PowerShell on Anything About IT

Deploying Windows 11 in minutes with AutomatedLab

Thu, 26 Aug 2021 19:01:10 +0000

In this blog post I am going to show you how you can quickly (in 5 minutes) deploy Windows 11 in Hyper-V using the AutomatedLab PowerShell module. In fact the process is no different than when deploying other Windows operating systems, but just in case you haven’t heard of AutomatedLab yet and plan to install Windows 11 in a VM, this might be a good opportunity to get familiar with it.

Defender ATP Advanced hunting with TI from URLhaus

Sun, 21 Jun 2020 14:57:47 +0000

Hello everyone, in today’s article we are going to take look at how we can use Threat Intelligence (TI) data from URLhaus with Microsoft Defender ATP advanced hunting.

URLhaus

URLhaus is a project from abuse.ch with the goal of sharing malicious URLs that are being used for malware distribution. https://urlhaus.abuse.ch/ The project provides several ways to find and retrieve information about malware URLs.

You can browse the URL database interactively through https://urlhaus.abuse.ch/browse/

Windows 10 2004 - What is new in the Windows Security App

Thu, 21 May 2020 13:10:05 +0000

When all goes well, Microsoft will soon release the next version of Windows 10 aka as Windows 10 2004. I am an active Windows Insider user and noticed a few little changes within the Windows 10 Security App that I think are worth sharing.

I used the following Windows 10 builds to identify changes, new features:

Windows 10, 1909, Version 10.0.18363.836
Windows 10, 2004, Version 10.0.19628.1

Windows Security App Icon

First thing you will notice is that there is a new tray icon. Windows 10 – 1909 Windows 10 - 2004

Importing GPO Security Baselines with PowerShell

Mon, 07 Oct 2019 19:00:42 +0000

Okay there’s this rule , if you do something manually for the third time, it’s about time to think of automating it. Here’s a script that I created to create Group Policy Objects and import the security baseline settings. The script will work with any security baseline that is provided with Group Policy backups e.g. Microsoft Security baseline, CIS, NSA.

Let me show you this with an example:

First download the latest Microsoft Security baseline which is included in the Microsoft Security Compliance Toolkit. https://www.microsoft.com/en-us/download/details.aspx?id=55319 there download Windows 10 Version 1903 and Windows Server Version 1903 Security Baseline - Sept2019Update.zip and Office365-ProPlus-Sept2019-FINAL.zip (or just the latest versions available).

Extract ConfigMgr Script Status Results with PowerShell

Mon, 09 Sep 2019 18:18:44 +0000

During a recent customer engagement I had to collect the size of user profiles across a large number of devices. I was first thinking of using a script that would collect the information we need, store it into a custom WMI table and then collect the data using ConfigMgr hardware inventory, but since we only needed a one time snapshot of this information I decided against that idea. The next option would be to go old school and run the script through Group Policy processing and store the results in a central location, but hey it’s 2019, no more logon scripts please And then the idea came up to run the script on the target clients via ConfigMgr.

Collecting NetTcpConnection and Process information with PowerShell

Thu, 08 Feb 2018 14:28:19 +0000

if you need information on active TCP connections, you probably start with the netstat command When using the -b or -o parameter netstat will also list the executable involved in creating the process respectively the owing Process ID.

The output then looks as following.

In PowerShell we can use Get-NetTCPConnection to retrieve TCP connection information.

When suspecting that something malicious is running on a device, I look at the TCP connections and want to know more about the executable that owns the process. I am also interested in who’s owning the domain and where it’s geographically located. And so another cmdlet was born. Get-NetConnectionDetails

Automating CIS-CAT Pro with PowerShell

Tue, 06 Feb 2018 20:34:49 +0000

CIS-CAT stands for Center for internet Security Configuration Assessment Tool. The CIS-CAT tool is used to perform configuration and vulnerability assessments. The Pro version is only available to CIS members, however if you want to try out the software, you can download the CIS-CAT Lite version from here: https://www.cisecurity.org/introducing-cis-cat-lite/ Note that the Lite version does not include the command line interface, so you won’t be able to use the automation described in this blog post. But you’re still welcome to continue reading this blog post. An overview of the CIS-CAT Pro can be found here: https://www.cisecurity.org/cybersecurity-tools/cis-cat-pro/

Exploring Microsoft Security Update information with PowerShell

Fri, 29 Dec 2017 13:36:30 +0000

Nowadays regular deployment of security updates is a must, whether at home or within the enterprise. If you are responsible to keep systems up to date you deploy the latest updates as soon as possible. But it is equally important to understand the vulnerabilities being addressed by these updates.

The Microsoft Security Update Guide allows you to find detailed information about security updates. Go to https://portal.msrc.microsoft.com/en-us/ and select “Go to the security update Guide”

How to check if Control Flow Guard is enabled

Sat, 29 Jul 2017 10:53:56 +0000

How to check if Control Flow Guard is enabledControl Flow Guard helps mitigate exploits that are based on flow between code locations in memory. Control Flow Guard (CFG) is a mitigation that requires no configuration within the operating system, but instead is built into software when it’s compiled. So how to check if an Application is Control Flow Guard is enabled? For my own testing purposes I created two executables one called ConsoleApplication1.exe that has CFG enabled and ConsoleApplication1_NO_CFG.exe. One way to find out whether a running application has CFG enabled is to use the sysinternals process explorer utility. If you have Visual Studio installed, the you can use dumpbin.exe with the /HEADERS flag, then look for the DLL characteristics section. Another nice utility I found is PELook from bytepointer.com Now while the above described methods are fine to look at an individual application, what if we wanted to scan an entire system with software installed? Use PowerShell!Luckily, I didn’t have to do all the work from scratch. I found the Get-PESecurity module from Eric Gruber on GitHub here. The Get-PESecurity module checks if a Windows binary has been compiled with ASLR, DEP, SafeSEH, StrongNaming and Authenticode. But it didn’t show the Control Flow Guard information. After I familiarized myself a little bit with the PE format specification on MSDN I learned that the information whether an image supports Control Flow Guard is stored in the DLLCharacteristics constant “GUARD_CF” with a value of 0x4000. So I extended the Get-PESecurity module here and there to add support for CFG. You can find my forked version of the Get-PESecurity PowerShell module which includes support for CFG here: https://github.com/alexverboon/PESecurityIf your company has in-house software developers encourage them to compile their applications with Control Flow Guard enabled. Additional resources I found while exploring CFGhttps://msdn.microsoft.com/en-us/library/windows/desktop/mt637065(v=vs.85).aspx http://sjc1-te-ftp.trendmicro.com/assets/wp/exploring-control-flow-guard-in-windows10.pdf https://docs.microsoft.com/en-us/windows/threat-protection/overview-of-threat-mitigations-in-windows-10 https://lucasg.github.io/2017/02/05/Control-Flow-Guard https://github.com/NetSPI/PESecurity https://blog.trailofbits.com/2016/12/27/lets-talk-about-cfi-microsoft-edition https://blogs.technet.microsoft.com/askpfeplat/2017/04/24/windows-10-memory-protection-features

