EmailRSS

Duplicating Group Memberships with PowerShell

Posted on by

One project that consistently saves me time every day is my custom Active Directory Users and Computers MMC. This MMC contains quick links to commonly visited OUs and embedded scripts for fast access! But this custom MMC only saves me time if I update it to match my current work.

Because of a very large site migration, I found myself needing to duplicate group memberships very quickly. I was pulling a fireman and migrating group memberships manually. What I needed was an extendable but simple way to automate this. Once again, PowerShell came to the rescue! The script below makes duplicating group memberships with PowerShell a breeze!

Duplicating Group Memberships with PowerShell

The custom AD task


This PowerShell script makes use of the Quest AD cmdlets. If you don’t have these cmdlets installed, you can download them from here.  This script is designed to be completely standalone. Because of that, we start by adding our Quest tools and prompting for a source and a destination computer.

Add-PSSnapin Quest.ActiveRoles.ADManagement

$SourceComputer= read-host "What is the source computer? (This computer is in the groups already.)"
$DestinationComputer= read-host "What is the destination computer? (This computer needs to be added to groups.)"
$DestinationComputer = Get-QADComputer -Identity $DestinationComputer


Your source computer should be the computer that is already in the correct groups. Your destination computer is the machine that needs to be placed in the correct groups. This script is flexible enough to accept a DestinationComputer prefix. For example, typing GAMCN for the DestinationComputer will grab every computer that begins with that prefix! Continue reading →

The Case of the Two IT Pros: the Magician and the Fireman

Posted on by

There are two types of IT professionals. Magicians and firemen. When I first started in IT, I was a fireman. I enjoyed the never ending problems and that superman like feeling when I saved the day with just seconds to spare. After a few years, I realized that I wasn’t making any progress. I was still fixing the same problems every day. I felt chained to the helpdesk. I realized that my work style was completely wrong!

 

Are you a Magician or a Fireman?

The easiest way to define yourself is to look at how you spend the majority of your day. Day in and day out, the fireman will run from one problem to the next. Always fixing problems but rarely really solving them. This barrage of issues dictates a reactive work style. If you were to clump most of their daily tasks together, the tasks would be urgent but not important.

The magician will spend most of the day working remotely, automating processes, and introducing efficiency. As problems are automated (and forever fixed), more time is made available to automate. This rather pleasant cycle lends itself to a proactive and flexible work style. If you were to clump most of their daily tasks together, the tasks would be important but not urgent.

Both types have overlap. Unanticipated problems will ruin any magician’s day. And a fireman will have that all too rare day where nothing breaks. If you are a fireman, you might be wondering how to be a magician. The secret is compounding time. The more problems you automate, the more time you will have to automate!

Funny Effects with Sleight of Hand

For a practical example, let’s see the power of compounding time. You help dozens of users every day. On average, it takes you three minutes to get a computer name from a user and you have to ask six users a day for their computer name. That is 18 minutes a day spent on finding this single piece of information. If you work 260 days a year, you will spend two work weeks on just finding computer names! Imagine how much could get done if it only took you 10 seconds to find a computer name?

By making small changes like this, you slowly start to see your day getting easier. You suddenly start to feel like you are getting ahead of issues and actually making progress! But here is the crucial step in this whole process. Any time saved must be used to save more time. If you script a process that saves you an hour a week, that hour must be used to script another process or to learn a new tool. Otherwise, your up front effort is wasted!

When you compound time for a few months, you will notice a few funny effects. First, your day will be a lot less stressful! Second, you will enjoy your work quite a bit more. Finally, you might start to worry about your job.


Can I Work Myself Out of a Job?

This is a topic often debated within our profession. My firm belief is that it is possible to work yourself out of a job if two conditions exist. First, you continue to automate but never show what you are doing. As with any job, you must show results to remain relevant.

An easy way to show results is to focus your projects on end user problems. Figure out a way to save a department time and show that department what you’ve done. By doing this, you will quickly gain staff members that sing your praises every day!

The second condition is to have idiotic management. It is possible to have a manager that thinks, “Well – no huge problems have popped up lately and our budget has been cut. Guess I will have to let someone go.” If that person was you, consider yourself lucky! You have spent time learning incredibly valuable skills like scripting, Group Policy, deployments, etc. Where your co-workers might have spent the day goofing off, you developed some serious talent! With this toolset, you have the ability to work anywhere (and probably get a raise in the process)!

So Where Do You Fall?

The times, they are a changing. The world of IT is becoming more and more automated. Because of this, I believe that the magician style of work is the easiest way to stay ahead of changes and trends. So where do you fall on this spectrum? Do you think I am right or wrong about this breakdown? Are there other roles or work styles that I completely missed?

