[mdt] MDT with PDQDeploy

[garethEds]

Afternoon Peeps,

 

Just a quick question.... in an MDT task sequence I have the following command - could someone check the syntax for me?

 

set-executionpolicy unrestricted; %SCRIPTROOT%\pdq_deploy_psexec.ps1

 

This is for a deployment. Do I need to put in the full path to %SCRIPTOOT% or does it know it?

 

Just about to go for lunch before experimenting - so thought I'd ask.

 

Cheers

 

Gareth

[garethEds]

HI All,

 

Having a nightmare getting pdq deploy to send out packages as part of the MDT Task Sequence - has anyone got it working at all?

 

I've split the commands into several steps:

 

1. Copy PSExec to the local machine (this works)

2. Copy the pdq_deploy script to the local machine (this works)

3. Run the script - this doesn't work despite the task sequence saying it does.

 

I'm stuck. I have no idea what is going on. The command line runs fine, the TS looks to be there. The machine looks to be doing something, but nothing gets installed.

 

I am assuming it maybe a permissions issue. MDT logs the machine on as an local Administrator - is this the issue?

 

Here is the command in MDT: powershell.exe -noprofile -command "Set-ExecutionPolicy Bypass LocalMachine"; powershell.exe -file "C:\Windows\pdq_deploy_psexec.ps1" - it's not the first command I have tried.

 

I've tried running the command line as a the service Build Account - but this didn't work either. Something is stopping it - but I'm lost to what it could be.

 

The build completes with not issues but no software has been installed. If I then login as an domain admin and run the script it works and everything gets installed. Do I need to move the command somewhere else? Or somehow get the script running as a different user?

 

Any help would be appreciated.

 

Gareth

[ITGuyNW]

Hi I might be able to help as I have recently got this all setup.

 

If you have been able to copy the scripts then that's good, that bit always failed on me so I had to include them in the wim.

 

As for the script itself....

 

netsh advfirewall set allprofiles state off

ipconfig /registerdns

 

PsExec.exe \\*example.exampledomain.sch.uk -h -accepteula ipconfig /flushdns

PsExec.exe \\*example.exampledomain.sch.uk -h -accepteula pdqdeploy.exe Deploy -Package "Package Name" -Targets $env:COMPUTERNAME

 

start-sleep 30

while(test-path "C:\Windows\AdminArsenal\PDQDeployRunner\service-1.lock"){

start-sleep 30

 

Change the bits in bold to the name of the computer where PDQ is (include the full FDQN name) and change the package name.

 

As for the TS, I have two entries.

 

One is for Powershell to bypass the execution policy

powershell.exe -command "Set-ExecutionPolicy Bypass"

 

 

The other calls the PDQ powershell script which is placed in the scripts folder in deployment share. (I find it runs 100% of the time if execution bypass is put in again, don't know why!)

powershell.exe -ExecutionPolicy Bypass %SCRIPTROOT%\pdq1.ps1

 

Also make sure you run the step as an admin account, preferably the admin account and the account you use for PDQ are the same.

 

 

When MDT runs, it gets to the Start PDQ Deploy bit, opens a command window, runs powershell and stays there until completion. Once PDQ finishes, it then carries on its way.

 

Does any of that help?

[garethEds]

Hi @executiverocker

 

I've got the same script (from the pdq website/webcast). I've not tried Bypass twice - but am doing so now based on how you point it out. Not much different to what I have been doing.

 

Thanks for posting.

 

Gareth

[ITGuyNW]

I had to do a lot of trial and error to get it working. Once it worked once, I froze everything and it's worked ever since!

[ITGuyNW]

I've just imaged a PC now actually and this is what I see when its running.

 

[MYK-IT]

@executiverocker - I briefly had a go last week, attempting to us PDQ within MDT TS to deploy software packages etc, using similar to what you posted. I had followed and used the scripts / techniques from this PDQ YouTube Video (

).

 

I too came across issues once the PDQ Deploy task was executed, basically nothing installed - I can't remember the exact errors, but had the impression it was permission related (perhaps account used for MDT deployment was/is different from that used for PDQ Deployment etc?). When I get an opportunity, I will revisit this - might even try the final few steps you suggested.

 

The alternative method I've used for now (as I don't want to continue duplicating software installs within MDT and PDQ etc) is by creating a nested package (containing everything needed for a new build pc) and deploying that, once the MDT deployment has completed. Not as slick, but a step in the right direction! PDQ has certainly saved many hours for us, so far!

[ITGuyNW]

@executiverocker - I briefly had a go last week, attempting to us PDQ within MDT TS to deploy software packages etc, using similar to what you posted. I had followed and used the scripts / techniques from this PDQ YouTube Video (

).

 

I too came across issues once the PDQ Deploy task was executed, basically nothing installed - I can't remember the exact errors, but had the impression it was permission related (perhaps account used for MDT deployment was/is different from that used for PDQ Deployment etc?). When I get an opportunity, I will revisit this - might even try the final few steps you suggested.

 

The alternative method I've used for now (as I don't want to continue duplicating software installs within MDT and PDQ etc) is by creating a nested package (containing everything needed for a new build pc) and deploying that, once the MDT deployment has completed. Not as slick, but a step in the right direction! PDQ has certainly saved many hours for us, so far!

 

The way I had it setup previously was having all deployments go into a "New Computer" OU, then set up a heartbeat schedule, so that every time AD synced within PDQ inventory it would then push the package to any new additions to the OU.

 

For the Script/MDT - I made sure I used the same admin login details for the computer PDQ deploy is on, the user logged on in PDQ Deploy and in the Start PDQ Deploy step in TS. When the imaged computer logs on as part of MDT, that is still local admin.

Edited July 11, 2019 by ITGuyNW

[davipton]

So after about 5 hours of mucking around with this today for what feels like umpteenth time I have managed to get this working with a fudge in the psexec version of running the script. I've basically used the - u and -p parameters after the psexec and used a domain admin passwordto see if there was some further permission issue. Low and behold it worked. Although this isn't secure it works so I have another avenue to follow to why the permissions set on task sequence aren't being passed whilst the task is being run. I have imaged about 10 machines now and this way the pdq deploy task does execute the installation of packages.

 

Hope this helps!

 

Regards

David

Edited July 12, 2019 by davipton

[garethEds]

So after about 5 hours of mucking around with this today for what feels like umpteenth time I have managed to get this working with a fudge in the psexec version of running the script. I've basically used the - u and -p parameters after the psexec and used a domain admin passwordto see if there was some further permission issue. Low and behold it worked. Although this isn't secure it works so I have another avenue to follow to why the permissions set on task sequence aren't being passed whilst the task is being run. I have imaged about 10 machines now and this way the pdq deploy task does execute the installation of packages.

 

Hope this helps!

 

Regards

David

@davipton - I cannot even get the psexec script to run in the first place. I have a service account for building via MDT which builds machines without any issues. It's just the task sequence step for running the script which gives me:

 

 

Not sure why the build account cannot run the psexec script to then call the psexec commands.

 

Fed up now.

 

Gareth

[garethEds]

Well -I've sorted it. It's a permissions issue so I've reverted back to using the delegated domain admin for testing and it all worked.

 

Now I need to work out why by Build Service Account will not work.

 

Gareth