Client-Management on Janik von Rotz

Configuration Manager - Configure requirement rules for deployment types with PowerShell

Fri, 20 Oct 2017 09:49:46 +0000

Configuration Manager applications can be equipped with powerful requirement rules. For example an application must be installed only if there is enough disk space on the target device or only if the device is the users primary device. The second example is an important requirement rule when working with user device affinity. Configuring this kind of rule is done in a few seconds using the management console. However, scripting the rule with PowerShell is much more difficult. As of today the cmdlets provided by Microsoft for automating Configuration Manager assets do not support building requirement rules for deployment types. But as always there is a workaround. In my case I’ve decided to create an application template containing all requirement rules and copy specific rules from there to other applications.

Once the template requirement rules are created, they can be copied using the script below.

Copy-CMDeploymentTypeRule

$SiteCode = "SITECODE"
$ProviderMachineName = "FQDN" 
if((Get-Module ConfigurationManager) -eq $null) {
    Import-Module "$($ENV:SMS_ADMIN_UI_PATH)\..\ConfigurationManager.psd1"
}
if((Get-PSDrive -Name $SiteCode -PSProvider CMSite -ErrorAction SilentlyContinue) -eq $null) {
    New-PSDrive -Name $SiteCode -PSProvider CMSite -Root $ProviderMachineName
}
Set-Location "$($SiteCode):\"

$RuleName = "Primary device Equals True"
# use * for all rules
$SourceApplicationName = "Application Requirement Rules Template"
$DestApplicationName = "VLC (2.2.6)"
$DestDeploymentTypeIndex = 0

# get the applications
$SourceApplication = Get-CMApplication -Name $SourceApplicationName | ConvertTo-CMApplication
$DestApplication = Get-CMApplication -Name $DestApplicationName | ConvertTo-CMApplication

# get requirement rules from source application
$Requirements = $SourceApplication.DeploymentTypes[0].Requirements | Where-Object {$_.Name -match $RuleName}

# apply requirement rules
$Requirements | ForEach-Object {
    
    $RuleExists = $DestApplication.DeploymentTypes[$DestDeploymentTypeIndex].Requirements | Where-Object {$_.Name -match $RuleName}
    if($RuleExists) {

        Write-Warning "The rule `"$($_.Name)`" already exists in target application deployment type"

    } else{
        
        Write-Host "Apply rule `"$($_.Name)`" on target application deployment type"

        # create new rule ID
        $_.RuleID = "Rule_$( [guid]::NewGuid())"

        $DestApplication.DeploymentTypes[$DestDeploymentTypeIndex].Requirements.Add($_)
    }
}

# push changes
$CMApplication = ConvertFrom-CMApplication -Application $DestApplication
$CMApplication.Put()

The ConvertTo-CMApplication cmdlet converts CM application objects to SDK objects. Using SDK objects offers more options to configure a CM application.

Source: Technet - Deployment Type Requirement mit Powershell hinzufügen

SCCM 1702 increase client log size and retention

Tue, 17 Oct 2017 13:46:41 +0000

With additional steps in an image deployment task sequence the log files will grow quite big. By default the Configuration Manager client keeps a log history of 0 and a size limit of 2 MB for each log file. In result you’ll find yourself missing important details when trying to debug a failed operating system deployment. At some point the log files will be cut off. In order to increase the log size and retention, parameters must be configured in two places.

First we need to inject a SMSTS configuration file into the boot image to set the log parameters. To do so we use a simple PowerShell script.

Copy-SMSTSConfigToBootImage.ps1

$BootImageFile = "C:\Program Files\Microsoft Configuration Manager\OSD\boot\x64\boot.wim"
$Index = "1"
$SMSIniFile = "D:\SCCM\Scripts\SMSTS.ini"

Write-Host "Start updating boot image: " (Get-Date).ToString()

Write-Host "Create temporary directory..."
$MountFolder = Join-Path $env:TEMP (Get-Random)
New-Item -ItemType Directory -Path $MountFolder | Out-Null
Write-Host "Created temporary directory: " $MountFolder

Write-Host "Mounting Windows-Image..." $BootImageFile
Mount-WindowsImage -Path $MountFolder -ImagePath $BootImageFile -Index $Index

Write-Host "Copy SMSTS.ini file..."
Copy-Item $SMSIniFile (Join-Path $MountFolder "Windows")

Write-Host "Dismount-WindowsImage..."
Dismount-WindowsImage -Path $MountFolder -Save -CheckIntegrity

Write-Host "Remove temporary directory..."
Remove-Item $MountFolder -Force

Write-Host "Complete upating boot image:" (Get-Date).ToString()

The script mounts a specified boot image and copies the SMSTS.init configuration file.

SMSTS.ini

[Logging]
LOGLEVEL=0
LOGMAXSIZE=5242880
LOGMAXHISTORY=3
DEBUGLOGGING=1
ENABLELOGGING=True

Once WinPE is unloaded and the selected windows image is being installed, we need set those parameters again. Only this time it is a bit easier.

Locate the Setup Windows and Configuration Manager step in your task sequence and set the installation properties as showed below below:

CCMLOGMAXSIZE=5242880 CCMLOGLEVEL=0 CCMLOGMAXHISTORY=3

The CM client MSI will detect these parameters and write them to the registry at HKLM:\SOFTWARE\Microsoft\CCM\Logging\@Global.

If you want to make sure the SMSTS.ini file has been loaded before installing an OS, press F8 before selecting the task sequence (debug mode must be enabled). A command line pops up and you can navigate to X:\Windows\ where the configuration file is stored.

I hope this tutorial works for you, otherwise ask me at any time.

Remove provisioned appx packages from Windows image for operating system deployment

Mon, 18 Sep 2017 09:51:20 +0000

While preparing a Windows image for SCCM deployment I looked for a viable solution to remove Windows apps from the image. SCCM offers a lot options to execute this kind of action such as running a task sequence or install an application. But none of the options worked out for me. Either they were too complicated to configure or simply didn’t work as expected. Today I’ve found a script on TechNet seemed to a good solution. This script showed me how easy it is to mount a windows image and remove the app packages directory from it. However, the script was outdated and didn’t offer the option to remove only selected apps. That’s why I’ve created my own remix of the script.

Let’s have a look:

Remove-SelectedAppxPackagesFromWIM.ps1

$pathToWIM = "D:\SCCM\OSD\OSImages\Windows 10 Enterprise (x64).wim"
$index = "1"
$appList = @(
    "Windows.ContactSupport",
    "microsoft.windowscommunicationsapps",
    "Microsoft.SkypeApp",
    "Microsoft.ZuneVideo",
    "Microsoft.ZuneMusic",
    "Microsoft.XboxIdentityProvider",
    "Microsoft.XboxApp",
    "Microsoft.WindowsStore",
    "Microsoft.WindowsMaps",
    "Microsoft.StorePurchaseApp",
    "Microsoft.People",
    "Microsoft.OneConnect",
    "Microsoft.Office.OneNote",
    "Microsoft.MicrosoftSolitaireCollection",
    "Microsoft.MicrosoftOfficeHub",
    "Microsoft.Messaging",
    "Microsoft.Getstarted",
    "Microsoft.DesktopAppInstaller",
    "Microsoft.BingWeather",
    "Microsoft.3DBuilder"
)
<#
"Microsoft.MicrosoftEdge"
#>

Write-Host "Start:" (Get-Date).ToString()

Write-Host "Create temporary directory..."
$pathMountFolder = Join-Path $env:TEMP (Get-Random)
New-Item -ItemType Directory -Path $pathMountFolder

Write-Host "Mounting Windows-Image..." $pathToWIM
Mount-WindowsImage -Path $pathMountFolder -ImagePath $pathToWIM -Index $index

Write-Host "Remove the built-in apps:"
$Apps = Get-AppxProvisionedPackage -Path $pathMountFolder | ForEach-Object {

    if($appList -contains $_.displayName) {

        Write-Host "Delete:" $_.DisplayName
        Remove-AppxProvisionedPackage -Path $pathMountFolder -PackageName $_.PackageName

    } else {

        Write-Host $_.DisplayName "is not in app list or already removed"
    }    
}

Write-Host "Dismount-WindowsImage..."
Dismount-WindowsImage -Path $pathMountFolder  -Save -CheckIntegrity

Write-Host "Remove temporary directory..."
Remove-Item $pathMountFolder -Force

Write-Host "Complete:" (Get-Date).ToString()

First, the script creates a temporary folder and mounts the windows image. Next, app packages from a predefined list are removed. Finally, the image is dismounted and the temporary folder deleted.

Manage the life cycle of your SCCM applications with PowerShell - Part 4 Remove Applications

Tue, 05 Sep 2017 08:32:11 +0000

“Manage the life cycle of your SCCM applications with PowerShell” is a short post series where I share my PowerShell experience with System Center Configuration Manager. In my last post I’ve shown you a script to distribute application content and deploy an application to its collections. In my final post I’ll show you the last part of the app life cycle - the termination.

Like the last script this one is also fairly simple. Provide the name of the application you would like to remove and the script is going to remove all assets related and the application itself. For security measures the script asks for confirmation before removing anything.

Remove-CMApplications.ps1

Import-Module "C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\bin\ConfigurationManager.psd1"
Import-Module ActiveDirectory
cd "$((Get-PSProvider | Where-Object {$_.Name -eq "CMSite"}).Drives.Name):"

$ApplicationName = "Visual Studio Code (1.15.1)" 
# use * for all applications

Get-CMApplication | Where-Object{ $_.LocalizedDisplayName -like $ApplicationName } | ForEach-Object {
    $Name = $_.LocalizedDisplayName
    $DeviceCollectionName = $Name + " Devices"
    $UserCollectionName = $Name + " Users"
    $ADGroupName = "DL_CM_$Name"
    
    Write-Host "`nStart removal of application $Name`n"

    $answer = Read-Host "Do you really want to remove the application $($Name)? (y/n)"

    if($answer -eq "y") {

        Write-Host "Remove application deployments."
        Get-CMApplicationDeployment | Where-Object{ ($_.ApplicationName -eq $Name) } | Remove-CMApplicationDeployment -Force

        Write-Host "Remove application package."
        Get-CMApplication -Name $Name | Remove-CMApplication -Force

        Write-Host "Remove AD group."
        Remove-ADGroup $ADGroupName -Confirm:$false

        Write-Host "Remove device and user collections"
        Remove-CMUserCollection -Name $UserCollectionName -Force
        Remove-CMDeviceCollection -Name $DeviceCollectionName -Force
    }
}

The only asset which is not removed is the application folder.

PowerShell nowadays is essential when administrating Microsoft products. In the long run there probably will be Microsoft products which can only configured properly using PowerShell cmdlets (see latest Exchange server). The Support for Configuration Manager is flawless, everything done in the management console can be done using PowerShell commands.

Manage the life cycle of your SCCM applications with PowerShell - Part 3 Deploy Applications

Fri, 01 Sep 2017 09:00:58 +0000

“Manage the life cycle of your SCCM applications with PowerShell” is a short post series where I share my PowerShell experience with System Center Configuration Manager. In my last post I’ve shown you a script that creates applications and all assets required to deploy it. This time I have a script to distribute the application content and deploy the application to its collections.

The script is fairly simple. It cycles through the applications catalog and checks whether they already have been distributed or deployed to its collection, if not it does so.

Deploy-CMApplications.ps1

Import-Module "C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\bin\ConfigurationManager.psd1"
cd "$((Get-PSProvider | Where-Object {$_.Name -eq "CMSite"}).Drives.Name):"

$ApplicationName = "CM Console (1.0.0)" 
# use * for all applications
$Action = "Install"
# use Install or Uninstall
$Purpose = "Required"
# use Available or Required

$DistributionPointName = "sccm.domain.net"
$CMApplicationDeployment = Get-CMApplicationDeployment
Get-CMApplication | Where-Object{ $_.LocalizedDisplayName -like $ApplicationName } | ForEach-Object {
    $Name = $_.LocalizedDisplayName
    $DeviceCollectionName = "$Name Devices"
    $UserCollectionName = "$Name Users"

    Write-Host "`nDistribute and deploy application $Name`n"

    try {
        Start-CMContentDistribution -ApplicationName $Name -DistributionPointName $DistributionPointName
        Write-Host "Content distributed"
    } catch {
        Write-Warning "Content has already been distributed."
    }

    $UserCollectionDeployment = $CMApplicationDeployment | Where-Object{ ($_.ApplicationName -eq $Name) -and ($_.CollectionName -eq $UserCollectionName)}
    if(-not $UserCollectionDeployment) {
        Write-Host "Deploy to user collection."
        $UserCollectionDeployment = New-CMApplicationDeployment -Name $Name -CollectionName $UserCollectionName -DeployAction $Action -DeployPurpose $Purpose
    } else {
        Write-Warning "Application has already been distributed to the user collection."
    }

    $DeviceCollectionDeployment = $CMApplicationDeployment | Where-Object{ ($_.ApplicationName -eq $Name) -and ($_.CollectionName -eq $DeviceCollectionName)}
    if(-not $DeviceCollectionDeployment) {
        Write-Host "Deploy to device collection."
        $DeviceCollectionDeployment = New-CMApplicationDeployment -Name $Name -CollectionName $DeviceCollectionName -DeployAction $Action -DeployPurpose $Purpose
    } else {
        Write-Warning "Application has already been distributed to the device collection."
    }
}

The next post of this series is already the last post. Stay calm!

Manage the life cycle of your SCCM applications with PowerShell - Part 2 Create Applications

Tue, 29 Aug 2017 15:07:47 +0000

“Manage the life cycle of your SCCM applications with PowerShell” is a short post series where I share my PowerShell experience with System Center Configuration Manager. In my last post I’ve showed you a script that creates the package source folder structure and another that adds the service users for SCCM. As mentioned these scripts have only been published for a better understanding of the follow-up scripts.

This time I would like to present you the script that adds new applications to the SCCM catalog. Here are the main features of the script:

Populates the folder structure for the registered applications.
Creates a user and device collection for each application.
Supports MSI, Executables and Scripted Installers.
Configures deployment types for each application.
Maps collections with an AD security group.
Add application supersedence if configured.

The script uses a config file. In there all information are stored required to create an application. Let’s have a look:

AppConfigs.ps1

$AppConfigs = @{
    Name = "7-Zip"
    Description = "7-Zip ist ein freies Datenkompressionsprogramm mit einer hohen Kompressionsrate."
    Version = "17.00 beta"
    Category = "File Manager"
    Company = "7-Zip"
    Publisher = "Igor Pavlov"
    Url = "http://www.7-zip.de/"
    Deploy = @{
        Type = "msi"
        Install = "7z1700-x64.msi"
        InstallationBehaviorType = "InstallForSystem"
        LogonRequirementType = "WhereOrNotUserLoggedOn"
    }
    Update = @{
        Supersedes = "7-Zip (16.04)"
        IsUninstall = $true
    }
},
@{
    Name = "CM Console"
    Description = "System Center Configuration Manager Console."
    Version = "1.0.0"
    Category = "Configuration Manager"
    Company = "Microsoft"
    Publisher = "Microsoft"
    Url = "https://www.microsoft.com/en-us/cloud-platform/system-center-configuration-manager"
    Deploy = @{
        Type = "script"
        Install = 'ConsoleSetup.exe /q TargetDir="C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole" EnableSQM=1 DefaultSiteServerName=sccm.domain.net'
        Uninstall = 'ConsoleSetup.exe /q TargetDir="C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole" /uninstall'
        InstallationBehaviorType = "InstallForSystem"
        LogonRequirementType = "WhereOrNotUserLoggedOn"
        DetectionScript =  @'
if (Test-Path "C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\bin\Microsoft.ConfigurationManagement.exe") {
        Write-Host "Installed"
} else {
}
'@
    }
},
@{
    Name = "7-Zip"
    Description = "7-Zip ist ein freies Datenkompressionsprogramm mit einer hohen Kompressionsrate."
    Version = "16.04"
    Category = "File Manager"
    Company = "7-Zip"
    Publisher = "Igor Pavlov"
    Url = "http://www.7-zip.de/"
    Deploy = @{
        Type = "msi"
        Install = "7z1604-x64.msi"
        InstallationBehaviorType = "InstallForSystem"
        LogonRequirementType = "WhereOrNotUserLoggedOn"
    }
},
@{
    Name = "VLC Script"
    Description = "VLC is a free and open source cross-platform multimedia player and framework that plays most multimedia files as well as DVDs, Audio CDs, VCDs, and various streaming protocols."
    Version = "2.2.6"
    Category = "Video Player"
    Company = "VideoLAN"
    Publisher = "VideoLAN Organization"
    Url = "https://www.videolan.org/"
    Deploy = @{
        Type = "powershell"
        Install = "powershell.exe -ExecutionPolicy Bypass -File .\Application.ps1 -Install"
        Uninstall = "powershell.exe -ExecutionPolicy Bypass -File .\Application.ps1 -Uninstall"
        InstallationBehaviorType = "InstallForSystem"
        LogonRequirementType = "WhereOrNotUserLoggedOn"
        DetectionScript =  @'
if (Test-Path "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe") {
        Write-Host "Installed"
} else {
}
'@
    }
},
@{
    Name = "VLC"
    Description = "VLC is a free and open source cross-platform multimedia player and framework that plays most multimedia files as well as DVDs, Audio CDs, VCDs, and various streaming protocols."
    Version = "2.2.6"
    Category = "Video Player"
    Company = "VideoLAN"
    Publisher = "VideoLAN Organization"
    Url = "https://www.videolan.org/"
    Deploy = @{
        Type = "script"
        Install = "vlc-2.2.6-win32.exe /S"
        Uninstall = '"C:\Program Files (x86)\VideoLAN\VLC\uninstall.exe" /S'
        InstallationBehaviorType = "InstallForSystem"
        LogonRequirementType = "WhereOrNotUserLoggedOn"
        DetectionScript =  @'
if (Test-Path "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe") {
        Write-Host "Installed"
} else {
}
'@
    }
},
@{
    Name = "Greenshot"
    Description = "Greenshot is the most awesome tool for making screenshots you can get on your Windows PC."
    Version = "1.2.9.129"
    Category = "Utility"
    Company = "Greenshot"
    Publisher = "Jens Klingen"
    Url = "http://getgreenshot.org/"
    Deploy = @{
        Type = "script"
        Install = 'Greenshot-INSTALLER-1.2.9.129-RELEASE.exe /VERYSILENT /NORESTART'
        Uninstall = '"C:\Program Files\Greenshot\unins000.exe" /VERYSILENT /NORESTART'
        InstallationBehaviorType = "InstallForSystem"
        LogonRequirementType = "WhereOrNotUserLoggedOn"
        DetectionScript =  @'
if (Test-Path "C:\Program Files\Greenshot\Greenshot.exe") {
        Write-Host "Installed"
} else {
}
'@
    }
}

As you cans see the config supports different kind of deployment types (script, msi, powershell) and supersedence. When it comes to deployment types, the script can be extended easily.

The config file is used by the script to create and configure the applications.

Add-SCCMApplications.ps1

Import-Module "C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\bin\ConfigurationManager.psd1"
Import-Module ActiveDirectory
cd "$((Get-PSProvider | Where-Object {$_.Name -eq "CMSite"}).Drives.Name):"

$CM_OU = "OU=SCCM,OU=AccessGroups,OU=Admin,DC=go4ksow,DC=net"
$PackageSource = "D:\SCCM\Applications\"
$HostName = "sccm"
. "$PSScriptRoot\AppConfigs.ps1"

$Domain = Get-ADDomain
$CMApplications = Get-CMApplication
$CMCategories = Get-CMCategory -CategoryType AppCategories
$CMDeviceCollections = Get-CMDeviceCollection
$CMUserCollections = Get-CMUserCollection

$AppConfigs | ForEach-Object {
    $AppConfig = $_
    $AppConfig.AppName = $AppConfig.Name + " (" + $AppConfig.Version + ")"
    $ContentLocation = "\\$HostName\PackageSource\Applications\$($AppConfig.Company)\$($AppConfig.Name)\$($AppConfig.Version)"
    $ADGroupName = "DL_CM_$($AppConfig.AppName)"
    $DeviceCollectionName =  $AppConfig.AppName + " Devices"
    $UserCollectionName =  $AppConfig.AppName + " Users"

    Write-Host "`nAdd CM Application $($AppConfig.AppName)`n"

    $App = $CMApplications | Where-Object{ $_.LocalizedDisplayName -eq $AppConfig.AppName}
    if(-not $App) {
        Write-Host "Create the application: $($AppConfig.AppName)."
        $IconLocationFile = Join-Path $PackageSource "icon.jpg"
        $App = New-CMApplication -Name $AppConfig.AppName `
            -LocalizedDescription $AppConfig.Description `
            -SoftwareVersion $AppConfig.Version `
            -Publisher $AppConfig.Publisher `
            -LinkText $AppConfig.Url `
            -IconLocationFile $IconLocationFile
    } else {
        Write-Warning "Application: $($AppConfig.AppName) already exists."
    }

    $Category = $CMCategories | Where-Object{ $_.LocalizedCategoryInstanceName -eq $AppConfig.Category }
    if(-not $Category) {
        Write-Host "Create the application category: $($AppConfig.Category)."
        $Category = New-CMCategory -CategoryType AppCategories -Name $AppConfig.Category
    } else {
        Write-Warning "Category: $($AppConfig.Category) already exists."
    }

    $CategoryIsSet = $null
    $CategoryIsSet = $App.LocalizedCategoryInstanceNames[0] -eq $Category.LocalizedCategoryInstanceName
    if(-not $CategoryIsSet) {
        Write-Host "Set application category."
        $App | Set-CMApplication -AppCategory $Category.LocalizedCategoryInstanceName
    } else {
        Write-Warning "Application category is already set."
    }

    $Path = $null
    $Path = (Join-Path $PackageSource $AppConfig.Company)
    if(-not (Test-Path -Path $Path)) {
        Write-Host "Create company application folder."
        New-Item -Path $Path -ItemType Directory | Out-Null
    }
    $Path = (Join-Path $Path $AppConfig.Name)
    if(-not (Test-Path -Path $Path)) {
        Write-Host "Create application folder."
        New-Item -Path $Path  -ItemType Directory | Out-Null
    }
    $Path = (Join-Path $Path $AppConfig.Version)
    if(-not (Test-Path -Path $Path)) {
        Write-Host "Create application version folder."
        New-Item -Path $Path  -ItemType Directory | Out-Null
    }

    $ADGroup = $null
    $ADGroup = Get-ADGroup $ADGroupName
    if(-not $ADGroup){
        Write-Host "Add AD group: $ADGroupName."
        $ADGroup = New-ADGroup -Name $ADGroupName -GroupScope DomainLocal -Path $CM_OU
    } else {
        Write-Warning "AD group: $ADGroupName already exists."
    }

    if($AppConfig.Deploy.type -eq "script") {

        $deployType = Get-CMDeploymentType -ApplicationName $AppConfig.AppName
        if(-not $DeployType){
            Write-Host "Add script deployment type."

            $param = @{
                ApplicationName = $AppConfig.AppName
                DeploymentTypeName = $AppConfig.AppName
                ScriptText = $AppConfig.Deploy.DetectionScript
                ScriptLanguage = "PowerShell"
                ContentLocation = $ContentLocation
                InstallCommand = $AppConfig.Deploy.Install
                UninstallCommand = $AppConfig.Deploy.Uninstall
                InstallationBehaviorType = $AppConfig.Deploy.InstallationBehaviorType
                LogonRequirementType = $AppConfig.Deploy.LogonRequirementType
                ForceScriptDetection32Bit = $true
            }
           $DeployType = Add-CMScriptDeploymentType @param
        } else {
            Write-Warning "Script deployment type already exists."
        }
    }

    if($AppConfig.Deploy.type -eq "msi") {

        $DeployType = Get-CMDeploymentType -ApplicationName $AppConfig.AppName
        if(-not $DeployType){
            Write-Host "Add default deployment type."

            $param = @{
                ApplicationName = $AppConfig.AppName
                DeploymentTypeName = $AppConfig.AppName
                ContentLocation = Join-path $ContentLocation $AppConfig.Deploy.Install
                InstallationBehaviorType = $AppConfig.Deploy.InstallationBehaviorType
                LogonRequirementType = $AppConfig.Deploy.LogonRequirementType
                Force = $true  
            }
            $DeployType = Add-CMMsiDeploymentType @param
        } else {
            Write-Warning "Script deployment type already exists."
        }
    }

    if($AppConfig.Deploy.type -eq "powershell") {

        $deployType = Get-CMDeploymentType -ApplicationName $AppConfig.AppName
        if(-not $DeployType){
            Write-Host "Add powershell deployment type."

            $param = @{
                ApplicationName = $AppConfig.AppName
                DeploymentTypeName = $AppConfig.AppName
                ScriptText = $AppConfig.Deploy.DetectionScript
                ScriptLanguage = "PowerShell"
                ContentLocation = $ContentLocation
                InstallCommand = $AppConfig.Deploy.Install
                UninstallCommand = $AppConfig.Deploy.Uninstall
                InstallationBehaviorType = $AppConfig.Deploy.InstallationBehaviorType
                LogonRequirementType = $AppConfig.Deploy.LogonRequirementType
            }
           $DeployType = Add-CMScriptDeploymentType @param
        } else {
            Write-Warning "Powershell deployment type already exists."
        }

        $ScriptPath = Join-Path $Path "Application.ps1"
        if(-not (Test-Path $ScriptPath)) {
            Write-Host "Add powershell deployment script."
            @'
Param(
  [switch]$Install,
  [switch]$Uninstall
)

if($Install) {
    Start-Process -FilePath ".\vlc-2.2.6-win32.exe" -ArgumentList "/S" -Wait
}

if($Uninstall) {
    Start-Process -FilePath "C:\Program Files (x86)\VideoLAN\VLC\uninstall.exe" -ArgumentList "/S" -Wait
}
'@ | Set-Content -Path $ScriptPath
        } else {
            Write-Warning "PowerShell deployment script already exists."
        }
    }

    $LimitingCollection = $CMDeviceCollections | Where-Object{ $_.Name -eq "All Systems" }
    $DeviceCollection = $CMDeviceCollections | Where-Object{ $_.Name -eq $DeviceCollectionName }
    if(-not $DeviceCollection) {
        Write-Host "Create the device collection."
        $DeviceCollection = New-CMDeviceCollection -Name $DeviceCollectionName -LimitingCollectionId $LimitingCollection.CollectionID -RefreshType 4 -Comment "Application Collection"
    } else {
        Write-Warning "Device collection already exists."
    }

    $QueryRule = 'select *  from  SMS_R_System where SMS_R_System.SecurityGroupName = "' + $Domain.Name + '\\' + $ADGroup.Name + '"'
    $Rule = Get-CMDeviceCollectionQueryMembershipRule -Name $DeviceCollectionName
    if(-not $Rule -and $ADGroup) {
        Write-Host "Add device collection membership rule."
        Add-CMDeviceCollectionQueryMembershipRule -CollectionName $DeviceCollectionName -RuleName "Active Directory Membership" -QueryExpression $QueryRule
    } elseif(-not $ADGroup) {
        Write-Warning "Could not create device colleciton membership rule as AD groups does not exist."
    } else {
        Write-Warning "Device collection membership rule already exists."
    }

    $LimitingCollection = $null
    $LimitingCollection = $CMUserCollections | Where-Object{ $_.Name -eq "All Users" }
    $UserCollection = $CMUserCollections | Where-Object{ $_.Name -eq $UserCollectionName }
    if(-not $UserCollection) {
        Write-Host "Create the user collection."
        $UserCollection = New-CMUserCollection -Name $UserCollectionName -LimitingCollectionId $LimitingCollection.CollectionID -RefreshType 4 -Comment "Application Collection"
    } else {
        Write-Warning "User collection already exists."
    }

    $QueryRule = $null
    $QueryRule = 'select *  from  SMS_R_User where SMS_R_User.SecurityGroupName = "' + $Domain.Name + '\\' + $ADGroup.Name + '"'
    $Rule = $null
    $Rule = Get-CMUserCollectionQueryMembershipRule -Name $UserCollectionName
    if(-not $Rule -and $ADGroup) {
        Write-Host "Add user collection membership rule."
        Add-CMUserCollectionQueryMembershipRule -CollectionName $UserCollectionName -RuleName "Active Directory Membership" -QueryExpression $QueryRule
    } elseif(-not $ADGroup) {
        Write-Warning "Could not create user colleciton membership rule as AD groups does not exist."
    } else {
        Write-Warning "User collection membership rule already exists."
    }

    if($AppConfig.Update) {
        if(-not $App.IsSuperseding) {
            Write-Host "Add application supersedence for $($AppConfig.Update.Supersedes)."
            $SupersedingDeploymentType = Get-CMDeploymentType -DeploymentTypeName $AppConfig.AppName -ApplicationName $AppConfig.AppName
            $SupersededDeploymentType = Get-CMDeploymentType -DeploymentTypeName $AppConfig.Update.Supersedes -ApplicationName $AppConfig.Update.Supersedes
            $DeploymentTypeSupersedence = Add-CMDeploymentTypeSupersedence -SupersedingDeploymentType $SupersedingDeploymentType -SupersededDeploymentType $SupersededDeploymentType -IsUninstall:$AppConfig.Update.IsUninstall
        } else {
             Write-Warning "This application already supersedes another application."
        }
    }
}

The script creates all assets required to deploy an application and reduces the probability of misconfiguration drastically. Here’s a screenshot of the assets for the VLC player package:

The application package has PowerShell deployment type. Instead of an exectable a PowerShell is called to install the Application. Using a script allows to make additional configurations before and after the installation or uinstallation of the package.

In my next post I will share the script for deploying the created applications. Stay focused!

Manage the life cycle of your SCCM applications with PowerShell - Part 1 Service Accounts and Package Source

Tue, 29 Aug 2017 12:19:29 +0000

I’m currently planning and building a System Center Configuration Manager (SCCM) infrastructure for a local hospital. SCCM is a complex system composed of various components to make the client and software life cycle management feasible. While configuring SCCM is a tedious job which is done once, managing applications is a recurring process. That’s why the application life cycle is the perfect candidate for scripted automation. With the most recent SCCM release Microsoft made it a lot easier to use the power of PowerShell. I’ve developed a few scripts which help creating, deploying and deleting SCCM applications. Configuring applications manually can be very bothersome and is always at risk for misconfiguration. The benefit for automation is huge.

In my first post of this series I want to show you how I’ve scripted the service users and package source share for SCCM. It’s not necessary that you run these scripts in your installation. I share them for a better understanding of the follow-up script. Furthermore, this posts intends to be a template for admins who are not sure how to configure their SCCM installation.

Separation of concerns is an important key principal of Microsoft products. That’s why SCCM requires a lot of service users in order to run the system. Based on their guidelines I’ve written a script to create the necessary required accounts. Let’s have a look:

Create-CMServiceAccounts.ps1

Import-Module ActiveDirectory
Import-Module PowerUp

$OU = "OU=ServiceAccounts,OU=Admin,DC=example,DC=net"
$Domain = "example.net"
$Users = @(
    @{
        DisplayName = "SCCM Site"
        Name = "sccm_site"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Runs the sccm primary site and its roles."
    }
     @{
        DisplayName = "SCCM Active Directory Discovery"
        Name = "sccm_discovery"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Discovers users, groups and system in the Active Directory."
    }
    @{
        DisplayName = "SCCM Active Directory Forest"
        Name = "sccm_forest"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Discovers Active Directory forests and publishes information in the system container."
    }
    @{
        DisplayName = "SCCM Proxy Access"
        Name = "sccm_proxy"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Connects site roles with the proxy server."
    }
    @{
        DisplayName = "SCCM Capture OSI"
        Name = "sccm_captureosi"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Stores the captured operating system images."
    }
    @{
        DisplayName = "SCCM Client Push"
        Name = "sccm_clientpush"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Installs the sccm client on existing windows clients."
    }
    @{
        DisplayName = "SCCM Exchange Connection"
        Name = "sccm_exchange"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Conencts the site with the Exchange server."
    }
    @{
        DisplayName = "SCCM Reporting Service"
        Name = "sccm_report"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Runs the SCCM reporting service."
    }
    @{
        DisplayName = "SCCM Domain Join"
        Name = "sccm_domainjoin"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Joins systems during the installation to the domain."
    }
    @{
        DisplayName = "SCCM SQL Service"
        Name = "sccm_sql"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Runs the SQL server."
    }
    @{
        DisplayName = "SCCM Network Access"
        Name = "sccm_network"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Accesses the packages source and loads files required for installation and deployment."
    }
    @{
        DisplayName = "SCCM WSUS"
        Name = "sccm_wsus"
        Password = Get-RandomPassword
        CannotChangePassword = $true
        ChangePasswordAtLogon = $false
        PasswordNeverExpires = $true
        Description = "Connects the site with the WSUS server."
    }
)

$Users | ForEach-Object {
    Write-Host "Create AD Service Account: $($_.Name) with Password: $($_.Password)"
    New-ADUser -Name $_.DisplayName -DisplayName $_.DisplayName -AccountPassword (ConvertTo-SecureString -AsPlainText $_.Password -Force) -Enabled $true -Path $OU -CannotChangePassword $_.CannotChangePassword -ChangePasswordAtLogon $_.ChangePasswordAtLogon -PasswordNeverExpires $_.PasswordNeverExpires -SamAccountName $_.Name -UserPrincipalName "$($_.Name)@$Domain" -Description $_.Description
}

As you can see the script requires two PowerShell modules. One ist the default Active Directory module and the other is the PowerUp module, which has been published by me. The PowerUp module is only required for the Get-RandomPassword function and can easily be ditched for something else, such as a static password list.

These service accounts must be configured in the SCCM console and will be granted different access rights on the package source share. The package source share is the folder structure where you store all the files required by SCCM to deploy operating systems and applications. Let’s check out the script to build the folder structure:

Create-CMPackageSourceShare.ps1

# set the parameters
$Source = "D:\SCCM"
$ShareName = "PackageSource"
$NetworkAccount = "domain.net\sccm_network"
$SiteAccount = "domain.net\sccm_site"
$SystemAccount = "NT AUTHORITY\SYSTEM"
$LocalServiceAccount = "LOCALSERVICE"
$CaputreOSIAccount = "domain.net\sccm_captureosi"

# create the source directory
New-Item -ItemType Directory -Path "$Source"

# Application
New-Item -ItemType Directory -Path "$Source\Applications"
New-Item -ItemType Directory -Path "$Source\Applications\Adobe"
New-Item -ItemType Directory -Path "$Source\Applications\Citrix"
New-Item -ItemType Directory -Path "$Source\Applications\Microsoft"
New-Item -ItemType Directory -Path "$Source\Applications\Microsoft\Office 2016"

# App-V
New-Item -ItemType Directory -Path "$Source\App-V"
New-Item -ItemType Directory -Path "$Source\App-V\Packages"
New-Item -ItemType Directory -Path "$Source\App-V\Source"

# Device Applications
New-Item -ItemType Directory -Path "$Source\DeviceApplications"
New-Item -ItemType Directory -Path "$Source\DeviceApplications\HP"
New-Item -ItemType Directory -Path "$Source\DeviceApplications\HP\Probook 450"
New-Item -ItemType Directory -Path "$Source\DeviceApplications\HP\Probook 450\x86"
New-Item -ItemType Directory -Path "$Source\DeviceApplications\HP\Probook 450\x64"

# Import
New-Item -ItemType Directory -Path "$Source\Import"
New-Item -ItemType Directory -Path "$Source\Import\Baselines"
New-Item -ItemType Directory -Path "$Source\Import\MOFs"
New-Item -ItemType Directory -Path "$Source\Import\Task Sequences"

# Logs
New-Item -ItemType Directory -Path "$Source\Logs"
New-Item -ItemType Directory -Path "$Source\Logs\MDTLogs"
New-Item -ItemType Directory -Path "$Source\Logs\MDTLogsDL"

# Operating System Deployment
New-Item -ItemType Directory -Path "$Source\OSD"
New-Item -ItemType Directory -Path "$Source\OSD\BootImages"
New-Item -ItemType Directory -Path "$Source\OSD\Captures"
New-Item -ItemType Directory -Path "$Source\OSD\MDTSettings"
New-Item -ItemType Directory -Path "$Source\OSD\MDTToolkit"
New-Item -ItemType Directory -Path "$Source\OSD\OSImages"
New-Item -ItemType Directory -Path "$Source\OSD\OSInstall"
New-Item -ItemType Directory -Path "$Source\OSD\Prestart"
New-Item -ItemType Directory -Path "$Source\OSD\USMT"
New-Item -ItemType Directory -Path "$Source\OSD\DriverPackages"
New-Item -ItemType Directory -Path "$Source\OSD\DriverPackages"
New-Item -ItemType Directory -Path "$Source\OSD\DriverPackages\HP"
New-Item -ItemType Directory -Path "$Source\OSD\DriverPackages\HP\Probook 450"
New-Item -ItemType Directory -Path "$Source\OSD\DriverSources"
New-Item -ItemType Directory -Path "$Source\OSD\DriverSources"
New-Item -ItemType Directory -Path "$Source\OSD\DriverSources\HP"
New-Item -ItemType Directory -Path "$Source\OSD\DriverSources\HP\Probook 450"
New-Item -ItemType Directory -Path "$Source\OSD\DriverSources\HP\Probook 450\Realtek Ethernet Controller Drivers"

# Script
New-Item -ItemType Directory -Path "$Source\Scripts"

# Tools
New-Item -ItemType Directory -Path "$Source\Tools"
New-Item -ItemType Directory -Path "$Source\Tools\PSTools"

# Windows Updates
New-Item -ItemType Directory -Path "$Source\WindowsUpdates"
New-Item -ItemType Directory -Path "$Source\WindowsUpdates\Office 2016"
New-Item -ItemType Directory -Path "$Source\WindowsUpdates\Windows 10"

# WSUS
New-Item -ItemType Directory -Path "$Source\WSUS"

# create the share
New-SmbShare -Name "$ShareName" -Path "$Source" -CachingMode None -ReadAccess Everyone -FullAccess $SiteAccount, $SystemAccount
# Get-SmbShare | where{$_.Name -eq "PackageSource"} | Remove-SmbShare

# set security permissions
$Acl = Get-Acl "$Source\Logs"
$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($NetworkAccount,"FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
$Acl.SetAccessRule($Ar)
Set-Acl "$Source\Logs" $Acl

$Acl = Get-Acl "$Source\OSD\Captures"
$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($CaputreOSIAccount,"FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
$Acl.SetAccessRule($Ar)
Set-Acl "$Source\OSD\Captures" $Acl

$Acl = Get-Acl "$Source\StateCapture"
$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($LocalServiceAccount,"FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
$Acl.SetAccessRule($Ar)
Set-Acl "$Source\StateCapture" $Acl

Of course you do not need all of these folders. Adjust the script according to your requirements and preferences.

Here’s a short explanation for each folder:

Application
This where the application installation files are stored.
Applications\[Vendor]\[Product]\[Version]

App-V
Source folder for App-V applications.
App-V\[Packages,Source]

Device Applications
Vendor specific applicatios, that are applied when deploying an image.
DeviceApplications\[Vendor]\[Product]\[Architecture]

Import
Going to import data into the SCCM database? Put them here.
Import\[Type]

Logs
Store important SCCM log files here.
Logs\[Type]

Operating System Deployment
Everything related for deploying os images.
OSD\[BootImages,Captures,MDTSettings,MDTToolkit,OSImages,OSInstall,Prestart]
Put driver files and source packages into these folders.
OSD\[DriverPackages,DriverSources]\[Vendor]\[Product and Version]\[Driver Type]

Script
PowerShell scripts for SCCM configurations.
Script

Tools
Any SCCM related tool.
Tools\[Type]

Windows Updates
Source folder for the software update deployment packages.
WindowsUpdates\[Product]

WSUS
This is the WSUS data folder.
WSUS

In the next post I will share the script to create new applications. Stay tuned!

Project: Setup Windows 7 Kiosk

Fri, 04 Oct 2013 16:01:56 +0000

The goal of this project is a simple Windows 7 Kiosk installation with nothing else as the newest version of internet explorer installed. A user should not be allowed to do something than can malfunction the system or even elevating the user privileges. I want to show you in this post which GroupPolicies I’ve used and what configurations I made to set up this type of installation.

First I want to commit my principles for working with ActiveDirectory and Group Policies:

The logged in user can…

The setup of the windows workstation is very simple:

The Group Policy Management Console is equipped with newest Windows 7 AMDX templates.

The following section shows the policies I’ve used to restrict the access to the computer and it’s programs.

Desktop background

Add a desktop wallpaper.

Remove Desktop Icons

Remove the default desktop icons.

Remove System Buttons

Remove the start system buttons and the options showed after click Ctrl + Alt + Delete.

Restricted Start Menu

Remove the all items in the windows start menu.

Restricted Taskbar

Denie any possiblity to customize the windows taskbar.

SharePoint Icon

Adds a simple icon to the desktop.

Delete Cache

Delete the browser cache on exit.

Disable Save Passwords

Internet explorer is not allowed to prompt for saving password information.

Hide Menus

Hide internet explorer menus.