EmailRSS

Tag Archives: Server

Desktop Central – a replacement for WSUS, GPSI, and much more.

Posted on by

This post is sponsored by ManageEngine. What’s this? 

For most organizations, including larger non-profits, centralized machine management is just something of a dream. These environments face two large hurdles: lack of funding and stretched support staff. I see this all of the time in education – many of our school systems do not quite reach the threshold where a product like System Center is required. Instead, these administrators are stuck in a management purgatory where they can’t find the funds for individual products and do not have the time to learn multiuse tools.

This problem has scaled in the last few years. Mobile devices and non-domain joinable hardware continues to spread. Many of these devices do not have a management system. The ones that do are completely incompatible with each other. The time strapped admin certainly does not have the resources to learn many different mobile device management systems. For a product to be successful in this environment, it must answer yes to three questions:

  • Is it capable of managing traditional and mobile devices in one pane?
  • Is it easy for an administrator to learn and use?
  • Is it affordable over the long term?

Today, we are going to review ManageEngine’s Desktop Central and see how it stands up to our three problems.

Test 1: Managing traditional and mobile devices

If your environment is anything like mine, you have a lot of different device types to support. I have supported environments with domain-joined Windows machines, workgroup machines, iPads, Macs, Android tablets, and Ubuntu boxes. That list was just the client side of the equation!

Desktop Central’s name is a bit misleading. It supports a whole lot more than just desktops. You will find support for Windows, Apple, and Linux operating systems. This includes client and server versions. It also supports Android, iOS, and Windows mobile devices.

Even though it is not something to brag about, some organizations are still stuck with legacy machines running Windows XP, Vista, and older versions of Windows Server. I am willing to bet that this problem will be a lot worse on Jan. 15 2020 as Windows 7 will have reached end of life. A nice and surprising thing about Desktop Central is their support for end of life operating systems. Organizations that are stuck with these older machines still have full management capacity through Desktop Central.

What about management features though? This single product can handle patch management, software deployment, asset management, and configuration. Mobile Device Management can handle over the air enrollment, profile management, app deployment, and security configuration. Both devices types (traditional/mobile) have detailed auditing and reporting features. Of particular note is the integration between tools. For example, logged on user reporting ties into the remote desktop control tool. It is safe to say that Desktop Central passes our first test in spades.

Test 2: Ease of Use

First impressions can be everything. For software, that impression is formed in the installation stage. How difficult is the installation for Desktop Central? Not difficult at all. Everything is contained in a single download and the wizard is a simple straightforward process. The management portion of Desktop Central does have to be installed on a Windows OS (client or server). In the future, it would be nice to install the management components on a Linux OS as well.

Once installed, you can begin managing devices. The entire product is web based, which is awesome in my opinion. Each management component has a standardized UI and is very intuitive. Useful metrics are upfront and centered. FAQ, a Knowledge Base, and instructional videos are available at the bottom of each screen. The web-based console is also customizable through the use of widgets.

When using Desktop Central, I can’t help but to compare it against native solutions. This makes me aware of how many shortcomings those built in tools have. How would you deploy software in your environment that only comes as an executable?  How would you generate a detailed list of machines and their unpatched vulnerabilities? These two common problems are clunky and difficult to solve in a native Windows environment. Group Policy Software Installation was never designed to be a full software deployment tool and WSUS does just enough to frustrate you. Both have partially built features that make you wonder if Microsoft is not trying to upsell you (GPSI User Driven Installations come to mind). Try imagining these scenarios stretched across non-Windows operating systems.  Overall, Desktop Central is very easy to setup and use!

Patch Management in Desktop Central

Test 3: Affordability

When purchasing software, I am reminded of a funny quote.

If SpaceX’s website can tell me the cost to put something into orbit, I shouldn’t have to call your company to get software prices.

