Aaron Czechowski, MCS

Moving on

Aaron Czechowski [Microsoft] — Fri, 08 Jun 2012 12:50:24 GMT

A long overdue post...

In April I changed roles within the company, leaving Microsoft Consulting Services and joining the Windows Intune product team as a program manager.

This blog will remain, but I currently have no plans to make any further posts. I am continually re-evaluating the latter part of that statement....

Using Windows PowerShell to convert collection membership rules

Aaron Czechowski [Microsoft] — Tue, 07 Feb 2012 09:30:40 GMT

I developed some automation for a customer to help them manage the lifecycle of collections used for assignment of DCM baselines as they are revised. Part of this required the ability to convert a collection from query-based membership to direct membership rules and vice versa. I realize this is a very niche piece of automation, but perhaps someone else can gain some benefit from these functions.

I used Michael Niehaus’ Windows PowerShell module for Configuration Manager to provide supporting functions and even derived several of the code blocks from his very handy functions. SCCM.psm1 is not technically required for these functions, but I assume it was used to create the connection to the site so that variables such as $sccmServer and $sccmNamespace are available.

There are three functions:

Add-SCCMCollectionDirectRule: this is a helper function used by both of the following. It takes two parameters: a collection object and an array of collection members. (It is a simplification of Michael’s related function.)
Convert-SCCMCollectionToDirect: as the name suggests this will take any collection, capture the current membership, remove the rule and then add the members as direct membership rules. It assumes there is only one query rule and does not refresh the collection membership.
Convert-SCCMCollectionToQuery: the converse of the above; it removes all direct membership rules and then adds the given query rule. It is adapted from Michael’s code with fewer parameters (which could easily be added back for increased functionality).

Function Add-SCCMCollectionDirectRule {

    Param (
        # SMS_Collection object, such as returned from Get-SCCMCollection function of SCCM.psm1
        [Parameter()] $Collection,
        # Array of SMS_CollectionMembers from MemberClassName WMI Class
        [Parameter()] $Members
    )

    # (derived from Add-SCCMCollectionRule in SCCM.psm1 by Michael Niehaus)
    $ruleClass = [wmiclass]"\\$sccmServer\$($sccmNamespace):SMS_CollectionRuleDirect"
    ForEach ( $member in $Members ) {
        $newRule = $ruleClass.CreateInstance()
        $newRule.RuleName = $member.Name
        $newRule.ResourceClassName = "SMS_R_System"
        $newRule.ResourceID = $member.ResourceID

$Collection.AddMembershipRule($newRule) | Out-Null
} # end foreach

} # end Add-SCCMCollectionDirectRule function

Function Convert-SCCMCollectionToDirect {

    Param (
        # SMS_Collection object, such as returned from Get-SCCMCollection function of SCCM.psm1
        [Parameter()] $Collection
    )

# Refresh to make sure we have all of the lazy properties
$Collection.Get()

    # Change the schedule from periodic (2) to manual (1)
    $Collection.RefreshType = 1
    $Collection.Put() | Out-Null

# Get the collection members
$collMembers = Get-WmiObject -Class $Collection.MemberClassName -Namespace $sccmNamespace -ComputerName $sccmServer

# Get the existing query rule, assuming there is only one
$rule = $Collection.CollectionRules[0]

# Delete the query rule
$Collection.DeleteMembershipRule($rule) | Out-Null

# Add members back as direct membership rules
Add-SCCMCollectionDirectRule -Collection $Collection -Members $collMembers

} # end Convert-SCCMCollectionToDirect function

Function Convert-SCCMCollectionToQuery {

    Param (
        # SMS_Collection object, such as returned from Get-SCCMCollection function of SCCM.psm1
        [Parameter()] $Collection,
        [Parameter()] $QueryName,
        [Parameter()] $Query,
        [Parameter()] [ValidateRange(0, 31)] [int] $RefreshDays
    )

# Get all lazy properties
$Collection.Get()

    #Set schedule
    $intervalClass = [wmiclass]"\\$sccmServer\$($sccmNamespace):SMS_ST_RecurInterval"
    $interval = $intervalClass.CreateInstance()
    $interval.DaySpan = $refreshDays
    $Collection.RefreshSchedule = $interval
    $Collection.RefreshType = 2    # periodic (2) vs manual (1)
    $Collection.Put() | Out-Null

    # Delete all direct membership rules
    ForEach ( $rule in $Collection.CollectionRules ) {
        $Collection.DeleteMembershipRule($rule) | Out-Null
    }

# Add query
Add-SCCMCollectionRule -collectionID $Collection.CollectionID -queryRuleNameb $queryName -queryExpression $query

# refresh the collection
$Collection.RequestRefresh() | Out-Null

} # end Convert-SCCMCollectionToQuery function

Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included script samples are subject to the terms specified in the Terms of Use.

