PowerShell on Anything About IT

Collecting AzureAD User Authentication Method Information

Sun, 07 Feb 2021 13:28:44 +0000

Hello everyone, last Friday I received an email from one of my customers, asking how to identify users in Azure AD that have enabled passwordless sign-in with the Microsoft Authenticator app. Previously I usually made use of the Script for Azure MFA authentication method analysis but that script uses the MSOnline PowerShell module where the Get-MsolUser cmdlet does not expose the information about these newer authentication methods.

So heading over to Microsoft Graph and there we can grab all authentication methods for users as shown in the example below.

Generating Advanced hunting queries with PowerShell

Fri, 10 Jul 2020 23:21:46 +0000

I was recently writing some advanced hunting queries for Microsoft Defender ATP to search for the execution of specific PowerShell commands. If you are just looking for one specific command, you can run query as sown below

// Find all machines running a given Powersehll cmdlet.
let powershellCommandName = "Invoke-RickAscii"; 
DeviceEvents 
| where ActionType == "PowerShellCommand" 
| where AdditionalFields contains powershellCommandName

But if you are looking for several functions, then there is going to be a lot of manual editing, and so the idea was born to use PowerShell to help me generate an advanced hunting query. The below function can do the following:

User Spam & Phish Submissions configuration in Office 365 – Part 1

Sun, 19 Jan 2020 13:54:51 +0000

Yesterday I noticed a tweet from @Pawp81 about a new feature being rolled out in Office 365 to configure user submissions. So, let’s have a look at this. When enabling the ‘Report Message’ add-in in Office 365, users can report misclassified email, whether safe or malicious, to Microsoft and its affiliates for analysis. Until now IT admins had to deploy the ‘Report Message’ add-in to their end users by configuring the centralized add-in deployment within the Microsoft 365 admin center as described here Furthermore when IT admins wanted to receive a copy of a reported message, a transport rule had to be created as described here.

PowerShell 7 – Group Policy Settings and Eventlogs

Mon, 30 Dec 2019 11:54:36 +0000

On December 16th Joey announced the availability of the PowerShell 7.0 release candidate. Time to look at the configuration options. Since I’m interested in the aspects of managing these settings within an enterprise environment, I closely followed the discussions on GitHub here https://github.com/PowerShell/PowerShell/pull/10468 and here https://github.com/PowerShell/PowerShell/issues/9309 and the outcome of these discussions is documented here https://github.com/PowerShell/PowerShell-RFC/blob/master/4-Experimental-Accepted/RFC0041-Policy.md

Installation

Now let’s look what options we have for the configuration of logging PowerShell 7 events. Let’s start with installing PowerShell 7.0 RC1. All download packages are listed here https://github.com/PowerShell/PowerShell/releases/tag/v7.0.0-rc.1 There are multiple options available for installing PowerShell 7 on Windows (AppX, ZIP, MSI) but for this demonstration I use the MSI based installer. https://github.com/PowerShell/PowerShell/releases/download/v7.0.0-rc.1/PowerShell-7.0.0-rc.1-win-x64.msi

How to identify orphan Group Policy content within the Sysvol folder

Tue, 19 Nov 2019 22:22:16 +0000

G’day everyone. Today I was working on a Microsoft Security Configuration baseline implementation and while browsing through the Sysvol folder I got the impression that there are less GPO objects stored within AD compared to the number of GPO content folders located within the Sysvol\Policies folder. As we speak about several hundred folders here, too many to count manually, and so another PowerShell script was born.

Now if the terms SYSVOL, policies folder doesn’t mean anything to you, I suggest you first read this article from Darren (@grouppolicyguy) Understanding Group Policy Storage.

Microsoft Defender ATP Advanced Hunting – Who's logging on with local admin rights?

Tue, 29 Oct 2019 16:00:07 +0000

Note: I have updated the kql queries below, but the screenshots itself still refer to the previous (old) schema names

If you’re among those administrators that use Microsoft Defender Advanced Threat Protection, here’s a handy tip how to find out who’s logging on with local administrators’ rights. But first when would you want to run this? Well here are some scenarios I can think of:

You want to find users that have local administrator rights on their devices.

Testing Windows Defender MAPS Connectivity with PowerShell

Mon, 08 Jul 2019 22:33:36 +0000

Whenever I work with customers on Windows Defender or Microsoft Defender Advanced Threat Protection, one of the first things I usually review are the current Windows Defender settings. Having Windows Defender properly configured is key, because otherwise you might not be able to make use of all the capabilities Defender and Defender ATP provides. One of them is MAPS (Microsoft Active Protection Service) or also known as Windows Defender Antivirus cloud-delivered protection service. Quite often I notice that clients have no connection to MAPS, this can be validated by running the following command from an elevated command prompt:

Exploring Microsoft Cloud App Security with PowerShell – Part1

Sun, 05 May 2019 13:45:37 +0000

Last Friday I was given the opportunity to present at the Configuration Manager Community Event (CMCE1905) in Bern, Switzerland. Although Microsoft Cloud App Security is not really related to ConfigMgr, many of the attendees are dealing with managing classic and modern workplaces and security is almost on everyone’s list of interest. During my session “Unleash the power of Microsoft Cloud App Security” I also demonstrated how one can explore information within Microsoft Cloud App Security through PowerShell. So, for all those interested how to do that, here we go.

Retrieving Windows Defender Exploit Guard Windows Event logs with PowerShell

Thu, 02 May 2019 15:14:57 +0000

Most of the features included in Windows Defender Exploit Guard can be enabled in audit or block mode. The impact can then be analyzed either by looking at the corresponding Windows Event log entries or through advanced hunting queries in Windows Defender ATP.

Today, I’ll share a script I recently wrote to quickly pull Windows Defender Exploit Guard related events from the Windows Event log. Anytime soon I will share some Kusto queries for the advanced hunting method through MDATP.

How to manage LAPS DebugLogging with PowerShell

Mon, 14 Jan 2019 19:10:39 +0000

If you need to troubleshoot the Local Administrator Password Solution **LAPS **you can configure how much information is written into the Windows Event log.

