SCCM - DCM

[Norphy]

I've spent a little while playing with DCM inside Configuration Manager now and it's getting to the point where I'm saying "Good god, I can see this being useful". I've got a couple of widgets set up, mostly for our Macs. I've got one detecting whether wireless is enabled and nuking it if the Mac is hard-wired, I've got one which detects its domain membership and rejoins it if it's fallen off. I've also got a Windows one which detects whether the screen resolution is at its native setting and reports if it isn't plus one that kills the firewall.

 

I'm wondering if anyone else is using DCM and what they're using it for. Does anyone have any scriptlets that they're willing to share?

[Norphy]

OK, so I thought I'd get the ball rolling. Feel free to use these if you think you'd find them useful. If you see a way to improve them (likely), pipe up. And so without further ado (adieu?):

 

First of all, this is the one I'm using to report screen resolutions. It's not remediating at moment, just reporting:

 

$CapableResolution = Get-CIMInstance CIM_VideoControllerResolution
$ActualResolution = Get-CIMInstance Win32_DesktopMonitor

IF ($CapableResolution[-1].HorizontalResolution -eq $ActualResolution.ScreenWidth -and $CapableResolution[-1].VerticalResolution -eq $ActualResolution.ScreenHeight) 

   { 
       echo "Resolutions Match"
   }
ELSE
   {   
       $CapHoz = $CapableResolution[-1].HorizontalResolution
       $CapVer = $CapableResolution[-1].VerticalResolution
       $ActHoz = $ActualResolution.ScreenWidth
       $ActVer = $ActualResolution.ScreenHeight


       echo "Resolutions do not match - Actual Resolution $ActHoz x $ActVer, monitor capable of $CapHoz x $CapVer"
   }

 

This one detects whether the Adobe Update Service is suppressed or not and suppresses it if it isn't. No more annoying balloon popups!

 

Discovery:

[xml]$AdobeUpdatePrefs = Get-Content "C:\Program Files (x86)\Common Files\Adobe\AAMUpdaterInventory\1.0\AdobeUpdaterAdminPrefs.dat"

if ($AdobeUpdatePrefs.Preferences.Suppressed -eq "0") 
   {
       echo "not suppressed"
   } 
   
   ELSE 
   
   {
       echo "suppressed"
   }

Remediation:

$UpdateFile = New-Object System.Xml.XmlDocument
$UpdateFile.Load("C:\Program Files (x86)\Common Files\Adobe\AAMUpdaterInventory\1.0\AdobeUpdaterAdminPrefs.dat")
$UpdateFile.Preferences.Suppressed = "1"
$UpdateFile.Save("C:\Program Files (x86)\Common Files\Adobe\AAMUpdaterInventory\1.0\AdobeUpdaterAdminPrefs.dat")

 

This one looks for the Intel graphics driver service and squashes it if it's running:

Discovery:

$IntelGFXService = Get-Service | Where-Object {$_.Name -like 'igfx*'}
if ($IntelGFXService -ne $null) {

   $IntelGFXServiceName = $IntelGFXService.Name
   $IntelFGXStartupMode = Get-CimInstance Win32_Service -Filter "Name='$IntelGFXServiceName'"
   $IntelGFXService.Status
   $IntelFGXStartupMode.StartMode

      if ($IntelGFXService.Status -eq "Running" -and $IntelFGXStartupMode.StartMode -eq "Auto") 
       {
           echo "Service Started, Startmode Automatic"
       }
      elseif ($IntelGFXService.Status -eq "Stopped" -and $IntelFGXStartupMode.StartMode -eq "Auto")
       {
           echo "Service Stopped, Startmode automatic"
       }
      elseif ($IntelGFXService.Status -eq "Running" -and $IntelFGXStartupMode.StartMode -eq "Disabled")
       {
           echo "Service Started, Startmode Disabled"
       }
      else
       {
           echo "all disabled"
       }

}
else 
{
   echo "all disabled"
}

Remediation:

$IntelGFXService = Get-Service | Where-Object {$_.Name -like 'igfx*'}

Set-Service -Name $IntelGFXService.Name -StartupType Disabled
Stop-Service -Name $IntelGFXService.Name
get-process igfx* | stop-process

 

For the Macs, I have three. The first detects whether it's a member of the domain. If it is, it gets joined. This one is a bit hacky, discovery and remediation are in the same snippet:

DOMAIN_STATUS=$(dsconfigad -show | awk "/Active Directory Forest/" | cut -d "=" -f 2)"_Member"


if [[ ${DOMAIN_STATUS} == " internal.lutonsfc.ac.uk_Member" ]]; then
   
echo "OK"
    
exit 2  # already a domain member, exit script

fi



dsconfigad -add {domain} -user {user} -password {password} -force


EXIT_CODE=$(echo $?)



if [[ ${EXIT_CODE} != 0 ]]; then
    
exit ${EXIT_CODE}

fi



echo "OK"

 

This one detects whether Airport is turned on:

Discovery:

WirelessState=$(networksetup -getairportpower en1)
echo $WirelessState

Remediation:

networksetup -setairportpower en1 off

 

This one detects whether the enabling or disabling of Airport requires an admin password or not and toggles it.

Discovery:

Wireless=$(/usr/libexec/airportd prefs | grep RequireAdminPowerToggle)
echo $Wireless

Remediation:

/usr/libexec/airportd prefs RequireAdminPowerToggle=YES

 

If I come up with any more, I'll share!

Edited September 30, 2014 by Norphy

[Norphy]

I have a couple more. The first detects whether the PC has a USB sound device attached and disables the on-board HDAUDIO device if it does:

 

Detection:

$SoundDevices = Get-CimInstance Win32_SoundDevice

if ($SoundDevices.DeviceID -like "USB*")
   {
       #USB Sound Card detected, will now check to see if on-board HDAUDIO is still active
       $HDAudio = Get-CimInstance Win32_SoundDevice -Filter 'DeviceID LIKE "HDAUDIO%"'
       $AudioStatus = $HDAudio.StatusInfo
       If ($AudioStatus -eq '3')
           {
               #On-board still active, need to disable
               echo "USB Audio detected, on-board audio needs to be disabled"
           }
       else
           {
               #USB detected, on-board disabled
              echo "OK"
           }
   }
else
   {
       #No USB, onboard sound to be left alone
       echo "OK"
   }

 

Remediation:

%Path_to_file%\devcon.exe disable HDAUDIO\*

 

Unfortunately there isn't a way to disable devices using PowerShell on Windows 7 so therefore I'm forced to use DEVCON to disable the device.

 

This one checks the SMART status on the hard drives installed in the system and sends an email if there's a predicted failure:

 

$PredictedFailure = (Get-WmiObject -namespace root\wmi –class MSStorageDriver_FailurePredictStatus -ErrorAction Silentlycontinue |  
   more |
   Select PSComputerName,PredictFailure,Reason,InstanceName)

$PSEmailServer = "smtp.server.domain.com"

$PredictedFailure | Foreach {
   if ($_.PredictFailure -eq $true) {
       echo $_.PredictFailure
       $Disk = (Get-WmiObject -Class Win32_DiskDrive -Filter "PNPDeviceID LIKE '%$($_.InstanceName.split("\")[1])%'")
      
       Send-MailMessage -to "[email protected]" `
               -From "[email protected]" `
               -Subject "Hard drive failure predicted on $($_.PSComputerName)" `
               -Body "Dear IT Support,

Configuration Manager has detected a predicted hard drive failure on $($_.PSComputerName). The disk that is failing is a $($Disk.Caption) with the capacity of $(([Decimal]::round($Disk.Size/1000000000)))GB. Please arrange a replacement ASAP.

Kind regards,

Your friendly neighbourhood Configuration Manager Server" `
               -Priority High                
}

else
   {
       echo $_.PredictFailure
   }

   }

 

Be sure to change the SMTP Server and email address values! Be aware that the PC will need to have PowerShell 3 for this script to work as that's where the send-mailmessage command was introduced.

Edited October 29, 2014 by Norphy

[Norphy]

I can't imagine that anyone else would ever want to use this but I'll put it up here anyway...

 

This one if for your Macs. It detects whether the info.plist file in the Java internet plugin is an alias or not. If it is, it renames the alias and makes a copy of the Enabled.plist file called info.plist.

 

The reason I'm doing this is because my management software won't index the plist if it's an alias. It therefore doesn't detect that the Java plugin has been installed and tries to reinstall it.

 

Fun!

 

Anyway, detection:

 

if [ -d /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin/Contents/ ]
   then

       infoplist=$(ls -F /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin/Contents/ | grep Info.plist )
       alias=${infoplist:${#infoplist} -1}

       if [ $alias = "@" ]
           then
                echo "File is an alias"

           else

               echo "OK"

       fi
   else
       echo "OK"

fi

 

Remediation:

mv /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin/Contents/Info.plist /Library/Internet\ Plug-ins/JavaAppletPlugin.plugin/Contents/InfoAlias.plist
cp /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin/Contents/Enabled.plist /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin/Contents/Info.plist