Configuration Manager Content Update Automation

Sam_Roberts — Mon, 18 Dec 2017 06:42:06 GMT

I recently encountered a challenge at one of my customers where the content library on the distribution points had become corrupted. The result was that we had to update the content of every package, application, driver, image etc. in order to correct the issue in the content library. If you have ever had to do this before you know that this can be a very time consuming activity depending on how much content you have and the size of the environment. My solution was to write a PowerShell script to do the heavy lifting for me. You can download the script below. The script is designed to maintain a specified number of packages updating at all times. I didn't want to overwhelm the site or queue up too many updates in case something higher priority needs to be updated. The script will check for how many content updates on in an "In Progress" state and try not to exceed the number specified. If the script determines that content can be updated it will update packages based off of a list of PackageIDs specified in a text file. After updating the packages the script will wait for a specified number of minutes. After the wait period it will again check for the number of packages in progress and update more content if below the threshold. The script will continue until it has updated all packages in the file. Its important to note that the InProgressThreshold parameter only applies to content that is targeted to a number of distribution points greater than the value in the TargetThreshold parameter. This option was created for large scale distribution where pull DPs may be in use and where there are a some sites that have slower network connections. If this does not apply to you I would recommend either setting the TargetThreshold parameter to a value higher than the number of DPs you have or set InProgressThreshold to 0. Download Here >> Update-SCCMContent_1.0 ----------------------------------------------------------------------------------- NAME Update-SCCMContent.ps1 SYNOPSIS Updates Configuration Manager content based on a list of PackageIDs. SYNTAX .\Update-SCCMContent.ps1 [-SiteCode] [-InputFile] [-InProgressThreshold] [-TargetThreshold] [[-MaxConcurrent] ] [[-Delay] ] [] DESCRIPTION Using a text file containing a list of PackageIDs this script will gradually update content while attempting to maintain a specified number of packages in the distribution queue. Progress will be logged to a file name content_update_yyyymmdd_hhmmss.log in the user's local AppData temp folder. PARAMETERS -SiteCode The Configuration Manager site code. (example: L01) Required? true Position? 1 Default value Accept pipeline input? false Accept wildcard characters? false -InputFile Path to a text file containing a list of PackageIDs to update. Required? true Position? 2 Default value Accept pipeline input? false Accept wildcard characters? false -InProgressThreshold The number of packages with content distribution in progress. This will be used to help determine when more updates will occur. This only applies to content that is targeting a number of distribution points greater than or equal to the value of the TargetThreshold parameter. Required? true Position? 3 Default value 0 Accept pipeline input? false Accept wildcard characters? false -TargetThreshold The InProgressThreshold value will only apply to content that is targeting at a number of distribution points greater than or equal to this value. Required? true Position? 4 Default value 0 Accept pipeline input? false Accept wildcard characters? false -MaxConcurrent The number of content updates to run concurrently. If not specified the default is 5. Required? false Position? 5 Default value 5 Accept pipeline input? false Accept wildcard characters? false -Delay Number of minutes to delay between update cycles. If not specified the default is 15. Required? false Position? 6 Default value 15 Accept pipeline input? false Accept wildcard characters? false This cmdlet supports the common parameters: Verbose, Debug, ErrorAction, ErrorVariable, WarningAction, WarningVariable, OutBuffer, PipelineVariable, and OutVariable. For more information, see about_CommonParameters (https://go.microsoft.com/fwlink/?LinkID=113216). INPUTS OUTPUTS -------------------------- EXAMPLE 1 -------------------------- PS C:\>.\Update-SCCMContent.ps1 -SiteCode L01 -InputFile .\packageids.txt -InProgressThreshold 15 -TargetThreshold 100 -MaxConcurrent 25 -Delay 15

Create ConfigMgr Configuration Items from Group Policy Object

Sam_Roberts — Mon, 19 Jun 2017 22:00:43 GMT

I have been asked by customers if it is possible to use ConfigMgr to monitor compliance of Group Policy settings. The short answer has always been yes but it is not easy. If you had to manually identify all the registry keys associated with a GPO and create the individual CI rules this process could takes hours if not days for larger policies. This script simplifies the process and queries for the values and creates the CIs in a matter of seconds. I have seen similar scripts however many of the others still require user to create a .POL file for the script to ingest then import a .CAB file into ConfigMgr. This script fully automates the process.

What Does it Do?

