HOWTO: Add a Local User to Windows 10 Using Group Policy (Add it To Local Administrators Group)

Since there are some outdated information about this topic, I’m going to give the steps necessary to create a local user to a Windows 10 machine using AD Group Policy, and then add this user to the local Administrator group.

First, create a new policy using Group Policy Management Editor and follow this screenshot:

Next, click on New and select Local User. In the Action field, select Update. For the other fields, select the options you need.

Click OK button and that’s basically how it’s done.

Next, I’m going to assign this user to the local Administrator group. I will be using the same group policy to achieve this.

Right-click on Restricted Groups and then click on Add Group…

Next, you’re going to type the username we created in the previous step.

I always find this misleading, but just make sure you local username account we created previously

Click OK to go to the next crucial step. You’re going to a work with This group is a member of section and click Add button

Next, type Administrators and click OK

The properties should look like the following screenshot

That’s all there is to it.

SCCM Task Sequence Remove Video Drivers

During my project to upgrade all our Windows 7 Enterprise SP1 (64bit) devices to Windows 10 Enterprise 1809 (64bit), I ran into a compatibility issue during the task sequence. Windows 7 video drivers were detected as incompatible during the in-place upgrade to Windows 10, so I had to find a way to remove the drivers during the SCCM task sequence.

This is the batch file code I used to disable, then remove video drivers from the task sequence.

@ECHO OFF

REM Driver is disabled
devcon disable =display

REM Driver is removed here
devcon remove =display

REM reg add command replaces whatever value is in the SearchOrderConfig with the appropriate value to tell the system NOT to go to windows update for driver updates
REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching /t REG_DWORD /v SearchOrderConfig /d 0x0 /f

REM Driver package is removed here
FOR /F “tokens=4 delims= ” %%A IN (‘devcon driverfiles ^=display ^| FINDSTR “Driver installed from”‘) DO devcon.exe dp_delete -f %%A

EXIT 0

The following shows where in the task sequence I add the video driver removal step. Also, note that I have a step to copy devcon.exe utility which is not on Windows 7 by default.

I’ve extensively tested this on my DELL devices and it works perfectly.

SCCM Task Sequence Error Code 0x80004005

While attempting to perform an in-place upgrade from Windows 7 Enterprise to Windows 10 Enterprise I came across Error Code 0x80004005.

Looking at C:\WINDOWS\CCM\Logs\smsts.log gave me the clues on the error message.

There are many posts on how to fix this particular error message; it seems that this error code is pretty generic and it shows up on several instances in many SCCM operations – this document particularly deals with a task sequence for an in-place operating system upgrade.

Since this was an in-place Windows upgrade, I needed to find out more detailed information and I was able to get it from C:\$WINDOWS-BT\Sources\Panther this folder contains a list of .XML files that collect compatibility data that is collected during the upgrade process.

I opened the last XML file and this gave me the actual clue as to what was failing during the upgrade process – video drivers were the culprit!

Now I know what’s going on during the task sequence and I can attempt to fix this issue.

I’ll blog about how to fix this issue in a new post, stay tuned!

New Windows 7 Install Not Updating

There’s an issue with brand new installations of Windows 7. If you’re trying to patch/update a brand new Windows 7 installation, Windows Updates will sit there for days without patching anything.

It turns out that, a while back, Microsoft updated their patching servers and because of that, brand new Windows 7 installations will fail to patch until you install the following KBs:

KB3102810
KB3135445
KB3138612

Some of these KBs will not say that will not apply, but keep trying the others and one will fix the Windows Update issue with newly installed Windows 7.

A while back, I opened a Technet case on Microsoft’s forums and here’s the original link.

 

Run PowerShell Script in Schedule Tasks

The following will allow you to run a Powershell script as a scheduled task. These instructions have been tested on a Windows 7 64bit computer.

Before proceeding, make sure your Powershell script runs without any errors. The best way to make sure your script is running fine is by calling it from a command prompt.

Note: Make sure you run Set-ExecutionPolicy from an elevated Powershell window to make sure your system (Windows 7) is allowed to run Powershell scripts.

1. Open a Command Prompt window
2. Run: powershell -file <your ps script file>
3. Make sure it executes properly

 

Now, open Windows 7 Task Scheduler:

1. In the Actions tab
2. Power shell is found at: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
   1. You can also just use powershell.exe
3. In Add arguments (optional) field, add the following: -File “C:\Path-to-your-script\Your-ps-script.ps1”
   1. Sample: -File “C:\Program Files (x86)\Info Folder\Get-Speed.ps1”
4. In Start in (optional) field, add the following: C:\Program Files (x86)\Info Folder
   1. Sample: C:\Program Files (x86)\Info Folder

I’m not going to go over the other sections as this is the main section to be able to execute Powershell scripts from Schedule Tasks.