Creating and Managing Azure Storage Tables with PowerShell

Sat, 01 Jul 2017 23:36:39 +0000

Today’s mission was to get more familiar with Azure Storage Tables and to manage them with PowerShell. On GitHub I found the AzureTableEntity module from Tao Yang. Below are a number of code snippets I used to get my hands dirty with Azure Storage tables and the module.

Install the Module

Install-Module -Name AzureTableEntity

Next we create an Azure Resource Group and an Azure Storage Account

# Create ResourceGroup
$Location = "Westeurope"
$ComputerInventory_ResourceGroup = "rg_CompComputerInventory"
New-AzureRmResourceGroup -Name $ComputerInventory_ResourceGroup -Location $Location
# Create StorageAccount
$SkuName = "Standard_LRS"
$ComputerInventory_StorageAccountName = "sacomputerinventory"
New-AzureRmStorageAccount -ResourceGroupName $ComputerInventory_ResourceGroup -Name $ComputerInventory_StorageAccountName -SkuName "$SkuName" -Location $Location,
```powershell
We will need the Storage Account key later so let’s get that one as well.

```powershell
# Retrieve the first StorageAccountAccessKey
$StorageAccount = Get-AzureRmStorageAccount -ResourceGroupName $ComputerInventory_ResourceGroup -Name $ComputerInventory_StorageAccountName
$StorageAccountAccessKey = (Get-AzureRmStorageAccountKey -ResourceGroupName $ComputerInventory_ResourceGroup -Name $ComputerInventory_StorageAccountName).Value[0]
```powershell

Next we create a new Table with the name “Computerinventory”

```powershell
#Create Table
$TableName = "ComputerInventory"
$context = New-AzureStorageContext -StorageAccountName $ComputerInventory_StorageAccountName -StorageAccountKey $StorageAccountAccessKey
New-AzureStorageTable -Name $TableName -Context $context
```powershell
Now that we have the table created, we can start adding data to it, let’s start with adding just one row first.

```powershell
# Add one entry
     $data = @{
     RowKey = ([guid]::NewGuid().tostring())
     PartitionKey = "Inventory"
     ComputerName = "Computer000001"
     Location = "Amsterdam"
     dtDate = [datetime]::UtcNow
     }
New-AzureTableEntity -StorageAccountName $ComputerInventory_StorageAccountName -StorageAccountAccessKey $StorageAccountAccessKey -TableName $TableName -Verbose -Entities $data
```powershell

Let’s take a look what’s in the table now

```powershell
$querystring = "(PartitionKey eq 'Inventory')"
$result = Get-AzureTableEntity -TableName $tableName -StorageAccountName $ComputerInventory_StorageAccountName -StorageAccountAccessKey $StorageAccountAccessKey  -QueryString $querystring -ConvertDateTimeFields $true -GetAll $true -Verbose
$result
```powershell
![image](images/image_thumb.png)

Next let’s add some more data to it, the below code creates some random computer inventory data.

# Generate some demo data for PC inventory

 

```powershell
   $locations = @("Amsterdam","Paris","Stockholm","London","New York","Seatle","Singapure","Hong Kong","The Hague","Barcelona","Madrid","Stockholm","Rome")
     $data = @()
     $count = 2
      While ($count -le 100)
      {
         $obj = @{
             RowKey = ([guid]::NewGuid().tostring())
             PartitionKey = "Inventory"
             ComputerName = "Computer" + $count.ToString("000000")
             Location = ($locations)[(Get-Random -Minimum 0 -Maximum $locations.Count )]
             dtDate = [datetime]::UtcNow
         }
         $data += (New-Object -TypeName PSCustomObject -Property $obj)
         $count++
     }
```powershell

# Add rows to Azure Storage Table

```powershell
New-AzureTableEntity -StorageAccountName $ComputerInventory_StorageAccountName -StorageAccountAccessKey $StorageAccountAccessKey -TableName $TableName -Verbose -Entities $data

```powershell
If all went fine, we should now have all the data in the table.

```powershell
$querystring = "(PartitionKey eq 'Inventory')"
$result = Get-AzureTableEntity -TableName $tableName -StorageAccountName $ComputerInventory_StorageAccountName -StorageAccountAccessKey $StorageAccountAccessKey  -QueryString $querystring -ConvertDateTimeFields $true -GetAll $true -Verbose
$result.Count
$result | Group-Object Location
```powershell

We now have 100 records in the table, with “**11**” computers located in Amsterdam

![image](images/image_thumb-1.png)

Now let’s look at Computer000001

```powershell
$querystring = "(ComputerName eq 'Computer000001')"
$result = Get-AzureTableEntity -TableName $tableName -StorageAccountName $ComputerInventory_StorageAccountName -StorageAccountAccessKey $StorageAccountAccessKey  -QueryString $querystring -ConvertDateTimeFields $true -GetAll $true -Verbose
$result
```powershell
![image](images/image_thumb-2.png)

It’s located in Amsterdam. Now let’s have a look at how to update a record, let’s say we want to change it to “Rotterdam”

```powershell
$NewLoczation = "Rotterdam"
$data = @{
PartitionKey = $result.PartitionKey
RowKey       = $result.RowKey
Location = $NewLoczation
ComputerName = $result.ComputerName
dtDate = $result.dtDate
}
Update-AzureTableEntity -StorageAccountName $ComputerInventory_StorageAccountName -StorageAccountAccessKey $StorageAccountAccessKey -TableName $TableName -Entities $data
```powershell

Let's retrieve the record again.

 