This script uses both the Configuration Manager and Active Directory PowerShell modules to query for registry keys associated with Group Policies then create the Configuration Items for each of the registry values. I have updated the script to include a few options on how this gets done. First, the script will either query for a single group policy or utilize a Resultant Set of Policy to determine applicable policies for a specified system. To enable the Resultant Set of Policy (RSOP) option include the 'ResultantSetOfPolicy' parameter and specify the system to run RSOP against using the 'ComputerName' parameter. Leveraging the Active Directory PowerShell module and the Get-GPResultantSetOfPolicy command the script will run an RSOP on a specified system and export the results to a temporary file. The file is then searched to determine what group policies are applied to the system and what the link order is for those policies. This will be used to determine what order the group policy data is queried to simulate their link order. If the 'ResultantSetOfPolicy' option is not used this step is skipped and the script will query only for the one group policy specified. To get a list of registry keys associated with the group policies the Get-GPRegistryValue command is used to query for the specified group policies. The full key path, key name, value and data type are all stored in an array. When the 'ResultantSetOfPolicy' option is used the group policies will be queried starting with the policy that would be applied last. As each additional policy is queried the script will check to see if that registry key has already been stored with another value. If the registry key is already present, the additional occurrence of that key will be skipped since the policy that is last applied would over write the lower policies. If the 'ResultantSetOfPolicy' option is not used the script will only query for the one policy specified. Once the script has successfully queried for all the associated registry keys and values it utilized the Configuration Manager PowerShell module to create the Configuration Item definition files in xml format. This will include a setting and rule for each of the registry keys of supported data type (binary values are not supported by DCM). You can specify the severity of non-compliant settings as well as remediation of non-compliant items using command line parameters. The final step is to import the Configuration Item definition file into Configuration Manager. By default, this is done automatically, creating a CI with settings and rules for all associated registry values. If you do not wish to have this automatically created you can use the 'ExportOnly' parameter which will save the data to a .cab file which can later be manually imported into Configuration Manager. In my tests, this script can query for and create a CI with over 200 registry values in under 20 seconds.

How to Use the Script

This script must be executed from a system that has access to both the GroupPolicy and ConfigurationManager PowerShell modules. The GroupPolicy module is installed with the Remote Admin Tools and the ConfigurationManager module is installed with the ConfigMgr Admin Console. Additionally, if the 'ResultantSetOfPolicy' option is used the user must have remote admin access to that system. Extract the .ZIP file and execute the PowerShell script via a PS console. Download Here >> Convert-GPOtoCI_1.2.6

Parameters:

GroupPolicy [optional] - This is enabled by default and will make the script query only for one specified group policy.
GpoTarget [required unless ResultantSetOfPolicy option is used] - Name of group policy object
ResultantSetOfPolicy [optional] - Utilizes a resultant set of policy to determine the set of applied GPOs. Cannot be used in conjunction with the GroupPolicy option.
ComputerName [required when ResultantSetOfPolicy is used] - Name of system to run RSOP on.
DomainTarget [required] - Fully qualified domain name
SiteCode [required] - ConfigMgr site code
Remediate [optional] - Enable configuration item to remediate non-compliant settings
Severity [optional] - Sets the severity of non-compliant items. (None, Informational, Warning or Critical)
ExportOnly [optional] - Exports the Configuration Item to a CAB file to be manually imported
Log [optional] - Writes all discovered registry keys and their related GPO name to a file.

Example 1: .\Convert-GPOtoCI.ps1 -GpoTarget "Windows 10 Settings" -DomainTarget contoso.com -SiteCode T01 Example 2: .\Convert-GPOtoCI.ps1 -GpoTarget "Windows 10 Settings" -DomainTarget contoso.com -SiteCode T01 -Remediate Example 3: .\Convert-GPOtoCI.ps1 -GroupPolicy -GpoTarget "Windows 10 Settings" -DomainTarget contoso.com -SiteCode T01 -Severity Warning Example 4: .\Convert-GPOtoCI.ps1 -ResultantSetOfPolicy -ComputerName lab-srv-test01 -DomainTarget contoso.com -SiteCode T01 Example 5: .\Convert-GPOtoCI.ps1 -GpoTarget "Windows 10 Settings" -DomainTarget contoso.com -SiteCode T01 -ExportOnly Tested On: Configuration Manager vNext 1706 Download Here >> Convert-GPOtoCI_1.2.6

Change Log

v 1.1.1 (7/12/2017)

Added -ExportOnly switch that will export the Configuration Item data to a .CAB file instead of automatically creating the CIs. This file can be used to import the CI into ConfigMgr.

v 1.2.1 (7/17/2017)

Added -ResultantSetOfPolicy parameter to enable to script to run RSOP against a system to determine the applied group policies then query for all registry keys associated with the applicable policies and settings.

v 1.2.3 (9/18/2017)

Added the -Log switch that will log all discovered registry keys and their related Group Policy object to a file named gpo_registry_discovery_mmddyyyy.log in the scripts root directory.

v 1.2.4 (9/18/2017)

Fixed bug where registry values were always being logged to file even when the -Log switch was not set.

v 1.2.6 (11/6/2017)

Bug fixes.
Allow for creation of User Policy based CIs.

Sam Roberts's TechNet Blog