The Pheasant Plucker - to SCCM and beyond!

Change Windows 7 Theme when Group Policy is applied

2016-07-13T15:59:00.001+01:00

Just a quick entry to work around the old high contrast issue in Windows 7.

Users can normally apply it but can't revert it back when group policy is locking it down.

Open a command prompt as admin and run the following - the blue can be edited accordingly. You may need the admin password but if you're an admin needing this for helpdesk reasons that shouldn't be an issue.

rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Themes /Action:OpenTheme /file:"C:\Windows\Resources\Themes\aero.theme"

External USB HDD Read Only when not Bitlockered

2016-07-05T09:40:00.000+01:00

Hi All,

Been a loooooong time since I've posted here.

Keeping ahead of times as always I'm upgrading a system to Windows 8.1 and found my external USB HDD is constantly prompting to be encrypted with Bitlocker. If I refuse it's marked as read only and I can't use it.

After alot of digging around I finally found a solution:

Open regedit and look for the following:

HKLM\System\CurrentControlSet\Policies\Microsoft\FVE!RDVDenyWriteAccess
HKLM\Software\Policies\Microsoft\FVE!RDVDenyCrossOrg

Set them to 0 and see if it gets you anywhere!!! worked a treat for me.

Free Disk Space Collection SCCM 2012

2014-11-28T12:06:00.001+00:00

We have been having several users with older PC's complaining of low disk space errors. These are normally shared Dell PC's with 80GB HDD's. We have lots of surgerys where tens of nurses will log on and subsequently create a local profile. As we have cached mode enabled for Outlook (don't ask) this creates massive .OST files in every profile.

I wanted SCCM to keep track of these machines and subsequently run a batch file that clears all the .OST files off the machine.

I wanted a collection that would list all machines with less than 1GB free disk space. I created the collection courtesy of http://myitforum.com/myitforumwp/2013/12/09/sccm-2012-r2-free-disk-space-report/ but found it was empty no matter what.

I then eventually came across this post http://e-enfra.blogspot.co.uk/2012/02/sccm-2012-free-disk-space-is-not.html instructing that by default the disk space isn't automatically collected by the hardware inventory cycle.

Enable this and just wait for the Harware Inventory Cycle to kick in and the disk space info will become available.

Hirens Boot Disk 15.2 Host

2014-11-05T09:45:00.002+00:00

I am now hosting Hirens Boot Disk 15.2 which you can download from here:

http://1drv.ms/1vHtDCU

Changing Themes on a locked down machine

2014-10-27T10:06:00.001+00:00

A user recently contacted me as she had inadvertantly activated "High Contrast" so her screen was black with purple task bars. After having a bit of fun with her explaining this was Microsofts Halloween Theme that kicks in every year during Halloween week I thought I should come clean.

As her machine was locked down with group policy I couldn't revert back to the standard theme using the normal methods so I came across this useful little script thanks to user "Misfortune" on the Windows 7 Forums

If you open up an admin command prompt and run this you should be able to revert it back. You can replace "Classic.Theme" with other options if you look in the file path you should be able to see the other themes...

rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Themes /Action:OpenTheme /file:"C:\Windows\Resources\Ease of Access Themes\classic.theme"

Removing Trusteer Rapport

2014-09-24T13:50:00.003+01:00

After uninstalling Rapport, some folders will remain, storing your Rapport settings (for future installation) and Rapport logs (for technical support analysis, if needed). These files and folders are completely inactive and may contain information useful for future installation or diagnosis of problems with Rapport.
Should you choose to delete these folders, or if you have trouble uninstalling Rapport and would like to manually remove all folders, please follow the instructions provided below.

Removing Rapport folders for Mac OS X

Removing Rapport folders for Windows XP

Removing Rapport folders for Windows Vista / 7 / 8

1) Go to Start menu and Choose Run (or Press the Windows key and the 'R' key together)
2) Type "C:\Program files" (or "c:\program files (x86)" for 64-bit machines) and click "Ok".

3) Find a folder named “Trusteer”, right click it with the mouse, and choose “Delete”. Make sure the folder was removed.

4) Open the Run command as described in step 1
5) Type "%userprofile%\appdata\local" and click "Ok".

6) Find a folder named “Trusteer”, right click it with the mouse, and choose “Delete”. Make sure the folder was removed.
* If the path results in an error, please use the following path instead: %appdata%
7) Open the run command again and this time type "%programdata%" and click "Ok".

- If you cannot locate the folder, it might be hidden because of default settings.

To change the folder’s settings:

- Go to the Start menu,

- Click on Control Panel,

- Click on Folder Options,

- Click on the View tab,

- Under “Hidden files and folders”, choose “Show hidden files, folders, and drives” and click OK.

8) Find a folder named “Trusteer”, right click it with the mouse, and choose “Delete”. Make sure the folder was removed.