Logging options are set through the following REG_DWORD values described below under:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions{D76B9641-3288-4f75-942D-087DE603E3EA}\ExtensionDebugLevel

Value
Meaning

Silent mode; log errors only When no error occurs, no information is logged about CSE activity This is a default value

Log Errors and warnings

Verbose mode, log everything

Azure Information Protection Scanner & Analytics – Resource Collection

Wed, 31 Oct 2018 18:42:25 +0000

Hey there,

This might sound like a bad excuse for not writing up a whole blog post, but in fact I had planned to write a few words about the Azure Information Protection Scanner and the recently announced Azure Information Protection Analytics that provides a central reporting capability for the AIP Scanner. Those that have used the AIP Scanner before, will agree that, gathering scanner results data was quite tedious as you had to grab plain text files from the local system and then process them manually or though some home-brew scripting to visualize the results.

It’s never too late to start learning PowerShell

Tue, 27 Mar 2018 10:34:53 +0000

It’s 2018 now and you might think who doesn’t know PowerShell yet. Although I’ve seen the number of people using PowerShell increasing over the past years, there’s still plenty of people out there that have the learning curve for PowerShell ahead of them. A few years ago, when the use of PowerShell got traction amongst many IT professionals the web was full of learning resources by means of blog posts, podcasts and online trainings. It seems that nowadays we expect everyone to be past the beginner’s level and so the type of content that is shared within the community is slightly changing to more advanced topics as well and that’s good for those that are riding the PowerShell wave already. However, let’s take into consideration that even in 2018, twelve years after PowerShell (Monad) arrived there are people that just start their journey into PowerShell. Think of the younger generation of IT professionals who spend the last ten years in school or the senior IT pro who’s changing their career into a field where PowerShell knowledge becomes inevitable.

PowerShell Core logging configuration

Tue, 16 Jan 2018 22:41:16 +0000

After having browsed through the PowerShell code a bit, found some references as to how to configure PowerShell Core logging options through GPO or via a configuration file.

There are no GPO Templates available for PowerShell Core, but the same settings as are written for Windows PowerShell also apply for Core, they just live within another registry key.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft*PowerShellCore*

So when you apply the folllowing registry settings , you can enable ScriptBlock logging and Transcripting for PowerShell Core.

Enabling PowerShell logging for PowerShell Core 6 (Workaround)

Sat, 13 Jan 2018 02:02:41 +0000

By default, PowerShell Core does not log events to the Windows Event logs. From a security perspective this isn’t ideal, but that’s something I’ll take a closer look at later. To enable PowerShell logging you have to run RegisterManifest.ps1 which is located in the "C:\Program Files\PowerShell\6.0.0" folder. But unfortunately running that command would not work for me. Now this is the beauty of PowerShell being open sourced, the code as well as the comments from developers is publicly available. So after a short search within the GitHub repo of PowerShell Core I found references about the issue.

Retrieving Windows Defender ATP query API data with PowerShell

Tue, 09 Jan 2018 20:45:15 +0000

I am currently working on some automation around Windows Defender, so started to look at the Windows Defender Advanced Threat Protection query API.

Note that this API is still in preview. I wrote two functions for this.

Connect-WindowsATP is used to get an access token. Note that you will need to first register the API in Azure Directory so that you get an Application ID that you have to include at the top of the script.

PowerShell script Update-PoshModule

Sun, 17 Dec 2017 20:14:52 +0000

With nowadays rapid development and release cycles it’s a good practice to regularly check whether you have the latest available module versions installed. Using native PowerShell cmdlets you would first list the module installed locally and then search for the latest module online.

When you have several modules installed, this becomes a laborious task. So I wrote a cmdlet that does all this work for me and you if you like.

PowerShell Script Get-BatteryChargeStatus

Sun, 30 Jul 2017 15:05:03 +0000

Update 01.08.2017

*I have updated the script to ensure that the Windows.Devices.Power.Battery class is properly loaded, as this wasn’t the case in a PowerShell 64 bit session. *

A little script i wrote to retrieve the Battery Charge status. The script makes use of the BatteryReport class that agregates the information should the device have more than one battery like the Surface Book.

function Get-BatteryChargeStatus
{
<#
.Synopsis
 Get-BatteryChargeStatus
.DESCRIPTION
 Get-BatteryChargeStatus shows the Battery Charging status,
 the remaining Battery capacity in percent and if the system
 is running on Battery.

 The Battery Status can have one of the following values:
 Charging, Discharging, Idle or NotPresent
.PARAMETER Detail
 Displays additional Battery Information

.EXAMPLE
 Get-BatteryChargeStatus

Status Utilization PowerOnline
------ ----------- -----------
Charging 99 True

.EXAMPLE
 Get-BatteryChargeStatus -Detail

ChargeRateInMilliwatts : 3052
DesignCapacityInMilliwattHours : 68902
FullChargeCapacityInMilliwattHours : 70222
RemainingCapacityInMilliwattHours : 69689
Status : Charging
Utilization : 99
PowerOnline : True

.NOTES
 30/07/2017, Initial version, Alex Verboon
 01/08/2017, added class init to check that Windows.Device class is available. 
 
 For more information see: 
 https://docs.microsoft.com/en-us/uwp/api/windows.devices.power.batteryreport
 
#>
 [CmdletBinding()]
 Param
 (
 [switch]$Detail
 )

 Begin
 {
 Try{
 # First ensure Windows.Devices class is available 
 $BattAssembly = [Windows.Devices.Power.Battery,Windows.Devices.Power.Battery,ContentType=WindowsRuntime] 
 #[Windows.Devices.Power.Battery].Assembly
 }
 Catch
 {
 Write-Error "Unable to load the Windows.Devices.Power.Battery class"
 }
 
 Try{
 $Report = [Windows.Devices.Power.Battery]::AggregateBattery.GetReport() 
 }
 Catch{
 Write-Error "Unable to retrieve Battery Report information"
 Break
 }

 If ($Report.Status -ne "NotPresent")
 {
 $pbmax = [convert]::ToDouble($Report.FullChargeCapacityInMilliwattHours)
 $pbvalue = [convert]::ToDouble($Report.RemainingCapacityInMilliwattHours)
 $Utilization = [int][math]::Round( (($pbvalue / $pbmax) *100))
 $PowerOnlineStatus = (Get-CimInstance -ClassName batterystatus -Namespace root/WMI).PowerOnline

 # Check if at least one battery reports running on power
 If ($PowerOnlineStatus -contains "True")
 {
 $PowerOnline = $true
 }
 Else
 {
 $PowerOnline = $false
 }
 }
 Else
 {
 [int]$Utilization = 0
 $PowerOnline = ""
 }
 }

 Process
 {
 If ($Detail -eq $true)
 {
 $Properties = [ordered] @{
 ChargeRateInMilliwatts = $Report.ChargeRateInMilliwatts
 DesignCapacityInMilliwattHours = $report.DesignCapacityInMilliwattHours
 FullChargeCapacityInMilliwattHours = $Report.FullChargeCapacityInMilliwattHours
 RemainingCapacityInMilliwattHours = $Report.RemainingCapacityInMilliwattHours
 Status = $Report.Status
 Utilization = $Utilization
 PowerOnline = $PowerOnline
 }
 $BatteryChargeStatus = (New-Object -TypeName PSObject -Property $Properties)
 }
 Elseif ($Detail -eq $false)
 {
 $Properties = [ordered] @{
 Status = $Report.Status
 Utilization = $Utilization
 PowerOnline = $PowerOnline
 }
 $BatteryChargeStatus = (New-Object -TypeName PSObject -Property $Properties)
 }
 }
 End
 {
 $BatteryChargeStatus
 }
}

Retrieving Office 365 roadmap information with PowerShell

Mon, 12 Jun 2017 21:51:12 +0000

Here’s a small cmdlet I wrote today to pull the Office 365 roadmap information with PowerShell.

Office 365 Centralized Deployment service

Sat, 10 Jun 2017 14:25:04 +0000

Just recently Microsoft announced the general availability of the Office 365 centralized deployment service. I have tested it and it really makes deploying Office Add-ins super easy. The add-in configuration and deployment can be managed through the Office 365 portal or using PowerShell.

For a quick overview watch the video “How to Deploy Office Add-ins within Your Organization”.

Now since I like using PowerShell, here’s a quick example how to enable and deploy an Office Add-in.

PowerShell Script - Get-MsolRoleMemberDetails

Sun, 20 Nov 2016 23:33:08 +0000

To get a list of all users that belong to a given role, the Microsoft Azure Active Directory module has a cmdlet Get-MsolRoleMember, however to run the cmdlet you must use the RoleObjectId parameter and provide a value. The possible values for RoleObjectId can be retrieved by running the Get-MsolRole cmdlet.

To simplify this, I wrote the Get-MsolRoleMemberDetails cmdlet. As you can see from the below screenshot, the list of available roles is dynamically populated.

Office 365 PowerShell script to retrieve AccountSku license information

Mon, 25 Apr 2016 21:00:39 +0000

A small PowerShell script that lists all users that have the specified Office 365 AccountSkuid enabled on their account.

The GroupPolicy Xtended PowerShell Module

Thu, 11 Feb 2016 09:42:48 +0000

Good day everyone. Today I would like to share with you the Group Policy Xtended PowerShell module that i’ve written recently. Histrocially I used to have various cmdlets stored in individual files and ran them when needed, I also shared them among my peers and with the public via my blog and the Microsoft Script repository. The challenge with this approach is that it’s hard to ensure eveyone has the latest versions of the cmdlets available and that when someone needs a cmdlet that he’s actually able to find it or actually knows that there’s one available.

PowerShell Script to remove Office 365 Service Plans from a user

Sun, 13 Dec 2015 21:09:16 +0000

When assigning an Office 365 license to a user, by default several service plans are enabled. When assigning an Office 365 E3 license to a user, the following service plans are enabled by default:

Azure Rights Management
Office 365 Pro Plus
Skype for Business Online (Plan 2)
Office Online
SharePoint Online (Plan 2)
Exchange Online (Plan 2)

From an end user perspective the user will see the following options when logging on to Office 365.

PowerShell Script to remove Office 365 Service Plans from a user

Sun, 13 Dec 2015 20:36:06 +0000

When assigning an Office 365 license to a user, by default several service plans are enabled. When assigning an Office 365 E3 license to a user, the following service plans are enabled by default:

Azure Rights Management
Office 365 Pro Plus
Skype for Business Online (Plan 2)
Office Online
SharePoint Online (Plan 2)
Exchange Online (Plan 2)

From an end user perspective the user will see the following options when logging on to Office 365.

PowerShell Script: Retrieve all Office 365 URLs and IP Ranges

Thu, 05 Feb 2015 23:21:03 +0000

This week I took the Office 365 Performance Management course on the Microsoft Virtual Academy. If you have any plans using Office 365 I strongly recommend taking this course. One of the topics that was often highlighted is the importance of having all Office 365 URLs and IP Ranges configured on the outbound allow list. The Office 365 URLs and IP Ranges are documented here and the changes to the list are described here.

PowerShell Script to Retrieve Internet Explorer Telemetry Data

Sat, 29 Nov 2014 15:27:40 +0000

During the past days I have been busy deploying the Internet Explorer Site Discovery Toolkit to our Internet Explorer 11 test clients. I will write about the deployment of the Toolkit in a separate post. Today I would like to share with you a PowerShell script I put together that allows you to retrieve the collected Internet Explorer Telemetry data from local or remote computers.

Internet Explorer Telemetry data is stored into the following WMI Classes

Analysing the file content of Windows Installer files using PowerShell

Sun, 05 Oct 2014 18:59:14 +0000

A few weeks ago we have started with the preparation for introducing Microsoft Office 2013 and Internet Explorer 11. As with every introduction of new software it’s all about compatibility. During the course of testing applications we were informed that some of them caused an issue due to hard coded paths. Each application is going to be installed anyway so that application owners can conduct testing, but at the same time I thought, it would be nice if we could identify potentially affected applications upfront without having to go through an actual install.

Use PowerShell to Troubleshoot Group Policy

Thu, 04 Sep 2014 21:44:17 +0000

While I was on vacation last summer Ed Wilson aka Microsoft Scripting Guy asked me if I would like to write a guest post for the Hey Scripting Guy Blog. Of course !! was my immediate response.

And here it is: Weekend Scripter: Use PowerShell to Troubleshoot Group Policy

The script referenced can be downloaded from here http://gallery.technet.microsoft.com/scriptcenter/Get-GPProcessingTime-a124aaf5

PowerShell Script to retrieve content from Internet Explorer ActiveX blocking log

Wed, 13 Aug 2014 23:12:50 +0000

In preparation of the Internet Explorer out of date ActiveX control blocking activities I wrote the below script that retrieves the content of the log stored under LOCALAPPDATA%\Microsoft\Internet Explorer\AuditMode\VersionAuditLog.csv

You can download the script from here

function Get-ActiveXControlLog
{
<#
.Synopsis
 Get-ActiveXControlLog
.DESCRIPTION
 Get-ActiveXControlLog retrieves the content of the Internet Explorer ActiveX control log stored locally. 
.EXAMPLE
 Get-ActiveXControlLog
 Shows all entries in the log file
.EXAMPLE
 Get-ActiveXControlLog -Show Allowed
 Shows only entries with status "Allowed"
.LINKS
 http://technet.microsoft.com/en-us/ie/dn798785.aspx
.NOTES
 version 1.0 by Alex Verboon
#>
 [CmdletBinding()]
 Param
 (
 [Parameter(Mandatory=$false,
 Position=0)]
 [ValidateSet("All","Allowed","Blocked")] 
 $Show="All"
 )

 Begin
 {
 # the default location of the log file
 $VersionAuditLog = [Environment]::GetFolderPath('LocalApplicationData') + "\Microsoft\Internet Explorer\AuditMode\VersionAuditLog.csv"
 # check if the log file is present
 If (Test-Path $VersionAuditLog)
 {
 Write-output "ActiveX out of date blocking control log found"
 }
 Else
 {
 Write-Verbose "ActiveX out of date blocking control log not found"
 # let's check if the logging policy is enabled at all
 $lm = (Get-ItemProperty -Path "HKLM:Software\Microsoft\Windows\CurrentVersion\Policies\Ext" -Name "AuditModeEnabled" -ErrorAction SilentlyContinue).AuditModeEnabled 
 $cu = (Get-ItemProperty -Path "HKCU:Software\Microsoft\Windows\CurrentVersion\Policies\Ext" -Name "AuditModeEnabled" -ErrorAction SilentlyContinue).AuditModeEnabled
 
 If ($lm -le 0)
 {
 write-output "ActiveX control logging policy is not enabled at the computer level"
 }
 Else
 {
 Write-Output "Active control logging policy is enabled at the computer level, but there's no log: $VersionAuditLog"
 }

 If ($cu -le 0)
 {
 write-output "ActiveX control logging policy is not enabled at the User level"
 }
 Else
 {
 Write-Output "Active control logging policy is enabled at the user level, but there's no log: $VersionAuditLog"
 }
 Throw 
 }
 }
 Process
 {

 # Get the content of the log file
 $axlog = Import-csv -Delimiter "," -Path $VersionAuditLog -Header URL, Path, ProductVersion, FileVersion, Action, Reason, EPMCompat
 $axlogdata = @()
 ForEach ($entry in $axlog)
 {
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name URL -Value $entry.URL
 $object | Add-Member -MemberType NoteProperty -Name Path -Value $entry.Path
 $object | Add-Member -MemberType NoteProperty -Name ProductVersion -Value $entry.ProductVersion
 $object | Add-Member -MemberType NoteProperty -Name FileVersion -Value $entry.FileVersion
 $object | Add-Member -MemberType NoteProperty -Name Result -Value $entry.Action
 $object | Add-Member -MemberType NoteProperty -Name Reason -Value $entry.Reason 
 $object | Add-Member -MemberType NoteProperty -Name EPMCompatible -Value $entry.EPMCompat
 $axlogdata += $object
 }
 }
 End
 {
 If ($Show -eq "All")
 {
 $axlogdata
 }
 Else
 {
 $axlogdata | Where-Object {$_.Result -eq "$Show"}
 }
 }
}

PowerShell Script - Get Group Policy events by CorrelationID

Thu, 17 Jul 2014 15:00:44 +0000

Update: 22. August 2014: I have posted an updated version of the script here.

During his Group Policy: Notes from the Field - Tips, Tricks, and Troubleshooting session at TechEd Group Policy MVP Jeremy Moskowitz demonstrates how to filter the event log using the correlation ID. Now because I love using PowerShell I thought I create a function for that using Jeremy’s XMLquery.

function Get-GPEventByCorrelationID
{
<#
.Synopsis
 Get Group Policy Eventlog entries by Correlation ID
.DESCRIPTION
 This function retrieves Group Policy event log entries filtered by Correlation ID
.EXAMPLE
 Get-GPEventByCorrelationID -CorrelationID A2A621EC-44B4-4C56-9BA3-169B88032EFD

 TimeCreated Id LevelDisplayName Message
 ----------- -- ---------------- -------
 7/17/2014 3:00:27 PM 5117 Information Group policy session completed successfully.

#>
 [CmdletBinding()]
 Param
 (
 # CorrelationID
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 Position=0)]
 [string]$CorrelationID 
 )

 Begin
 {
 $Query = '*[System/Correlation/@ActivityID="{CorrelationID}"]'
 $FilterXML = $Query.Replace("CorrelationID",$CorrelationID)
 }
 Process
 {
 Get-WinEvent -FilterXml $FilterXML
 }
 End
 {
 }
}

PowerShell - Retrieve System Startup Time Information

Mon, 06 Jan 2014 20:02:18 +0000

The below script gathers the following system startup time information from a local or remote client.

Computername
Last Wakeup time (from Sleep, Hibernate or Fast boot on Windows 8x clients) The last wakeup date/time is converted from UTC into the client local time.
Last Boot time
The Time Zone of the client
The system wakeup / sleep message from the Windows event log

Important: the script uses PowerShell remoting, it’s therefore required that the targeted clients have WinRM enabled.

PowerShell - Creating Dummy files

Thu, 02 Jan 2014 17:16:27 +0000

Here’s a function I wrote to create a large dummy file either filled with zero’s or random characters. The -Target parameter must be eitehr a file including the path or just the path. If the path does not exist, it will be created. If only a path is provided a file with a random file name is generated.

Function New-BigFile {
<#
.Synopsis
 Creates a large dummy file with or without random conntent
.DESCRIPTION
 Creates a large dummy file with or without random conntent 
 Credits for the randome content creation logic goes to Robert Robelo
.PARAMETER Target
 The full path to a folder or file. If the target is a folder a random file name is generated
.PARAMETER MegaByte
 The size of the random file to be genrated. Default is one MB
.PARAMETER Filecontent
 Possible values are or When is specified the file is filled with
 random values. The value fills the file with nulls. 
.PARAMETER ShowProgress
 This parameter is optional and shows the progress of the file creation. 
.EXAMPLE
 New-Bigfile -Target C:\Temp\LF -Megabyte 10 -Filecontent random
.EXAMPLE
 New-Bigfile -Target C:\Temp\LF\bigfile.txt -Megabyte 10 -Filecontent random
.EXAMPLE
 New-Bigfile -Target C:\Temp\LF -Megabyte 10 -Filecontent empty
#>

[CmdletBinding(SupportsShouldProcess=$True)]
param(
 [Parameter(Mandatory = $true, Position = 0)]
 [String]$Target,
 [Parameter(Mandatory = $false, Position = 1)]
 [ValidateRange(1, 5120)]
 [UInt16]$MegaByte = 1,
 [Parameter(Mandatory = $true,position = 2)]
 [ValidateSet("random","empty")]
 [string]$FileContent,
 [Switch]$ShowProgress
)

If ([string]::IsNullOrEmpty([System.IO.Path]::GetDirectoryName("$target")) -eq $True)
{
 Write-Output "Specify a directory or file including path!"
 Throw
}

If([string]::IsNullOrEmpty([System.IO.Path]::GetExtension("$target")))
{
 Write-Verbose "Provided input $target has no file extension, target is a folder"
 $fname = ("" + ([guid]::NewGuid()) + ".LF")
 Write-Verbose "Random generated filename: $fname"
 $Target = Join-path $Target $fname
 $folder = [System.IO.Path]::GetDirectoryName($target)

 If ((Test-path $folder) -eq $false)
 {If ($PSCmdlet.ShouldProcess("Directory does not exist, creating directory $folder ")) 
 { New-Item -Path $folder -ItemType Directory | Out-Null}}
}
Else
{
 If ((Test-path -Path $target) -eq $true)
 {Write-verbose "File $Target already exists, exiting to prevent overwrite"
 Break}
 Else
 {Write-Verbose "File $target does not exist yet"}

 # Check if the directory actually exists, if not create it
 $folder = [System.IO.Path]::GetDirectoryName($target)
 If ((Test-path $folder) -eq $false)
 {If ($PSCmdlet.ShouldProcess("Creating folder $folder")) 
 {New-Item -Path $folder -ItemType Directory | Out-Null}}
}

$path = $Target
$total = 1mb * $MegaByte
$strings = $bytes = 0

If ($FileContent -eq "random")
{
If ($PSCmdlet.ShouldProcess("Creating random file $path with $Megabyte MB")) 
{

# create the stream writer
$sw = New-Object IO.streamWriter $path

# get a 64 element Char[]; I added the - and _ to have 64 chars
[char[]]$chars = 'azertyuiopqsdfghjklmwxcvbnAZERTYUIOPQSDFGHJKLMWXCVBN0123456789-_'
1..$MegaByte | ForEach-Object {
# get 1MB of chars from 4 256KB strings
1..4 | ForEach-Object {
# randomize all chars and...
$rndChars = $chars | Get-Random -Count $chars.Count
# ...join them in a string
$str = -join $rndChars
# repeat random string 4096 times to get a 256KB string
$str_ = $str * 4kb
# write 256KB string to file
$sw.Write($str_)
# show progress

 if ($ShowProgress) {
 $strings++
 $bytes += $str_.Length
 Write-Progress -Activity "Writing String #$strings" -Status "$bytes Bytes written" -PercentComplete ($bytes / $total * 100)
 }

# release resources by clearing string variables
Clear-Variable str, str_
}
}
$sw.Close()
$sw.Dispose()
# release resources through garbage collection
[GC]::Collect()
}
}

Else 
{
 If ($PSCmdlet.ShouldProcess("Creating empty file $path with $Megabyte MB")) 
 {
 # write 4K worth of data at a time
 $bufSize = 4096
 $bytes = New-Object byte[] $bufSize
 $file = [System.IO.File]::Create("$path")
 # write the first block out to accommodate integer division truncation
 $file.Write($bytes, 0, $bufSize)
 for ($i = 0; $i -lt $Megabyte*1MB; $i = $i + $bufSize) { $file.Write($bytes, 0, $bufSize) 

 if ($ShowProgress) {
 Write-Progress -Activity "Writing String #$strings" -Status "Bytes written" -PercentComplete ($i/($megabyte*1MB)*100 )
 }
 }
 $file.Close()
} 
} 
} 

```powershell
Run the following command to create a dummy file of 10 MB with random content

```powershell
New-bigfile c:\temp\lf 10 random -Verbose 

```powershell

Run the following command to create a dummy file dummy10mb.txt with random content

```powershell
New-bigfile c:\temp\lf\dummy10mb.txt 10 random -Verbose 

```powershell
Run the following command to create a dummy file of 20 MB filled with zeros

```powershell
New-bigfile c:\temp\lf 20 empty-Verbose

If you prefer to see what is going on, add the -Showprogress option. And last but not least the function also supports the -whatif option.

PowerShell - Using the WordPress Rest API

Sun, 29 Dec 2013 19:07:27 +0000

I just found out that meanwhile (since October last year) the Rest API for wordpress now also works on self-hosted wordpress sites. So i can now access the content of my blog through PowerShell.

$posts = Invoke-RestMethod -uri "https://public-api.wordpress.com/rest/v1/sites/www.verboon.info/posts/?number=50"
$posts.posts | Select-Object @{"Name" = "Title";"e"= {($_.Title)-replace "–","-"}}, @{"Name" = "Date"; "Expression" = {get-date ($_.Date) -Format "yyyy-MMM-dd"}} | ft

More details abou the WordPress Rest API can be found here

PowerShell - Creating Scheduled Tasks with PowerShell version 3

Sun, 29 Dec 2013 17:45:30 +0000

I am currently working on a script where I need to create a scheduled task that runs a powershell script at a given time. With PowerShell 4.0 a scheduled task can be easily created with the new cmdlets New-ScheduledTaskAction, New-ScheduledTaskTrigger and Register-ScheduledTask, but unfortunately i have to create a solution that works on clients running PowerSshell version 3.0.

When searching the web for examples how others have solved this I found many examples where people invoke the schtasks.exe command but in order to further improve my PowerShell skills I wanted to avoid calling external executables and do as much in PowerShell as possible. So after a bit of further searching I found an interesting post from @letitknowblog who uses the Task Scheduler’s com object for creating a scheduled task.

PowerShell - Get Stock Quote Information

Sun, 15 Dec 2013 13:29:17 +0000

The below script makes use of a webservice hosted by webserviceX.net and provides stock quote information.

<#
.Synopsis
 Retrieve stock information
.DESCRIPTION
 Retrieve stock information 
.PARAMETER Symbol
 Stock symbol of one or more companies
.EXAMPLE
 Get-StockInfo -Symbol MSFT,INTC
.LINK
 
.NOTES
 Version 1.0, by Alex Verboon
#>
 
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 HelpMessage= 'Stock Symbol for the company')]
 [String[]]$Symbol
)

begin{}
process{

if ([string]::IsNullOrEmpty($Symbol))
 {Write-Output "You must provide a Symbol"
 Exit}
 
ForEach ($stock in $Symbol)
 {
 [xml][/xml]$sq = Invoke-WebRequest -uri http://www.webservicex.net/stockquote.asmx/GetQuote?symbol=$stock
 $sqdetail = [xml][/xml]$sq.DocumentElement.'#text' 
 $sqdetail.StockQuotes.stocK
 }
}

End{}

PowerShell - Retrieve App-V 4.6 Package Information

Mon, 02 Dec 2013 21:44:12 +0000

Today we’ve been looking at App-V 4.6 package settings before and after migrating them from ConfigMgr 2007 to ConfigMgr 2012, so after opening the App-V mmc console 3x manually…..another script was born.

The below Get-Appv4PkgInfo.ps1 script retrieves information from the App-V Package WMI class. You can run the script against one or more computers and the optional –View parameter lets you define what information you want to see.

<#
.Synopsis
 Retrieve local App-V 4.6 Package information
.DESCRIPTION
 Retrieve local App-v Package Information from root\Microsoft\appvirt\client
.PARAMETER Computer
 One or multiple computernames
.PARAMETER View
 Specifies the information that is displayed for the identified App-V Package
 Valid options for the view parameter are Default,Path, Cache, Inuse, Size, GUIDS, Locked,All
.EXAMPLE
 Get-Appv4PkgInfo.ps1 -Computer TestClient1, TestClient2

 Shows the same output as when providing the -View Default parameter

.EXAMPLE
 Get-Appv4PkgInfo.ps1 -Computer TestClient1 -View Default

 Computer AppVname Version 
 -------- -------- ------- 
 TestClient1 SCCM Client Center 2.0.4.1 x64 R1 5

.EXAMPLE
 Get-Appv4PkgInfo.ps1 -Computer TestClient1,Testclient2 -View Path 
 
 Computer AppVname SFTPath 
 -------- -------- ------- 
 TestClient1 SCCM Client Center 2.0.4.1 x64 R1 FILE://c:\windows\ccmcache\7\sccm client.
.LINK
 http://technet.microsoft.com/en-us/library/cc843631.aspx
.NOTES
 Version 1.0, by Alex Verboon
#>
[CmdletBinding()]
Param(
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,HelpMessage="Enter Computername(s)",
 Position=0)]
 [Alias("ipaddress","host")]
 [String[]]$Computer, 

 [Parameter(Mandatory=$false,
 ValueFromPipelineByPropertyName=$true,HelpMessage="Select the type of information to display",
 Position=1)]
 [ValidateSet("Default","Path","Cache","Inuse","Size","GUIDS","Locked","All")] 
 $View="Default"
)

Begin{}

Process{
$appv =@()
ForEach($c in $Computer) 
{
 $applications = get-wmiobject -ComputerName $c -query "SELECT * FROM Package" -namespace "root\Microsoft\appvirt\client" -ErrorAction SilentlyContinue
 ForEach($app in $applications)
 {
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "Computer" -Value $c
 $object | Add-Member -MemberType NoteProperty -Name "AppVname" -Value $app.Name
 $object | Add-Member -MemberType NoteProperty -Name "Version" -Value $app.Version
 $object | Add-Member -MemberType NoteProperty -Name "SFTPath" -Value $app.SftPath
 $object | Add-Member -MemberType NoteProperty -Name "PackageGUID" -Value $app.PackageGUID
 $object | Add-Member -MemberType NoteProperty -Name "VersionGUID" -Value $app.VersionGUID
 $object | Add-Member -MemberType NoteProperty -Name "Locked" -Value $app.Locked
 $object | Add-Member -MemberType NoteProperty -Name "LaunchSize" -Value $app.LaunchSize
 $object | Add-Member -MemberType NoteProperty -Name "InUse" -Value $app.InUse
 $object | Add-Member -MemberType NoteProperty -Name "CachedSize" -Value $app.CachedSize
 $object | Add-Member -MemberType NoteProperty -Name "CachedPercentage" -Value $app.CachedPercentage
 $object | Add-Member -MemberType NoteProperty -Name "CachedLaunchSize" -Value $app.CachedLaunchSize
 $object | Add-Member -MemberType NoteProperty -Name "TotalSize" -Value $app.TotalSize
 $appv += $object
 } # end foreach application
} # end foreach computer
} # end process 

End{
# Define the properties to display based on -View parameter option
switch($view)
 {
 Default {$selcol = "Computer", "AppVname","version"}
 Inuse {$selcol = "Computer", "AppVname","Inuse"}
 Size {$selcol = "Computer", "AppVname","LaunchSize","TotalSize"}
 Cache {$selcol = "Computer", "AppVname","CachedSize","CachedPercentage","CachedLaunchSize"}
 GUIDS {$selcol = "Computer", "AppVname","PackageGUID","VersionGUID"}
 Path {$selcol = "Computer", "AppVname","SFTPath"}
 Locked {$selcol = "Computer", "AppVname","Locked"}
 All {$selcol = "*"}
 }
$appv | Select-Object -Property $selcol 
}

PowerShell - Yet another Sysinternals download script

Sun, 01 Dec 2013 22:10:33 +0000

Today I completed the Microsoft Virtual Academy Advanced Tools & Scripting with PowerShell 3.0 Jump Start course. If you haven’t looked at it yet, I realy recommend you do so, lots of good stuff there. So for the purpose of applying some of the stuff I’ve learned there regarding the use of -Whatif and -verbose messages i wrote the below script which downloads the sysinternals tools.

<#
.Synopsis
 Download Sysinternals Tools
.DESCRIPTION
 Download the Sysinternals tools from live.sysinternals.com to the local machine
.NOTES
 version 1.0
.EXAMPLE
 Get-Sysinternals -Path C:\Data|sysinternals
.EXAMPLE
 Get-Sysinternals.ps1 -Path C:\Data\Sysinternals -Whatif -verbose
#>

[CmdletBinding(SupportsShouldProcess=$true)]
Param(
[Parameter(Mandatory=$true,ValueFromPipelineByPropertyName=$true,ParameterSetName="Directory",
 HelpMessage= 'The local download folder')]
[String]$Directory
)

Begin
 {
 Write-Verbose "Starting Sysinternals Tool download"
 $url="http://live.sysinternals.com/tools/"

 if ((Test-path -path $Directory) -eq $False)
 {
 Write-Verbose "Creating Directory $Directory"
 if ($PScmdlet.ShouldProcess("Creating folder $Directory","",""))
 {New-Item -ItemType Directory -Path $Directory}
 } 

 $siuri = Invoke-WebRequest -Uri $url -EA SilentlyContinue
 if ($siuri.BaseResponse.StatusCode -eq "OK")
 {
 $sfiles = $siuri.Links | Where-Object {$_.href -ne '/'} | Select-Object -ExpandProperty innerText
 }
 Else
 {
 Write-Verbose "Unable to reach $url"
 Exit 1
 } 
 }

Process
 {
 ForEach ($st in $sfiles)
 {
 $downloadfile = $url+$st
 #Write-Verbose -Message "Downloading $downloadfile to $Directory\$st"
 if ($PScmdlet.ShouldProcess("Downloading now $downloadfile to $Directory\$st","",""))
 {Start-BitsTransfer -Description "SysinternalsDownload - $st" -Source $downloadfile -Destination "$Directory\$st"}
 }
 }

End
 {
 Write-Verbose "Download complete"
 }

PowerShell Script–Set App-V 4.6 Cache Size

Fri, 29 Nov 2013 18:13:07 +0000

Background: As part of our migration process from Configuration Manager 2007 to Configuration Manager 2012 R2 we also adjust the App-V Cache Size that is currently set to 6GB to 11GB because the ConfigMgr Agent Cache is set to 10GB, this by following the best practice described in Microsoft’s whitepaper Virtual Application Management with Microsoft Application Virtualization 4.5/4.6 and System Center Configuration Manager 2007 R2**** where it says.

“The App-V Client cache free disk space threshold parameter should be set to ensure that the available disk space on the client PC is at least 1 GB larger than the Configuration Manager Client cache size.”

PowerShell App Deployment Toolkit– How to make the message Font size larger

Fri, 22 Nov 2013 14:32:33 +0000

I have had a request this week to make the font size of the Message text displayed by the PowerShell App Deployment Tookit function **Show-InstallationPrompt **a bit larger.

To make the font of the message larger, all you need to do is adding 2 lines of code to the Function Show-InstallationPrompt that is embedded within the AppDeployToolkitMain.ps1 file.

Add the following code just above the “#button left” section.

#custom - Bigger text size $Font = New-Object System.Drawing.Font(“Arial”,14,[System.Drawing.FontStyle]::Regular) $labelText.Font = $Font #custom - Bigger Text Size

How to change the SCCM 2012 Package Source Path with PowerShell

Mon, 13 May 2013 20:08:57 +0000

Let’s assume you’ve just created a larger number of packages within SCCM 2012 and then you’re asked to move the package sources to a different location. I guess no-one on earth would want to visit each package and update the data source manually, So I wrote 2 scripts that automate this task. It could actually be done with one script, but when it comes to changing such things I prefer to validate things.

PowerShell: Script to Retrieve SCCM 2012 Client Settings

Tue, 30 Apr 2013 22:16:54 +0000

4/3/2017 - Update: here’s a better version: https://www.verboon.info/2017/03/configmgr-client-policy-settings-get-cmclientpolicysettings/

To make documenting the configured SCCM Client configuration settings a bit easier I wrote a small script that retrieves all the configured settings for the Default and custom configuration settings.

To run this script the Configuration Manager powershell module must be loaded and connected to the site.

# Get the different Client settings Names
$a = Get-CMClientSetting | select Name

foreach ($a in $a ) 
{
	# Get all possible values for the Get-CMClientSetting -Setting parameter
	$xsettings = [Enum]::GetNames( [Microsoft.ConfigurationManagement.Cmdlets.ClientSettings.Commands.SettingType])

	# dump the detailed configuration settings
	foreach ($xsettings in $xsettings ) {
 	#write-host $a.Name
	 Get-CMClientSetting -Setting $xsettings -Name $a.Name | format-table
 }

}

How to automate SCCM 2012 Task Sequence Media Creation

Mon, 15 Apr 2013 20:46:29 +0000

Just recently I went through the CM12 Console Task Sequence media creation wizard several times a day, so at some point I thought, this is a good candidate for automation.

If you have CU1 for SCCM 2012 SP1 already installed, you can take advantage of the new cmdlet **New-CMTaskSequenceMedia **Below an example.

CreateTaskMedia.ps1

import-module ($Env:SMS_ADMIN_UI_PATH.Substring(0,$Env:SMS_ADMIN_UI_PATH.Length-5) + '\ConfigurationManager.psd1')
cd NL1:

New-CMTaskSequenceMedia -BootableMediaOption -MediaInputType CDDVD -ProtectPassword $false -BootImageId NL100002 -DistributionPointServerName labsccm01.labhome.local -ManagementPointServerName labsccm01.labhome.local -MediaMode Dynamic -MediaPath C:\Sources\TSMedia\batchcreatedmedia1.iso -MediaSize SizeUnlimited -EnableUnknownSupport $false  -CreateMediaSelfCertificate $true -AllowUnattendedDeployment $false -UserDeviceAffinity DoNotAllow

If you haven’t installed CU1 yet, no worries. the command line tool CreateMedia.exe located in the SCCM Administrator Console’s bin directory does the same thing.

Group Policy changes included in the Windows Management Framework 3.0

Tue, 26 Feb 2013 06:48:22 +0000

While creating a new Group Policy object to enable WinRM (Windows Remote Management) on clients, I noticed some Group Policy changes that are introduced with the Windows Management Framework 3.0. The Windows Management Framework 3.0 contains the following updates:

Windows PowerShell 3.0
Windows Management Instrumentation (WMI) 3.0
Windows Remote Management (WinRM)
Management OData IIS Extension
Server Manager CIM Provider

I became aware of the changes as I was referring to a blog post I had written a while back about how to enable Windows Remote Management via Group Policy.I noticed that the name of the Group Policy setting located under Computer Configuration \ Windows Components \ Windows Remote Management (WinRM) \ WinRM Service \ Allow automatic configuration of listeners was changed to Allow Remote Server management through WinRM

Exploring the functions included in Microsoft.BDD.Utility.dll

Sun, 23 Dec 2012 15:33:45 +0000

While browsing through the MDT 2012 scripts, I noticed that here and there MDT uses functions included in the Microsoft.BDD.Utility.dll which is loaded by ZTIUtility.vbs. A good example is the ZTIGather.wsf where the following function is used to determine whether the system is running UEFI or native BIOS.

’ Determine if we are running UEFI

bIsUEFI = FALSE

On Error Resume Next

bIsUEFI = oUtility.BDDUtility.IsUEFI

On Error Goto 0

So I took Nir Sofer’s DLL Export Viewer to find out what other functions are included in Microsoft.BDD.Utility.dll

Explore the Microsoft Open Specifications

Tue, 11 Dec 2012 07:59:42 +0000

If you’re interested in reading how things really work, the Microsoft Open Specifications are a great resource. Microsoft Open Specifications is primarily intended for software developers but can also be of interest for anyone else who works with Microsoft products. The reason why these documents are little-known is because it isn’t easy to find them on MSDN where they are published.

This has changed now. On the Microsoft Open Specifications Developer Center you can now easily find the open specification documents through an intuitive Tiles or Pivot explorer.

How to use vbscripts in BGINFO

Thu, 09 Feb 2012 21:47:45 +0000

Out of the box BGINFO includes a number of predefined fields that can be used to display information on the desktop such as Computer name, IP Address etc. But if the standard fields aren’t enough,BGINFO allows creating custom fields that can pull data from various sources like WMI, Registry, File content, Environment variables or VBScript.

The below example shows how to embed VBSCRIPT code output in BGINFO. First we create a VBSCRIPT file called comp.vbs that has the following content. (Credit for the script goes to Moral Volcano)

Running within an SCCM 2007 Tasksequence or not?

Thu, 22 Dec 2011 19:18:52 +0000

I’ve been working on a batch script that runs as part of an SCCM 2007 TaskSequence or simply as a regular program. Because there were different conditions whether I run the script as part of a TaskSequence or just as a program and did not want to create two separate scripts I needed a way to detect within what environment the script is running.

I was first thinking of looking for the existence of any _SMSxyz Task Sequence variables as they don’t exist when running a script within an advertised program, but that would have required some extra code I wanted to avoid. So I ended up with the code below.

A quick look at the Windows PowerShell Module for Intel vPro

Sat, 04 Sep 2010 18:41:44 +0000

In a previous post Using Intel AMT Power Management @ Home I wrote about how to use Intel AMT Power Management at home or let’s say in an environment where you don’t have systems managed by an infrastructure that provides integrated support for Intel AMT.

Now Intel has released a PowerShell Module for Intel vPro. You find all the details in the following blog posts.

Intel Core vPro Processor PowerShell Module - Release & Introduction

Scripting HP Wireless Device State

Tue, 13 Oct 2009 15:20:45 +0000

An old colleague called me up this week (well in fact it was my old boss who has left our company), and told me about an issue they had when deploying an ISP specific Software Package that interacts with the Wireless Devices on their HP notebooks.

The problem was that if the WWAN device has been turned of via the quick launch button by the end user, the software would not install.

ToolTip – less misérables (MSI file extractor)

Fri, 03 Apr 2009 17:59:53 +0000

Today I found a nice utility that allows you to easily extract individual files from an MSI package. The tool is called “less miséreables”. it’s a kind of a funny name, but it does the job.

To extract a file, simply launch the utility, select the file(s) you want to extract and click on the extract button.

Of course the same can be done by using the MSIEXEC command from the command line as shown below, but that does extract all files.

Active Directory Powershell Blog

Wed, 25 Mar 2009 22:34:48 +0000

Those interested in managing Active Directory with PowerShell, have a look at the Active Directory Power Shell Blog.

Hyper-V Terminology

Mon, 16 Mar 2009 21:04:25 +0000

Talking to people about virtualization almost every day, I notice that many aren’t that familiar yet with all the terminologies. Ben Armstrong has written two good articles on his blog, describing all the terminologies used around Hyper-V.

Hyper-V Terminology

Hyper-V Terminology Update

One of the things that seems to confuse people a lot is understanding the difference between Hyper-V Server and Hyper-V on Server 2008. I take the freedom of copying Ben’s explanation (below).

Windows PowerShell - Free booklet

Thu, 27 Nov 2008 22:10:10 +0000

As it looks like, Windows PowerShell will become part of Windows7, so it’s about time to start learning this powerfull scripting language. After i had downloaded PowerShell v1.0 (v2.0 is currently in CTP), i’ve started collecting and searching the documentation and learning guides. I’m not goig to list them all here, most resources and further links can be found on the Microsoft Technet Script Center. But there is one i would like to reference as it is a comprehensive and well written booklet provided and written by a Microsoft Consultant. Free Windows PowerShell workbook: server administration

Creating GPO reports

Thu, 13 Nov 2008 22:00:05 +0000

Usually when you need a report for a given Group Policy object, you would launch the Group Policy Management Console, select the GPO and then select the settings tab that produces the report.

But what if you need a report for multiple or even all your GPOs you have within your Active Directory ? Going through each GPO and produce the report manually is going to take ages and is boring.

Scripting Registry permissions

Tue, 08 Jul 2008 11:30:28 +0000

Today some e-mails where exchanged on how to best script registry permissions.

Depending on what you want to achieve here’s a couple of tools that can be of help.

SetACL.exe

http://www.helge.mynetcologne.de/setacl/index.htm http://setacl.sourceforge.net/

SubinACL.exe

http://www.microsoft.com/downloads/details.aspx?FamilyID=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B&displaylang=en

Regini.exe

http://support.microsoft.com/kb/237607

Scripting XP quicklaunchbar

Sat, 28 Jun 2008 08:20:27 +0000

I posted this a couple of years ago into the MyITforum site and received plenty of replies on this, as at that stage it was an unknown trick. Below the trick how to enable the Windows XP quicklaunch bar by using a registry hack.

copy the reg key “HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop\Default Taskbar” to: “HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop\Taskbar” (for XP RTM) “HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop\TaskbarWinXP” (for XP SP1) (to be safe copy it to both locations)