https://4c4806b4.configjon-blog.pages.dev/Recent content on Jon's NotesHugoen-usFri, 11 Sep 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/dell-bios-password-management-wmi/Fri, 11 Sep 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/dell-bios-password-management-wmi/<p>Earlier this year, I wrote about how to <strong><a href="https://4c4806b4.configjon-blog.pages.dev/dell-bios-settings-management/">manage Dell BIOS password</a></strong><a href="https://4c4806b4.configjon-blog.pages.dev/dell-bios-settings-management/"><strong>s</strong></a> using PowerShell. The method described in that post uses the <a href="https://4c4806b4.configjon-blog.pages.dev/working-with-the-dell-command-powershell-provider/"><strong>DellBIOSProvider</strong></a> PowerShell module. This method works, but I was not completely satisfied with it, as the PowerShell module needs to be downloaded and installed on every system the script runs on.</p> <p>Thankfully, Dell recently released a <a href="https://downloads.dell.com/manuals/common/dell-agentless-client-manageability.pdf"><strong>technical whitepaper</strong></a> documenting WMI classes that can be used to directly modify BIOS settings without needing an outside program or PowerShell module. This allowed me to create a new version of the Dell BIOS Settings Management script that does not require any additional content to function.</p>https://4c4806b4.configjon-blog.pages.dev/dell-bios-settings-management-wmi/Fri, 11 Sep 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/dell-bios-settings-management-wmi/<p>Earlier this year, I wrote about how to <a href="https://4c4806b4.configjon-blog.pages.dev/dell-bios-settings-management/"><strong>manage Dell BIOS settings</strong></a> using PowerShell. The method described in that post uses the <a href="https://4c4806b4.configjon-blog.pages.dev/working-with-the-dell-command-powershell-provider/"><strong>DellBIOSProvider</strong></a> PowerShell module. This method works, but I was not completely satisfied with it, as the PowerShell module needs to be downloaded and installed on every system the script runs on.</p> <p>Thankfully, Dell recently released a <a href="https://downloads.dell.com/manuals/common/dell-agentless-client-manageability.pdf"><strong>technical whitepaper</strong></a> documenting WMI classes that can be used to directly modify BIOS settings without needing an outside program or PowerShell module. This allowed me to create a new version of the Dell BIOS Settings Management script that does not require any additional content to function.</p>https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-troubleshooting/Mon, 06 Jul 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-troubleshooting/<p><strong>This post was updated on February 13th, 2021.</strong></p> <p>There are many issues that can happen while configuring and using an Always On VPN solution. In this post I&rsquo;ll be covering the common errors I&rsquo;ve encountered while setting up Always On VPN. In addition, I&rsquo;ll share some useful commands and show to how monitor VPN connections. Also, make sure to check out the troubleshooting section of the official <strong><a href="https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always-on-vpn-deploy-troubleshooting">Microsoft Documentation</a></strong>.</p> <p>Links to each individual post in this series can be found below.</p>https://4c4806b4.configjon-blog.pages.dev/always-on-vpn/Thu, 04 Jun 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/always-on-vpn/<h3 id="deployment-guide">Deployment Guide</h3> <p><strong><strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-basic-deployment-guide/">Always On VPN - Basic Deployment Guide</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-certificates-and-active-directory/">Always On VPN - Certificates and Active Directory</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-vpn-and-nps-server-configuration/">Always On VPN - VPN and NPS Server Configuration</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-user-tunnel/">Always On VPN - User Tunnel</a></strong></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-device-tunnel/">Always On VPN - Device Tunnel</a></strong></p>https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-basic-deployment-guide/Thu, 04 Jun 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-basic-deployment-guide/<p>With all the increased focus on working from home and remote access lately, I figured now would be a good time to share my notes on configuring Always On VPN. This first post will cover the basics of the Always On VPN technology. This guide will be split into multiple parts. Links to each individual post in this series can be found below.