Slow Logon And Logoff With Folder Redirection, Roaming Profiles And Offline Files

Note: Folder redirection, roaming profiles, offline files and others are part of Microsoft’s User State Virtualization. Before implementing it though, make sure that roaming profiles reside on a file server local the user’s network. You’ll avoid the issue I’m about to describe. This small piece of information is not mentioned in Microsoft’s documents. By the way, throughout all this ordeal, we’ve had BranchCache enabled and this didn’t speed up the user experience either.

Ever since we upgraded to Windows 7 Enterprise, our branch office users started complaining about extremely slow logon and logoff. In some instances, a user logon or logoff could take over ten minutes!

When we migrated our users from Windows XP Professional to Windows 7 Enterprise SP1 (x64), we enabled a few enterprise features:

• Folder redirection (Desktop, Favorites, Links, Documents, Pictures, Videos, Searches and Contacts folders are redirected to a file server in our datacenter)
• Roaming profiles (Users’ roaming profile folders are located on a file server in our datacenter)
• Offline Files (Users’ home folders were set as offline files/folders)

Each branch office connects to our datacenter by means of a Internet based VPN connection. We provisioned each branch office with a business class Internet cable link connection with more than adequate bandwidth.

Each branch office has a local DC used only for authentication and printing purposes.

After three months of working with Microsoft, we finally came up to what seemed to be the cause(es) of the issue – folder redirection, AppData not redirected and the use of Dfs links!

Here’s an example on how we configured folder redirection in our environment.

In our environment, we take advantage of Dfs and its features almost everywhere, so it was natural for us to use Dfs links here as well.

Folder Redirection For AppData

As part of the troubleshooting process, Microsoft recommended us to configure folder redirection for AppData.

Originally, AppData was not redirected, so AppData resided on the user’s local computer/laptop. During a logoff process, logs revealed that AppData was causing delays because it had to write files the user’s roaming profile folder (roaming profile folders reside on a file server in our datacenter).

After making the change to our test group policy, and applying it to our test machine, this step improved the logon and logoff process drastically. Logon and logoff now took less than four minutes! However, we demanded for better improvements.

However, something else broke when we made this change…Acrobat Reader XI became unusable for it could not come out of its Not Responding… state. The quick fix for this – disable Protected Mode. Stick around for more details on this later on.

Enter Dfs (Distributed File System)…

The Microsoft case owner, running out of ideas by now, contacted his senior technical lead and he advised us to use server shares as opposed to Dfs links.

Now that we had folder redirected AppData, along with the other folders, we went ahead and changed each folder’s target to use a server share instead of a Dfs link.

Note: Even when using server shares Acrobat Reader XI would still not work properly. The Not Responding… messages weren’t as frequent, but it was still bad enough that users could get annoyed by the behavior. 

This was the winning change!

The Acrobat Reader XI fix

Basically, you’re going to either add the following registry entry or do it directly on Acrobat Reader.

Here’s the registry key:

If you want to do it directly on Acrobat Reader, then go to Preferences, Security (Enhanced) and then un-check Enable Protected Mode at startup. 

Not the end yet…

As of 4/2/2014, I’m now getting an average of 25 seconds logon and 35 seconds logoff on my test laptop at one of our branch office!

I’m now going to check what causes our Dfs domain infrastructure to behave this way.

As of 9/30/2014, the AppData re-direction workaround broke Internet Explorer browsing – pages take a very long time to load while browsing using IE (10 and up). I opened a case with Microsoft and it looks like the slow down of IE is by design because we’re re-directing AppData and AppData, in our environment, isn’t on a local server to the users’ network. We moved AppData to our central file server located on our data center in a co-location. Again, this bit of information isn’t found on Microsoft’s documentation, so be careful before you go re-directing AppData!
We’re now looking into possibly removing roaming profiles and AppData re-direction because this is affecting productivity for our users.

Pin & Unpin Icons To The Windows 7 Taskbar

During the deployment of Windows 7, I was given the task to find out a way to pin and unpin icons to the taskbar.

Well, the process is rather easy, but it takes two steps.

1. Find out the verbs associated with the application you want to pin/unpin to the taskbar.
2. Execute the proper verb that will pin or unpin the application.

Note: This code isn’t mine, I modified it a bit to suit my needs

1. Let’s find the verbs

Here’s the VB code that handles that:

Const CSIDL_COMMON_PROGRAMS = &H17 

Const CSIDL_PROGRAMS = &H2 

Set objShell = CreateObject(“Shell.Application”) 

Set objScript = CreateObject( “WScript.Shell” )

REM The original code had the following line as part of it

REM Set objFolder = objShell.Namespace(“C:\Program Files\Internet Explorer”)

REM In my case, I’m pointing directly to the user path where all taskbar shortcut files are located

Set objFolder = objShell.Namespace(“C:\Users\” & objScript.ExpandEnvironmentStrings ( “%USERNAME%” ) & “\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar”)

REM I want to see a list of verbs pertaining to IE link file

Set objFolderItem = objFolder.ParseName(“Internet Explorer.lnk”) 

Set colVerbs = objFolderItem.Verbs 

For Each objVerb in colVerbs 

    Wscript.Echo objVerb 

Next

You can get verbs from .exe or .lnk files.

Here’s the output for that code (the output will change based on your computer):

cscript /nologo GetVerbs.vbs

&Open

Open file locat&ion

&Enable/Disable Digital Signature Icons

Run as &administrator

Edit with &Notepad++

Scan with System Center 2012 Endpoint Protection…

Unpin from Tas&kbar

Pin to Start Men&u

Restore previous &versions

Cu&t

&Copy

Create &shortcut

&Delete

Rena&me

P&roperties

2. Let’s pin, or unpin, to the taskbar

The code that handles pinning or unpinning to the taskbar is here:

Const CSIDL_COMMON_PROGRAMS = &H17 

Const CSIDL_PROGRAMS = &H2 

Set objShell = CreateObject(“Shell.Application”) 

Set objScriptShell = CreateObject( “WScript.Shell” )

REM Unpin Internet Explorer 64-bit from the taskbar

Set objFolder = objShell.Namespace(“C:\Users\” & objScriptShell.ExpandEnvironmentStrings ( “%USERNAME%” ) & “\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar”)

Set objFolderItem = objFolder.ParseName(“Internet Explorer (64-bit).lnk”) 

Set colVerbs = objFolderItem.Verbs

For Each objVerb in colVerbs 

    If Replace(objVerb.name, “&”, “”) = “Unpin from Taskbar” Then objVerb.DoIt 

Next

REM Pin Internet Explorer to the taskbar

Set objFolder = objShell.Namespace(“C:\Program Files (x86)\Internet Explorer”)

Set objFolderItem = objFolder.ParseName(“iexplore.exe”) 

Set colVerbs = objFolderItem.Verbs

For Each objVerb in colVerbs 

    If Replace(objVerb.name, “&”, “”) = “Pin to Taskbar” Then objVerb.DoIt 

Next

As soon as the script finishes the results are shown in the taskbar.

Deploy Adobe Acrobat Reader XI (11.0.03) Using SCCM 2012 SP1

There are several blogs on this topic; however, some seem to be lacking one or more details or may not show how to patch and customize Adobe Acrobat Reader XI. In this blog, I will show you how to patch, customize and deploy, via SCCM, Adobe Reader XI (11.0.03).

Pre-requisite: Make sure you have installed Adobe Customization Wizard XI

1. Download the latest version of Acrobat Reader from Adobe’s FTP site.
1. The direct FTP link is: ftp://ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.03/en_US/
2. We’re going to download the EXE file: AdbeRdr11003_en_US.exe
3. Next, from an administrator command line, we’re going to extract the MSI from the EXE file using the following command: AdbeRdr11003_en_US.exe -nos_o”c:\SomeDirectory” -nos_ne
1. Do not close this command line window as we’ll use it again.
2. For this example I’m extracting the contents to C:\temp\Adobe XI (11.0.03) folder.
   

4. Once we’ve extracted the source files from the EXE file, then let’s run (as an administrator) the Adobe Customization Wizard XI to create the MST file that we’re going to use to customize Adobe Reader XI.
1. If the customization wizard isn’t run as an administrator, you won’t be able to save the package.
5. Basically, we’re going to make changes in the the following sections:
1. Personalization Options
2. Installation Options
3. Shortcuts
4. WebMail Profiles
5. Online and Adobe online services Features
   
   
   
   

6. Once the customization options have been completed, proceed to click on Transform menu option then click on Generate Transform…
1. Save the MST file in the same folder where the Adobe Reader MSI exists.
2. For this example, we’re going to save this file as AcroRead.mst
7. Next, click on File and then click on Save Package.
8. Back to the command line and let’s create an Application Installation Point (AIP) in order to patch Acrobat Reader.
1. In the folder where the MSI file was extracted, you’ll notice that file AdbeRdrUpd11003.msp is located there – that’s our patch file that we’ll be applying.
2. For this example we’re going to create a new folder – C:\AdobeAIP
9. From the command line, in step 3, we’re going to create the AIP with the following command: msiexec /a AcroRead.msi
1. Once the wizard comes up, make sure to point it to the folder created in step 8.2
2. Make sure you run this command from the folder in step 3.
3. Take a look at the files extracted
10. Change directory to folder C:\AdobeAIP
11. Now we’re ready to patch the Acrobat Reader source files, let’s use the following command: msiexec /a AcroRead.msi /p “c:\temp\Adobe XI (11.0.03)\AdbeRdrUpd11003.msp”
1. This will open a wizard window; make sure there are no error messages during this task.
   

12. If the patching process was successful, then we should now have a patched Acrobat Reader XI installation as well as a customization file.
13. From Step 3 folder (C:\temp\Adobe XI (11.0.03)), copy the MST file to the Step 6 folder (C:\AdobeAIP)
14. At this time, folder C:\AdobeAIP should contain a patched Acrobat Reader  XI as well as the customization file. We’re going to use the contents of folder C:\AdobeAIP as our deployment files to create our SCCM 2012 deployment package.
15. Copy all contents of C:\AdobeAIP to the share that SCCM uses to deploy applications in your environment.
16. Let’s create a new application deployment package in SCCM. First, go to the Software Library section, and click on Application Management and then click on the Applications container to create the new package.
17. Right click on the Applications container then click on Create Application option.
18. Point to the network share where you copied the files in Step 15 and select the file AcroRead.msi
1. You may get a warning message about not being able to verify the publisher of this MSI file, just click on Yes.
19. In the General Information wizard screen, in the Installation program field, add the following:TRANSFORMS=”AcroRead.mst”
1. This line should read: msiexec /i “AcroRead.msi” TRANSFORMS=”AcroRead.mst” /q
   

20. Continue accepting defaults until the application wizard finishes.
21. Now, you can deploy this new application to a selected number of computers or users.

Supersedence Notes

In my environment, I’m replacing, or superseding, and older version of Adobe Acrobat Reader. Here’s a quick screenshot on how it’s done.

Identify Drivers Loading During Windows 7 Boot Process

This article is somewhat not complete, and it may contain some incorrect definitions, but it’s out there mainly for reference. Updates coming soon!

1. Open Regedit and go to HKLM
2. Expand HKLM\Select and look at the value of Current key
3. Based on the value of Current key (1, 2 or 3), select the proper HKLM\System\ControlSet00x
4. Expand HKLM\System\ControlSet00x\Control\Class
5. Under Class you’ll get a list of drivers that load during the boot process of Windows 7
6. In each driver entry, under the Class folder, look for the following keys: LowerFilters and UpperFilters – these are some of the drivers that load during the boot process

Wake-on-Lan (WoL) with DELL Optiplex

We wanted to get Wake-on-Lan (WoL) to work on our DELL Optiplex 990 desktops with Windows 7.

Here’s how we got this work in our environment. (Make sure your DELL computers are running the latest BIOS version.)

Enable BIOS settings:

1. Under Power Management
1. Enable – Wake on Lan ( LAN Only )
1. This one is needed for Windows 7 and to allow the machine to be woken up from a sleep state
2. Disable – Deep Sleep Control
1. This one is needed to allow to boot up the machine when the machine has been shutdown

Enable Windows 7 settings:

1. Go to Window’s Device Manager
2. Go to the properties for your primary network card
3. Go to the Power Management tab
4. Click to enable Allow this device to wake the computer

Note: Make sure you create an incoming rule in Windows 7 firewall to allow some of the WoL testing tools to run properly.

Network settings:

1. If you’re working on a large network, then make sure your network team adds ip directed-broadcast on the router/switch interface where you’ll be sending WoL packets.

We now have all the settings necessary to get WoL working.

To test these settings, you can use the following tools:

Wake-on-LAN monitor/sniffer – great tool! (See Windows 7 settings note)

Wake-on-LAN magic packet sender tool