9) Open the run command and this time type: c:\windows\system32\drivers. Click Ok.
10) Locate the following files and remove them (right click it with the mouse, and choose “Delete”):
* RapportKELL.sys (would be named RapportKE64.sys in 64-bit operating systems)
* RapportHades64.sys (Windows 8 only)

11) To ensure all Trusteer files were removed, open C drive and search for “Trusteer” in the search bar on the top right-hand side of the window.

If any files related to Trusteer are found, delete them.

A change of career...

2014-09-22T14:36:00.000+01:00

I've recently embarked on a new journey and I'm retraining as a counsellor. Please drop by to see my other Blog Counsellor Chris and see what I'm up to.

Windows 9 Technical Preview Leak

2014-09-12T10:03:00.000+01:00

With thanks to WinSupersite

"Two German technology blogs have leaked screenshots of the upcoming Windows 9 Technical Preview, which is billed as build 9834. The shots depict the new Start menu, floating Modern app windows, a notification center, multiple desktop workspaces, a flat new design for the desktop, and many other changes that we've long expected."

http://winsupersite.com/windows/windows-9-technical-preview-screenshots-leak-analysis-part-1

SCCM Report for all machines with IE9

2014-06-25T15:50:00.000+01:00

If you know the steps to create a report then the SQL query you could use would be somthing like:

SELECT DISTINCT a.Name0 AS [Machine Name],
c.FileVersion AS [IE Version],
d.Caption0
FROM v_GS_SoftwareFile c INNER JOIN
v_GS_SYSTEM a ON c.ResourceID = a.ResourceID INNER JOIN
v_GS_OPERATING_SYSTEM d ON a.ResourceID = d.ResourceID INNER JOIN
v_FullCollectionMembership b ON a.ResourceID = b.ResourceID
WHERE (c.FileName = 'iexplore.exe') AND (c.FileVersion like '9.%')
ORDER BY a.Name0

Please note this has a little bug where it will report multiple instances of the same machine due to the fact that SCCM will have polled every version of IE9 (each incremntal update etc)

It would be better to export this data in to Excel and then delete the duplicates in the name column...

ifM63x64.sys file missing or corrupt - SCCM OSD (X1 Carbon)

2014-05-19T11:17:00.000+01:00

Building a new Lenovo X1 Carbon with the new integrated LAN adapter (no more guessing which USB port to use!) via SCCM 2007 and I came across this little blinder.

After the first reboot to OS I was presented with this error screen:

I spotted that is was driver in my driver pack (taken from Lenovo's SCCM pack) for the Intel Ethernet FCoE Virtual Storport Miniport Driver.

I located the driver in my driver pack and removed it - left he check box UNTICKED to update the distribution point and then manually when and updated it after myself.

Once I was happy that the source had incremented by one version I kicked off the build again.

Sure enough it sailed through and we are all happy....

Your account has been disabled. Please see your system administrator

2014-05-01T14:59:00.000+01:00

Scenario:

A non-domain joined virtual machine (HyperV) that as just been sysprepped. SCCM Capture has completed, machine has rebooted but you get presented with Username and password field instead of Windows config options.

You try to log on with local admin account and get the error "Your account has been disabled. Please see your system administrator".

Assumptions:

You've been using SCCM to build machines

You didn't activate the admin account

You really can't be arsed to go back to the task sequence and make the change then spend 1hr rebuilding the machine

You have some form of access to WinPE either via PXE (F12) or USB/CD boot image
Troubleshooting is ENABLED in your BootPE to allow for F8 to envoke a cmd prompt.

Solution:

Now this isn't going to work for everyone but this is a method I've used previously when I've done something dumb like not enabling the local admin account!

Bare in mind this is for when there are NO ACCOUNTS AVAILABLE ! You may have seen this method elsewhere on the net when they then tell you to log in as an administrator.... Really.... When I've just Googled "I've been dumb and forgotten to activate my admin account"... You're telling me to fix it by logging on as administrator.... REALLY???

Here goes.

Boot your machine into WinPE via F12 PXE or via removable media boot disk
Hit F8 and bring up the CMD prompt
Nav to C:\Windows\System32
Enter the following commands:

Ren magnify.exe magnify1.exe
Ren cmd.exe magnify.exe

Reboot your machine
At login click the Ease of Access button at the bottom left of the screen – tick the box that says “Make items on the screen larger (Magnifier)” then click apply and if you’ve done everything correctly a command prompt will appear.
Enter the following command:

Net user administrator /active:yes

This activates the administrator account

Net user administrator 123

(This is telling the administrator account to use a password of 123)

Try logging on!!!
Don't forget to go and rename magnify.exe to cmd.exe and magnify1.exe to mangnify.exe

2 more armed forces hits today!

2014-04-16T16:18:00.000+01:00

Great to see that Pheasant Plucker is getting hits from Armed Forces techs!

Hope it helps you lads and lasses out there :)

DN

Fan speed cycles between full and normal speeds - ThinkCentre M93 Tiny, M93p Tiny, M73 Tiny

2014-03-26T09:48:00.000+00:00

Symptom
The fan speed may cycle between full and normal speeds. The symptoms may vary. The system may randomly lose power and/or will not power on when pressing the Power button. The keyboard may not be recognized if it is plugged into USB Port 3.