USGCB Policy Bug: Turn off desktop gadgets

Aaron Czechowski [Microsoft] — Mon, 23 Jan 2012 20:26:14 GMT

The US Government Configuration Baseline (USGCB) group policy object (GPO) for Windows 7 Computer Settings includes the setting:

Computer Configuration\Administrative Templates\Windows Components\Desktop Gadgets
Turn off desktop gadgets = Enabled

This setting is not included in the settings spreadsheet or the associated SCAP content. It was mistakenly included in the GPO and is expected to be removed in a future release. If desired, agencies can safely deviate this setting since the SCAP content does not include it.

NOTE: the three other settings in this policy section are still enabled to control the use of Desktop Gadgets.

Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation.

Verifying Configuration Manager Backup Task with Windows PowerShell

Aaron Czechowski [Microsoft] — Mon, 23 Jan 2012 19:44:06 GMT

A seemingly simple requirement for a Desired Configuration Management configuration item is to verify that the Configuration Manager 2007 site backup maintenance task is enabled. What became the difficult part of this was tracking down the specific location in WMI that this data exists. I have to give credit to Jamie Moyer for pointing me in the right direction.

Function Get-SccmBackupEnabled {

    # Refresh the site control file
    Invoke-WmiMethod -Path SMS_SiteControlFile -Name RefreshSCF -ArgumentList $sccmSiteCode -Computername $sccmServer -Namespace $sccmNamespace | Out-Null

    # Get the backup task object for this site
    $bkTask = Get-WmiObject -Query "SELECT * FROM SMS_SCI_SQLTask WHERE SiteCode = '$sccmSiteCode' AND ItemName = 'Backup SMS Site Server'" -Computername $sccmServer -Namespace $sccmNamespace

    If ( -not $bkTask ) { $False }
    ElseIf ( $bkTask.On -eq 'True' ) { $True }
    Else { $False }
}

The key here is the SMS_SCI_SQLTask WMI class, not SMS_SCI_MaintenanceTask as I originally suspected.

This cannot be used as-is in DCM; it must be paired with some code to first create the connection to the site server and then call this function. I use Michael Niehaus’ PowerShell module which works very nicely for many common Configuration Manager automation tasks including the initial connection (New-SCCMConnection).

Using SMBIOS GUID to import computer information for VMware guest

Aaron Czechowski [Microsoft] — Wed, 04 Jan 2012 15:34:00 GMT

To import computer information into Configuration Manager for OS deployment you have to enter the computer name and then one or both of the following unique identifiers: MAC address or SMBIOS GUID, aka UUID. Many customers use the MAC address because it is shorter and typically more accessible. However, if the UUID is required this can seem difficult to obtain especially when the target systems are VMware guests. When the guest is initially created it is assigned a UUID which is stored in the VMX configuration file as the uuid.bios property. Here is an example line from the VMX file:

uuid.bios = “42 38 d4 b6 00 90 3e 75-94 06 b3 10 ea fa 2b 1e”

This does not look like a usual SMBIOS GUID in the standard (8)-(4)-(4)-(4)-(12) format. When the system boots and attempts to PXE boot, the same UUID is visible although formatted differently, for example:

Network boot from Intel E1000
Copyright (C) 2003-2008 VMware, Inc.
Copyright (C) 1997-2000 Intel Corporation

CLIENT MAC ADDR: 00 50 56 B8 00 14 GUID 4238D4B6-0090-3E75-9406-B310EAFA2B1E
CLIENT IP: 192.168.1.100 MASK: 255.255.255.0 DHCP IP: 192.168.1.10
GATEWAY IP: 192.168.1.1
…

Looking at the actual SMBIOS GUID via the UUID property of the Win32_ComputerSystemProduct WMI class (or the comparable System UUID property on the ConfigMgr System Resource), it appears as:

UUID = “B6D43842-9000-753E-9406-B310EAFA2B1E”

The difference between these two (uuid.bios up above and UUID directly above), which are identical except for formatting, is explained in an older Remote Installation Services article on TechNet. The VMware VMX uses the “raw byte order” format while Windows and Configuration Manager use the “pretty print” format. (Thanks to Michael Kelley for that nugget of information.)

