MDMoore313's questions

PS C:\ProgramData\Microsoft\Windows\Hyper-V\BigHomie> New-WindowsImage -CapturePath K: -ImagePath C:\VHDImports\Win764.wim -name "BigHomies Personal Image" -Verify -CompressionType "Max"

Throws the following error:

    New-WindowsImage : The given key was not present in the dictionary.
At line:1 char:1
+ New-WindowsImage -CapturePath K: -ImagePath C:\VHDImports\Win764.wim -name " ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [New-WindowsImage], KeyNotFoundException
    + FullyQualifiedErrorId : System.Collections.Generic.KeyNotFoundException,Microsoft.Dism.Commands.NewWindowsImageC
   ommand

I'll say running this command w/out the -CompressionType parameter runs and gives an uncompressed .wim file. Running this w/out giving an argument to the -CompressionType parameter gives an error that I need to supply an argument of type System.String.

Google turns up little about this specific error, none of which seems applicable to my situation, and none of those results are about the error happening with powershell, let alone this particular cmdlet.

I just setup and sysprepped a nice new VM, now I need to convert it to a wim real quick, to upload to my sccm server. For some reason, I can't change the VM properties to boot from a legacy nic for pxe, which is how I usually capture my images using sccm. VMM just changes the settings right back, even though it says successful.

Anyway, the first page of google was terrible for this, w/ the exception of a 3rd party .ps1 script on MS's website, but I'm using 2012r2, I should be able to do this natively, right?

It happens from time to time. I update a package and need to update the distribution point. We have multiple DPs, and usually everything goes through fine, however every once in a while, our main DP fails to update the package.

The content status log never says much about the failure. I don't have backend server access to the management points, or the DPs, I'm just the SCCM admin. I can check any logs in SCCM, run reports, and everything, but I don't know where to look.

In the past I've tried setting the "Disconnect Users from Distribution Point" setting on the problem package, both sub-settings to 0, but it doesn't really work for us. The problem just seems to go away on it's own after some time, but sometimes it takes several days. For the majority (really all, but there may be one or two I've overlooked) we set clients to "Run Program from Distribution Point" When deploying the program, not sure if that has anything to do with it, or what the root cause is.

Update

I've found a little more information in the reports, specifically the All Status Messages for a Specific Package at a Specific Site query. Using my package ID for the query, after the DP Update failed again, I did see one entry that stood out:

Distribution Manager failed to process package "Configuration Updates" (package ID = SOM00013).

Possible cause: Distribution manager does not have access to either the package source directory or the distribution point. Solution: Verify that distribution manager can access the package source directory/distribution point.

Possible cause: The package source directory contains files with long file names and the total length of the path exceeds the maximum length supported by the operating system. Solution: Reduce the number of folders defined for the package, shorten the filename, or consider bundling the files using a compression utility.

Possible cause: There is not enough disk space available on the site server computer or the distribution point. Solution: Verify that there is enough free disk space available on the site server computer and on the distribution point.

Possible cause: The package source directory contains files that might be in use by an active process. Solution: Close any processes that maybe using files in the source directory. If this failure persists, create an alternate copy of the source directory and update the package source to point to it.

I'm doubting the middle two causes for simple reasons

• The source folder isn't that deep to contain long filenames for NTFS, although I'll attempt to check for completeness.

• I can add files to the DP just fine, so it's not a filespace problem, other packages can be updated just fine.

What I wasn't expecting is that the 3rd cause says the source directory is in use somewhere. What difference would that make anyway? Isn't is just copying the files off the fileshare into the SCCM DP Share? Further throwing me for a loop b/c clients don't even access the source directory, it's pretty much just a staging directory for sccm to copy files from.

That just leaves the first cause, but that again goes back to the same thing: Other packages can update just fine.

Booted up a VM into the SCCM OSD WinPE, entered password, and selected a task sequence. Before any packages were downloaded, I was hit with error 8007000E. The smsts.log file reports this error, and using the Trace Log Tool's error lookup that code means:

Not enough storage is available to complete this operation.

