Windows Migration Solutions from the Field - Jim Riekse https://docs.microsoft.com/archive/blogs/jimriekse/feed.xml Sat, 02 Dec 2017 19:13:43 GMT en-US hourly 1 Configuration Manager - Diagnosing Unexpected Changes to the Driver Store https://docs.microsoft.com/archive/blogs/jimriekse/configuration-manager-1610-and-up-diagnosing-unexpected-changes-to-the-driver-store Sat, 02 Dec 2017 19:12:26 GMT https://blogs.technet.microsoft.com/jimriekse/?p=335   You will now have all the creates and deletes for the driver store. If you have a large number of logs here and you are looking for a specific driver that can be challenging as well. I noticed that when importing a driver that was previously deleted the unique identifier in the log stayed the same. If you were interested in the history of a particular driver that was deleted, re-importing it and then looking at the Excel file (prepared with the steps above) should give you the unique identifier of the driver within the Description field. If you then filtered the Description field using contain text filter with the value of this unique identifier you should have the create/delete history of the driver in the drive store. Another way to pin down the unique identifier of a particular driver is to use the DriverCatalog.log from the site server which has a history of all imports. If you find the particular driver in the import log you then have a time that can be cross-referenced to the state message log for the driver create log entry (which holds the specific driver unique identifier). Hope this strategy helps you if you are in need of this information.   Note that this method was used on Configuration Manager 1610 so your mileage may vary if using different Configuration Manager versions.      ]]> Changing HP BIOS/UEFI settings with HP's Bios Configuration Utility https://docs.microsoft.com/archive/blogs/jimriekse/changing-hp-biosuefi-settings-with-biosconfigutility64-exe Fri, 16 Jun 2017 19:53:17 GMT https://blogs.technet.microsoft.com/jimriekse/?p=316 https://ftp.hp.com/pub/caps-softpaq/cmit/HP_BCU.html This utility is easy to use to configure BIOS/UEFI settings appropriately from either the full operating system or WinPE. The download from HP contains two executables in both 32 and 64-bit versions named BIOSConfigUtility and HPQPswd. A user guide is also included which has the full documentation. The BIOSConfigUtility utility sets BIOS/UEFI values, can read existing BIOS/UEFI settings, in addition to other functions listed in the documentation. The HPQPswd GUI utility can create a password file for use accessing BIOS/UEFI's with a password. This blog article is an attempt to get you up and running in the shortest amount of time and provide lessons learned that may not be in the documentation. An easy way to get started with these utilities is to read the existing settings and values from a physical HP model via a simple script. One way to do this is to create a short batch script like below and run it with local administrative rights. The following script can be used if an existing BIOS/UEFI password is not set: rem Sets source directory for use throughout the script pushd "%~dp0" rem Read the settings and values from the HP physical system. Note the 64-bit version is used on an OS that is 64-bit BiosConfigUtility64.exe /get:<resultFile.txt> If a BIOS/UEFI password is set you first need to use the HPQPswd GUI utility to create a .bin file with the encrypted password and then reference the created .bin file with an additional parameter in the batch script as shown below: rem Sets source directory for use throughout the script pushd "%~dp0" rem Read the settings and values from the HP physical system. Note the 64-bit version is used on an OS that is 64-bit BiosConfigUtility64.exe /get:<resultFile.txt> /cpwdfile:<.binFile> Looking at the resulting .txt file that should have been created in the directory where the utilities were run from you should see something like the following: BIOSConfig 1.0 ; ;     Originally created by BIOS Configuration Utility ;     Version: 4.0.13.1 ;     