</p> <p><strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-certificates-and-active-directory/">Always On VPN - Certificates and Active Directory</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-vpn-and-nps-server-configuration/">Always On VPN - VPN and NPS Server Configuration</a></strong><br> <strong><strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-user-tunnel/">Always On VPN - User Tunnel</a></strong></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-device-tunnel/">Always On VPN - Device Tunnel</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-troubleshooting/">Always On VPN - Troubleshooting</a></strong></p>https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-certificates-and-active-directory/Thu, 04 Jun 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-certificates-and-active-directory/<p>This is the second post in my series on setting up a basic Always On VPN deployment. In this post I will be covering the requirements for the Always On VPN certificates. I will also talk about how Active Directory groups can be utilized. Links to each individual post in this series can be found below.</p> <p><strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-basic-deployment-guide/">Always On VPN - Basic Deployment Guide</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-vpn-and-nps-server-configuration/">Always On VPN - VPN and NPS Server Configuration</a></strong><br> <strong><strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-user-tunnel/">Always On VPN - User Tunnel</a></strong></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-device-tunnel/">Always On VPN - Device Tunnel</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-troubleshooting/">Always On VPN - Troubleshooting</a></strong></p>https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-device-tunnel/Thu, 04 Jun 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-device-tunnel/<p><strong>This post was updated on August 17th, 2020.</strong></p> <p>This is the fifth post in my series on setting up a basic Always On VPN deployment. In this post I will be covering the configuration of the device tunnel. Links to each individual post in this series can be found below.</p> <p><strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-basic-deployment-guide/">Always On VPN - Basic Deployment Guide</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-certificates-and-active-directory/">Always On VPN - Certificates and Active Directory</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-vpn-and-nps-server-configuration/">Always On VPN - VPN and NPS Server Configuration</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-user-tunnel/">Always On VPN - User Tunnel</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-troubleshooting/">Always On VPN - Troubleshooting</a></strong></p>https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-user-tunnel/Thu, 04 Jun 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-user-tunnel/<p><strong>This post was updated on August 17th, 2020.</strong></p> <p>This is the fourth post in my series on setting up a basic Always On VPN deployment. In this post I will be covering the configuration of the user tunnel. Links to each individual post in this series can be found below.</p> <p><strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-basic-deployment-guide/">Always On VPN - Basic Deployment Guide</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-certificates-and-active-directory/">Always On VPN - Certificates and Active Directory</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-vpn-and-nps-server-configuration/">Always On VPN - VPN and NPS Server Configuration</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-device-tunnel/">Always On VPN - Device Tunnel</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-troubleshooting/">Always On VPN - Troubleshooting</a></strong></p>https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-vpn-and-nps-server-configuration/Thu, 04 Jun 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-vpn-and-nps-server-configuration/<p>This is the third post in my series on setting up a basic Always On VPN deployment. In this post I will be covering the configuration of the VPN server and the NPS server. I will also talk about the network and firewall configuration. Links to each individual post in this series can be found below.