```powershell
$querystring = "(ComputerName eq 'Computer000001')"
$result = Get-AzureTableEntity -TableName $tableName -StorageAccountName $ComputerInventory_StorageAccountName -StorageAccountAccessKey $StorageAccountAccessKey  -QueryString $querystring -ConvertDateTimeFields $true -GetAll $true -Verbose
$result
```powershell
and there we go, it's now registered in Rotterdam.

![image](images/image_thumb-3.png)

Let’s query the entire database again.

```powershell
$querystring = "(PartitionKey eq 'Inventory')"
$result = Get-AzureTableEntity -TableName $tableName -StorageAccountName $ComputerInventory_StorageAccountName -StorageAccountAccessKey $StorageAccountAccessKey  -QueryString $querystring -ConvertDateTimeFields $true -GetAll $true -Verbose
$result.Count
$result | Group-Object Location
```powershell

![image](images/image_thumb-4.png)

and finally, let’s remove the Computer000001

I query the information again, as i will re-use the return values to build the remove properties.

```powershell
$querystring = "(ComputerName eq 'Computer000001')"
$result = Get-AzureTableEntity -TableName $tableName -StorageAccountName $ComputerInventory_StorageAccountName -StorageAccountAccessKey $StorageAccountAccessKey  -QueryString $querystring -ConvertDateTimeFields $true -GetAll $true -Verbose
$Remove = @{
PartitionKey = $result.PartitionKey
RowKey = $result.RowKey
Computername = $result.ComputerName
}
Remove-AzureTableEntity -StorageAccountName $ComputerInventory_StorageAccountName -StorageAccountAccessKey $StorageAccountAccessKey -TableName $TableName -Entities $Remove

ConfigMgr Client Policy Settings - Get-CMclientpolicysettings

Sat, 04 Mar 2017 13:04:23 +0000

Here’s a function i wrote recently to retrieve the ConfigMgr Client Policy settings. To use the function you must have the System Center Configuration Manager Cmdlet library installed.

Retrieve Azure Virtual Machine Size information with PowerShell

Tue, 07 Feb 2017 19:46:07 +0000

One important topic to consider when deploying virtual machines in Azure is the size of the virtual machine as this affects the pricing, but beware that not only virtual machine sizing has a pricing impact other factors like storage and optional features like IP address options add to the costs as well.

A good starting point to get an understanding of virtual machine costs is the Azure pricing calculator: https://azure.microsoft.com/en-in/pricing/calculator/

Be aware that when selecting SSD disks, storage costs will be noticeable higher than when using HDD disks. To get a better understanding of the available Azure virtual machine sizes I strongly recommend to the read the following documentation:

Download and Install the Windows Assessment and Deployment Kit with PowerShell

Tue, 07 Feb 2017 16:22:42 +0000

Back in June 2012 I posted the Automated download and Installation for the Windows Assessment and Deployment kit article. Not a lot has changed since then,i.e. you still need to first download the sources before you can install them. Nevertheless since using batch scripts isn’t really state of the art anymore these days,I decided to rewrite the script in PowerShell.

Downlload source from GitHub

Select-MyAzureRmSubscription

Tue, 07 Feb 2017 15:08:07 +0000

I have multiple Azure subscriptions linked to my account, so anytime I connect to Azure in PowerShell I have to make sure i am working in the right context. To simplify this I wrote a little helper function called Select-MyAzureRmSubscription.

After entering the -SubscriptionName parameter the script enumerates alll the subscriptions I have access to and generates a dynamic parameter option.

Script location on GitHub: https://github.com/alexverboon/posh/blob/master/Azure/Utilities/select-MyAzureRmSubscription.ps1

PowerShell Script - Get-MsolUserInformation

Sun, 18 Dec 2016 18:27:57 +0000

The Get-MsolUserInformation cmdlet provides an easy way to retrieve all users that are a member or guest and/or are registered in Azure Directory or Active Directory.

PowerShell Script - Get-WinBuildInfo

Sat, 12 Nov 2016 16:19:36 +0000

Here’s a script I wrote that retrieves all the Windows 10 build information, including Insider level when enabled.

And here’s a list of sites that provide information about the builds, releases, version numbers etc.

http://changewindows.org/platform/desktop

https://buildfeed.net/

https://technet.microsoft.com/en-us/windows/release-info.aspx

https://support.microsoft.com/en-us/help/12387/windows-10-update-history?ocid=client_wu

Windows 10 Upgrade Analytics – Notes and PowerShell snippets

Mon, 03 Oct 2016 22:55:04 +0000

I am considering using the Windows 10 upgrade analytics for our Windows 10 project that we’ve just started just recently. Below you find some random notes and references I have gathered during my exploration journey.

The Upgrade Analytics Blog

Here is where you find the latest information from the Upgrade Analytics team: https://blogs.technet.microsoft.com/upgradeanalytics/

Upgrade Analytics on TechNet

Information about the Architecture, deployment techniques, prerequisites and more can be found here: https://technet.microsoft.com/en-us/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics

If you have concerns about data privacy, this document describes in detail what data is being collected and send to Microsoft Windows 7, Windows 8, and Windows 8.1 appraiser telemetry events and fields

Clean up unused Azure Resources with PowerShell

Sun, 02 Oct 2016 00:25:26 +0000

Today when I opened my Azure portal I had a little surprise. The monthly MSDN subscription credit was much lower as I expected it to be. Did I eventually forget to turn off a virtual machine? Curious to find out where the cost had come from, I drilled into the subscription details and noticed that the higher costs had come from the Premium storage that I had used recently to deploy a virtual machine using an SSD disk instead of a HDD disk. But still it wasn’t clear why just that one virtual machine would be that expensive, so i drilled into the premier storage account and noticed that there were several orphaned VHD disks there. A clean up was required.

PowerShell script to run the Windows App Certification Kit

Sat, 24 Sep 2016 19:18:21 +0000

The Windows App Certification Kit is an easy to use tool to check whether an application has potential compatibility issues when running on Windows 10. The tool can be executed in GUI mode and in command line mode. I wrote a PowerShell script that runs the Windows App Certification Kit in a more or less automated way.

I say more or less, because the application installation process of the application itself might still prompt for input. Also the final report generation of the App Cert Tool itself requires manual interaction that i was unable to suppress. , Nevertheless I hope you find the script useful and saves you a bit of time when testing applications.

PowerShell Script - Get-IscMSSecBulletinInfo

Wed, 06 Apr 2016 22:03:52 +0000

Hey there, the Internet Storm Center recently extended their Rest API with some features for Microsoft Patch Data. So where there is a REST API, there’s an opportunity for a PowerShell Script. The Get-IscMSSecBulletinInfo can be found here: https://github.com/alexverboon/posh/blob/master/Security/Get-IscMSSecBulletinInfo.ps1

Cheers

/Alex

The System Center Configuration Manager Cmdlet Library

Wed, 17 Jun 2015 18:21:01 +0000

Hey there, usually when I post something I try to post something new, something that ideally hasn’t been posted before. Today, I’ll make an exception. This becasue when recently speaking to others dealing with ConfigMgr I noticed that not everyone is aware yet that back in April the ConfigMgr team released the System Center Configuation Manager CmdLet Library. So i believe it’s worth to spread the word again.

So here we go:

Group Policy Settings in Windows 10 Build 10.0.10130

Fri, 05 Jun 2015 12:25:54 +0000

Windows 10 build 10.0.10130 brought a couple more new Group Policy settings, here they are:

 **Location** **Setting** **Description** Computer Configuration

Administrative Templates
Windows Components
Windows Update Defer Upgrade If you enable this policy setting, in Pro and Enterprise SKUs you can defer upgrades till the next upgrade period (at least a few months).
If you do not have it set you will receive upgrades once they are available that will be installed as part of your update policies.

How to solve “The RPC server is unavailable” when loading the ConfigMgr PowerShell Module

Wed, 29 Oct 2014 17:03:43 +0000

Since a few weeks, I received the below error message when importing the ConfigMgr module in PowerShell, but everything I ran afterwards worked fine, so I kept ignoring it for a while.

But now it was about time to get rid of this annoying message. My friend Claude Henchoz gave me a hint a while ago that helped me solve the issue. Looking at the error message more closely, I noticed the name of our old meanwhile decommissioned POC environment for ConfigMgr 2012 R2.

Use PowerShell to find all collections where the specified device has a membership

Tue, 14 Oct 2014 18:44:28 +0000

Yesterday I deployed a computer with ConfigMgr and then wondered why it got certain software installed. And so another script was born.

The Get-CMCollectionOfDevice command retrieves all collections where the specified device has a membership

The Script can be downloaded from here

<#
.SYNOPSIS
 Get-CMCollectionOfDevice retrieves all collections where the specified device has a membership

.DESCRIPTION
 The Get-CMCollectionOfDevice retrieves all collections where the specified device has a membership

.PARAMETER Computer
 The name of the computer device

 Example: Client01

.PARAMETER SiteCode
 The Configuration Manager Site Code

 Example: PRI

.PARAMETER SiteServer
 The computer name of the Configuration Manager Site Server

 Example: Contoso-01

.EXAMPLE
 Get-CMCollectionOfDevice -Computer Client01

 CollectionID Name Commnent LastRefreshTime 
 ------------ ---- -------- --------------- 
 SMS00001 All Systems All Systems 14.10.2014 14:25:57 
 SMSDM003 All Desktop and Server Cli... All Desktop and Server Cli... 14.10.2014 14:30:02 
 PR100011 ALL Contoso Workstation Lim. Limiting collection used f... 14.10.2014 16:37:53 
 PR100014 Zurich Location Zuerich 14.10.2014 14:45:53 

 The above command lists all collections where computer Client01 is a member of. The default
 parameter values for SiteCode and SiteServer defined in the script are used. 

.EXAMPLE
 Get-CMCollectionOfDevice -Computer Client01 -SiteCode PRI -SiteServer Contoso-01
 
 The above command lists all collections where computer Client01 is a member of within the
 Configuration Manager site PRI connecting to Site Server Contoso-01

.NOTES
 Version 1.0 , Alex Verboon
 Credits to Kaido Järvemets and David O'Brien for the code snippets
#>

function Get-CMCollectionOfDevice
{
 [CmdletBinding()]
 [OutputType([int])]
 Param
 (
 # Computername
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 Position=0)]
 [String]$Computer,

 # ConfigMgr SiteCode
 [Parameter(Mandatory=$false,
 ValueFromPipelineByPropertyName=$true,
 Position=1)]
 [String]$SiteCode = "PRI",

 # ConfigMgr SiteServer
 [Parameter(Mandatory=$false,
 ValueFromPipelineByPropertyName=$true,
 Position=2)]
 [String]$SiteServer = "contoso-01.corp.com"
 )
Begin
{
 [string] $Namespace = "root\SMS\site_$SiteCode"
}

Process
{
 $si=1
 Write-Progress -Activity "Retrieving ResourceID for computer $computer" -Status "Retrieving data" 
 $ResIDQuery = Get-WmiObject -ComputerName $SiteServer -Namespace $Namespace -Class "SMS_R_SYSTEM" -Filter "Name='$Computer'"
 
 If ([string]::IsNullOrEmpty($ResIDQuery))
 {
 Write-Output "System $Computer does not exist in Site $SiteCode"
 }
 Else
 {
 $Collections = (Get-WmiObject -ComputerName $SiteServer -Class sms_fullcollectionmembership -Namespace $Namespace -Filter "ResourceID = '$($ResIDQuery.ResourceId)'")
 $colcount = $Collections.Count
 
 $devicecollections = @()
 ForEach ($res in $collections)
 {
 $colid = $res.CollectionID
 Write-Progress -Activity "Processing $si / $colcount" -Status "Retrieving Collection data" -PercentComplete (($si / $colcount) * 100)

 $collectioninfo = Get-WmiObject -ComputerName $SiteServer -Namespace $Namespace -Class "SMS_Collection" -Filter "CollectionID='$colid'"
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "CollectionID" -Value $collectioninfo.CollectionID
 $object | Add-Member -MemberType NoteProperty -Name "Name" -Value $collectioninfo.Name
 $object | Add-Member -MemberType NoteProperty -Name "Commnent" -Value $collectioninfo.Comment
 $object | Add-Member -MemberType NoteProperty -Name "LastRefreshTime" -Value ([Management.ManagementDateTimeConverter]::ToDateTime($collectioninfo.LastRefreshTime))
 $devicecollections += $object
 $si++
 }
} # end check system exists
}

End
{
 $devicecollections
}
}

PowerShell Script - Get-CMInstalledSoftware

Fri, 08 Aug 2014 19:23:05 +0000

ConfigMgr 2012 comes with a lot of build-in reports, but often it just does not contain all the information I want. Creating a custom report takes more time than just writing a script.

The Get-CMInstalledSoftware script retrieves all computers that have the specified software installed. Like it? Get your copy of the script from here

<#
.Synopsis
 Get all computers that have the specified software installed
.DESCRIPTION
 Get-CMInstalledSoftware retrieves all computers where the specified software is installed on. 
 The function queries SMS_G_System_INSTALLED_SOFTWARE which contains both 32 and 64 bit software
 installations.

 The following information is collected
 
 Computername,OperatingSystemNameandVersion InstallDate, InstalledLocation, Productname, ProductVersion
 Publisher, UninstallString

.EXAMPLE
 Get-CMInstalledSoftware -ProductName "Client Center for Configuration Manager%"

 Computername : Client01
 OperatingSystemNameandVersion : Microsoft Windows NT Workstation 6.1
 Productname : Client Center for Configuration Manager 2012
 ProductVersion : 1.0.1.0
 Publisher : Zander Tools
 InstallDate : Friday, 1. August 2014 00:00:00
 InstalledLocation : C:\Program Files\Client Center for Configuration Manager 2012\
 UninstallString : MsiExec.exe /X{B299EE26-A664-42A2-8D4E-6BF005EB5E75}

.PARAMETER -ProductName
 The Name of the Software. Use % before or after the productname as a wildcard. 
 
#>

Function Get-CMInstalledSoftware
{
 [CmdletBinding()]
 [OutputType([int])]
 Param
 (
 # Software Product Name
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 Position=0)]
 $ProductName,

 [Parameter(Mandatory=$false,
 ValueFromPipelineByPropertyName=$true,
 Position=1)]
 $SiteCode = "SR1",

 [Parameter(Mandatory=$false,
 ValueFromPipelineByPropertyName=$true,
 Position=2)]
 $SiteServer = "chrv0300.corp.gwpnet.com"
 )

Begin
{
 [string] $Namespace = "root\SMS\site_$SiteCode"
}

Process
{
 $arsw = Get-WmiObject -Namespace $Namespace -ComputerName $SiteServer -Query "SELECT * FROM SMS_G_System_INSTALLED_SOFTWARE where ProductName like '$ProductName'" # and ProductVersion = '11.0.61030.0'"
 $clientswithsw = @()

 ForEach ($res in $arsw)
 {
 $CMResource = (Get-WmiObject -Namespace $Namespace -ComputerName $SiteServer -Query "SELECT Name, ResourceID,Active, SMSUniqueIdentifier,OperatingSystemNameandVersion FROM SMS_R_SYSTEM WHERE ResourceID = '$($res.ResourceID)'")

 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "Computername" -Value $cmresource.Name
 $object | Add-Member -MemberType NoteProperty -Name "OperatingSystemNameandVersion" -Value $cmresource.OperatingSystemNameandVersion
 $object | Add-Member -MemberType NoteProperty -Name "Productname" -Value $res.ProductName
 $object | Add-Member -MemberType NoteProperty -Name "ProductVersion" -Value $res.ProductVersion
 $object | Add-Member -MemberType NoteProperty -Name "Publisher" -Value $res.Publisher
 $object | Add-Member -MemberType NoteProperty -Name "InstallDate" -Value ([Management.ManagementDateTimeConverter]::ToDateTime($res.InstallDate).DateTime)
 $object | Add-Member -MemberType NoteProperty -Name "InstalledLocation" -Value $res.InstalledLocation
 $object | Add-Member -MemberType NoteProperty -Name "UninstallString" -Value $res.UninstallString

 $clientswithsw += $object
 }
}

End
{
 $clientswithsw
}
}

ConfigMgr - PowerShell Script to list Image Binary Delta Replication Setting

Sun, 18 May 2014 22:15:09 +0000

Here’s a script that lists all Boot and Operating system images stored within Configuration Manager and shows whether the Binary Delta Replication Setting is enabled or not.

<#
.Synopsis
 List Binary Delta Replication Setting for ConfigMgr Boot and Operating System images
.DESCRIPTION
 This cmdlet Lists ConfigMgr the Boot image and Operating System image Binary Delta Replication Setting
.EXAMPLE

.EXAMPLE
 Another example of how to use this cmdlet
.NOTES
 #http://msdn.microsoft.com/en-us/library/hh948196.aspx
 Version 1.0 by Alex Verboon

#>
function Get-CMImgBDRSetting
{
 [CmdletBinding()]
 Param
 (
 # Param1 help description
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 Position=0)]
 $SiteCode,
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 Position=1)]
 $SiteServer
 )

 Begin
 {
 [string] $Namespace = "root\SMS\site_$SiteCode"
 $allImages = Get-WmiObject -Namespace $Namespace -ComputerName $SiteServer -Query "SELECT Name, Description, Version,PkgFlags, PackageType FROM SMS_PackageBaseclass Where PackageType = '258' OR PackageType = '257' "
 $USE_BINARY_DELTA_REP = "0x04000000"
 }
 Process
 {
 $bdr_images = @()
 ForEach ($img in $allImages)
 {
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "Name" -Value $img.Name
 $object | Add-Member -MemberType NoteProperty -Name "Version" -Value $img.Version
 $object | Add-Member -MemberType NoteProperty -Name "Description" -Value $img.Description
 $object | Add-Member -MemberType NoteProperty -Name "Binary_Delta_Rep" -Value ($ubdr = if($img.PkgFlags -band $USE_BINARY_DELTA_REP) {"Enabled"} Else {"Disabled"})
 $bdr_images += $object
 }
 }
 End
 {
 $bdr_images | Sort-Object Name
 }
}

PowerShell Script - List Scheduled Tasks

Mon, 28 Apr 2014 14:43:55 +0000

Here’s a simple script I put together to list the scheduled tasks including the description, status and whether the task is set to hidden or not. When deploying a new operating system I find it important to understand what scheduled tasks are enabled to run, as sometimes there might be some potential to improvie the systems performance by disabling those you feel are not needed in your environment.

$schtasks = @()
$st = Get-ScheduledTask
ForEach ($SchTask in $st)
{
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "TaskName" -Value $SchTask.TaskName
 $object | Add-Member -MemberType NoteProperty -Name "Description" -Value $SchTask.Description
 $object | Add-Member -MemberType NoteProperty -Name "State" -Value $SchTask.State
 $object | Add-Member -MemberType NoteProperty -Name "Hidden" -Value $SchTask.Settings.Hidden
 $schtasks += $object
}
$schtasks | Sort-Object "Hidden" -Descending | Format-list

Within the Scheduled Tasks UI, by default you will not see the contents of Tasks that are set to hidden. But this can be enabled. Open the Task Scheduler with taskschd.msc and within the View Menu select “Show Hidden Tasks”.

Managing Windows Defender / System Center Endpoint Security with PowerShell

Tue, 08 Apr 2014 13:17:21 +0000

I just read a blog post from Ed Wilson (Scripting Guy) about Use PowerShell to Configure Windows Defender Preferences and wondered if there’s more here. And yes there is. If you have a default insallation of Windows 8 and have defender enabled or work in an enterprise environment and use Configuration Manager with the System Center Endpoint Security agent deployed on your clients then you the below listed cmdlets available.

Windows Defender

To get a list of all available Defender cmdlets just run the following command within a powershell console

How to export third-party driver packages using PowerShell

Fri, 04 Apr 2014 19:43:09 +0000

Windows 8.1 Update introduces a new cmdlet that allows you to export third-party drivers that are located within the driver store of a Windows client.

$ExpDrv = Export-WindowsDriver -Online -Destination c:\temp\3rdpartydrivers 

```powershell
The result, all drivers exported into the provided destination directory

![2014-04-04_21h36_47](images/2014-04-04_21h36_47_thumb.png)

Now we have a whole bunch of folders, but what drivers did we actually export?

```powershell
$ExpDrv | Select-Object ClassName, ProviderName, Date, Version | Sort-Object ClassName

PowerShell - Get latest Microsoft KB information

Tue, 17 Dec 2013 00:36:24 +0000

I frequently visit kbupdate.info which is a great resource for finding latest KB updates, but still you have to manually click through the various lists. Now that I am learning PowerShell anyway, i thought i’ll give myself another task to further improve my PowerShell skills. So here we go, below you find a script that retrieves the latest KB update information for various products and displays them on screen so that I can quickly browse through them and directly launch the article of interest in Internet Explorer.

PowerShell - How to qukckly access the Azure Management Portal

Mon, 09 Dec 2013 23:42:33 +0000

Whenever I worked with Azure, first thing i usualy did was fire a web search to get the url for the Azure Management portal. I know I could bookmark it……..it’s just that I already have way too many bookmarks. But today I discovered a nice cmdlet in PowerShell called Show-AzurePortal** **which gets you automatically to the right place.

Show-AzurePortal

Note: You must install the Azure PowerShell cmdlets. http://msdn.microsoft.com/en-us/library/windowsazure/jj156055.aspx

PowerShell Desired State Configuration - My first experiences

Sat, 16 Nov 2013 20:44:28 +0000

During the past weeks I have been reading and listening about PowerShell Desired State Configuration a new feature introduced with PowerShell 4.0 which ships with Windows 8.1 and Server 2012R2 but is also available for Windows 7 SP1 and Server 2008 R2 as part of the Windows Management Framework 4.0

To keep things simple at first, I have only focused at running DSC on a local client and only used two built-in configuration resources. What i wanted to achieve was not only to get a DSC running, but also understand how things work.

PowerShell Script - Are we running as Admin?

Fri, 08 Nov 2013 20:19:16 +0000

While exploring some of the new cmdlets that come with Windows 8.1 I came across Test-NetConnection. and noticed that it has a property called IsAdmin. When running the cmdlet in an elevated PowerShell session the property returns True otherwise False. So I put together a very simple script to check whether we are running as admin or not.

<#
.Synopsis
 Checks if we run as administrator
.DESCRIPTION
 This script uses the Test-NetConnection cmdlet that contains a IsAdmin Property to check if we ar running as admin
.EXAMPLE
 Check-Admin.ps1
#>

$AmIAdmin = Test-NetConnection localhost 
 if ($AmIAdmin.IsAdmin -eq "True") {write-host "Running as Admin"} Else {write-host "NOT Running as Admin"}

Other (and probably more reliable) ways to determine whether we are running as admin are described here by Ed Wilson and here by Ben Armstrong.

ConfigMgr PowerShell Script to check if Application or Program is allowed to run in TS without being deployed

Thu, 07 Nov 2013 23:54:46 +0000

Kind of a long title for a blog post, but I could not come up with something shorter to describe the content of this blog post. The below script shows the status of the “Allow this Application / program to be installed from the Application / program install task sequence action without being deployed” setting.

<#
.Synopsis
 Get Application and Package - Program information regarding Task Sequence support
.DESCRIPTION
 The script checks all applications and packages if they are allowed to be installed from a TS without being deployed
.EXAMPLE
 Get-TSInstallEnabled -Site Lab
.NOTES
 Version 1.0
 Written by Alex Verboon
#>

[CmdletBinding()]

param( 
 # ConfigMgr Site
 [Parameter(Mandatory = $true, ValueFromPipeline=$true)]
 [String[]] $Site
 )

if ($Site.Length -eq 0)
 { 
 Throw "ConfigMgr Site code required"
 } 
Else
 {
 $SiteCode = $Site
 }

function Get-TSInstallEnabled ()
{

# Check that youre not running X64
if ([Environment]::Is64BitProcess -eq $True)
 { 
 Throw "Need to run at a X86 PowershellPrompt"
 } 
# Load ConfigMgr module if it isn't loaded already
if (-not(Get-Module -name ConfigurationManager))
 { 
 Import-Module ($Env:SMS_ADMIN_UI_PATH.Substring(0,$Env:SMS_ADMIN_UI_PATH.Length-5) + '\ConfigurationManager.psd1')
 } 
 
# Change to site
Push-Location
Set-Location ${SiteCode}:

 function Get-AppTSInfo()
 {
 $Apps = @() 
 foreach ($Application in Get-CMApplication)
 {
 $AppMgmt = ([xml][/xml]$Application.SDMPackageXML).AppMgmtDigest
 $AppName = $AppMgmt.Application.DisplayInfo.FirstChild.Title
 $AllowTs = $AppMgmt.Application.AutoInstall
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "Application Name" -Value $Appname

 if ($AllowTs -ne "true") {$AllowTs = "false"}

 $object | Add-Member -MemberType NoteProperty -Name "Allowed TS Install" -Value $AllowTs
 $Apps += $object
 }
 $Apps 
 }

 Function Get-PackageTSInfo()
 {
 $Progs = @() 
 foreach ($Prog in Get-CMProgram)
 {
 $ProgName = $Prog.ProgramName
 $PackageName = $prog.PackageName
 $AllowTs = $Prog.ProgramFlags -band [math]::pow(0,0)
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "Program Name" -Value $ProgName
 $object | Add-Member -MemberType NoteProperty -Name "Package Name" -value $Packagename

 if ($AllowTs -ne "1") {$AllowTs = "false"} Else {$AllowTs = "true"}

 $object | Add-Member -MemberType NoteProperty -Name "Allowed TS Install" -Value $AllowTs
 $Progs += $object
 }
 $progs 
}

Get-AppTSInfo | Format-Table -AutoSize 
Get-PackageTSInfo | Format-Table -AutoSize 
Pop-Location
}

Get-TSInstallEnabled

Additional Information

PowerShell Script to detect ConfigMgr Task Sequence unfriendly Software Updates

Tue, 05 Nov 2013 23:58:55 +0000

Update: 15 Une 2014 - Added KB2965788

If you’re dealing with ConfigMgr and OS Deployment task sequences you’re probably aware of the KB article recently published by Microsoft called “Task sequence fails in Configuration Manager if software updates require multiple restarts”.

Let’s hope the list of KBs causing this issue isn’t going to grow too much over time, in any case we’ve decided that we would continue to review the article whenever we add new patches to our infrastructure. To simplify the task of checking whether one of the affected KBs has slipped into a software update group, I created the below script.

PowerShell Script - Get-ComputerGeolocation

Sun, 27 Oct 2013 13:35:01 +0000

28-OCT-2013 Update: I have updated the script to retry when the status of the location provider is in initializing mode.

The below script uses the Windows Location provider and the Google Geocoding API to retrieve the geographical location of the computer. The accuracy of the information retrieved depends on the source used to determine the location which are:

Wi-Fi triangulation
IP address resolution
Cell phone tower triangulation
Global Position System (GPS)

Windows automatically uses the best source, so when accessing the Windows Location provider you don’t need to tell it which source to use.

ConfigMgr - PowerShell Script to collect remote log files

Sun, 13 Oct 2013 14:35:41 +0000

Looking at a client’s ConfigMgr Agent log files is inevitable when managing a Configuration Manager infrastructure. If you are working within a local area network only, then you will most likely just connect to the remote systems configuration manager log folder and drag and drop the appropriate log files into CMTrace.exe. But if your clients are distributed across a WAN network with slow network links opening the log file from a remote location is probably not the most efficient way for analyzing the log files content. And because troubleshooting typically requires looking at multiple log files you finally end up copying multiple log files or just the whole log folder to your client to open them locally.

List ConfigMgr Software Update Group members with PowerShell

Sun, 22 Sep 2013 20:47:18 +0000

The below script allows you to select a Configuration Manager software update group and then lists the software updates that are assigned to it.

<#
.Synopsis
 Lists assigned software updates in a configuration manager 2012 software update group
.DESCRIPTION
 Lists all assigned software updates in a configuration manager 2012 software update group that is selected 
 from the list of available update groups or provided as a command line option
.EXAMPLE
 Get-UpdateGroupcontent.ps1
.EXAMPLE
 Get-UpdateGroupcontent.ps1 -UpdateGroup "Win7x64_12_11_15"

#>

[CmdletBinding()]

param(

 # Software Update Group
 [Parameter(Mandatory = $false, ValueFromPipeline=$true)]
 [String] $UpdateGroup
 )

$SiteCode = "POC"

Function Get-UpdateGroupcontent
{

# Check that youre not running X64
if ([Environment]::Is64BitProcess -eq $True) 
 { Throw "Need to run at a X86 PowershellPrompt"
 }

# Load ConfigMgr module if it isn't loaded already
if (-not(Get-Module -name ConfigurationManager)) {
 Import-Module ($Env:SMS_ADMIN_UI_PATH.Substring(0,$Env:SMS_ADMIN_UI_PATH.Length-5) + '\ConfigurationManager.psd1')
 }

# Change to site
 Push-Location
 Set-Location ${SiteCode}:

#Set-CMQueryResultMaximum -Maximum 5000

if ($UpdateGroup.Length -eq 0) {
 $UpdateGroup = Get-CMSoftwareUpdateGroup | Select-Object LocalizedDisplayName | Out-GridView -Title "Select the Software Update Group " -PassThru 
 }
Else
 {
 $UpdateGroup = Get-CMSoftwareUpdateGroup | Where-Object {$_.LocalizedDisplayName -like "$($UpdateGroup)"} | Select-Object LocalizedDisplayName 
}

$info = @()