Getting a Bird’s Eye View of Your Group Memberships with PowerShell

Posted on by

Getting a Bird’s Eye View of Your Group Memberships with PowerShell

Site migrations suck! And right now, I am stuck in the middle of one. This week, I was tasked with migrating applications and settings for 1,000 computers. Because our applications and settings are controlled through Group Policy (and scoped with security groups), we have a lot of groups that need to be matched and migrated.

Wanting to get a bird’s eye view of my group layout, I put together this script. It is still very much a work in progress but I hope it will help you in your own Active Directory/Group Policy cleanups or migrations.

 

Grabbing Our Data

This script starts by prompting you for a computer name. It will then use the Quest AD Cmdlets and find the OU that this machine is a member of. Next, it will grab every computer that is in that same OU.

Clear-Variable Groups -ErrorAction SilentlyContinue

$SearchComputers = read-host "What is the computer name?"

$Computers = Get-QADComputer *$SearchComputers* | Select-Object ParentContainer
$Computers = Get-QADComputer -SearchRoot $Computers.ParentContainer | Sort-Object Name

$SearchComputers = Get-QADComputer *$SearchComputers* | Select-Object ParentContainer
$SearchComputers = $SearchComputers.ParentContainer

Continue reading →

Pinning Programs to the Taskbar with Group Policy

Posted on by

This post has been superseded by the Pin Programs to the Taskbar in Windows 10 with Group Policy article. You can continue reading below for an overview of how pinning works at the OS level. The article below also contains two corny jokes.

 

The Taskbar in Windows 7 and the Start Screen in Windows 8 are the first places your users should go to access their applications. Unfortunately, users do not take advantage of these locations by pinning programs. Instead, they will cumbersomely search the Start Menu or minimize twelve applications to get to the desktop. It is time to make their life a bit easier!

In part one of this two part series, we will cover pinning programs to the Taskbar with Group Policy. In part 2, we will cover similar tricks for managing the Windows 8 Start Screen. No matter your OS, making applications easier to access will certainly make your staff happier!

Pinning Programs to the Taskbar with Group Policy

Outlook in two less clicks! YES!!!


How Can I Pin Programs to the Taskbar with Group Policy?

Not as easy as you would think. It can’t be done with Administrative Templates. Though you can use Group Policy Preferences, it isn’t fun or flexible. The best way (so far) seems to be with Group Policy Scripts.  Here is the funny thing about programs that are pinned to the Taskbar. They aren’t exactly stored clearly or cleanly.

For an application to show up on the Taskbar, it must have a corresponding shortcut and appear in a specific registry value. The shortcut must exist under the current user’s roaming appdata (%APPDATA%). The exact location is at: %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

The registry key is the tricky part of this equation as the program values are stored in the Taskband Current User registry key. This key can be found at: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband. And it looks like:

Pinning Programs to the Taskbar with Group Policy

See the tricky part now?

Because the values above are unique to the specific programs pinned, you can deploy this registry key (along with a shortcut preference). This way involves a bit of work and isn’t self documenting. It does work if you have one standard taskbar for your environment that doesn’t change. For a simpler way, keep reading.

 

Continue reading →

An Easier Way to Access the Helpdesk (without IE Maintenance Important URLs)

Posted on by

Do you get tired of telling people where your technology helpdesk is or how to access it? I certainly do! Looking for an easier way, I discovered that Internet Explorer includes a very intuitive way to connect your users to your helpdesk. Under the help menu in IE, you will notice an Online Support button. By default, this link takes you to support.microsoft.com.

IE Maintenance Important URLs

With a simple registry hack, we can point this button to any URL that we want! Implementing this is easy when using Group Policy Preferences. Our end result allows us to redirect users to our internal helpdesk URL!

What About IE Maintenance?

Beginning with IE 10, managing settings with Internet Explorer Maintenance (IEM) became impossible! While Administrative Templates and IE Preferences can replace most of the settings within IEM, they don’t support all of the Important URLs. The big one that was no longer supported was the Online Support link.

Most of these settings can be configured in the registry. The trick was finding out exactly what needed to be set. Thankfully, Microsoft has documented this process thoroughly in this very obscure TechNet article.

 

Deploying Your Registry Change

In a GPO, navigate to User Configuration/Preferences/Registry. Create a new registry preference with the following settings:

Action: Create

Hive: HKEY_Current_User

Key Path: Software\Microsoft\Internet Explorer\Help_Menu_URLs

Value Name: Online_Support

Value Type: REG_SZ

Value Data: YOUR HELPDESK URL

 

Close the Group Policy editor and link this GPO to an OU containing users. If you use a unique helpdesk URL for specific locations, you can also use Loopback Policy Processing to set this registry key for a group of computers.

On the next GPUpdate (including a background refresh), your clients will have easy access to your company helpdesk! This is true even if Internet Explorer is currently open. Pretty cool!

Wrapping up – how do your users access the helpdesk? Favorites? Start Menu/Screen shortcuts? Custom Error URLs? Something else?