I am happy to say that ManageEngine does not hide anything and does not force you to call them for pricing! Pound per pound, there is no doubt that Desktop Central is much cheaper than products like System Center. This is especially true if you do not want to pay for a bunch of products that you will not be using (SCVMM or SCDPM for example). ManageEngine’s pricing takes that modular methodology and runs with it! This makes it possible for you to select the exact components and pricing that you need for your environment. Prices and support options are clearly displayed. Multiple purchase methods are available (subscription based/perpetual license).

Desktop Central comes in three versions. The professional edition is designed for single sites and starts at $645. The enterprise edition is designed for many sites and starts at $795. This edition can also save organizations additional money through Windows licensing costs as it contains similar features found in the Enterprise/Education versions of Windows OS (an AppLocker substitute is the main example). The third version is for SMBs and is free for up to 25 devices. It also includes support for 25 mobile devices. It is nice to see this option available for smaller (future) customers.

Overall, Desktop Central is a win

ManageEngine’s Desktop Central passes the three big tests organizations face. It is fully featured, easy to use, and not cost prohibitive. Its modular nature enables advanced functionality and it can be integrated into other ManageEngine products. This enables some powerful combinations. Imagine things like tying in your helpdesk to your software deployment system.

If you are interested in Desktop Central, you can download a fully functional 30-day trial or play around in this demo environment.

Delayed Folder Redirection File Screens with PowerShell

Posted on by

File Screens, a feature of the File Server Resource Manager tool, allows administrators to restrict the type of files that can be stored on a share. It is both useful and infuriating. Useful to me as I can enable it on our student’s redirected folder location. Infuriating for students because they can’t save any EXEs in this location.*

Delayed Folder Redirection File Screens with PowerShell

File Screens has a downside though. It is an all or nothing approach to file type filtering. In the example above, users are either allowed or blocked from saving executable files on the HomeFolders location. The result is dependent on if the rule is active or not.

Let’s say that you don’t really mind that a user saves an executable to their redirected downloads folder. You might have asked a user to download an application so you can deploy it. Or a user might need to run a small application once (such as a online meeting plugin).  When file screens are enabled, your users get a nasty accessed denied error. What is needed is something a bit more flexible – say, a PowerShell script (or two).

 

Cleaning up EXEs with PowerShell

Our first script allows a trial run on your share or DFS Namespace. You will need to modify the Get-ChildItem path in the first line to match your environment. The script will search for any file in that location that has an .EXE extension and has a Last Write Time older than 7 days ago. Each file is then marked as hidden. This allows us to simulate a -whatif scenario.**  If you want to see what files will be marked as hidden, run just the $Files line and see what is contained in that variable.

$Files = Get-ChildItem "\\Test.local\data\Staff\" -Recurse | Where-Object {$_.Extension -eq ".EXE" -and $_.Lastwritetime -lt ((Get-Date).AddDays(-7))} | sort Lastwritetime 

foreach ($File in $Files){

$(Get-Item $File.FullName).Attributes = 'Hidden'

}

If your environment is like mine, no one will notice that their EXEs are missing. When you feel confident to actually remove the files (and have a valid backup), run the second script. It has a slightly modified foreach loop that calls the Remove-Item Cmdlet. If the $File item is successfully removed, the file details are written to .\DeletedFiles.csv. The Get-ChildItem and Remove-Item Cmdlets use the additional -force parameter in this script. This parameter allows both Cmdlets to interact with hidden and read-only files. This is needed if you marked all of your EXEs as hidden with the first script.

$Files = Get-ChildItem "\\Test.local\data\staff" -Recurse -Force | Where-Object {$_.Extension -eq ".EXE" -and $_.Lastwritetime -lt ((Get-Date).AddDays(-7))} | sort Lastwritetime 

foreach ($File in $Files){

Remove-Item -Path $File.FullName -Recurse -Force

    if ($? -eq $True){
    $File | export-csv .\DeletedFiles.csv -NoTypeInformation -Append
    }
}

These two scripts saved almost 60GB of storage in my environment and I hope they help your servers out as well! I now use file screens on certain shares and this script on other shares. And if you are getting tired of folder redirection, don’t despair – you only have two more articles in this series to read. 🙂

 

*AppLocker would prevent an EXE from running in this location.