Date="2017/06/16" Time="14:44:57" UTC="-4" ; ;     Found 160 settings ;   The values in this file marked with an * are the ones that are currently set. To create a script that will set specific values you can edit the output file created in the last step leaving only the specific values you would like to set. An example of an editing output file is shown below which sets one value: BIOSConfig 1.0 Data Execution Prevention Disable *Enable To run a batch script that sets this one value the following script could be used that uses the /set command rem Sets source directory for use throughout the script pushd "%~dp0" rem Set a value on a HP physical system. Note the 64-bit version is used on an OS that is 64-bit BiosConfigUtility64.exe /set:<InputFile.txt> /verbose That concludes the basics. I’ve learned the following implementing this in practice which may useful to consider:
  • Different HP models have different setting names. However, to make a script that can be run on multiple models the different setting names and their associated values can be combined into a single input file. When the script runs it sets the values for the settings that match and ignores the ones that don’t.
  • Older models like the HP 6005 require a password to enable the TPM. If a password isn’t already set it’s easy to set a password, enable the TPM, and then remove the password.
  • Older models like the HP 6005 allow the utility to change the password, but this password is not useable to access the BIOS physically. This situation is related to Unicode.
  • Some models like the 800 G2 require that the HP Bios Config Utility is run twice with a reboot after each to enable the TPM. To avoid additional reboots in a task sequence scenario, the utility can be run in WinPE to leverage the automatic reboot after the WinPE phase is completed.
  • Use of the password .bin file has historically had issues on some models like the HP 705 G2
An additional note is that in my experience the HP BIOS/UEFI default configurations are flexible regarding using either MBR or UEFI partitioning. This gives flexibility in the timing of running the HP Config Utility when provisioning systems. For reference below is the batch script I’ve used to work around some of the items I discussed above: rem Sets source directory for use throughout the script pushd "%~dp0" rem Set a predefined password on the BIOS/UEFI BiosConfigUtility64.exe /npwdfile:password.bin r rem Set the values from the input file that match the settings on that particular model BiosConfigUtility64.exe /set:<InputFile.txt> /verbose /cpwdfile:password.bin rem Optionally remove the BIOS/UEFI password if it is not desired BiosConfigUtility64.exe /nspwdfile:"" /cpwdfile:password.bin   I hope this information has been helpful and gets you up and running quickly.  
No warranty is implied with usage of the information in this article.
 ]]> Resolving Missing Application State Messages Due to ‘CI Version Info Timed Out’ Errors in Configuration Manager 2012 https://docs.microsoft.com/archive/blogs/jimriekse/resolving-missing-application-state-messages-due-to-ci-version-info-timed-out-errors-in-configuration-manager-2012 Sat, 09 Jul 2016 17:55:17 GMT https://blogs.technet.microsoft.com/jimriekse/?p=305 Problem: Configuration Manager 2012 applications that were previously deployed no longer show as successes when looking at the Monitoring\Deployments section for a particular application. You will most likely see a majority of errors with no state messages there explaining the cause. Environment Issue Seen: System Center Configuration Manager 2012 (up to 1511) Symptoms: Using the console to run the report Software Distribution - Application Monitoring\Application infrastructure errors for an  application with missing state messages the report will show a large number of errors with a description of  ‘CI Version Info Timed Out’. Additionally, in the CIAgent.log for a client that is missing state messages this same error will be shown. Resolution: On a client with this issue find the entry in the CIAgent.log with a line similar to the following example: CIAgentJob({9148AA4C-9523-4482-9F85-50EF84B5E106}): CAgentJob::VersionInfoTimedOut for ModelName ScopeId_BB07E0A0-9C6F-4683-B902-5DA067E71FCA/Application_679af1dd-cbb4-4b2e-8ea5-cdc0b476cf14, version 3 not available. To find the application associated with this error open the CM console and follow these steps:
  • Go to Software Library\Applications
  • Click the Search box (so the cursor is in the field)
  • Click the button on the ribbon All Subfolders
  • Type the GUID from the previous CIAgent.log error into the Search field. From the example above this would be 679af1dd-cbb4-4b2e-8ea5-cdc0b476cf14
  • Click Search
The application associated with the error should show in the results. Removing the deployments associated with this application AND any task sequences deployments that contain this application should resolve the error and allow each affected client to resume sending state messages for applications that have been previously installed. Note that if multiple applications have an issue on that client you may have to go through this process several times until no errors of this type are found in the client CIAgent.log. I believe this kind of situation may be caused by the way the CM client application state does its evaluation where an error with a particular application may cause an error in the batch process and prevent state messages for that client from being sent to the server. Hopefully this advice helps. In my experience, state messages for affected clients will return in the next day or so after the next application state evaluation cycle runs. For more immediate results it may be useful to trigger the application state evaluation on a particular client and then check the details for that client within the Monitoring\Deployments section for an application that is deployed to it. The details will show for that client before the overall status for that client is updated in the Summarization view. Reference to an article with a similar situation: https://social.technet.microsoft.com/Forums/en-US/7ebe1966-1417-4e5e-ba29-1aac6b5b0de1/sccm-2012-deployment-of-updates-failes-with-ci-version-info-timed-out?forum=configmanagersecurity   No warranty is implied with this information.]]> Group Policy Printer Deployment Issue with New Profiles when using WSD ports https://docs.microsoft.com/archive/blogs/jimriekse/group-policy-printer-deployment-issue-with-new-profiles-when-using-wsd-ports Wed, 23 Mar 2016 08:28:49 GMT https://blogs.technet.microsoft.com/jimriekse/?p=303 The WSD Port Monitor is a new printer port monitor in Windows Vista and Windows Server 2008. This port monitor supports printing to network devices that are designed to include Web Services for Devices (WSD) technology. Web Services for Devices allows network-connected IP-based devices to advertise their functionality and offer these services to clients by using the Web Services protocol. WSD-based devices and clients communicate over the network using a series of SOAP (Simple Object Access Protocol) messages over UDP and HTTP(S). WSD for Devices provides a network plug-and-play experience that is similar to installing a USB device. Web Services for Devices also defines a security profile that may be extended to provide additional protection and authentication using device-based certificates.   Not warranty is implied using any information in this post.]]> Offline SharePoint 2016 Beta 2 and earlier issue, when not using prerequisiteinstaller.exe with offline parameters https://docs.microsoft.com/archive/blogs/jimriekse/offline-sharepoint-2016-beta-2-and-earlier-issue-when-not-using-prerequisiteinstaller-exe-with-offline-parameters Fri, 12 Feb 2016 11:08:00 GMT https://blogs.technet.microsoft.com/jimriekse/2016/02/12/offline-sharepoint-2016-beta-2-and-earlier-issue-when-not-using-prerequisiteinstaller-exe-with-offline-parameters/ If you are piloting SharePoint 2016 with the Beta 2 release or earlier and run into this issue be aware of the following resolution (this was the last version I tested at the time of this post):