</p> <p><strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-basic-deployment-guide/">Always On VPN - Basic Deployment Guide</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-certificates-and-active-directory/">Always On VPN - Certificates and Active Directory</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-user-tunnel/">Always On VPN - User Tunnel</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-device-tunnel/">Always On VPN - Device Tunnel</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/always-on-vpn-troubleshooting/">Always On VPN - Troubleshooting</a></strong></p>https://4c4806b4.configjon-blog.pages.dev/bios-/-firmware-configuration/Mon, 30 Mar 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/bios-/-firmware-configuration/<h3 id="task-sequence-downloads">Task Sequence Downloads</h3> <p><strong><a href="https://4c4806b4.configjon-blog.pages.dev/bios-management-example-task-sequences/">BIOS Management - Example Task Sequences</a></strong></p> <h3 id="dell">Dell</h3> <p><strong><a href="https://4c4806b4.configjon-blog.pages.dev/dell-bios-password-management/">Dell BIOS Password Management</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/dell-bios-settings-management/">Dell BIOS Settings Management</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/working-with-the-dell-command-powershell-provider/">Working with the Dell Command | PowerShell Provider</a></strong></p> <h3 id="hp">HP</h3> <p><strong><a href="https://4c4806b4.configjon-blog.pages.dev/hp-bios-password-management/">HP BIOS Password Management</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/hp-bios-settings-management/">HP BIOS Settings Management</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/installing-the-hp-client-management-script-library/">Installing the HP Client Management Script Library</a></strong></p> <h3 id="lenovo">Lenovo</h3> <p><strong><a href="https://4c4806b4.configjon-blog.pages.dev/lenovo-bios-password-management/">Lenovo BIOS Password Management</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/lenovo-bios-settings-management/">Lenovo BIOS Settings Management</a></strong></p>https://4c4806b4.configjon-blog.pages.dev/installing-the-hp-client-management-script-library/Tue, 10 Mar 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/installing-the-hp-client-management-script-library/<p>If you&rsquo;ve been keeping up with my blog posts, you&rsquo;ll know that HP natively provides a few WMI classes and methods to the WIndows OS. These WMI classes work great for managing BIOS settings, but what if I want to manage Firmware updates or work with HP Softpaqs? One answer is to use the <strong><a href="https://ftp.hp.com/pub/caps-softpaq/cmit/hp-cmsl.html">HP Client Management Script Library</a></strong>. The HP CMSL is a bundle of PowerShell modules created by HP for the purpose of managing HP firmware and drivers from the command line.</p>https://4c4806b4.configjon-blog.pages.dev/bios-management-example-task-sequences/Mon, 24 Feb 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/bios-management-example-task-sequences/<p><strong>UPDATE September 16th, 2020 - The scripts included in these downloads are currently outdated. I plan to update this post soon with the latest script versions.</strong></p> <p>Now that I have working BIOS management scripts for Dell, HP, and Lenovo, I figured I would put them all together in a few example task sequences. This post will also act as a hub for my BIOS management posts.</p> <h3 id="current-bios-management-posts">Current BIOS Management Posts</h3> <p><strong><a href="https://4c4806b4.configjon-blog.pages.dev/dell-bios-password-management/">Dell BIOS Password Management</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/dell-bios-settings-management/">Dell BIOS Settings Management</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/hp-bios-password-management/">HP BIOS Password Management</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/hp-bios-settings-management/">HP BIOS Settings Management</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/lenovo-bios-password-management/">Lenovo BIOS Password Management</a></strong><br> <strong><a href="https://4c4806b4.configjon-blog.pages.dev/lenovo-bios-settings-management/">Lenovo BIOS Settings Management</a></strong></p>https://4c4806b4.configjon-blog.pages.dev/dell-bios-settings-management-psmodule/Fri, 21 Feb 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/dell-bios-settings-management-psmodule/<p><strong>This post was updated on September 11th, 2020.</strong></p> <p>Update: Dell does now provide native WMI classes to manage BIOS settings on newer models. For more information, see this post: <strong><a href="https://4c4806b4.configjon-blog.pages.dev/dell-bios-settings-management-wmi/">Dell BIOS Settings Management - WMI</a></strong>. For information on using the Dell PowerShell module to configure settings on older models, continue reading this post.