The VM's hard disk is IDE and 60GB Dynamic. I've never had this problem before.

So, $software runs on a 'server' (windows client w/ file sharing to share out the db folder), and laptop client has the drive mapped and $software also installed. This is the vendor's recommended setup.

Well, when user boots up laptop and logs in, wireless isn't connected yet, no mapped drives, so when software is opened it doesn't detect the files (b/c they aren't mapped) and user can't work.

I thought I got around this by using a powershell login script to detect when the wireless connected and then map the drive, but I just followed up and she says the laptop stop working again, so I can only assume that must have broken somehow. The user starts the software manually after logging in, and I'm not going to tell her to go in My Computer and double click the Z drive to manually initiate the mapping, then start the software. Makes me look bad.

What I will be trying when I go onsite is make use of local group policy and

-Set the wireless profile for the office as a computer config, so it logs on before login

-Set the Always wait for network at computer startup and logon group policy

-Use Group policy to set the drive mapping for the user at login

My hope is that all this is done before the desktop appears, because from a user experience standpoint if the desktop is up then everything should be ready to go.

Any other ideas, or things I've overlooked?

Got SCVMM 2012 R2 up and running, created a single VM w/ dynamic memory (512MB-4096MB) and a 40GB dynamic disk. The host is configured for NIC Teaming using switch independent configuration.

I setup a legacy network adapter and boot up to WinPE. The version of the boot.wim is WinPE4, configured to launch sccm. I do not know if it has virtual nic and storage drivers, but I didn't have a problem when creating standard hyper-v VMs in the past (2012, non R2). It downloads the boot.wim, but freezes at the very end when (I'm assuming) it goes to unpack it.

That's a 100% progress bar, and it just sits there. I'm in the process of creating a fixed disk VM, but I doubt that will resolve the problem. Posting here in the mean time in case anyone else has come across this as well.

Using ADK for Windows 8.1, and the DISM cmdlets that come with them. I have WMF 4.0 installed. My machine is Windows 7 x64 SP1, and I'm trying to mount the wim using

PS C:\Users\BigHomie> Mount-WindowsImage -ImagePath 'C:\Program Files (x86)\Windows
Kits\8.1\Assessment and Deployment Kit\Windows Preinstallation Environment\x86\
en-us\winpe.wim' -Path C:\WinPE_x86 -index 1

And receive the following error:

Mount-WindowsImage : DismInitialize failed. Error code = 0x8007007e
At line:1 char:1
+ Mount-WindowsImage -ImagePath 'C:\Program Files (x86)\Windows
Kits\8.1\Assessmen ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : NotSpecified: (:) [Mount-WindowsImage], COMExcep
   tion
    + FullyQualifiedErrorId : Microsoft.Dism.Commands.MountWindowsImageCommand

Using dism.exe works fine.

Update

Forgetting I had this problem, I went to mount a wim using the Powershell ISE and actuallygot a visual error message about

"C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\Deployment Tools\x86\DISM\api-ms-win-downlevel-advapi32-l4-1-0.dll" 

not being installed. After checking that the dll did in fact exist in the folder I called regsvr32 and received another error message

Will try reinstalling as recommended.

#Get user names that have logged onto workstation
$Users = gwmi win32_networkloginprofile | where {$_.name -match "EXP\\"} | where {$_.name -notmatch "srvtasksched"}


$Users | foreach{

    $Name = $_.Name
    $LastLogon = $_.LastLogon

    $LogonTime = [System.datetime]::ParseExact($LastLogon.Substring(0, $LastLogon.IndexOf(".")), "yyyyMMddHHmmss", [System.Globalization.DateTimeFormatInfo]::InvariantInfo)

    if($(Get-Date).Subtract($LogonTime).TotalDays -ge 14)
    {
        #User hasn't logged into workstation in over 2 weeks
        #Get profile path
        $UserSID = $(New-Object System.Security.Principal.NTAccount($Name)).Translate([System.Security.Principal.SecurityIdentifier]).Value
        $UserRegKey = GCI 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList' | where {$_.Name -match $UserSID}

        $ProfilePath = $(Get-ItemProperty $UserRegKey.PSPath -Name ProfileImagePath).ProfileImagePath

        Write-Host "Deleting User $Name"
        gwmi win32_userprofile | where {$_.SID -eq $UserSID} | foreach {$_.Delete()}

    }

}

That's the script. It detects and deletes domain profiles (Domain is EXP) on systems that haven't logged into the system in over 14 days, and it works.