Scenario:

You install the prerequisites manually instead of using the prequisiteinstaller.exe. This avoids a known issue with the way the prequisiteinstaller.exe handles the IIS installation, but can cause a different issue when attempting to create a farm through the SharePoint 2016 Products Configuration Wizard. The following error is displayed in this scenario when the wizard is creating the configuration database:



Configuration Failed

One or more configuration settings failed. Completed configuration settings will not be rolled back. Resolve the problem and run this configuration wizard again. The following contains detailed information about the failure:

Failed to create the configuration database.

An exception of type Microsoft.SharePoint.Upgrade.SPUpgradeException was thrown. Additional exception information: One or more types failed to load. Please refer to the upgrade log for more details.



The issue can be resolved by removing all versions of WcfDataServices and then reinstalling the WcfDataServices using the prequisiteinstaller.exe with the appropriate parameter and follow any reboot prompts. Below is the command:

prequisiteinstaller.exe /wcfdataservices56:<location of WcfDataServices.exe>

Finally, to move forward clear the previous installation by removing the two created databases on the SQL server and re-attempt creating a farm using the SharePoint 2016 Products Configuration Wizard.


As always no warranty is implied.

]]> Setting up a Windows 10 Universal App with No Experience https://docs.microsoft.com/archive/blogs/jimriekse/setting-up-a-windows-10-universal-app-with-no-experience Thu, 17 Sep 2015 13:11:00 GMT https://blogs.technet.microsoft.com/jimriekse/2015/09/17/setting-up-a-windows-10-universal-app-with-no-experience/ If you would like to get started with Windows 10 universal apps and don't have much experience, this short guide will show you how to set one up and sideload it on a Windows 10 client. This is very much a beginner's guide to get started.

1. Install a version of Visual Studio 2015 that includes the Windows 10 universal app components. The easiest way to do this is to use the free community edition which includes these tools which can be found here: https://www.visualstudio.com/downloads/download-visual-studio-vs Ideally an online Windows 10 target is optimal. In my case I used a 2012 R2 server to run Visual Studio. A physical system is preferred since the emulators won't work in a virtual environment. After running the executable from the installer, choose custom and ensure the Universal Windows App Development Tools category with its two sub-components are checked. Proceed with the install.

2. Start visual studio 2015. I skipped the account section and proceeded to the main application. To setup a blank application, click File, New, then Project, and choose Blank App (Universal Windows). In the right-pane, you can browse to the MainPage.xaml which is the location where you could add code to create a simple application.

3. Since I was curious how I would deploy the universal application on a Windows 10 client, I proceeded to double-click the Package.appxmanifest (also in the right-pane). Just so the application isn't completely default, I made a small change in the Visual Assets tab of changing the Background color field to 'blue' instead of the default which changed how the icon ended up looking. If you click on the Packaging tab, you'll see that a certificate is already setup.

4. Another change I made along the top ribbon was change the architecture to x64 since this was the client I was targeting.

5. To create the package, click on Project (along the top), then Store, and then Create App Package. Choose No to publishing to the Store, click Next, change the Architecture to x64 if this is your target, and click Create.

6. If you left the defaults you'll now have an app package created as a sub-directory in c:\users\<profile>\Documents\Visual Studio 2015\Projects\<appname>\<appname>\AppPackages. Copy this to the Windows 10 client you'd like to install the universal app on.

7. On the Windows 10 client, make a change in the settings by clicking the main settings, then Update & Security, then For developers, and choose Sideload apps or Developer mode.

8. On the Windows 10 client, navigate to the certificate that's within the app package you copied previously. Install it to the local machine in the Trusted Root Certification Authorities container.

9. On the Windows 10 client, open up an elevated powershell window. Within Powershell, change the directory to the location of your app package. In my test I ran into an issue with dependencies so I first installed the dependencies which are located in the dependencies subfolder within the app package. To install the dependencies first, within powershell run the following line for each of the two dependencies:

add-appxpackage <path to dependency.appx> 

Finally, install the app by running the same line for the .appxbundle file

add-appxpackage <path to application .appxbundle> 

10. On the Windows 10 clientPublish, you should now be able to find your new application in the Start Menu and open it!

]]> Bare Metal Restore Using iSCSI with Server 2012/2012R2 https://docs.microsoft.com/archive/blogs/jimriekse/bare-metal-restore-using-iscsi-with-server-20122012r2 Wed, 15 Jul 2015 08:59:00 GMT https://blogs.technet.microsoft.com/jimriekse/2015/07/15/bare-metal-restore-using-iscsi-with-server-20122012r2/ If you are using an iSCSI connection to backup your 2012/2012R2 servers you may also want to perform a bare metal restore using iSCSI. If you've ever done a bare metal restore using the Windows Server 2012/2012R2 media the standard process is to boot to the installation DVD matching the OS being restored, click repair, browse through a couple more choices, and finally choose 'System Image Recovery'. At this point you can choose a backup on a direct-attached disk or connect to a network share. When the backup is on an iSCSI device there are two basic ways to access it which can divided into the easy way and the hard way.