**Though now that I think of it, modifying the ACLs on the EXE to add an deny would have been a better way of simulating the actual delete.

Saving Space by Shrinking Pictures – Reduce Picture Size with Folder Redirection

Posted on by

Pictures and videos consume the most space in the redirected folders of my users. While I don’t have a great solution for videos yet, I cobbled together a few PowerShell scripts into a single solution. The script below will search a root folder (\\Test\FR\Staff\) and work through each user’s subfolder (\\Test\FR\Staff\jmoody\). It will find any picture greater than your specified resolution and reduce it to a more appropriate size. Even small environments could save several 100 GBs!

I wanted to see how big of a difference this re-sizing could make. I modified the script output to keep the old photo for comparison. To show you the size difference, look at the screenshot below. The new photo is almost 30x smaller than the original photo!  On my 1920×1080 monitor – I can see zero difference in quality.

Saving Space by Shrinking Pictures - Reduce Picture Size with Folder Redirection

In the very first line of the PowerShell script, you will need to set your domain name. The next three $UserFolders lines are examples searches. The first will convert pictures only in the Jmoody subfolder. The second will convert the first 10 folders in the root folder. The final example will convert all folders. As you implement this script in your environment, I recommend a roll-out using those three examples. For safety, keep extending the select -first example until you are comfortable converting every picture that is in your folder redirection share.

Here is the script  – I’ll meet you with some more information below it. If your mouse wheel breaks while scrolling down, remember that you can still use the Page Down button on your keyboard. 🙂

Continue reading →

Configuring Folder Redirection – Part 2 – Group Policy and Security

Posted on by

When properly configured, Folder Redirection manages itself and untethers the user from their computer. With our DFS Namespace created, it is time create our folder redirection structure and configure our Group Policy Object. Navigate to your namespace (ex: \\Test.local\Data\) and create a new folder named “FR”. All redirected folders will be kept in this sub folder.

 

How to Correctly Set Security Permissions for Folder Redirection

Edit the security properties on the FR folder and select the advanced button. Disable inheritance and remove all inherited permissions. You should now have zero permissions listed for this folder. We now need to configure four permission entries:

  • Give SYSTEM Full Control to this folder, subfolders, and files.
  • Give Domain Administrators Full Control to this folder, subfolders, and files.
  • Give CREATOR OWNER Full Control to subfolders and files only
  • Give Authenticated Users Read/Execute, List folder contents, Create folders, write attributes to this folder only.

Configuring Folder Redirection - Part 2 - Group Policy and Security

These permissions allow for any user to create a folder in the root of \data\FR. When a user (with folder redirection enabled) logs in, their account will create their root folder (ex: \data\FR\Joseph\). Because they are the creator of the folder, the CREATOR OWNER permission entry will give them Full Control to that folder, all subfolders (ex: \data\FR\Joseph\Desktop) and all files. Domain Administrators will still be able to access the redirected folder but all other users are denied access.

If you want to create separate redirected folder locations for different departments or users, you would create sub-root folders under \data\FR. For example, you might create the following folder structure:

  •  \\Test.local\data\FR\IT
  • \\Test.local\data\FR\Staff
  • \\Test.local\data\FR\Students

In this case, you would apply the four permission entries on the sub-root folder (ex: IT) instead of at the FR folder level. If you have a dedicated security group for the users, you can remove the authenticated users entry and substitute your dedicated security group. Just be sure to set the Applies to: This folder only setting.

Note: Any distribution group can be changed to a security group. In Active Directory, select the group and change the type from Distribution to Security. That group is now a mail-enabled security group.

 

How to Configure Group Policy for Folder Redirection

Launch the Group Policy Management Console. Create a new GPO under the Group Policy Objects container and name it. Creating the GPO in this container ensures we don’t accidentally roll out settings before we are ready.