So taking a UUID from a VMware VMX to import into Configuration Manager for OS deployment requires some conversion. The attached script does a simple conversion; there may be a more elegant method relying upon the underlying mathematics of the UUID, but that’s beyond my current knowledge.

The script usage is as follows:

.\Convert-UUID.ps1 -rawUUID ""

where is formatted as follows:

01 23 45 67 89 ab cd ef-fe dc ba 98 76 54 32 10

such as used in the uuid.bios property of a VMX file. For example, the above rawUUID yields the following output:

67452301-ab89-efcd-fedc-ba9876543210

Convert-UUID.zip

How to create a bootable ISO

Aaron Czechowski [Microsoft] — Wed, 04 Jan 2012 15:19:52 GMT

I know this information exists elsewhere in the world and I really dislike redundant posts. But I’m always hard-pressed to find this so am posting it here more as a reminder to myself. If it is of use to anyone else, all the better.

When you update a MDT 2010 Update 1 distribution share that includes the option to create a bootable ISO, the OSCDIMG command (in RunCmd.cmd), as well as a log of the output (PEManager.log), is located at %Temp%\PEManager.####, for example, C:\Users\Aaron\AppData\Local\Temp\PEManager.4336.

RunCmd.cmd contains the following (reformatted for easier readability):

“C:\Program Files\Windows AIK\Tools\AMD64\OSCDIMG.EXE”

-u2
-udfver102
-m
-o
-h
-yo”C:\Program Files\Microsoft Deployment Toolkit\Templates\BootOrder.txt”
-bootdata:2#p0,e,b”C:\Program Files\Windows AIK\Tools\PETools\amd64\boot\ETFSBOOT.COM”#pEF,e,b”C:\Program Files\Windows AIK\Tools\PETools\amd64\boot\EFISYS.BIN”
”C:\Users\Aaron\AppData\Local\Temp\MDTUpdate.4336\ISO”
”C:\Users\Aaron\AppData\Local\Temp\MDTUpdate.4336\LiteTouchPE_x64.iso”
> “C:\Users\Aaron\AppData\Local\Temp\PEManager.4336\PEManager.log” 2>&1

See [some website] for details on the various OSCDIMG parameters.

Disk Cleanup in a MDT Task Sequence

Aaron Czechowski [Microsoft] — Wed, 04 Jan 2012 15:18:00 GMT

While using MDT to remaster an existing Windows 7 image I added tasks to apply Windows 7 Service Pack 1 and a slew of other updates to the image (so that deployed workstations are up to date out of the gate instead of waiting for updates to come down to each system across the network). Unfortunately this bloated the end product WIM by almost 2 GB. I started to look into ways I could cleanup any unnecessary files on the hard drive before capturing the image. Instead of just hacking away at the disk, deleting temporary files and other caches, I decided to try to integrate the built-in Disk Cleanup utility.

Disk Cleanup, cleanmgr.exe, has command line parameters that are well documented but there is little to nothing on how to automate this, especially in the context of a MDT task sequence. The typical process is to run cleanmgr.exe /sageset:n (where n is an arbitrary integer) and set the files to delete in the interface. This then configures a cleanup profile in the registry so that when running cleanmgr.exe /sagerun:n it has a preset configuration to use.

To automate this for the task sequence I made the decision that every cache type (aka handler) is to be deleted in this scenario, including the one most important to me: Service Pack Backup Files. I wrote the attached MDT-style script that loops through each subkey under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches and sets the StateFlags0042 value to DWORD 2 (in this example, n = 42). There is an article on MSDN that includes an excellent description of the StateFlags value. The script then runs cleanmgr.exe /sagerun:42 to do the needful.