Affected configurations

The above symptom is associated with, but not limited to, the following systems:

ThinkCentre M93 Tiny (Type 10A4, 10A5)
ThinkCentre M93p Tiny (Type 10AA, 10AB)
ThinkCentre M73 Tiny (Type 10AX, 10AY)

System is confiured with:
A USB keyboard plugged into USB Port 3 in the back of the system and one of the following:

The system is set up to go into S4 (Hibernate).
The system is powered off (S5 state) from either selecting shutdown from Windows or pressing the Power button on the system.

Applies to:

All Operating Systems

Solution

The user should update the system BIOS to prevent this issue from occurring. If running this update from a USB device, then do not plug the device into USB Ports 2 or 3.
For the ThinkCentre M93 Tiny (10A4, 10A5) and ThinkCentre M93p Tiny (10AA, 10AB), update the BIOS to level FBKT73A, or greater, from the following URL. This BIOS includes an EC firmware update to level 29.
http://support.lenovo.com/en_US/downloads/detail.page?DocID=DS035753
For the ThinkCentre M73 Tiny (10AX, 10AY), update the BIOS to level FHKT40A, or greater, from the following URL. This BIOS includes an EC firmware update to level 31.
http://support.lenovo.com/en_US/downloads/detail.page?DocID=DS038325

FLIR One - Thermal imaging for iPhone 5S

2014-03-13T13:51:00.000+00:00

Ok so finally my geek life long wish of owning some form of FLIR device seems to be about to become a reality.

FLIR have just announced the imminent release of the FLIR Case for the iPhone 5S which houses a thermal imaging lense and it's own power source.

I have reserved mine but should the nice men and ladies at FLIR want to provide an evaluation unit for me to review on The Pheasant Plucker they could bob me an email :)

More info is available over at their site:

http://www.flir.com/flirone/

Jabra Rox Bluetooth Headphones

2014-03-13T13:47:00.003+00:00

Jabra have just announced the release of their latest music headphones the Rox.

Please take a look at their site for information as to the specifications

http://www.jabra.com/Products/Bluetooth/JABRA_ROX/Jabra_ROX

Should Jabra wish to contact me in regards to providing evaluation items for technical review please mail me via the blog.

Microsoft Error Codes seen during SCCM software deployments

2014-03-05T10:55:00.000+00:00

I may have posted this before - I can't remember.

Error code               Value  Description
---------------------------------------------------------------------------
ERROR_SUCCESS               0   Action completed successfully.
ERROR_INVALID_DATA         13   The data is invalid.
ERROR_INVALID_PARAMETER    87   One of the parameters was invalid.
ERROR_INSTALL_SERVICE_
 FAILURE                 1601   The Windows Installer service could not be 
                                accessed. Contact your support personnel 
                                to verify that the Windows Installer 
                                service is properly registered.
ERROR_INSTALL_USEREXIT   1602   User cancel installation.
ERROR_INSTALL_FAILURE    1603   Fatal error during installation.
ERROR_INSTALL_SUSPEND    1604   Installation suspended, incomplete.
ERROR_UNKNOWN_PRODUCT    1605   This action is only valid for products that
                                are currently installed.
ERROR_UNKNOWN_FEATURE    1606   Feature ID not registered.
ERROR_UNKNOWN_COMPONENT  1607   Component ID not registered.
ERROR_UNKNOWN_PROPERTY   1608   Unknown property.
ERROR_INVALID_HANDLE_
 STATE                   1609   Handle is in an invalid state.
ERROR_BAD_CONFIGURATION  1610   The configuration data for this product is 
                                corrupt. Contact your support personnel.
ERROR_INDEX_ABSENT       1611   Component qualifier not present.
ERROR_INSTALL_SOURCE_
 ABSENT                  1612   The installation source for this product 
                                is not available. Verify that the source 
                                exists and that you can access it.
ERROR_INSTALL_PACKAGE_
 VERSION                 1613   This installation package cannot be 
                                installed by the Windows Installer 
                                service. You must install a Windows 
                                service pack that contains a newer version 
                                of the Windows Installer service.
ERROR_PRODUCT_
 UNINSTALLED             1614   Product is uninstalled.
ERROR_BAD_QUERY_SYNTAX   1615   SQL query syntax invalid or unsupported.
ERROR_INVALID_FIELD      1616   Record field does not exist.

