future. Download and import the latest Office365 ADMX files into your Group Policy Central Store. And then enable the Prevent Microsoft Teams from starting automatically after installation under Administrative Templates\Microsoft Teams.

I went with a slightly modified Group Policy method because I do not let programs start automatically from the default Run list. Instead, I use a Group Policy Registry Preference Item. This item adds a run once key that starts the Teams Installer executable on logon.

Setting Teams to Auto Login and Open in the Background

Most user settings for Teams, including the Open Application in Background setting are stored in %APPDATA%\Microsoft\Teams\desktop-config.json.

Open your desktop-config.json file[note]I use Visual Studio Code, but any basic text editor will work[/note] and find the appPreferenceSettings section. Set openAsHidden, openAtLogin, registerAsIMProvider [note]This will set Teams as the default IM app for office and let users see presence information (like online, away, busy, etc.) in Outlook[/note], and runningOnClose as true.

Here is a snippet from my JSON showing those settings:

"appPreferenceSettings":{"disableGpu":false,"openAsHidden":true,"openAtLogin":true,"registerAsIMProvider":true,"runningOnClose":true}

Copy your edited JSON to a network location and deploy it to your user’s roaming appdata. I use Group Policy File Preferences to do this and I have the preference action set to Update.

While you are working in Group Policy Preferences, create an item to delete the Microsoft Teams shortcut that is created on the desktop. Without this, a new Microsoft Teams shortcut is created on every computer that you login on.

If you prevent programs from starting automatically on logon, add %APPDATA%\Microsoft\Windows\Start Menu\Programs\Microsoft Corporation\Microsoft Teams.lnk to your Run these programs at user logon allow list.

Stop Teams Firewall Prompt and Add Notification Icon

There are two final customizations to make. First, let’s get rid of the firewall prompt that can appear when someone starts a Teams call or screen share.[note]Teams will still work if the user cancels the Firewall prompt but I still do not want them to worry about this prompt.[/note]

Copy the below PowerShell script and make it run as a logon/logon PowerShell script in Group Policy. Most of my staff will not jump into Teams on the first logon so I set it as a logoff script as it isn’t a big deal if it runs multiple times.

new-netfirewallRule -name ${UserName}-Teams.exe-tcp -Displayname ${UserName}-Teams.exe-tcp -enabled:true -Profile Any -Direction Inbound -Action Allow -program ${LocalAppData}\microsoft\teams\current\teams.exe -protocol TCP

new-netfirewallRule -name ${UserName}-Teams.exe-udp -Displayname ${UserName}-Teams.exe-udp -enabled:true -Profile Any -Direction Inbound -Action Allow -program ${LocalAppData}\microsoft\teams\current\teams.exe -protocol UDP

Because you set Teams to automatically start and run in the background, you may want it to always appear in the Notification Area (clock location in the bottom right). This gives users an easy way to see notifications and open Teams. To do so, use this PowerShell script:

<#
Set the $ProgramName to the program that needs to stay visible. Tea is the correct program name for Microsoft Teams

Source: https://4sysops.com/archives/forcing-notification-area-icons-to-always-show-in-windows-7-or-windows-8/
#>

$ProgramName = "Tea"
$Setting = 2
$encText = New-Object System.Text.UTF8Encoding
[byte[]] $bytRegKey = @()
$strRegKey = ""
$bytRegKey = $(Get-ItemProperty $(Get-Item 'HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify').PSPath).IconStreams
for($x=0; $x -le $bytRegKey.Count; $x++)
{
$tempString = [Convert]::ToString($bytRegKey[$x], 16)
switch($tempString.Length)
{
0 {$strRegKey += "00"}
1 {$strRegKey += "0" + $tempString}
2 {$strRegKey += $tempString}
}
}

[byte[]] $bytTempAppPath = @()
$bytTempAppPath = $encText.GetBytes($ProgramName)
[byte[]] $bytAppPath = @()
$strAppPath = ""