The easy way is to:
- attach the iSCSI LUN to server on your network if it is not already connected
- ensure a drive letter is assigned
- boot the target restore server from the installation DVD matching the OS to be restored
- perform the standard steps using 'System Image Recovery' to connect to the iSCSI backup as a network share
- perform the bare metal restore. Note that there's an option in 'System Image Recovery' to include additional storage drivers if needed to write to your server storage and also to prevent a reboot if you are cloning a server.

There are a number of reasons you may want to perform a bare metal restore from an iSCSI device directly. I consider this the hard way because of the following.

- Using the 2012/2012R2 installation DVD to enter the recovery WinRE environment does not natively provide the tools to attach directly to an iSCSI device. 
- Specifically, within the WinRE recovery environment the service 'Microsoft iSCSI Initiator Service' will not start without prestaging several additional WinRE DISM features and also configuring an active network connection. Lastly, an iSCSI GUI is not present to create the iSCSI connection which may be problematic if you're not familiar with iSCSI command line syntax.

If you're convinced you'd like to proceed the following approach works successfully.

At a high level the approach is to:

- Determine whether you would like to restore a 2012 or 2012 R2 OS. Retrieve the appropriate installation DVD or .iso.
- Since when clicking Repair from the installation DVD you are moving to different boot environment called WinRE its necessary to modify the WinRE environment by obtaining the WinRE.wim file. The WinRE.wim is located inside the install.wim on the installation DVD.
- Use dism to mount the install.wim and copy out the winre.wim so it can be modified. Also, copy the pertinent OS-specific iscsi files from the install.wim.
- Install the ADK matching the OS version to be restored. Copy the feature .cab files to a safe place.
- Mount the winre.wim
- Copy the OS-specific iSCSI files to the WinRE mount directory
- Add a batch file with the networking commands to the WinRE mount directory
- Use DISM to install the pertinent DISM features into the WinRE mount directory
- Commit the changes to the winre.wim
- Integrate the winre.wim into a bootable WinPE/RE .iso. I chose a MDT .iso I already had. Alternatively you could create a bootable .iso via a different method.
- Boot up to the created .iso or burn a CD/DVD
- Choose 'Command Line', ensure networking is working, setup the iSCSI connection with the iSCSI GUI, and then go back into 'System Image Recovery' and perform the bare metal restore.

At a more specific level it makes sense to first collect all the necessary resources and then run a script to integrate the components into the WinRE environment:

- Create the following directory structure to hold the resources you'll collect. This will line up with a batch file that can be used to update the winre.wim file.
  Main Directory
      2012Iscsifiles
          Drivers
          en-us
      2012r2Iscsifiles
          Drivers
          en-us
      2012packages
          en-us
      2012r2packages
          en-us
      netcmds
      Orig2012winre
      Orig2012r2winre
      Updated2012winre
      Updated2012r2winre
- Copy the install.wim from the installation DVD matching the OS to be restored (2012 or 2012 R2)
- Create a temporary mount directory
- Run the dism command with admin rights to mount install.wim to obtain the winre.wim file: Dism /Mount-Image /ImageFile:"<path to install.wim>" /Index:1 /MountDir:"<path to mount dir>"
- Ensure file explorer is set to view operating system files since winre.wim is hidden. Copy "<path to mount dir>\windows\system32\recovery\winre.wim" to the predefined Orig<OS>winre and Updated<OS>winre directories.
- Copy the necessary iscsi files some of which may be redundant. Copy the files starting with iscsi* from the "<path to mount dir>\Windows\System32" directory to the predefined <OS>iscsifiles directory. Copy the file msiscsi.sys from the "<path to mount dir>\Windows\System32\Drivers" directory to the predefined <OS>iscsifiles\Drivers directory. Finally, copy the files starting with iscsi* from the "<path to mount dir>\Windows\System32\en-us" directory to the predefined <OS>iscsifiles\en-us directory.
- Create a batch file within the predefined netcmds directory named netdhcp.cmd. Edit the file by adding the following lines below, and save it in the predefined netcmds directory. Note the remarked out line for a static IP that can be used if necessary.
  netcfg -winpe
  wpeutil InitializeNetwork
  REM - enable for static - netsh int ipv4 set address "Ethernet" static <staticAddress> <subnet> <gateway>
  net start msiscsi
  iscsicpl
- Retrieve the DISM feature cab files from the appropriate version of the ADK depending on whether its 2012 or 2012 R2. If you don't have the appropriate version available and installed you'll need to download and install it first. The 2012 version of the ADK can be downloaded from: https://www.microsoft.com/en-us/download/details.aspx?id=30652 The 2012 R2 (with update) version of the ADK can be downloaded from: https://www.microsoft.com/en-US/download/details.aspx?id=39982 Once the appropriate ADK is installed, copy the contents of the ADK directory "c:\program files (x86)\Windows Kits\8.x\Assessment and Deployment Kits\Windows Preinstallation Environment\amd64\WinPE_OCs" and its en-us subdirectory to the predefined <OS>packages directory.
- The following batch files can be used to update the winre.wim file with the collected resources. Create of copy of each batch file in the main predefined directory which allows the relative paths to work correctly. To run, right-click on the batch file for the right OS and choose 'Run as administrator'. Note that there are separate batch files for 2012 and 2012 R2 that have slight differences. The pause statements are simply to allow you to stop the process if you notice an error. Note that if you need to make successive runs with the batch file you'll want to copy the original winre.wim from the predefined Orig<OS>winre directory to the predefined Updated<OS>winre directory to ensure you start fresh with each run.

2012 Batch File contents:
Rem For 2012
rem mount winre from 2012 media (that's inside install.wim)
md c:\temp\mount
Dism /Mount-Image /ImageFile:"%~dp0Updated2012winre\winre.wim" /Index:1 /MountDir:"c:\temp\mount"
pause
rem Copy iscsi files including iscsi GUI. There may be several redundant files. When running the script seeing Access Denied is normal as files that are already there are not copied.
xcopy "%~dp02012IscsiFiles\*" c:\temp\mount\windows\System32 /E /R /H /Y /C
pause
rem Add Networking batch file to WinRE
copy "%~dp0netcmds\*" c:\temp\mount\Windows\System32 /Y
pause
rem add packages from 2012 ADK, , there may be several redundant packages
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012packages\WinPE-WMI.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012packages\en-us\WinPE-WMI_en-us.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012packages\WinPE-NetFx4.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012packages\en-us\WinPE-NetFx4_en-us.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012packages\WinPE-Scripting.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012packages\en-us\WinPE-Scripting_en-us.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012packages\WinPE-PowerShell3.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012packages\en-us\WinPE-PowerShell3_en-us.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012packages\WinPE-StorageWMI.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012packages\en-us\WinPE-StorageWMI_en-us.cab"
pause
Dism /Unmount-Image /MountDir:c:\temp\mount /Commit
pause

2012 R2 Batch File contents:
rem For 2012 R2
rem mount winre from 2012 R2 media (that's inside install.wim)
md c:\temp\mount
Dism /Mount-Image /ImageFile:"%~dp0Updated2012r2winre\winre.wim" /Index:1 /MountDir:"c:\temp\mount"
pause
rem Copy iscsi files including iscsi GUI. There may be several redundant files. When running the script seeing Access Denied is normal as files that are already there are not copied.
xcopy "%~dp02012r2IscsiFiles\*" c:\temp\mount\windows\System32 /E /R /H /Y /C
pause
rem Add Networking batch file to WinRE
copy "%~dp0netcmds\*" c:\temp\mount\Windows\System32 /Y
pause
rem add packages from 2012 R2 ADK, there may be several redundant packages
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012r2packages\WinPE-WMI.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012r2packages\en-us\WinPE-WMI_en-us.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012r2packages\WinPE-NetFx.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012r2packages\en-us\WinPE-NetFx_en-us.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012r2packages\WinPE-Scripting.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012r2packages\en-us\WinPE-Scripting_en-us.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012r2packages\WinPE-PowerShell.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012r2packages\en-us\WinPE-PowerShell_en-us.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012r2packages\WinPE-StorageWMI.cab"
Dism /Add-Package /Image:"c:\temp\mount" /PackagePath:"%~dp02012r2packages\en-us\WinPE-StorageWMI_en-us.cab"
pause
Dism /Unmount-Image /MountDir:c:\temp\mount /Commit
pause