</p> <p>This post is one of 3 posts in my series on managing BIOS settings using PowerShell. I&rsquo;ve also written about <strong><a href="https://4c4806b4.configjon-blog.pages.dev/hp-bios-settings-management/">HP</a></strong> and <strong><a href="https://4c4806b4.configjon-blog.pages.dev/lenovo-bios-settings-management/">Lenovo</a></strong>. In this post I&rsquo;ll be talking about using PowerShell to manage Dell BIOS settings.</p>https://4c4806b4.configjon-blog.pages.dev/configuration-manager-collection-creation-script/Tue, 18 Feb 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/configuration-manager-collection-creation-script/<p>I just finished updating the script I&rsquo;ve been using to bulk create collections in Configuration Manager. I know there are already many different examples of this same type of script out there, but I figured I&rsquo;d share my take on it.</p> <p>The script can be downloaded from my GitHub: <a href="https://github.com/ConfigJon/ConfigMgr-Scripts/tree/master/Create-Collections"><strong>https://github.com/ConfigJon/ConfigMgr-Scripts/tree/master/Create-Collections</strong></a></p> <h3 id="create_collectionsps1">Create_Collections.ps1</h3> <p>This script can be used to dynamically create user collections, device collections, and folder structure based on information in a CSV file. The script should be run as a user account with rights to connect to and create collections in Configuration Manager. The script should be run on a computer with the Configuration Manager Admin Console installed. The script will automatically search for the ConfigurationManager.psd1 file, attempt to import it, and connect to the specific site.</p>https://4c4806b4.configjon-blog.pages.dev/app-packaging-powershell-functions/Thu, 30 Jan 2020 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/app-packaging-powershell-functions/<p>I&rsquo;ve recently been working on a lot of app packaging, and I decided to take the opportunity to update my scripts. In this post I&rsquo;ll cover 3 PowerShell functions that I found to be the most useful. The functions can be found on my <strong><a href="https://github.com/ConfigJon/Miscellaneous-Scripts/tree/master/App%20Packaging">GitHub</a></strong>.</p> <h3 id="invoke-msiexec">Invoke-MsiExec</h3> <p>This function works with msiexec.exe. The function allows for installing or uninstalling a .msi based application.</p> <p>The function has a number of parameters:</p> <ul> <li><strong>FilePath</strong> - The path to the .msi or .msp file</li> <li><strong>Guid</strong> - The GUID of the MSI-based application to be uninstalled</li> <li><strong>Install</strong> - Indicates that the /i switch should be used when calling msiexec.exe</li> <li><strong>Uninstall</strong> - Indicates that the /x switch should be used when calling msiexec.exe</li> <li><strong>Patch</strong> - Indicates that the /p switch should be used when calling msiexec.exe</li> <li><strong>Arguments</strong> - A comma separated list of arguments to pass to msiexec.exe</li> <li><strong>ExitCodes</strong> - A comma separated list of non-standard exit codes</li> </ul> <p>Some notes about the parameters:</p>https://4c4806b4.configjon-blog.pages.dev/dell-bios-password-management-psmodule/Sun, 03 Nov 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/dell-bios-password-management-psmodule/<p><strong><strong>This post was updated on September 11th, 2020.</strong></strong></p> <p>Update: Dell does now provide native WMI classes to manage BIOS passwords on newer models. For more information, see this post: <strong><a href="https://4c4806b4.configjon-blog.pages.dev/dell-bios-password-management-wmi/">Dell BIOS Password Management - WMI</a></strong>. For information on using the Dell PowerShell module to configure passwords on older models, continue reading this post.</p> <p>This is the third post in my series on how to manage BIOS / Firmware passwords with PowerShell. Previously, I&rsquo;ve discussed <strong><a href="https://4c4806b4.configjon-blog.pages.dev/lenovo-bios-password-management/">Lenovo BIOS Password Management</a></strong> and <strong><a href="https://4c4806b4.configjon-blog.pages.dev/hp-bios-password-management/">HP BIOS Password Management</a></strong>.</p>https://4c4806b4.configjon-blog.pages.dev/working-with-the-dell-command-powershell-provider/Sun, 03 Nov 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/working-with-the-dell-command-powershell-provider/<p><strong>This post was updated on February 20th, 2022.