Function Rot13($byteToRot)
{
if($byteToRot -gt 64 -and $byteToRot -lt 91)
{
$bytRot = $($($byteToRot - 64 + 13) % 26 + 64)
return $bytRot
}
elseif($byteToRot -gt 96 -and $byteToRot -lt 123)
{
$bytRot = $($($byteToRot - 96 + 13) % 26 + 96)
return $bytRot
}
else
{
return $byteToRot
}
}

for($x = 0; $x -lt $bytTempAppPath.Count * 2; $x++)
{
If($x % 2 -eq 0)
{
$curbyte = $bytTempAppPath[$([Int]($x / 2))]
$bytAppPath += Rot13($curbyte)
}
Else
{
$bytAppPath += 0
}
}

for($x=0; $x -lt $bytAppPath.Count; $x++)
{
$tempString = [Convert]::ToString($bytAppPath[$x], 16)
switch($tempString.Length)
{
0 {$strAppPath += "00"}
1 {$strAppPath += "0" + $tempString}
2 {$strAppPath += $tempString}
}
}

if(-not $strRegKey.Contains($strAppPath))
{
Write-Host Program not found. Programs are case sensitive.
break
}

[byte[]] $header = @()
$items = @{}

for($x=0; $x -lt 20; $x++)
{
$header += $bytRegKey[$x]
}

for($x=0; $x -lt $(($bytRegKey.Count-20)/1640); $x++)
{
[byte[]] $item=@()
$startingByte = 20 + ($x*1640)
$item += $bytRegKey[$($startingByte)..$($startingByte+1639)]
$items.Add($startingByte.ToString(), $item)
}

foreach($key in $items.Keys)
{
$item = $items[$key]
$strItem = ""
$tempString = ""
for($x=0; $x -le $item.Count; $x++)
{
$tempString = [Convert]::ToString($item[$x], 16)
switch($tempString.Length)
{
0 {$strItem += "00"}
1 {$strItem += "0" + $tempString}
2 {$strItem += $tempString}
}
}
if($strItem.Contains($strAppPath))
{
Write-Host Item Found with $ProgramName in item starting with byte $key
$bytRegKey[$([Convert]::ToInt32($key)+528)] = $setting
Set-ItemProperty $($(Get-Item 'HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify').PSPath) -name IconStreams -value $bytRegKey
ps explorer | kill
}
}

The script, above, will refresh the Explorer process which makes the screen “flicker” once. I set the script to run through a Scheduled Task that waits for Idle. This allows me to deploy it through Group Policy Preferences and ensure it does not run when someone is using their computer.

That is a lot of work for a single app! Hopefully, this guide made it a bit easier for you. Depending on the route you took, you should now have a Teams setup that is automatically installs, auto starts, runs in the background, and is generally unobtrusive for your users.

Automatic Disk Cleanup with Group Policy and SCCM

Posted on February 3, 2020 by Joseph Moody

While Windows does an OK job of preventing low disk space, you can use Group Policy or SCCM to vastly improve those tasks and prevent low disk space problems on your clients.

In my environment, we had a few dozen machines with less than 10% free disk space. By using this setup, we now have zero and a few dozen less problems to worry about! When we purchase new computers, we are saving $100 per machine because we know that we can use a smaller SSD.

Setting up an automatic disk cleanup requires two components. First, you need a way to filter out machines that have low disk space from normal machines. Group Policy or SCCM can do this for you. Even though I personally use SCCM to do this, I’ll outline how to use both tools.

Second, you need a way to tighten the existing cleanup tasks while expanding the low disk cleanup to other common space hogs. SCCM can do this but Group Policy is my preferred solution for most of the settings.[note]Sometimes, low disk space can prevent the SCCM client from behaving normally but Group Policy will still apply normally.[/note]

Finding Machines with Low Disk Space Using Group Policy

To find these computers with Group Policy, we can use a WMI Filter. If you have access to SCCM, I would recommend using SCCM to find computers instead – skip to the next heading.

If you do not have SCCM, Group Policy will work just fine. You won’t have access to reporting and processing will be a fraction slower. WMI filters do have to process every time and slow down Group Policy processing. This WMI filter is fast (.50ms on my test machine), so it is not a huge deal.

If you are using Group Policy, open the Group Policy Management Console and head down to the WMI Filters section. Create a new WMI filter and paste in the following query:

Select * from Win32_LogicalDisk where VolumeName = "OSDisk" AND FreeSpace < 10000000000

This query will equal TRUE on any computer when the OSDisk volume has less than 10GBs of free space. If you wish to apply the disk cleanup to all drives (including external/USB drives) in the machine, remove the VolumeName section. You can also adjust the FreeSpace size or reverse the less than symbol to a greater than symbol for testing.