Following the successful completion of the appropriate batch file, you should have an updated winre.wim file in the predefined Updated<OS>winre directory. 

To create a bootable .iso from the updated winre.wim:
- I chose to open up a MDT .iso I had on file with my favorite .iso utility
- rename the updated winre.wim to boot.wim
- use my favorite .iso utility to overwrite the boot.wim within the .iso and re-save the .iso

There are many ways to create a bootable .iso so you may want to use another method if you're more comfortable with it.

If you are restoring a physical server you may need to burn a CD/DVD from the .iso. At this point you're ready to restore your target server by:
- boot up the server with the .iso or CD/DVD
- choose 'Command Line'
- execute the netdhcp.cmd file to start networking. Note if you need a static IP, you can use the syntax that's remarked out in the batch file.
- setup the iSCSI connection with the iSCSI GUI
- go back into 'System Image Recovery' and perform the bare metal restore! This process works great to restore virtual servers as well.

Hopefully this was helpful and you are working successfully with 2012/2012R2 and iSCSI bare metal restore!

On a final note, while I was researching this solution I found the 2008 R2 TechNet article that included iSCSI WinPE integration https://technet.microsoft.com/en-us/library/ee619769(v=ws.10).aspx. I found that when using the registry additions referenced in the 2008 R2 article in 2012/2012 R2 WinXE environments, iSCSI would work correctly, but bare metal restoration would fail with an error.

]]> Leveraging copyprofile in Windows 8 deployments and Internet Explorer protected mode https://docs.microsoft.com/archive/blogs/jimriekse/leveraging-copyprofile-in-windows-8-deployments-and-internet-explorer-protected-mode Thu, 02 Apr 2015 12:09:56 GMT https://blogs.technet.microsoft.com/jimriekse/2015/04/02/leveraging-copyprofile-in-windows-8-deployments-and-internet-explorer-protected-mode/ When leveraging the copyprofile=true attribute in an unattend.xml file during a Windows 8 deployment it's important to ensure the default local administrator profile's .\AppData\LocalLow is not present as this temporary data may cause unexpected side effects with Internet Explorer's protected mode. The purpose of the LocalLow folder is to provide protection for the user by providing a safe location that possibly unsecure data can be written and read. By default, a default profile does not have a LocalLow folder and it's a great idea if leveraging copyprofile in Windows 8 deployments to delete the LocalLow folder from the local administrator profile as part of a cleanup step before capturing the image.

Note that if you are experiencing unexpected results using Internet Explorer's protected mode it's also possible to remove the .\AppData\LocalLow folder either from the default profile or a specific profile and allow it recreate.

]]> ConvertPOLtoDCM - Utility to Convert Group Policy .pol files into Configuration Manager 2012 Compliance CIs https://docs.microsoft.com/archive/blogs/jimriekse/convertpoltodcm-utility-to-convert-group-policy-pol-files-into-configuration-manager-2012-compliance-cis Tue, 26 Aug 2014 09:55:00 GMT https://blogs.technet.microsoft.com/jimriekse/2014/08/26/convertpoltodcm-utility-to-convert-group-policy-pol-files-into-configuration-manager-2012-compliance-cis/ If you are serious about checking compliance in your System Center Configuration Manager 2012 managed environment it may have occurred to you that it would be convenient to convert key group policies into System Center Configuration Manager 2012 Compliance Configuration Items (CIs). The following utility will convert the Registry Policy (.pol) portion of group policies; the section under 'Administrative Templates'. If you are interested in converting the entire group policy I've written another more complex blog post that you can use Maximizing SCM to create ConfigMgr 2007 and 2012 DCM Baselines - https://blogs.technet.com/b/jimriekse/archive/2014/05/05/maximizing-scm-to-create-configmgr-2007-and-2012-dcm-cabs.aspx