</strong></p> <p>I&rsquo;ve recently been writing a series of blog posts on how to manage BIOS and Firmware settings using PowerShell. When working with HP and Lenovo hardware I was able to modify the settings by connecting to the WMI classes that are surfaced on the hardware by default. With Dell this was not as straightforward.</p> <p>In order to access the Dell WMI classes that can be used to query and modify BIOS settings, the <strong><a href="https://www.dell.com/support/article/us/en/04/sln311855/dell-command-monitor?lang=en">Dell Command | Monitor</a></strong> software needs to be installed. This posed another problem, as I wanted to be able to modify BIOS settings while in WinPE, and Dell Command | Monitor only installs in a full Windows OS. The solution to this issue was the <strong><a href="https://www.dell.com/support/article/us/en/04/sln311262/dell-command-powershell-provider?lang=en">Dell Command | PowerShell Provider</a></strong>.</p>https://4c4806b4.configjon-blog.pages.dev/lenovo-bios-settings-management/Thu, 01 Aug 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/lenovo-bios-settings-management/<p><strong>This post was updated on October 18th, 2020.</strong></p> <p>This post is one of 3 posts in my series on managing BIOS settings using PowerShell. I’ve also written about <strong><a href="https://4c4806b4.configjon-blog.pages.dev/dell-bios-settings-management/">Dell</a></strong> and <strong><a href="https://4c4806b4.configjon-blog.pages.dev/hp-bios-settings-management/">HP</a></strong>. In this post I’ll be talking about using PowerShell to manage Lenovo BIOS settings.</p> <p>The script can be downloaded from my GitHub: <strong><a href="https://github.com/ConfigJon/Firmware-Management/tree/master/Lenovo">https://github.com/ConfigJon/Firmware-Management/tree/master/Lenovo</a></strong></p> <h3 id="lenovo-wmi-and-powershell">Lenovo, WMI, and PowerShell</h3> <p>Lenovo provides a WMI interface that can be used for querying and modifying BIOS settings on their hardware models. This means that we can use PowerShell to directly view and edit BIOS settings without the need for a vendor specific program. This script uses 6 of the Lenovo provided WMI classes.</p>https://4c4806b4.configjon-blog.pages.dev/hp-bios-settings-management/Mon, 29 Jul 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/hp-bios-settings-management/<p><strong>This post was updated on September 18th, 2020.</strong></p> <p>This post is one of 3 posts in my series on managing BIOS settings using PowerShell. I&rsquo;ve also written about <strong><a href="https://4c4806b4.configjon-blog.pages.dev/dell-bios-settings-management/">Dell</a></strong> and <strong><a href="https://4c4806b4.configjon-blog.pages.dev/lenovo-bios-settings-management/">Lenovo</a></strong>. In this post I&rsquo;ll be talking about using PowerShell to manage HP BIOS settings.</p> <p>The script can be downloaded from my GitHub: <strong><a href="https://github.com/ConfigJon/Firmware-Management/tree/master/HP">https://github.com/ConfigJon/Firmware-Management/tree/master/HP</a></strong></p> <h3 id="hp-wmi-and-powershell">HP, WMI, and PowerShell</h3> <p>HP provides a WMI interface that can be used for querying and modifying BIOS settings on their hardware models. This means that we can use PowerShell to directly view and edit BIOS settings without the need for a vendor specific program. This script uses 3 of the HP provided WMI classes.</p>https://4c4806b4.configjon-blog.pages.dev/hp-bios-password-management/Thu, 18 Jul 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/hp-bios-password-management/<p><strong>This post was updated on September 18th, 2020.</strong></p> <p>In my last blog post, (<strong><a href="https://4c4806b4.configjon-blog.pages.dev/lenovo-bios-password-management/">Lenovo BIOS Password Management</a></strong>), I talked about managing Lenovo BIOS passwords with PowerShell. I liked how that process worked, so I decided to create a similar process to handle HP BIOS passwords. Once again, the goal was to have a script that could automatically set, change, or clear BIOS passwords while providing logging and optional user prompts. In this post, I’ll cover the basics of how the script works and some limitations of the script.</p>https://4c4806b4.configjon-blog.pages.dev/lenovo-bios-password-management/Mon, 08 Jul 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/lenovo-bios-password-management/<p><strong>This post was updated on October 18th, 2020.