However, I started receiving complaints that the script is deleting local accounts, one local account in particular. Assuming that was impossible (I have perfect script skills, right?), I took a look, ran the script, and saw that the profile folders for all the local accounts were still present under C:\Users (Win 7 workstations). False claim.

Fast forward, more complaints. I ran the script again, same results. However, this time I noticed that the registry entry for one particular local account was gone (the one the complaints are stemming from). I ran the script pretty much line by line after that, breaking down the $Users | foreach{ loop, making sure it grabs the correct sids and runs Win32_UserProfile.delete() on the right SIDs, it does.

However, when running the script (it's a sched task so I ran it 'manually' from there), that same local SIDs is deleted, and all the rest remain, which adds to the confusion; because when watching the action, I see the domain user folders under C:\Users delete immediately, but the local ones remain, adding to the confusion.

At first I thought this was limited to a single local profile, however after opening the registry I noticed HKEY_USERS only had a couple entries:

All the other SIDs, local or domain, were gone. It is limited to a single local user account.

The effects of this of course is that when someone logs into a local account, everything in their profile folder is overwritten, however watching the script run and delete all profile folders of domain accounts but not local accounts is a bit misleading.

Update

I removed and updated info above. Also, pictures are worth a thousand words, so here goes:

1. Shot of Profile List Reg Key and C:\Users before running script. The partially blank SIDs are tied to domain accounts, and the highlighted profile folders are to domain users:

2. Shot of same, after script runs. One domain SID left, which is mine:

For clarification, I want to know why a local account is being deleted when this script runs. It seems like either

1. No local accounts would be deleted (script runs as intended)

2. All local profiles would be deleted (script doesn't discriminate against one local account, even if that means it also doesn't run as intended).

I would like to get the creation date of a local user account (Win 7 if it matters). I've looked at the following WMI objects (and google of course):

Win32_UserAccount Win32_NetworkLoginProfile

The objects returned from NetworkLoginProfile have the last login time, but not the creation date. Checking the Date Created property of their profile folder merely gives the date that folder was created, not necessarily the account itself.

We don't typically run bleeding edge software in $environment, that being said since 4.0 has been out for a while; I haven't come across any conflicts posted on the web. Does anyone know of any? Specifically, with regard to SCCM, Exchange, Sharepoint, Office 2k10, 2k13, and/or Windows 7 clients.

I'm trying to use the Start-CMSoftwareUpdateDeployment cmdlet to deploy a software update group to an existing collection.

PS WHO:\> Start-CMSoftwareUpdateDeployment -SoftwareUpdateGroupName "Update Group - Microsoft Updates" -CollectionName `
Eval_OSUpdates -DeploymentType Required -SendWakeUpPacket $true -AllowRestart $true -PersistOnWriteFilterDevice $true `
-DownloadFromMicrosoftUpdate $true -DeploymentName "Evaluation Deployment - Update Group - Microsoft Updates" `
-UserNotification DisplayAll -RestartWorkstation $false -AllowUseMeteredNetwork $true

All required parameters are given, however I receive the following error upon execution:

Start-CMSoftwareUpdateDeployment : ConfigMgr Error Object:
instance of SMS_ExtendedStatus
{
    Description = "One or more updates are present for which a EULA exists which hasn't been approved.";
    ErrorCode = 1078462208;
    File = "e:\\nts_sccm_release\\sms\\siteserver\\sdk_provider\\smsprov\\sspciassignment.cpp";
    Line = 361;
    Operation = "PutInstance";
    ParameterInfo = "";
    ProviderName = "ExtnProv";
    StatusCode = 2147749889;
};
At line:1 char:1
+ Start-CMSoftwareUpdateDeployment -SoftwareUpdateGroupName "SoM Update Group - Mi ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (Microsoft.Confi...ploymentCommand:StartSoftwareUpdateDeploymentCommand) [Start-CMSoftware
   UpdateDeployment], WqlQueryException
    + FullyQualifiedErrorId : UnhandledExeception,Microsoft.ConfigurationManagement.Cmdlets.Sum.Commands.StartSoftwareUpdateDeployment
   Command

I'm pretty sure I know which update needed the EULA accepted, but in attempting to automate this it'd be nice to accept any EULAs programmatically and not have manual steps in the process.

I see the cmdlet Get-SoftwareUpdateLicense, but all that does is return a bloody string of the EULA, which nobody reads.

A step closer today I found an MSDN article on the AcceptEULA method, but I don't know how to call it on the update, as the update is of type SMS_SoftwareUpdate, but that method isn't listed when I pipe to Get-Member, and of course just trying to willy nilly call the method throws an error.

To summarize, that's where I'm stuck at: I don't know how to call this WMI method on a particular SMS_SoftwareUpdate object, using powershell if that makes a difference.

We're an sccm shop, and use it to deploy Windows. When deploying Dell laptops (multiple models), the touchpad drivers seem install properly, but the software doesn't. The resulting problem is that when the touchpad is pressed on occasion, the mouse pointer will 'jump' to certain points on the screen.

A possible symptom of this problem/visible sign is if the touchpad icon isn't in the system tray. The software is in the control panel, but when opened part of the gui is pixelated, indicating botched install maybe?

The manual resolution to this, is to go into device manager and uninstall the driver with the option to uninstall all driver software. After a restart, the driver and software is apparently reinstalled, and from there works as expected.

Obviously this partially defeats the purpose of a zero touch deployment. If anyone knows why this is and/or a possible workaround, those answers would be valid as well. Barring that, I want to find a way to deploy the driver and touchpad software in an unattended way, so that it can be conditionally installing during the imaging process. To be honest I'm not sure how to troubleshoot this, I suppose I could try drvinst.exe to install the driver, but finding out why this fails initially would keep me from spinning my wheels.

Not referring to militaries or governments, but for other organizations or shops that needs an IT infrastructure (who doesn't nowadays). Similar to this question, but purely in regard to hardware and/or services, such as servers, storage, email services, etc.

I don't imagine it's cut and dry for every org, because every organization is different. Should they consider:

• Size of the org and what resources are required

• Whether or not the org has in house IT support

• Recurring cost of replacing hardware vs. hardware 'subscription'

• Of course there are security concerns, such as 'Is this service from <provider> compliant with <security standard>

• If going with a hosted option, what's the exit strategy if all of a sudden the agreement can't go forward, for whatever reason.

• Options for backups, with either choice.

There's of course more to consider than just cost. I ask this because you have small 1-2 employee shops that need services such as email or file services, all the way up to huge organizations, but those huge organizations aren't IT shops, their production may be basket-weaving or something, should they invest in a private infrastructure to host their basket-weaving drawings, documents and the like? How is that a value add for them?

Update

Not necessarily cloud, colocation is an option as well.

Running an outward facing server for contractors who's hostname is sub.example.com. The service needs to send mail to the contractors for various reasons (new projects, login details, etc). I have no intentions on making this machine an smtp server, and can successfully send mail through smtp.gmail.com, as I have Google Apps.

Trouble is, the emails go out as [email protected], where is the account I use to authenticate to smtp.google.com to send the mail, when I'd like it to go out as [email protected].

I supposed that could be looked upon as spoofing in a way, so I understand why this wouldn't readily be done.

Setting up sendmail with an smtp relay worked, but all the emails end up in junk folders during my test. This continued even after I setup SPF records for the subdomain on the root domain's dns.