ERROR_INSTALL_ALREADY_
 RUNNING                 1618   Another installation is already in 
                                progress. Complete that installation 
                                before proceeding with this install.
ERROR_INSTALL_PACKAGE_
 OPEN_FAILED             1619   This installation package could not be 
                                opened. Verify that the package exists and 
                                that you can access it, or contact the 
                                application vendor to verify that this is 
                                a valid Windows Installer package.
ERROR_INSTALL_PACKAGE_
 INVALID                 1620   This installation package could not be 
                                opened. Contact the application vendor to 
                                verify that this is a valid Windows 
                                Installer package.
ERROR_INSTALL_UI_
 FAILURE                 1621   There was an error starting the Windows 
                                Installer service user interface. Contact 
                                your support personnel.
ERROR_INSTALL_LOG_
 FAILURE                 1622   Error opening installation log file. 
                                Verify that the specified log file 
                                location exists and is writable.
ERROR_INSTALL_LANGUAGE_
 UNSUPPORTED             1623   This language of this installation package 
                                is not supported by your system.
ERROR_INSTALL_TRANSFORM_
  FAILURE                1624   Error applying transforms. Verify that
                                the specified transform paths are valid.
ERROR_INSTALL_PACKAGE_
 REJECTED                1625   This installation is forbidden by system 
                                policy. Contact your system administrator.
ERROR_FUNCTION_NOT_
 CALLED                  1626   Function could not be executed.
ERROR_FUNCTION_FAILED    1627   Function failed during execution.
ERROR_INVALID_TABLE      1628   Invalid or unknown table specified.
ERROR_DATATYPE_MISMATCH  1629   Data supplied is of wrong type.
ERROR_UNSUPPORTED_TYPE   1630   Data of this type is not supported.
ERROR_CREATE_FAILED      1631   The Windows Installer service failed to 
                                start. Contact your support personnel.
ERROR_INSTALL_TEMP_
 UNWRITABLE              1632   The temp folder is either full or 
                                inaccessible. Verify that the temp folder 
                                exists and that you can write to it.
ERROR_INSTALL_PLATFORM_
 UNSUPPORTED             1633   This installation package is not supported 
                                on this platform. Contact your application 
                                vendor.
ERROR_INSTALL_NOTUSED    1634   Component not used on this machine.
ERROR_PATCH_PACKAGE_
 OPEN_FAILED             1635   This patch package could not be opened. 
                                Verify that the patch package exists and 
                                that you can access it, or contact the 
                                application vendor to verify that this is 
                                a valid Windows Installer patch package.
ERROR_PATCH_PACKAGE_
 INVALID                 1636   This patch package could not be opened. 
                                Contact the application vendor to verify 
                                that this is a valid Windows Installer 
                                patch package.
ERROR_PATCH_PACKAGE_
 UNSUPPORTED             1637   This patch package cannot be processed by 
                                the Windows Installer service. You must 
                                install a Windows service pack that 
                                contains a newer version of the Windows 
                                Installer service.
ERROR_PRODUCT_VERSION    1638   Another version of this product is already 
                                installed. Installation of this version 
                                cannot continue. To configure or remove 
                                the existing version of this product, use 
                                Add/Remove Programs on the Control Panel.
ERROR_INVALID_COMMAND_
 LINE                    1639   Invalid command line argument. Consult the 
                                Windows Installer SDK for detailed command 
                                line help.
ERROR_INSTALL_REMOTE_
  DISALLOWED             1640   Installation from a Terminal Server
                                client session not permitted for 
                                current user.
ERROR_SUCCESS_REBOOT_
  INITIATED              1641   The installer has started a reboot.
                                This error code not available 
                                on Windows Installer version 1.0.
ERROR_PATCH_TARGET_
  NOT_FOUND              1642   The installer cannot install the
                                upgrade patch because the program
                                being upgraded may be missing, or the
                                upgrade patch updates a different
                                version of the program. Verify that 
                                the program to be upgraded exists on
                                your computer and that you have the 
                                correct upgrade patch.
 
                                This error code is not available on
                                Windows Installer version 1.0.
ERROR_SUCCESS_REBOOT_
 REQUIRED                3010   A restart is required to complete the 
                                install. This does not include installs 
                                where the ForceReboot action is run. Note 
                                that this error will not be available until 
                                future version of the installer.

Trend OfficeScan 10 causing Hash Mismatch Errors in SCCM 2007

2014-02-20T09:40:00.000+00:00

For the last 2 years of my SCCM Career I've been blighted with issues concerning the above. I've added exceptions to our Trend server, calls have been logged but I can never seem to get this sorted.

I find that if Trend is running the execmgr.log will sometimes show Hash Mismatch errors. If I manually disable Trend (or better still remove it!!) - it works fine.

I've started adding a quick command to my Task Sequences and package deployments to temporarily disable OfficeScan while the deployment takes place and it works a charm!!

Simply add the following command lines before and after via Task Sequence or simply create a package with a batch file containing the following.

Before:

net stop tmlisten
net stop ntrtscan

After:

net start tmlisten
net start ntrtscan

Obviously this works manually too if you should ever need to disable Trend remotely... Even if it has a password!!!!!!!! ;)

AppV Application Slow to open

2014-02-04T14:41:00.000+00:00

I've recently sequenced a Pathology application that we use in the NHS that uses a Terminal Emulator to retrieve bloods direct from the Lab.