The ConvertPOLtoDCM utility leverages the ImportRegPol utility written by Aaron Margosis which is included in the attached .zip file and is necessary for ConvertPOLtoDCM to work correctly. More information on ImportRegPol can be found on: https://blogs.technet.com/b/fdcc/archive/2008/05/07/lgpo-utilities.aspx

ConvertPOLtoDCM can be used either interactively or via the command line. To use ConvertPOLtoDCM the following preliminary steps are needed:

- Download the attached ConvertPOLtoDCM .zip file
- Download the LGPO-Utilities.zip file which includes the ImportRegPol utility from https://blogs.technet.com/b/fdcc/archive/2008/05/07/lgpo-utilities.aspx
- Extract the contents of both .zip files
- Copy the files ImportRegPol.exe and ImportRegPol.htm from the extracted LGPO-Utilities directory to the extracted ConvertPOLtoDCM directory. ImportRegPol.exe must be in the same directory as the ConvertPOLtoDCM powershell script to work correctly.
- Ensure that the powershell execution policy allows the execution of the unsigned utility by opening the Powershell ISE as an administrator and running the command Set-ExecutionPolicy Unrestricted
- Ensure you have source content to convert - either a GPO backup or an exported log from the ImportRegPol utility

To use ConvertPOLtoDCM interactively, launch the Powershell script. Either right-click the script and choose Run with Powershell OR open the Powershell ISE and run from there. Local administrative rights are not needed to run the utility. Enter the necessary parameters in the GUI and click Convert.



To use ConvertPOLtoDCM via command line a .htm help file within the attached .zip file details the proper syntax.

Once the .cab file is created it can be imported into System Center Configuration Manager 2012 by navigating to the Assets and Compliance section, expanding Compliance Settings, right-clicking on Configuration Items, and choosing Import Configuration Data. Follow the wizard and ensure the following checkbox is NOT checked Create a new copy of the imported configuration baselines and configuration items.

ConvertPOLtoDCM.zip

]]> Offline USMT 5 and Excluding Local Accounts https://docs.microsoft.com/archive/blogs/jimriekse/offline-usmt-5-and-excluding-local-accounts Sat, 05 Jul 2014 06:37:00 GMT https://blogs.technet.microsoft.com/jimriekse/2014/07/05/offline-usmt-5-and-excluding-local-accounts/ Excluding local accounts is a common scenario when migrating profiles and data using USMT. This is a simple task when using online USMT 5 by adding the parameter /ue:%computername%\*. It is a much different situation using offline USMT. Offline USMT is initiated while in WinPE so the context of the current computer is not available. As a result local accounts are evaluated by SID and therefore the parameter /ue:%computername%\* does not accomplish the goal during the offline capture. This parameter doesn't work during the restore phase either since the SID cannot be translated to the computername even if the computer is named the same. The options in this scenario are limited. If the more common local accounts are known they can be excluded by defining them with successive exclude commands during the capture /ue:*\localaccount1 /ue:*\localaccount2. If using this method ensure that the restore parameter /lac is included to prevent the restore failing if a local account is encountered since there is a real possibility some local accounts may not be excluded. The /lac parameter used by itself will restore local accounts, but leave them disabled.

When using offline USMT 5 keep in mind the differences in data migrated versus online USMT that are documented in the following TechNet article:

https://technet.microsoft.com/en-us/library/hh825238.aspx

]]>