It would be a lot of effort to setup and administer an smtp server just for this, as the mail volume won't be that serious. I can settle for sending mail from the root domain account through smtp.gmail if it's good practice (I can't remember if I've come across this before as a customer/user, even if I have that wouldn't mean it's good practice).

Which brings me to my question, albeit I've tried to remove any subjectiveness: Is it best practice to send the email with the matching domain as the service ([email protected]), or is sending from the root domain ([email protected]) just as acceptable?

A Shining Example: Inside all of my task sequences I have a group that installs driver packages conditionally based on computer model:

And of course, this list does nothing but grow. The fact that it grows isn't a big deal, what is a big deal is that every time it changes I have to manually copy and paste those changes across every task sequence I have, which of course leaves huge room for human error. The same goes for other groups of tasks that are common across task sequences.

Looking for a solution where I could centrally manage these tasks, be it link other task sequences to a group within another task sequence, or create a separate task sequence and link to that.

I came across a solution by John Marcum (SCCM MVP) that mentioned this ability, but this was a while ago and I can't find the link to it anymore to see if it's even still being updated/maintained, but I'm looking for more of a free solution, or even using Powershell or the ConfigMgr SDK is fine with me, I'm no stranger to either.

Update

Getting close: http://msdn.microsoft.com/en-us/library/jj217869.aspx

Remotely as in via command line. Not sure if there's a reg key or something similar I can peek at to see if a user has the correct printers mapped.

Some way some how, a user's machine couldn't get read the bitlocker password off of the TPM chip, and I had to enter the recovery key (stored in AD) to get in. No big deal, but once in the machine, I tried to suspend bitlocker per recovery documentation, and got an error message about the TPM not being initialized. I knew the TPM was on and activated in the BIOS, but Windows still made me reinitialize the TPM chip, and in the process it created a new TPM owner password.

I found that odd because it prompted me to save this password or print it (there wasn't an option not to), but it made no reference of a recovery password, nor did it back this password up to AD.

After the user took her laptop and left I started thinking that if the TPM password change, does the recovery password change also? If so, that new recovery password will need to be uploaded to AD, but MS' documentation doesn't make that clear, and doesn't back up the new recovery key (if one exists) to AD automatically when the group policy says it must, and from a network standpoint AD is accessible.

I've setup a basic group policy consisting of the default Applocker rules. Per Microsoft's technet article on the subject, any files not explicitly allowed to run by the policy are supposed to be blocked from running. After deploying this policy and verifying it was being applied to the correct user using gpresult, I was still able to download and run an exe from the internet, an exe that was saved to the user profile's temp folder. It was at that point I did more googling, and saw that the App Identity service had to be running, and it wasn't: So, like any good admin, I started it, set it to automatic, and rebooted just in case. The policy still didn't work after restarting. Below is a screenshot of the current policy.

I added the deny rules explicitly because the default rules weren't working. I correctly applied the policy to the machine and verified that the rules are enforced (it says so in the screenshot). I used the Test-AppLockerPolicy cmdlet to verify that the rule is should be blocking the EXEs and MSIs from running, but it doesn't. Open to most suggestions, no matter how ludicrous they may sound.

Update

Forgot to add that I checked the event log for AppLocker during this whole fiasco, and it was blank. Not a single entry the entire time.

Specifically 2012, but I'll take what I can get:

When a task sequence fails, it automatically starts a 15 minute countdown and then restarts (provided there is no command prompt open). Is there a way to disable this at the task sequence level?

I don't want to set every step to 'continue on error' either. The purpose is so that when one leaves and comes back then they know it failed and at what step, not just pseudo complete, it may as well just auto reboot in that case.

Sample screenshot:

In SCCM for package deployments, there's an option to make the assignment mandatory and the schedule to be at logoff, and also options for only deploying packages when no user is logged on.

I'd like to deploy software updates in the same manner. I don't see the settings, so I'm assuming some hack workaround has to be used, and I'd like to know if anyone has done it, is doing this, or has an idea of what I can do for this to occur. I'm pretty versed in powershell, sccm, and c# so anything along those lines would be awesome. I'm using SCCM 2012 SP1 for reference.