</strong></p> <p>This post discusses how to manage Lenovo BIOS passwords using WMI. My goal was to have a script that could change or clear existing passwords and could display a prompt to the screen when manual intervention was required. In this post, I&rsquo;ll cover the basics of how the script works. I&rsquo;ll also talk about some limitations of the script and some areas it could be improved in the future</p>https://4c4806b4.configjon-blog.pages.dev/windows-customizations-with-powershell/Wed, 26 Jun 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/windows-customizations-with-powershell/<p>The out of the box Windows 10 experience has improved over the years, but I still find most clients I work with want to make various tweaks and modifications to the default settings. In the past I would add these customizations to a Configuration Manager task sequence as individual steps. But I&rsquo;m lazy, and I didn&rsquo;t want to have to continually add each individual step over and over. Plus I like to keep task sequences shorter when I can. The solution was to create a PowerShell script that allows the admin to select which of the common Windows customizations to run in their environment.</p>https://4c4806b4.configjon-blog.pages.dev/create-and-print-a-word-document-with-powershell/Thu, 25 Apr 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/create-and-print-a-word-document-with-powershell/<p>I was working with a client that had a requirement where each computer that was deployed needed to be paired with a physical document that had information about the computer. The solution I used to automate this process was to use a PowerShell script to take information from a running task sequence, then write and print a Word document.</p> <ul> <li> <p>Here is a high level outline of the process.</p> <ul> <li>Information about the computer and deployment is collected by a PowerShell script during the task sequence</li> <li>The same PowerShell script then copies that information to a network share as a CSV file</li> <li>A separate computer or server has a Windows Scheduled Task set to run a second PowerShell script on a schedule</li> <li>The second PowerShell script takes any CSV files in the network location as input. It uses the data from the CSV files to build a Word document and then sends that document to a printer.</li> </ul> </li> </ul> <p>This is the script that runs during the task sequence to collect information and write it to a CSV file on a network share. This example script is collecting the Serial Number, Asset Tag, and Computer Model.</p>https://4c4806b4.configjon-blog.pages.dev/update-compliance-log-analytics-queries/Wed, 10 Apr 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/update-compliance-log-analytics-queries/<p>Lately I have been helping many people with moving their update workloads from Configuration Manager and WSUS to Windows Update for Business. The one thing I get the most questions about with the move to Windows Update for Business is how to monitor update compliance. The computers are now pointing to the internet for updates, and as a result, no longer report update compliance information to Configuration Manager or WSUS. The answer to this is the <strong><a href="https://docs.microsoft.com/en-us/windows/deployment/update/update-compliance-monitor">Update Compliance</a></strong> solution in Azure Log Analytics.</p>https://4c4806b4.configjon-blog.pages.dev/management-point-root-ca-trust-issue-http-403/Sat, 06 Apr 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/management-point-root-ca-trust-issue-http-403/<p>I was setting up a Configuration Manager environment in HTTPS mode and I was running into issues with the server selecting a client authentication certificate.</p> <p>I was seeing these messages in the <strong>MPControl.log</strong>.</p> <p><img loading="lazy" src="https://4c4806b4.configjon-blog.pages.dev/management-point-root-ca-trust-issue-http-403/images/Certificate_Error-1024x243.png"></p> <p>I was seeing this message in the <strong>IIS log</strong>.</p> <p><img loading="lazy" src="https://4c4806b4.configjon-blog.pages.dev/management-point-root-ca-trust-issue-http-403/images/IIS_Error-1.png"></p> <p>I was getting a <strong>2148204809</strong> error which translates to <strong>A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.</strong> That told me something was wrong with the root CA trust. Some searching online brought up a few useful posts on the subject.</p>https://4c4806b4.configjon-blog.pages.dev/microsoft-laps-step-by-step-part-1/Tue, 02 Apr 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/microsoft-laps-step-by-step-part-1/<p>This is an updated version of a post I made on the Now Micro blog last year. The original version of this post can be read <a href="https://blog.nowmicro.com/2018/02/28/configuring-laps-part-1-configuring-active-directory/"><strong>Here</strong></a>.