Edit the GPO and navigate to User Configuration\Policies\Windows Settings\Folder Redirection. Right click on Desktop and select properties. Change the setting from Not configured to Basic. Under Root path, type the namespace path to your FR folder. See the screenshot below for an example:

Configuring Folder Redirection - Part 2 - Group Policy and Security

Before pressing OK, select the Settings tab and uncheck Grant the user exclusive rights to Desktop. This will allow administrators to view the desktop folder. Press ok and then Yes to the warning. This folder redirection policy will only apply to devices running Windows Vista and above.

Enable folder redirection on any remaining folders that you wish to store centrally. Personally, I make the following exceptions to three specific folder redirection targets:

  • I do not redirect Appdata. I prefer to use UE-V for this feature.
  • I do not redirect the Start Menu
  • I put Pictures, Music, and Videos into their own folders and do not let them follow the Documents folder.

Configure your GPO to apply to a test user and link it to an OU. Folder redirection should be enabled by the second logon. If you want to make the experience happen on the first logon, you can enable the Always Wait on the Network at Computer Startup or Logon group policy setting.

In our next post, we will extend folder redirection by enabling data deduplication, Volume Shadow Services, and Offline Files!

Data Deduplication in Server 2012/2012 R2 – Saving GBs with a Checkbox

Posted on by

Data Deduplication is the best feature in Server 2012/2012 R2. For any shop, it provides a huge benefit for 5 minutes of work! When configured, data deduplication will analyze files for duplicate chunks, remove the duplicate portions, and reference files to a single specially stored copy. This can give you some amazing space savings!

Data deduplication is useful for three main scenarios:

  • Folder Redirection/Home Folders/User Share: imagine all of the PDFs that are emailed out and saved into each user’s documents.
  • Software Distribution/Application shares: a lot of software share the same components.
  • VDI: If you have 100 VMs running the same OS, the disk space saved with data deduplication would be insane! Microsoft saved close to 90% in their environment!

In this guide, we will setup data deduplication and learn some best practices for integration.

Data Deduplication in Server 2012/2012 R2 - Saving GBs with a Checkbox

Saving 31% on an SCCM distribution point!



 

How to Configure Data Deduplication in Server 2012/2012 R2

First, data deduplication can not be configured on a system or boot volume. With that out of the way, pick a machine running Server 2012 or higher. In Server Manager, launch the Add Roles and Features Wizard. Under Server Roles, expand File and Storage Services – select the Data Deduplication role and finish the wizard. This role does not require a reboot.

Data Deduplication in Server 2012/2012 R2 - Saving GBs with a Checkbox

Side note – I love data deduplication so much that I enable this role on nearly every new server with role installations in my Task Sequence.

 

Select the File and Storage Services node in Server Manager and then select volumes. Right click on data volume and select Configure Data Deduplication…

Data Deduplication in Server 2012/2012 R2 - Saving GBs with a Checkbox

Configure Data Deduplication on a new volume.

 

Change the type from disabled to General purpose file server (or check the enable box if you are on Server 2012). Leave the deduplicate files older than setting at the default value. You may want to exclude certain folders/files from deduplication. For example, SCCM 2012 requires a few folders to be excluded.

Data Deduplication in Server 2012/2012 R2 - Saving GBs with a Checkbox

Excluding folders from Data Deduplication for SCCM 2012

 

Select Set Deduplication Schedule and check the Enable throughput optimization box. Adjust the duration so that the optimization is outside of your work hours – the server will be taxed while this optimization occurs. Use Server Manager Performance Counters to keep an eye on resources during optimization.

Depending on your server size, it may take a day or two for volumes to be completely optimized. If you are wanting to see results quickly, you have two options:

  • Launch DDPEval.exe (ex: ddpeval.exe \\Server-01\Data\). This tool in is the System32 folder on any server with data dedupe installed on it. You can copy this EXE to any 2008R2+ machine to evaluate potential savings.
  • Start a dedup job with PowerShell. The following command will dedup volume D and consume up to 50% of the server’s RAM: Start-DedupJob D: -Type Optimization –Memory 50

That wraps up our data deduplication guide. If you wish to learn more, the links below will help: