TheScarfedOne

That time of year again (well - for us anyway), after doing a load of machine rebuilds - and name changes etc - your AD may look a bit cluttered. Even more so as we moved from using RIS (groan - old tech alert) to SCCM... So - rather than resurrect some old threads, here is a collection of highly useful powershell scripts to hunt out those old computers and remove them or move them to another OU so you can spot them all together. Credit to original posters: Boz_l and Rabbieburns For this, you will need to install and run the Quest Powershell console. Quest AD Cmdlets are free to download from PowerShell Commands (CMDLETs) for Active Directory by Quest Software GOTCHA: these commands do not seem to run in the standard shell even with the cmdlets installed. A bit like exchange 2010 seems to need its own shell. Outputs to shell console: get-qadcomputer -IncludeAllProperties | Where-Object { $_.lastlogon -lt (get-date).AddDays(-90) } Outputs to csv: get-qadcomputer -IncludeAllProperties | Where-Object { $_.lastlogon -lt (get-date).AddDays(-90) } | select-object Name, ParentContainer, Description, pwdLastSet | export-csv c:\outdated.csv Moves to alternate OU: get-qadcomputer -IncludeAllProperties | Where-Object { $_.lastlogon -lt (get-date).AddDays(-90) } | Move-QADObject -to my.corp/obsolete Tack this to the end to disable the accounts: | disable-QADComputer Check Locate obsolete computer records in AD « Dmitry’s PowerBlog: PowerShell and beyond for more. And QAD cmdlets reference - PowerGUI Wiki Enjoy :-)

I think we will go back to an array! Unianimous verdict of the array of geeks at Novotel currently :-)

Due to some faffage with our email this break (HyperV time) - Ive not got said email. Dos_Box, Ive sent you a PM with my personal email in. Can you send across the details? Also coming over on the Wednesday afternoon - so afternoon/evening drinks and food sounds like a plan . Even got both nights - so Thursday evening sheeebang too :-) Stuart

OK, I know the "old" XP version of Movie Maker wasnt the best - but as far as quick (ish), easy, and user friendly and FREE movie editting goes - it ticked the boxes. It also follows all the rules for Group Policy etc with no irritations unlike some commercial offerings. Problem, Microsoft upset the EU Anti Trust bods, so no longer is it in newer versions. Ok, no biggy - lets use the new "Live" version. Er... no - its full of "Live" links and upload and signin rubblish. We have a sitewide ban on use of any of the "Live" services - incident with Messenger. Problem then, other free options I thought. Pinnacle's free one looked ok, until I installed it and saw it was littered with trial and upgrade bits. Grrrr, so just on the off chance I thought Id give google a quick whizz. Glad I did, and I hope this post saves you a lot of hassle! First point of call was this one - where we could compile and build our own Win 7 Package. http://www.sevenforums.com/tutorials/35151-windows-movie-maker-6-0-install-windows-7-a.html Then, this genius (and I can take no credit other than for finding and posting) went and released it all pre-done. Works a dream - and cos we use SCCM, out onto all my machines silently it does indeed go!! http://noeld.com/programs.asp?cat=video#wmminst Enjoy, and save yourself some hassle!!

Some more shameless blog plugging! Once you get to the build/capture stage... Until then, the guys over at windows-noob.com got me set up and running.

@ Ric - scratch my last post - definately go and steal my stuff from the blog! Windows 7, Bitlocker and SCCM, job done :-)

I really need to pay more attention to what is going on. Up on my blog pages, Ive posted my Build and Capture and also my Deployment sequences for my Laptops (including bitlocker). I know they go over what you need, but I dont have the problem you have been looking at. Take a squizz and steal away :-) Ive had a look through what youve said/done and I cant see why/how youve got the problem. Stuart Wilkie Network Services Manager King Edward VI Community College

Because when you want to have a real rant - one post isnt enough (or you go on too much!), here is part 2 of my (Bil's) rant about Sharepoint Document Libraries...

Firstly - a little disclaimer. I am not the original author of this post, but I agree with the sentiment of it. Its all to easy to think that the Document Libraries are File Shares and treat them as such - particularly if you let your users use the Explorer View (grrrr!) Anyway - the honour of the original poster is the Sharepoint Legend that is Bil Simser. Google is your friend....

So, time to rack up my blog writing a bit more! As you may have read, we have deployed (well still deploying) Windows 7 with Bitlocker as the encryption for all our Staff Laptops. We are using Toshiba Tecra A10s by the way. While we were testing, we came across some things that were a real pain. The first being that unless you are a local admin, you cannot change the Bitlocker pin. Problem - big problem. Under XP, we did used to have Staff as local admins - but used GPs and Software Restriction Policies to control it. We do want staff to be able to change their pins tho. Right, so how to sort it? Well, the manage-bde - changepin c: would work quite nicely; except that would need the CMD window, and its not very elegant. Ok, so we let them be local admins then? Well yes, that was fine until we found that it exposed our WPA2 key! Grrrr! So - into Visual Studio I went, and used the Bitlocker API and the results are in the attached zip. Its based on the one available on Codeplex - so credit there :-). Its a single compiled exe, which you should put in C:\Program Files. Ive only tested it on x86, so not sure what will happen on x64. Also, as I used the new version of Studio - you need .net FW 4 on the machine. As usual, use at your own risk. Works fine in my environment, its pretty basic in what it does - im working on catching the errors better. At the moment, it reports the API error code.

You might want to go and take a look on my blog. Ive just finished a three poster on how we deploy Windows 7 with Bitlocker on all our staff laptops. Works a dream. We use SCCM to manage the process - but in case you dont have it (and you should get it by the way!!), you can do all the same stuff with MDT as well. I will be posting an app up too shortly for changing pin codes, which needs you to be an Admin user normally.

Hello again everyone! Here is ther final part of my wee guide on getting SCCM, Windows 7 and Bitlocker all done together...! Sorry its taken a bit longer to get this updated, been busy on another project which I will blog about next 6. Well - Part 5 from the last post really - explaining the "fancy stuff" that happens after the build and main software drop... The main thing going on here is the auto log in. This is needed to run a load of a load of first use stuff for my techies. So, what are we doing then? Autologin stuff - run SetupSNK to add our WPA2 protected WLAN, run SCCM Client Configuration Control Panel applet, run SCCM Client Run Advertised Programs Control Panel applet, and presents a CMD window showing Bitlocker Status and then presenting the change pin screen (we set a default as part of the scripting). Im fairly good with our code commenting, so just take a look at the attached vbs in a zip. This may need adjusting for your environment, so the usual warnings apply. Java Update Policy Settings - makes Java behave Microsoft HTML Help Settings - sets rights for HTML help files oRipa Screen Reorder Settings - sets the default save path for the screen recorder Shockwave 11 Auto update - makes Shockwave behave Daemon Tools Run - sets the environment for Daemon Tools gm6file Settings - sets file association for Gamemaker Explorer Settings - hides a load of the Windows 7 Library stuff which appears to the left of Explorer Windows Known Folder Settings - sets timeouts and reduces load times Deletions for Librarys and Folder Redirection - as it says on the tin. Win7 Folder redirection gets broken by an update. This fixes it! AutoRun Login Settings - does the Run Once autologin, SCCM Client, SCCM Run Adv. Progs, Bitlocker Status, Bitlocker Pin Change Coming next from me, a nice little Visual Studio application to allow end users to change their Bitlocker Pin Codes without them being a local admin!! If they are, you may have noticed they can get at some unwanted options - like Wireless options!!

Hello again everyone! So, back again with Part 2 of my wee guide on getting SCCM, Windows 7 and Bitlocker all done together... 3. Make sure you clear and or activate the TPM on your device. Sounds simple doesnt it... if the TPM isnt active on your machine, or if it is previously owned - your build will fail! You have been warned - and my techies know that they have to pay into the "fails" pot for any dense mitstakes - this being one!! We have Toshiba Tecra A10s - 160 of them to be precise. In those, the BIOS has the TPM enable/disable option, as well as clear the owner (only there when the TPM is enabled). 4. Get ready to deploy the image you captured in Part 1 onto your device. Best place to get the info on this... well rather than writing it all here, Im just going to credit the resource that got me up and running. http://www.windows-noob.com Read, and re-read the guide to get it set up. DO NOT skip any steps. To keep you on the right track, again I have attached my Task Sequence. You will see it has all my software setout for deployment also. You might think this takes a long time - total time is actually 30mins. 5. The "fancy stuff" - getting Bitlocker enabled and all the autorestarting stuff. Right, I need to explain what the actual sequence above does... 1. Drops the image onto the machine 2. Sets owner on the TPM 3. Installs all the software 4. Sets a load of Bitlocker related Reg keys (in case Group Policy is a bit slow) 5. Enables the Bitlocker Protection 6. Auto logs in and runs a load of first use stuff for my techies. The Reg stuff - force AD recovery keys, enable advanced pins (alphanumeric), sets minimum length, enables pin and tpm as authentication method. Autologin stuff - run SetupSNK to add our WPA2 protected WLAN, run SCCM Client Configuration Control Panel applet, run SCCM Client Run Advertised Programs Control Panel applet, and presents a CMD window showing Bitlocker Status and then presenting the change pin screen (we set a default as part of the scripting). Part 3 will deal with all the scripts and fandango used once the build has finished...

Im spying a lot of the usual rabble so far in the list!! So - looks like lots of people in the IBIS then ;-). Fun times.

Cheers DB, are we going to use this thread to arrange meeting times etc. Booking into the IBIS now :-) for both nights.

Signed up two days ago, and ready to book my tickets and hotel. DB... any news?

Im just using the built in Windows Server Backup. It is now Exchange aware :-)

I would go with the above, disable notification tray, but enable the "Show only specified control panel applets" GP to give the options you want (eg sound etc)

Yep - there is a GP to control this on. I havent got any 2003 servers left so cant guarantee this option will be available. The option is inside the User Config > Start Menu and Desktop area of GP. Will edit tomo with the exact path. Stuart

Hello again everyone! Yep - Im still here, and after a little career break - back at it again. I spoke to quite a few people about Deploying Windows 7 (particularly including Bitlocker) on the EduGeek Stand at Bett (where I lurked with intent for most of the show)... so here is my complete guide to how it is done... 1. Make sure you have got SCCM set up properly. Sounds simple doesnt it... well its often not quite as simple as it sounds. So, part one is going to deal mainly with getting SCCM set up properly to deploy OS images (and first how to get your "Gold" Windows 7 Image). The recommended route, for doing a full scale deployment system, would be to have a separate SQL Server, SCCM Site System, and SCCM Distribution Partner system (which helps with sharing the load for deploying packages etc). Best place to get the info on this... well rather than writing it all here, Im just going to credit the resource that got me up and running. http://www.windows-noob.com Read, and re-read the guide to get it set up. DO NOT skip any steps. 2. Getting your "Gold" Image. Get your Windows 7 Enterprise DVD ready. Import it into SCCM (again use the guides above to get this right). See the attached zip for the Task Sequence used to build. Part 2 will deal with all the scripts and fandango Ive used to take the captured image, and put it on a machine. This is then Bitlockered, and put into an admin logon ready to configure (change the pin from a default we chose to the user chosen option) and allow us to choose other TS's to run.

Yes you are right - there are a whole load of settings related to driver install, and permissions for it. Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Load and unload device drivers There are others for controling what class of drivers can be installed too, will go find and post...

We have got the same suite and done all separate installations. I will get all the info of my Uni tech that i gave the project to, and post it up tomo. One point which we cant fix yet though is Flash Catalyst which on first run wants to write to the desktop for some god unknown reason. Grrr!

Oh god - i had too. That had us in stitches for ages! He had absolutely no idea what we were laughing at, and then made it worse by "moving" the bad to a more inappropriate place. Who at D-Link came up with that?? Legend. We need a photo of the bag someone - some member who got one, please let us know so we can share with everyone.

Ah yes... this would be EduTech james :-p

Does this class as a Yay or a Boo?? It did provide us with much amusement, particularly when we were setting him up! Sorry James :-p