</p> <p><strong>Why is Local Administrator Password Management Needed?</strong></p> <p>The question of how to deal with users having administrative rights on computers or other network resources is one that has many different answers and has evolved over time. While the scenarios around network and domain administrative access may be more complex, the local administrative rights scenario should be very similar for almost everyone.</p>https://4c4806b4.configjon-blog.pages.dev/microsoft-laps-step-by-step-part-2/Tue, 02 Apr 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/microsoft-laps-step-by-step-part-2/<p>This post is the second part of a two-part series on configuring and deploying the Microsoft Local Administrator Password Solution (LAPS). The <a href="https://4c4806b4.configjon-blog.pages.dev/microsoft-laps-step-by-step-part-1/"><strong>First Post</strong></a> covered the steps needed to configure Active Directory to support LAPS. This post will cover the steps needed to enable the LAPS functionally on devices.</p> <p>In order for the local administrator password to be randomized on devices, two conditions need to be met.</p> <ol> <li> <ol> <li>The client needs to have a group policy object linked that enables LAPS</li> <li>The client needs to have the LAPS group policy client-side extensions installed so it knows what LAPS is</li> </ol> </li> </ol> <h2 id="configure-group-policy-to-deploy-laps-settings">Configure Group Policy to Deploy LAPS Settings</h2> <p>Group Policy is used to configure LAPS settings and to enable the LAPS functionally on targeted devices. The LAPS settings can be added to an existing group policy object, however in this example, a new group policy object will be created to deploy the settings.</p>https://4c4806b4.configjon-blog.pages.dev/create-configuration-manager-antimalware-policies-with-powershell/Sun, 24 Mar 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/create-configuration-manager-antimalware-policies-with-powershell/<p>As I spend time working in many different Configuration Manager environments, I find myself regularly needing to create Antimalware Policies. Most of the settings in the antimalware policies can be configured quickly, however the setting that always takes me the most time is the Exclusion Settings.</p> <p>There needs to be different policies with different exclusion settings for different types of devices. Each of these separate policies have 3 different areas for adding file paths, file types, and processes. And for some reason, unknown to me, the dialog window for adding exclusions has a 260 character limit. This means that even if all the exclusion settings are in a list, you can&rsquo;t just copy the whole list in at once. All this adds up to make this process time consuming and inconsistent.</p>https://4c4806b4.configjon-blog.pages.dev/create-windows-firewall-rules-for-appdata-executables/Thu, 14 Mar 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/create-windows-firewall-rules-for-appdata-executables/<p>I was recently deploying an application that required Windows Firewall rules to be created for an executable that ran from each user&rsquo;s AppData folder. The way I accomplished this was to use a combination of PowerShell scripts and the Windows Task Scheduler.</p> <p>I created two PowerShell scripts for this solution. <strong>Create_Scheduled_Task.ps1</strong> and <strong>Create_Firewall_Rules.ps1</strong>.</p> <p>The <strong>Create_Scheduled_Task.ps1</strong> script copies the Create_Firewall_Rules.ps1 script to a subfolder in C:\Users\Public and creates a scheduled task to run that script each time a user logs onto the computer. You will need to set the <strong>$appName</strong>, <strong>$scriptName</strong>, and <strong>$folderPath</strong> variables.</p>https://4c4806b4.configjon-blog.pages.dev/modify-local-administrators-membership/Wed, 13 Mar 2019 00:00:00 +0000https://4c4806b4.configjon-blog.pages.dev/modify-local-administrators-membership/<p>I encountered a scenario where I needed to add or remove domain users from the local administrators group on an individual computer basis. The <a href="https://docs.microsoft.com/en-us/sccm/apps/deploy-use/create-deploy-scripts"><strong>Run Script</strong></a> feature in Configuration Manager worked great for this.</p> <p>I used an Add script and a Remove script. Both scripts have a $Member parameter that takes the name of a domain user or group and adds it to or removes it from the local administrator group on selected computers.</p>