I had managed to sequence it fine but the package was taking an age to load up and sometimes timing out completely.

After looking at the SFTLOG (C:\ProgramData\Microsoft\Application Virtualization Client) I noticed an error: 4636126-0B01FD04-0000041E

As per AppV error format:

App-V Error 04-0000041E

Event:
Starting/Running the application
Error Message / Symptoms:
It took to long until the application was ready for interaction with the users.
The application shuts down after about 5 minutes
Potential Causes:
The application is a Java or DOS like application. App-V can not determine that the application is ready for User Input, because the app does not use default Windows Classes.
Potential Solutions:
In the OSD file, SUBSYSTEM VALUE has to be changed from "windows" to "console" (case sensitive).
If it is an 16-bit application, also the VM VALUE should be set from "Win32" to "Win16"
References:
Microsoft Knowledgebase Article: http://support.microsoft.com/kb/931112. This articles lists a set of potential causes, however the most common reason (SUBSYSTEM "windows") is not listed there.

Thanks to Falko at Kirx.org for the above.

Once I'd made these changes I updated the package and viola, Bob's your aunties live-in lover!

Operating System Deployment with USB Dongles (Lenovo in my case)

2014-01-30T09:44:00.000+00:00

With the advances in technology we have seen in recent years, devices have become smaller, thinner and lighter than ever before.

With this we are finding that some devices are loosing functionality - ie. Some devices are having ports omitted to retain their slender profile.

The Lenovo X1 Carbon adopted this approach and required a USB dongle which I posted about the pitfalls of PXE boot here: Lenovo X1 PXE Issues

I've seen an increase in the issues these dongles are causing us deployment techs, one of those being that each of these dongles have their own MAC address. In true tech style when we see this new wizardry the first thing we say is "MINE"... Well actually the first thing we normally say is "Ooh Shiney" but then there's a Smeagle like "My Precious" when we claim the Shiney as our own.

I did this. I had my very own dongle. It worked great. ONCE! Every subsequent build failed. I did a bit of research and found that it had it's own MAC that was registering in SCCM so I had to surrender my Shiney and give it on to the user.

I now use the supplied dongles for each build as it isn't worth the trouble but I have it on good authority that with the latest gen of Lenovo kit they are shipping certain models with on-board NICs (therefore unique MACs) and the dongle is purely a port extender utilising USB to present an Ethernet port.

If you have fallen prey to this (and insist on using one dongle to rule them all) you need to read my earlier post to search SCCM for machines by their MAC address.

Have fun...

DocN

iPhone Activation Error

2013-10-06T10:35:00.001+01:00

So if you, like me have woken up on 6th October 2013 to find a nice little error on your crApple device asking you to "Activate" then you may want to find out how to fix it.

As the calendar rolls over to 6th Oct; Reports are coming in from all over the World of people with iOS7 beta6 being locked out of their phones due to the expiry of the test version of the nice shiney iOS7 being retired.

Blah blah blah I'm going to cut the crap and just get on with it as it's Sunday morning and I'm trying to enjoy my kids, a bacon butty & a cup of tea...

Get the stuff you need & back it up baby...

Download the latest crapTunes or update from within crapTunes.
Backup your crapPhone with crapTunes if you can (I couldn't).
You can still access photos so if you need to, back them up too.
Download the latest version of iOS 7.0.2 from one of these sources (not responsible for external content etc etc) then hold down on the option key (Mac) or the shift key (Windows) and click the “Check for Update” button in the Summary pane of crapTunes. Browse to the file you downloaded. (it will take an age!)

iPad2(Wi-Fi) (iPad2,1)	7.0.2 (11A501)
iPad2(AT&T) (iPad2,2)	7.0.2 (11A501)
iPad2(Verizon) (iPad2,3)	7.0.2 (11A501)
iPad2,4 (iPad2,4)	7.0.2 (11A501)
iPad2,5 (iPad2,5)	7.0.2 (11A501)
iPad2,6 (iPad2,6)	7.0.2 (11A501)
iPad2,7 (iPad2,7)	7.0.2 (11A501)
iPad3,1 (iPad3,1)	7.0.2 (11A501)
iPad3,2 (iPad3,2)	7.0.2 (11A501)
iPad3,3 (iPad3,3)	7.0.2 (11A501)
iPad3,4 (iPad3,4)	7.0.2 (11A501)
iPad3,5 (iPad3,5)	7.0.2 (11A501)
iPad3,6 (iPad3,6)	7.0.2 (11A501)
iPhone4 (iPhone3,1)	7.0.2 (11A501)
iPhone3,2 (iPhone3,2)	7.0.2 (11A501)
iPhone4(Verizon) (iPhone3,3)	7.0.2 (11A501)
iPhone4S (iPhone4,1)	7.0.2 (11A501)
iPhone5,1 (iPhone5,1)	7.0.2 (11A501)
iPhone5,2 (iPhone5,2)	7.0.2 (11A501)
iPhone5,3 (iPhone5,3)	7.0.2 (11A501)
iPhone5,4 (iPhone5,4)	7.0.2 (11A501)
iPhone6,1 (iPhone6,1)	7.0.2 (11A501)
iPhone6,2 (iPhone6,2)	7.0.2 (11A501)
iPodTouch(5G) (iPod5,1)	7.0.2 (11A501)

Choose the file and let it do it's thing. Don't worry - you won't loose any data either!!!