ForEach ($item in $UpdateGroup)
{
 Write-host "Processing Software Update Group" $($item.LocalizedDisplayName)
 forEach ($item1 in (Get-CMSoftwareUpdate -UpdateGroupName $($item.LocalizedDisplayName)))
 {
 $object = New-Object -TypeName PSObject
 #$object | Add-Member -MemberType NoteProperty -Name UpdateGroup -Value $item.LocalizedDisplayName
 $object | Add-Member -MemberType NoteProperty -Name ArticleID -Value $item1.ArticleID
 $object | Add-Member -MemberType NoteProperty -Name BulletinID -Value $item1.BulletinID
 $object | Add-Member -MemberType NoteProperty -Name Title -Value $item1.LocalizedDisplayName
 $info += $object
 }
}

$Title = "Total assigned software updates in " + $item.LocalizedDisplayName + " = " + $info.count
$info | Out-GridView -Title "$Title"
}

# -----------------------------------------------------------------------------------------------------*
# Get the list of software updates in the selected update group
Get-UpdateGroupcontent

Windows 8.1 Command Prompt or PowerShell

Mon, 09 Sep 2013 22:38:04 +0000

If you have used the Windows 8.1 preview build, you will have noticed that the X-Menu by default had PowerShell enabled instead of the Command Prompt.. However within the RTM release of Windows 8.1 Microsoft changed this, so now the command prompt is the default again as it was in Windows 8.

To change the default back to PowerShell open the Taskbar and Navigation Properties and enable “Replace Command Prompt with Windows PowerShell in the menu when I right click the lower left corner or press Win +X”

How to configure system volume with PowerShell

Wed, 29 May 2013 16:53:47 +0000

Back in 2011 I wrote a blog post on how to mute Windows System Volume programmatically. This week I found another approach on GitHub using PowerShell.

The PowerShell Module WindowsAudioDevice-Powershell-Cmdlet** **provides a number of cmdlets to control the Windows System volume.

Get-DefaultAudioDevice
Get-AudioDeviceList
Set-DefaultAudioDevice [-Index]
Set-DefaultAudioDevice [-Name]
Set-DefaultAudioDevice [-InputObject]
Set-DefaultAudioDeviceVolume -Volume
Get-DefaultAudioDeviceVolume
Set-DefaultAudioDeviceMute
Write-DefaultAudioDeviceValue [-StreamValue

I wrote the below PowerShell script to solve a request to set the system volume to mute.

Tip: PowerShell Script to create Shutdown/Restart/Logoff Windows 8 Tile for the Start menu

Fri, 17 May 2013 13:52:36 +0000

A PowerShell script shows how to create a Shutdown, Restart or Logoff Windows 8 tile for the Start menu.

Script source and documentation can be downloaded from here

How to check the status of BIOS & UEFI & Secure Boot with PowerShell

Fri, 11 Jan 2013 14:22:06 +0000

During the past weeks I spend a bit of time deploying Windows 8 to UEFI enabled clients. With PowerShell 3.0 on Windows 8 you will find some new cmdlets that provide information about the status of your system’s BIOS/UEFI/Secure boot configuration.

The below table shows the return values depending on whether the system’s firmware is using BIOS, UEFI and if Secure boot is enabled or not.

 **BIOS / UEFI Setup**

 BIOS

 UEFI with CSM

 UEFI native

 Secure boot enabled

 UEFI native

 Secure boot

 disabled


 **PowerShell Command**

 Result

 Confirm-SecureBootUEFI

 Cmdlet not supported on this platform

 False

 True

 False

 Get-SecureBootUEFI –Name SetupMode

 Cmdlet not supported on this platform

 1

 0

 1

 Get-SecureBootUEFI –Name SecureBoot

 Cmdlet not supported on this platform

 0

 1

 0

 Executing any of these cmdlets on a Windows 8 system that uses BIOS generates an error.

The return value of the SetupMode variable tells us if the system is operating in Setup mode or in UserMode meaning that the platform key is enrolled. (For more details read the Firmware/OS Key Exchange: creating trust relationships chapter within the UEFI Specification that can be found here)

Windows Services, what changed from Windows 7 to Windows 8

Thu, 19 Apr 2012 20:02:48 +0000

Nearly 3 years ago I wrote a blog post about the Windows Services changes between Windows Vista and Windows 7. Assuming that we won’t see any big changes with regard to Services when Windows 8 will be released I repeated the exercise by looking at what has changed between Windows 7 Enterprise and the Windows 8 Consumer Preview Build.

To obtain the services data from each system, i executed the following PowerShell command:

Microsoft releases DaRT 8 Beta

Thu, 29 Mar 2012 06:20:32 +0000

Microsoft has released a Beta for DaRT 8. You find more details in the articles listed below. I’ve only been looking at it shortly, but here’s what I liked most:

DaRT 8 now comes with full PowerShell support and some of the cmdlets added can also be used beyond DaRT.
A complete new version of the DaRT image build wizard.
UEFI support

MDOP: DaRTing to the Future

http://windowsteamblog.com/windows/b/business/archive/2012/03/28/mdop-darting-to-the-future.aspx

Microsoft DaRT 8 Beta Q&A

Retrieve Group Policy size in SYSVOL folder with PowerShell

Mon, 24 Jan 2011 18:07:28 +0000

Needless to say that there are quite some benefits in using a central store for Group Policies, one of them is that you can prevent the so-called SYSVOL bloat. A good description of the SYSVOL bloat is described here. So how much size do my GPOs currently consume within the SYSVOL folder? I asked myself that question a few days ago and ended up with let’s say my first version of the GetGPOSize PowerShell script.

Creating Group Policy Objects with PowerShell

Sat, 16 Oct 2010 16:52:03 +0000

In my previous post I wrote about how to create Group Policy reports using the Group Policy PowerShell CmdLets. Today I want to share with you my first hands-on experiences with creating a Group Policy using PowerShell.

But first, why would one use PowerShell to create Group Policies? Well here are a few use cases:

You are a Consultant and always start your Group Policy Implementation with a set of GPOs including your best practice settings.

Creating Group Policy Reports with PowerShell

Sun, 03 Oct 2010 19:14:43 +0000

I’ve had this on my “must do some hands on” list for months, finally found some time to play a bit with the new PowerShell Group Policy CmdLets that where introduced with Windows 7. For today i decided to work with the Get-GPO and the Get-GPOReport CmdLets.

The Get-GPO CmdLet allows you to list one or all GPOs that exist in a domain. If you know the name and want to know when it was last modified, simply type Get-GPO