Paul J Hadad - ConfigMgr Guy https://docs.microsoft.com/archive/blogs/paul_hadad_blog/feed.xml Paul Hadad Senior Consultant Microsoft - Client Deployment / Configuration Manager Wed, 17 Apr 2019 03:31:18 GMT en-US hourly 1 Running Automated Scripts in WinPE https://docs.microsoft.com/archive/blogs/paul_hadad_blog/running-automated-scripts-in-winpe Tue, 26 Jul 2016 19:14:25 GMT https://blogs.technet.microsoft.com/paul_hadad_blog/?p=45 *PCIe and DisplayPort - No Security

   1.First you mount the boot image to make some customizations. The Script that we use in this example is written in PowerShell so don’t forget to add this optional component to the boot image. Steps to Mount Boot Image:https://technet.microsoft.com/en-us/library/hh824814.aspx2. 2.Add an HP folder at the Root of the boot image that contains the biosconfigutility64.exe Utility and a bat file that will be called by the unattend.xml that kicks off the script. HP_Folder   Thunderbolt.cmd (contains one line to execute PS1 script) Powershell.exe -executionpolicy unrestricted -file x:\hp\thunderbolt.ps1 Note: You can also include any other required files that could also modify the bios to convert it from Legacy to UEFI. Root_winpe 3. Add the Unattend.xml file to the root of the boot Image that includes a RunAsynchronousCommand. You can see the command that runs the bat file we created in Step B.

<?xml version="1.0" encoding="utf-8"?>

<unattend xmlns="urn:schemas-microsoft-com:unattend">

<settings pass="windowsPE">

<component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="https://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance">

<RunAsynchronous>

<RunAsynchronousCommand wcm:action="add">

<Path>cmd /c x:\HP\Thunderbolt.cmd</Path>

<Order>1</Order>

<Description>Set Thunderbolt</Description>

</RunAsynchronousCommand>

</RunAsynchronous>

</component>

</settings>

<cpi:offlineImage cpi:source="wim:c:/temp/en_windows_10_enterprise_version_1511_x64_dvd_7224901/sources/install.wim#Windows 10 Enterprise Technical Preview" xmlns:cpi="urn:schemas-microsoft-com:cpi" />

</unattend>

Note: Only a handful of components are supported with the WinPE boot image. You can create an answer file and include any of the following settings for use with Windows PE: 4. The Powershell Script below performs a few simple checks before running.
  1. Checks WMI to ensure this only runs on the correct model.
  2. Check the BIOS for the current Thunderbolt Security Setting, changes it if incorrect and then stops the task Sequence engine in order to reboot the system for the change to take effect.
  3. If the correct model and thunderbolt setting are detected it proceeds with the task sequence (Yes I will get around to adding logging)
if ($(Get-WmiObject -Namespace "root/cimv2" -Class "win32_computersystem").model -match "HP Elite x2 1012 G1") { $result = cmd /c BiosConfigUtility64.exe /getvalue:"Thunderbolt Security Level" $resultxml =[xml] $result $wmithunbolt = $resultxml.biosconfig.setting.value.Innertext if($wmithunbolt -notmatch "\*PCIe and DisplayPort - No Security,PCIe and DisplayPort - User Authorization,PCIe and DisplayPort - Secure Connect,DisplayPort only") { CMD /c "x:\hp\biosconfigutility64.exe /setvalue:`"Thunderbolt Security Level`",`"PCIe and DisplayPort - No Security`"" stop-process -name "tsmboot*" } } Note: Few things that gave us grief was that when WinPE loads, WMI is available but non Microsoft created ("root\HP\InstrumentedBIOS") classes throw error code (0x8004100E) in Powershell and vbscript, This resulted in us using the BiosConfigUtility64.exe /getvalue to get around the problem.  Also the HP Support package SP75214.exe was adding to the Boot image as Driver pack. Thanks Victor and John M! As you can see this provides a great way to let WinPE perform some pre-build automation right when it initializes. This could easily be modified to change the bios to UEFI in preparation for Windows 10, taking advantage of the new security features. Disclaimer: The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included script samples are subject to the terms specified in the Terms of Use            ]]> Synchronize from an upstream data source location (URL) https://docs.microsoft.com/archive/blogs/paul_hadad_blog/synchronize-from-an-upstream-data-source-location-url Thu, 11 Apr 2013 13:26:59 GMT https://blogs.technet.microsoft.com/paul_hadad_blog/2013/04/11/synchronize-from-an-upstream-data-source-location-url/ Most of the time the top-level site in a hierarchy is configured to synchronize software updates metadata with Microsoft Update. Some company’s corporate security policies don’t allow access to the Internet from the top-level site. Now with System Center Configuration Manager 2012 SP1 it is possible to configure the synchronization source for the top-level site to use an existing WSUS server that is not in your Configuration Manager hierarchy.  In the Software Update Point Component properties you now have the option to synchronize from an upstream data source location (URL)

https://technet.microsoft.com/en-us/library/gg712696.aspx#BKMK_WSUSSyncSource

 

The synchronization takes care of the patch catalog but what about the updates I need to create my patch bundles? If you configure the Upstream WSUS server as a patch repository you will have an alternative download location but still keep the Top level ConfigMgr 2012 SP1 Server not directly connected to the Internet. It is important to make sure that the upstream WSUS Server is configured with matching patch levels and synchronization option with the Software Update point to avoid headaches.

 

Populate the WSUSCONTENT folder with Express Installation files.

On the Upstream WSUS standalone server selecting the option to download the express installation files will allow some time for the update binary downloads to take place. It will populate the WSUSCONTENT folder with all the express installation files based on the products and classifications that you have selected. This option doesn’t require you to approve updates. For my test I only selected the categories that I required and the server downloaded 200 GB of express installation files. You'll notice when you set up a software update group and select updates to add to your bundle you are only prompted with the options to download from the Internet or a network location.

  • Create a New Software Update group on the top level ConfigMgr server.
  • Select browse and enter in the UNC path to the WSUSCONTENT folder on the upstream Standalone WSUS Server. It will grab all the updates you selected and move them to your deployment package source.

This option provides another layer of security and should allow an administrator to work on other tasks other than downloading security updates.

 

 

 

]]>