BLOODY CRAPPLE!!!

DocN

There may be too many steps in the task sequence object.

2013-09-05T16:07:00.003+01:00

So this was a new one on me. Before you ask; no, we hadn't made any changes to our system - it just happened. Yes - it just happened, just like I'm guessing has happened to you if you're reading this.

I fired up my SCCM console locally on my machine. I went to edit a Task Sequence and then got this little gem:

Good one uh? I then jumped on the server and tried the server console. Still the same.

A bit of twitchy bum moments, log file seaching and a touch of Googling I found that this could be caused by MDT going; what we in the industry call; "Tits up".

Do you have MDT integrated into SCCM too? You do? Good - read on...

Try re-running the MDT integration as per the start menu folder location for MDT on your SCCM server and you should find things fine and dandy.

It didn't work? Oh... Sorry - try this link here.

'Consumerization of IT' Taking Its Toll on IT Managers

2013-07-17T16:24:00.001+01:00

http://www.cio.com/article/689944/_Consumerization_of_IT_Taking_Its_Toll_on_IT_Managers

Upgrade Microsoft OCS 2007 to Lync 2013 in a Windows 7 x86 environment using SCCM 2007: Part 2

2013-07-17T16:19:00.003+01:00

Continued from Part 1

Compressing the Lync Client (cont...)

You will now have a folder called Microsoft_Lync_2013_x86_01 containing:

This is now the source folder we will point our SCCM package to.

You will now need to create a program in the package and point it to the TSINSTALL.bat

Creating the Task Sequence

There were several factors involved in my choice to use a task sequence to do this. Mainly because we can run command lines directly from the TS rather than having to come up with a massively long boring script.

Create a new task sequence under the Operating System Deployment section of SCCM
Choose "create a new custom task seqeunce"
Name it Install Lync 2013 x86 and click finish
Add an Install Software step and call it Install Microsoft Lync 2013 x86
Choose the package and program you created earlier (an assumption)
Create a run command line step to kill of the Communicator process. Name it Kill Communicator Process and use the command: taskkill /im communicator.exe /f
Create a run command line step to kill of the Outlook process. Name it Kill Outlook Process and use the command: taskkill /im outlook.exe /f
Create a run command line step called Remove Live Meeting with the command: MsiExec.exe /X{A98AFBC7-D5A7-46A1-8795-EABE2F55A7D6} /qn REBOOT=ReallySuppress
Create a run command line step called Remove OCS 2007 with the command: MsiExec.exe /X{E5BA0430-919F-46DD-B656-0796F8A5ADFF} /qn REBOOT=ReallySuppress
Create a run command line step called RemoveOutlook Plugin using the command: MsiExec.exe /X{1DE3088D-E607-4EB0-9223-106E7B5AF2F1} /qn REBOOT=ReallySuppress
Create a run command line step called Delete Source Files with the command del c:\lync2013x86 /F /Q - run this step with an admin account as per the tick box at the bottom.

Your Task Sequence should look this this.

*I ticked "Continue on error" in the options tab on every step EXCEPT the install Lync step.

Click OK to save the Task Sequence.

Now advertise the task sequence out to a collection - I advise not populating the collection yet - just test this on 1 computer for now and then add a few more once your happy it's working the way it should. Tailor the advertisment in as way to suit you; Silently or with an on screen prompt etc. ASAP or a timed schedule...

I AM NOT RESPONSIBLE FOR YOUR CHOICES OF TARGET - DON'T BLAME ME IF YOU TRASH YOUR ESTATE WITH THIS METHOD!!!

This is what will happen.

Target computer will recieve policy from SCCM
TS will launch and copy over source folder
Program will run which will create the extract source, extract the 7z install and run setup.exe
Once Lync has installed the TS will kill off OCS & Outlook
It will remove Live Meeting, OCS and the Outlook Plugin
Source files are deleted.

I really hope this works for people and I welcome any constructive comments....

docN

Upgrade Microsoft OCS 2007 to Lync 2013 in a Windows 7 x86 environment using SCCM 2007: Part 1

2013-07-17T15:57:00.000+01:00

As part of our ongoing commitments to optimise our users desktop experience; our infrastructure team are currently implementing a Lync back end. Of course it comes to me to package and deploy the client out to our estate. As we are currently running a mixture of XP and Win7/8 there is a different method required for XP.

In this post I will explain how I went about packaging up Lync so it would remove any legacy installs of Office Communicator and replace it will Lync.

