EmailRSS

Four Active Directory PowerShell Scripts and Notes

Posted on by

When wrapping up our PowerShell lunch and learn today, I made you guys two promises. First, I would get the notes uploaded. Second, I would copy up the 4 sample scripts that we worked with. Here is that content:

The PowerShell + AD management notes can be found here. The notes are sparse but are designed to be followed with a PowerShell console. We started our session by querying machines and ended by stringing together multiple cmdlets for some cool automation! If you have any questions (or thoughts) about the notes, drop me a comment.

At the end of our session, we dove into 4 scripts. All four scripts use the Quest AD Cmdlets. You can use the native AD module if desired.

 

Cleaning Up Old Computers

Our first script disables (and eventually deletes) stale computers from your domain. You will need to create an OU named Computers_Stale. If you have the AD recycle bin enabled, you can modify the script to just delete the computer instead of disabling it.

#Import Module
Add-PSSnapin Quest.ActiveRoles.ADManagement

#Disable and Move to Computer_stale

    #Administration: Disable Old Computers and Move to Computers_Stale
    $Computers = Get-QADComputer -SearchRoot "DC=Test,DC=local" -SearchScope Subtree -Inactivefor 366
    $Computers | Set-QADComputer -Location (Get-Date)
    $Computers | Disable-QADComputer 
    $Computers | Move-QADObject -NewParentContainer 'OU=Computers_Stale,DC=Test,DC=local' 

#Delete Super Stale Computers
$Computers = Get-QADComputer -SearchRoot "OU=Computers_Stale,DC=Test,DC=Local" | where Location -GT (Get-Date).AddMonths(-7)
$Computers | Remove-QADObject

A lengthier version of this script (along with some additional instructions) can be found here.

 

Continue reading →

(Updated) Lunch and Learn: Active Directory and PowerShell

Posted on by

Our next Lunch and Learn will be on Active Directory and PowerShell! We will cover the two ways to manage AD with PowerShell, how to use and combine cmdlets, and look at some sample scripts. Specifically, we will learn how to create users, automatically update groups, and clean up AD. If you have any specific items that you want to see, leave a comment and I will try to work it into the notes.

Here are the details:

  • Date: 07/14/14 (Monday)
  • Time: 11:30 – 12:30 PM EST
  • Location: Risley Annex (2900 Albany Street Brunswick, GA 31520). GIT Lab 1 – park in gated lot – enter building – take a right

We will be in a computer lab so we have about 25 spots. These computers will have PowerShell on them so that you can follow along. If you plan to attend in person, leave a comment or email me so that I can reserve a spot for you.

If you are attending remotely, ensure that you have a computer running PowerShell v3 and that you have the Active Directory module installed (get-module).

 

The remote meeting link is: https://meet.lync.com/deployhappiness2-deployhappiness/joseph/MGHNYQBN

The meeting uses Lync. If you have any issues joining, use the Windows 8 Modern (Store app) or the Lync web app.

 

See you all soon!

*This should actually be called a Learn and Lunch as we typically go out to lunch after the training.

Automatic Restarts Make for a Smooth Day

Posted on by

Automatic Restarts Make for a Smooth Day

How many times has a reboot cleared out a quirky issue? How many times have you had to ask, “have you restarted yet?”  By using Group Policy Preferences Scheduled Tasks, you can ensure that every computer automatically reboots once a day.

This simple task allows software to install and updates to apply before your users arrive for the day.  Got five minutes to set this up? Great! Let’s configure a daily restart task.

Decide where to store the scheduled task. You could launch the GPMC and create a new GPO named Daily Restart. Or put the task in a related GPO (such as one that configures Power Options). Next, navigate to Computer Configuration/Preferences/Control Panel Settings/Scheduled Tasks.

Right click on Scheduled Tasks and select New – Scheduled Task (at least Windows 7).  Name your task and provide a description. Change the task’s account to NT Authority\System and select the Run whether user is logged on or not option.

01

Select the Triggers tab and create a new trigger. Set the task to begin on a schedule and select the Daily option. In our environment, the restart occurs before our first employees arrive.

You will want to set your task to begin early enough that you restart the maximum number of computers. Later, we will configure the task to not run if the machine is in use.

02

With your trigger is configured, select the Actions tab and create a new action. Leave the action type at Start a Program. For the program, enter:

shutdown.exe -r -f -t 0

This will forcefully restart a machine with a zero second delay. Make sure that your command includes a zero instead of the letter o. If your machines automatically start up in the morning, you could make your command shutdown.exe -s -f .

One last fun fact before we get back on topic. Shutdown.exe -i makes remotely shutting down groups of machines easy. You can even prompt a message up on a user’s screen. Now back to your regularly scheduled article.

03

In your Daily Restart task preference, select the Conditions tab. If needed, configure the task to start only if the machine is idle for X amount of time. Under Power, check all three options. This will ensure that remote laptops don’t scare their owners by restarting at 5 AM.

Allowing the task to Wake the computer to run might seem counter intuitive. If the machine is off, why would we want to wake it up just to restart it? Certain Group Policy settings only process on a true startup. The biggest example is Group Policy Software Installation.

If the machine hibernated the previous day, it would not install your applications until the next full reboot. Setting the task to wake the machine ensures a full restart every day!

The final bit of configuration that you might want to do is to limit the deployment of this task. For example, you might have certain machines that should never restart automatically. To do this, select the common tab and configure a new Item Level Target. My preferred method is limit deployment to all machines not in a specified security group.

04

Setting your computers to automatically restart is one more way to make your day smoother! What other tricks do you use to make life a bit simpler?

How to Remotely PXE Boot a Computer

Posted on by

You have your MDT task sequence perfected! All of your machines are configured in the MDT database. When you boot a machine into MDT, it looks up its name and images without any prompts. If only you didn’t have to physically PXE boot the computer! If only you had a way to remotely PXE boot a computer…

Remotely PXE Network Boot a Computer

Rethinking a PXE Boot

Your goal isn’t to PXE boot a computer; your goal is to set the onboard-NIC as the primary boot device. That small difference is so important! When a machine is online, changing the boot order this way will allow it to boot into a MDT task sequence the next time it starts up. This post will focus on remotely PXE booting a Dell computer. This same concept can be applied to any make/model that allows you to edit the boot order.

Your first step is to build a BIOS settings package that sets the onboard-NIC as the primary boot device. If you haven’t made a BIOS package yet, this guide covers the steps in detail. Download and install the Dell Client Configuration Toolkit. The download can be found here.

Launch the Client Configuration Toolkit, select Create Package, and choose Multi-Platform file. In the boot management section, double click on bootorder. Select View/Change – Edit – Add Device. Your first device should be the embedded NIC with a Device Instance of 0. The second device should be the Hard Disk with a Device Instance of 1.

Remotely PXE Network Boot a Computer

Save the boot order and export the configuration as an EXE. If your machines contain a BIOS password, specify it now. Copy this EXE to a network share.

 

Running a Batch File Remotely

Now we need to create a batch file to execute this package on remote machines. We will be using the PSTools suite. A download can be found under the Desktop Management section here.

Copy the psexec and psshutdown tools to the root pf your local profile. Create a new batch file in the same folder. Paste in the following:

xcopy "\\SERVER\SHARE\Dell\forcepxe.exe" "\\%1\\C$\Users\Public\"
psexec \\%1 -u DOMAIN\USERNAME-p PASSWORD -h "C:\Users\Public\forcepxe.exe"

psshutdown.exe -r -t 60-c -m "This computer has been scheduled for a remote image. If you would like to delay this process, please select cancel" \\%1

pause

You will need to edit the xcopy path to point to your BIOS settings EXE. You will also need to specify credentials for the psexec line. The user specified needs to be an admin on the remote machine. You can now run this script from the run box.  I named my batch file forcepxe.bat. By pressing WIN + R, I can simply type forcepxe REMOTECOMPUTERNAME to run this script.

03

Remotely PXE Network Boot a Computer

In the script output, you should see that the BIOS package successfully copied and executed on the remote machine. The machine will pause for 60 seconds to allow a user to cancel the reboot. After a minute, it will restart and boot off of the NIC! Pretty awesome right? One problem though – we are now stuck in an endless loop. The machine will install the OS and reboot back into a MDT task sequence. On the bright side, you don’t need deepfreeze anymore. 🙂

In our next post, we will edit our task sequence to prevent this endless loop by changing the boot sequence in Windows PE. Do you have another way of PXE booting a remote machine? What hurdles prevent you from getting to a Zero Touch image?

Time for Another Lunch and Learn!

Posted on by

Lunch and Learns are kind of a tradition around here. A bunch of us get together, eat some good food, and learn something really cool!  I had three people email me yesterday asking for another lunch and learn. I guess I have to stop being so lazy and start organizing.

I need two things from you guys. First, I need a rough count on physical attendees so that I can pick a large (or small) enough place. If you are in the South Georgia (US) area and would like to come, leave a comment.  If you aren’t located in the area, don’t worry – you can still attend virtually!

Like last time, the topic is decided by popular vote. Do you have a topic that you would like to learn more about? Make a topic suggestion below.  Next week, I will organize the topics into a poll for us to vote on. I will start by suggesting three topics:

  • Using PowerShell with Active Directory
  • Why aren’t you using SCCM
  • Making Windows 8.1 Easy

I will have the date, time, and place next week. So who is ready for another lunch and learn?