I added this cleanup task to the end of the Custom Tasks group of the State Restore phase (for those of you using the Standard Client Task Sequence). It cleaned almost 3 GB of data from the system, which resulted in the final WIM only growing by 575 MB from the starting custom image (instead of almost 2 GB without the cleanup).

CustomDiskCleanup.zip

Deploying Windows 7 Language Packs via ConfigMgr

Aaron Czechowski [Microsoft] — Sun, 18 Dec 2011 17:31:15 GMT

During a Windows 7 64-bit deployment project the customer gave me a requirement to allow users to install a variety of language packs without adding all of them to the baseline image to keep the size down. They are already using ConfigMgr to advertise applications for user self-service so this seemed the most logical method to provide this capability.

Windows 7 language pack setup, lpksetup, includes parameters to support a managed installation. I successfully tested the following from the command prompt:

lpksetup.exe /i de-DE /p . /r /s

I advertised a program with this command line, but it quickly failed. The test system returned an error status message, ID 10003: “An error occurred while preparing to run the program for advertisement…. The operating system reported error 2147942402: The system cannot find the file specified.”

Execmgr.log contained the following:

File C:\Windows\SysWOW64\CCM\Cache\…\lpksetup.exe is not a valid executable file
Invalid executable file lpksetup.exe

I altered the program command line to directly reference the executable at %WinDir%\System32\lpksetup.exe with the same result.

Since ConfigMgr executes from a 32-bit process I launched a 32-bit command prompt (C:\Windows\SysWOW64\cmd.exe) to manually try the lpksetup command line.

C:\Windows\SysWOW64>C:\Windows\System32\lpksetup.exe /?
'C:\Windows\System32\lpksetup.exe' is not recognized as an internal or external command, operable program or batch file.

C:\Windows\SysWOW64>dir C:\Windows\System32\lpksetup.exe
Volume in drive C is OSDisk
Volume Serial Number is 1234-5678

Directory of C:\Windows\System32

File Not Found

It turns out that lpksetup.exe on Windows 7 64-bit is a 64-bit-only process so with WOW file redirection in a 32-bit process C:\Windows\System32 redirects to C:\Windows\SysWOW64, which does not contain lpksetup.exe. So I altered the ConfigMgr program command line to:

%WinDir%\SysNative\lpksetup.exe /i de-DE /p . /r /s

Using the SysNative alias allowed the language pack to be successfully installed on Windows 7 64-bit from a ConfigMgr advertised program.

Windows XP Remote Assistance and DontDisplayLastUserName

Aaron Czechowski [Microsoft] — Sun, 18 Dec 2011 16:57:50 GMT

While implementing Remote Assistance during a Windows 7 deployment I found that a RA connection to older Windows XP workstations would behave like a Remote Desktop connection: the user would not be prompted to allow the administrator to connect, and the administrator would be prompted to logon. I eventually traced the issue to the presence of the DontDisplayLastUserName value, set to 1, at HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. These specific Windows XP workstations were upgraded from earlier versions of Windows, persisting this setting which is deprecated in Windows XP, but causing this problem with Remote Assistance. I applied a custom administrative template to modify this older registry value and RA started to work as expected.

The necessary functionality historically provided by this registry value is applied by enabling the group policy setting “Interactive logon: Do not display last user name” at Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. This policy setting configures the DontDisplayLastUserName value at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System. Remote Assistance is not affected by the presence of this setting.

Microsoft Support article KB306045 has more detail on this issue.

ConfigMgr query for blocked or approved clients

Aaron Czechowski [Microsoft] — Thu, 08 Dec 2011 17:58:01 GMT

This is nothing new; I’m typically not one to repost information that can be found elsewhere online. This is just so that I have an easy place to find it in the future!

select SMS_R_SYSTEM.ResourceID, SMS_R_SYSTEM.ResourceType, SMS_R_SYSTEM.Name, SMS_R_SYSTEM.SMSUniqueIdentifier, SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client
from SMS_R_System
inner join SMS_CM_RES_COLL_SMS00001
on SMS_CM_RES_COLL_SMS00001.ResourceId = SMS_R_System.ResourceId
where SMS_CM_RES_COLL_SMS00001.IsBlocked = '1'

Replace IsBlocked with IsApproved to query for approved clients.