This is going to be a lengthy one so make coffee - LOTS of coffee. Hopefully though it will help other people to achieve the same as me should that be what they require.

You will need the following:

Lync 2013 x86 client (I downloaded the ISO from our VLSC)
7zip (executable AND command line) http://www.7-zip.org/

Assumptions:

You are proficient in SCCM 2007 packaging and deploying

you have used the OCT to customise Office installs

You require a silent install

Packaging the Lync client

Customising the install

Assuming you have the above we will first setup the Custom.MSP file via the OCT. Once you have extracted the ISO your file structure will look like the above. You will not have the "Admin" shortcut so we create that now.

Right click "setup.exe" and click "create shortcut"
Rename "setup.exe - shortcut" to "Admin"
Right click "Admin" and at the end of the Target path you need to add "/admin". Mine looks like this: "\\MYSCCMSERVER\Packages\Microsoft_Lync_2013_x86\setup.exe" /admin
Click OK
Double click Admin and you will be prompted to create or open an MSP file - just click OK to create a new one.
Under Setup, click Install location and organisational name - enter your org name here.
Under Licensing & User Interface choose your method of entering the product key - I use KMS.
Click I accept the terms... box, change display level to "none" and tick suppress modal
Under "Additional content" click "Add registry entries" and add the following:
Machine setting
1. Root : HKEY_Local_Machine
2. Type: DWORD
3. Key: Software\Policies\Microsoft\Office\15.0\Common\General
4. Name: ShownFirstRunOptin
5. Value: 0×00000001
User Setting
1. Root : HKEY_Current_User
2. Type: DWORD
3. Key: Software\Microsoft\Office\15.0\Common\General
4. Name: ShownFirstRunOptin
5. Value: 1

Once you are happy that you have customised your install accordingly click "file" "save as" and save the file into the "updates" folder of the Lync package as "custom.msp".

Compressing the Lync Client

Using 7zip we will now compress the source folder. Simply right click the folder that contains your install and select 7-Zip>Add to "(foldername).7z"

Create a second folder and add the resulting 7z file - this is the folder that will be deployed over to the clients machines. For this example mine is called "Microsoft_Lync_2013_x86_01"

Add the 7za.exe command line tool you downloaded (you did download it right?)

Create a batch file called "TSINSTALL.bat". In the batch file add the following lines:

md c:\lync2013x86

7za.exe x Microsoft_Lync_2013_x86_01.7z -oC:\lync2013x86
cd c:\lync2013x86
setup.exe

Continue to PART 2

Enabling Bitlocker on a Windows 2 Go Device

2013-06-28T09:47:00.000+01:00

When you try to turn on BitLocker on the Windows 2 Go device you created in the previous post you'll possibly see the following message:

This device can't use a Trusted Platform Module. Your administrator must set the "Allow BitLocker without a compatible TRP" option in the "Require additional authentication at startup" policy for OS volumes.

Solution:

1. "Windows+R" to start the Run command .

2. Type "gpedit.msc" and click OK.

3. A new window will open.

4. Click on Administrative Templates under Computer Configuration

5. Double Click on Windows Components (right window pane).

6. Double Click on BitLocker Drive Encryption.

7. Double Click on Operating System Drives.

8. Double Click on Require Additional Authentication at Startup

9. A new window will be opened.

10. Click "Enabled"

11. Click OK and close the window.

IF YOU WANT THE KEY TO BE BACKED UP TO ACTIVE DIRECTORY

Load gpedit.msc

Local computer policy\Administrative Templates\Windows Components\Bit Locker Encryption

Turn on the following :

o ‘Store BitLocker recovery information in AD DS’

Local computer policy\Administrative Templates\Windows Components\Bit Locker Encryption\Fix data drives

o ‘Choose how bitlocker-protected fix drives can be recovered’

Local computer policy\Administrative Templates\Windows Components\Bit Locker Encryption\Operating System Drives

o ‘Choose how Bitlocker-protected OS drives can be recovered’

Local computer policy\Administrative Templates\Systems\Trusted Platform Module services

o ‘Turn on TPM backup to AD DS’

Open CMD

Type ‘manage-bde -protectors -get c:’

You should get a similar return

o BitLocker Drive Encryption: Configuration Tool version 6.1.7601

o Volume C: [OSDisk]

o All Key Protectors

o TPM: ID: {1B86C47C-B81E-4F1A-A8C2-598B9F54C99C}

o Numerical Password: ID: {FE3311F0-0ED2-419D-8455-B10D3A104887}

o Password: 551463-589820-493438-138534-340098-388795-215589-457996

Then type ‘manage-bde -protectors -adbackup c: -id {Numerical Password}’

you should get:

o BitLocker Drive Encryption: Configuration Tool version 6.1.7601

o Recovery information was successfully backed up to Active Directory.