If you do not have access SCCM, skip to the Cleaning Up Disk Space with Group Policy section – at the bottom of this article.

Find Machines with Low Disk Space Using SCCM

The Hardware Inventory in SCCM can be used to find computers with low disk space. From that, you can build out a Low Disk Space collection and target those devices with additional cleanup tasks.

First, make sure that your clients are reporting their Logical Disk Free Space in the hardware inventory. Under Administration/Client Settings, open your default client settings and select Hardware Inventory. Next, select Set Classes. Finally, expand Logical Disk (SMS_LogicalDisk) and ensure that Free Space (MB) is checked). If is not checked, check it and continue on – clients just won’t populate into your Low Disk Space collection until their next Hardware Inventory cycle.

Now, create a new Device Collection and add in the following query statement:

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_LOGICAL_DISK on SMS_G_System_LOGICAL_DISK.ResourceID = SMS_R_System.ResourceId where SMS_G_System_LOGICAL_DISK.FreeSpace <= 10000 and SMS_G_System_LOGICAL_DISK.VolumeName = "OSDisk"

Notice that is query is virtually the same as the Group Policy WMIFilter. The FreeSpace is measured in megabytes for SCCM instead of just bytes for Group Policy.

Cleaning Up Disk Space with SCCM

If you have SCCM, you can technically use it for all of the cleanup settings that are set using Group Policy in the section below. I find these settings easier and more reliable to implement with Group Policy.

For SCCM, we are only concerned with the client cache size. In the Configuration Manager console, create a new Client Device Settings. Under Client Cache Settings, set the Maximum cache size (either percentage of disk or MB) to a very low value.

Deploy these settings to just your Low Disk Space device collection.

Finally, create a new group in Active Directory that has the same name as your Low Disk Space device collection. Use these steps to sync your SCCM collection to that AD group. We will use this group to apply the Group Policy cleanup tasks.

Cleaning Up Disk Space with Group Policy

In the Group Policy Management Console, create a new GPO named something like “Cleanup Computers with Low Disk Space”.

If you are using the WMI filter to target your computers, leave the Security Filtering to Authenticated Users and set the WMI filter from None to your Low Disk filter.

If you are syncing a SCCM device collection to an AD security group, remove Authenticated Users and add your group to the Security Filtering section – don’t set a WMI filter.

Edit your GPO and add the following PowerShell shutdown script:

# Remove all items in these directories
Remove-Item -recurse -force "C:\Windows\Prefetch\*"
Remove-Item -recurse -force "C:\Windows\Temp\*"
Remove-Item -recurse -force "C:\Windows\Logs\CBS\*"
#Offline Files
Remove-Item -recurse -force "C:\Windows\CSC\v2.0.6\namespace\*"

Remove-Item -recurse -force "C:\Users\*\AppData\Roaming\Microsoft\Windows\Recent Items\*"

# Remove items with exclusions
Remove-Item -recurse -force c:\Users\*\AppData\Local\* -exclude "Microsoft","Google"

Most of the files removed should be temp files. The exception is the \namespace\ line as it removes Offline files synced from a DFS namespace and the final line (exclusions line). When testing this, you may want to remove the Offline Files line and check the local user appdata folder for additional items to exclude.

Under Computer Configuration, set the following Administrative Templates – as pictured below:

In our environment, we had one final culprit that ate up disk space. Folder Redirection with Offline Files on shared desktops. To fix this, we can create a Registry Group Policy Preference to nuke the entire offline file cache. To do this, create a new computer side Registry preference:

Hive: HKLM
Key Path: SYSTEM\CurrentControlSet\Services\CSC\Parameters
Value Name: FormatDatabase
Value Type: Dword
Value Data: 1

Most of these settings only apply on a shutdown so it might take a reboot or two to see them in action.

With all of this setup, you should no longer see computers with low disk space. This will prevent helpdesk calls and might even let you purchase smaller drives for your computers. If you have any suggestions or improvements, I would love to hear about them – just leave me a comment!

Pages

Archives

Categories

WordPress

Subscribe