Copy the following into a VBS script and run it to pull the information over to AD

'===============================================================================
'
' This script demonstrates the addition of an Access Control Entry (ACE)
' to allow computers to write Trusted Platform Module (TPM)
' recovery information to Active Directory.
'
' This script creates a SELF ACE on the top-level domain object, and
' assumes that inheritance of ACL's from the top-level domain object to
' down-level computer objects are enabled.
'
'
'
' Last Updated: 07/01/2006
' Last Reviewed: 09/19/2009
' Microsoft Corporation
'
' Disclaimer
'
' The sample scripts are not supported under any Microsoft standard support program
' or service. The sample scripts are provided AS IS without warranty of any kind.
' Microsoft further disclaims all implied warranties including, without limitation,
' any implied warranties of merchantability or of fitness for a particular purpose.
' The entire risk arising out of the use or performance of the sample scripts and
' documentation remains with you. In no event shall Microsoft, its authors, or
' anyone else involved in the creation, production, or delivery of the scripts be
' liable for any damages whatsoever (including, without limitation, damages for loss
' of business profits, business interruption, loss of business information, or
' other pecuniary loss) arising out of the use of or inability to use the sample
' scripts or documentation, even if Microsoft has been advised of the possibility
' of such damages.
'
' Version 1.0.1 - Tested and re-released for Windows 7 and Windows Server 2008 R2

'
'===============================================================================

' --------------------------------------------------------------------------------
' Access Control Entry (ACE) constants
' --------------------------------------------------------------------------------

'- From the ADS_ACETYPE_ENUM enumeration
Const ADS_ACETYPE_ACCESS_ALLOWED_OBJECT      = &H5   'Allows an object to do something

'- From the ADS_ACEFLAG_ENUM enumeration
Const ADS_ACEFLAG_INHERIT_ACE                = &H2   'ACE can be inherited to child objects
Const ADS_ACEFLAG_INHERIT_ONLY_ACE           = &H8   'ACE does NOT apply to target (parent) object

'- From the ADS_RIGHTS_ENUM enumeration
Const ADS_RIGHT_DS_WRITE_PROP                = &H20 'The right to write object properties
Const ADS_RIGHT_DS_CREATE_CHILD              = &H1   'The right to create child objects

'- From the ADS_FLAGTYPE_ENUM enumeration
Const ADS_FLAG_OBJECT_TYPE_PRESENT           = &H1   'Target object type is present in the ACE
Const ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT = &H2   'Target inherited object type is present in the ACE

' --------------------------------------------------------------------------------
' TPM and FVE schema object GUID's
' --------------------------------------------------------------------------------

'- ms-TPM-OwnerInformation attribute
SCHEMA_GUID_MS_TPM_OWNERINFORMATION = "{AA4E1A6D-550D-4E05-8C35-4AFCB917A9FE}"

'- ms-FVE-RecoveryInformation object
SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION = "{EA715D30-8F53-40D0-BD1E-6109186D782C}"

'- Computer object
SCHEMA_GUID_COMPUTER = "{BF967A86-0DE6-11D0-A285-00AA003049E2}"

'Reference: "Platform SDK: Active Directory Schema"

' --------------------------------------------------------------------------------
' Set up the ACE to allow write of TPM owner information
' --------------------------------------------------------------------------------

Set objAce1 = createObject("AccessControlEntry")

objAce1.AceFlags = ADS_ACEFLAG_INHERIT_ACE + ADS_ACEFLAG_INHERIT_ONLY_ACE
objAce1.AceType = ADS_ACETYPE_ACCESS_ALLOWED_OBJECT
objAce1.Flags = ADS_FLAG_OBJECT_TYPE_PRESENT + ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT

objAce1.Trustee = "SELF"
objAce1.AccessMask = ADS_RIGHT_DS_WRITE_PROP
objAce1.ObjectType = SCHEMA_GUID_MS_TPM_OWNERINFORMATION
objAce1.InheritedObjectType = SCHEMA_GUID_COMPUTER

' --------------------------------------------------------------------------------
' NOTE: BY default, the "SELF" computer account can create
' BitLocker recovery information objects and write BitLocker recovery properties
'
' No additional ACE's are needed.
' --------------------------------------------------------------------------------

' --------------------------------------------------------------------------------
' Connect to Discretional ACL (DACL) for domain object
' --------------------------------------------------------------------------------

Set objRootLDAP = GetObject("LDAP://rootDSE")
strPathToDomain = "LDAP://" & objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com

Set objDomain = GetObject(strPathToDomain)

WScript.Echo "Accessing object: " + objDomain.Get("distinguishedName")

Set objDescriptor = objDomain.Get("ntSecurityDescriptor")
Set objDacl = objDescriptor.DiscretionaryAcl

' --------------------------------------------------------------------------------
' Add the ACEs to the Discretionary ACL (DACL) and set the DACL
' --------------------------------------------------------------------------------

objDacl.AddAce objAce1

objDescriptor.DiscretionaryAcl = objDacl
objDomain.Put "ntSecurityDescriptor", Array(objDescriptor)
objDomain.SetInfo

WScript.Echo "SUCCESS!"