Category Microsoft Windows 10

WSUS – GPO and Windows 10 / Server 2016 Registry Settings

You create a WSUS GPO and apply it to the Computers.

Now how do you validate its working

Open the registry and browse to :
computer\HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate

 

The GPO for WSUS should populate the registry with following values

WUServer …updates server
WUStatusServer…update
UpdateServicesURLAlternate

These values should match the GPO settings for WSUS.

WSUS and Windows 10 – Clients not checking in or checking in and then disappearing

Clients not checking in or checking in and then disappearing

Cloned images – SUSCLIENTID is not reset with Sysprep!!!

This needs to be done if your creating a template for Windows 2016 and Windows 10 in a virtual environment.

So if you have deployed servers from template already, do the following fix. Or if you realised before deployment, just delete the reg keys before converting the virtual machine to a template.

Solutions / Fix

Stop Windows Update service

 

Open up regedit

Browse to  : computer\hklm\software\microsoft\windows\currentversion\windowsupdate

Delete susclientID
Delete susclientidvalid

Start Windows Update service

Open up command prompt as admin on the effected Window 2016 or Window 10 client, if the image has already been deployed

type

c:\windows\system32\UsoClient.exe RefreshSettings

The clients should then check in and create a new SusClientId and SusClientIdValidation

 

WSUS and Windows 10 Clients – UsoClient.exe

So, you deploy a GPO to Window 10 clients, but your in a hurry to get the clients to check in…

As a SysAdmin for many years I would log on to a client, open command prompt and type :

wuauclt /detectnow  (Windows 7 / Windows Server 2008/2012 clients)

 

In Windows 10 you will notice that it doesn’t do anything and doesn’t show you anything. (As shown above)

(confirmed on https://blogs.technet.microsoft.com/yongrhee/2017/11/09/wuauclt-detectnow-in-windows-10-and-windows-server-2016/)

An example of “Whats New” in Windows 10, and Windows Server 2016 To check or scan “Windows Update” from the command prompt :
CMD (Run As Administrator)
c:\windows\system32\

UsoClient.exe startscan

And there is more switches….

  1. StartScan – Used To Start Scan
  2. StartDownload – Used to Start Download of Patches
  3. StartInstall – Used to Install Downloaded Patches
  4. RefreshSettings  – Refresh Settings if any changes were made
  5. StartInteractiveScan  – May ask for user input and/or open dialogues to show progress or report errors
  6. RestartDevice – Restart device to finish installation of updates
  7. ScanInstallWait – Combined Scan Download Install
  8. ResumeUpdate – Resume Update Installation On Boot

Create an ISO file with PowerShell post by Ben Liebowitz

Recently I came across this post. As a VMware admin, you often want to create an ISO as a quick method to copy files or installation files to a VM.

Ben Liebowitz shows how to create an ISO of large files with PowerShell. For the full post use the link below

http://thelowercasew.com/create-an-iso-file-with-powershell

All credit to  for this script

This is a copy of function to use incase the link above fails :

function itself:

 


#Get-Help About-Classesfunction New-IsoFile
{
<# .Synopsis Creates a new .iso file .Description The New-IsoFile cmdlet creates a new .iso file containing content from chosen folders .Example New-IsoFile “c:\tools”,”c:Downloads\utils” This command creates a .iso file in $env:temp folder (default location) that contains c:\tools and c:\downloads\utils folders. The folders themselves are included at the root of the .iso image. .Example New-IsoFile -FromClipboard -Verbose Before running this command, select and copy (Ctrl-C) files/folders in Explorer first. .Example dir c:\WinPE | New-IsoFile -Path c:\temp\WinPE.iso -BootFile “${env:ProgramFiles(x86)}\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\Oscdimg\efisys.bin” -Media DVDPLUSR -Title “WinPE” This command creates a bootable .iso file containing the content from c:\WinPE folder, but the folder itself isn’t included. Boot file etfsboot.com can be found in Windows ADK. Refer to IMAPI_MEDIA_PHYSICAL_TYPE enumeration for possible media types: http://msdn.microsoft.com/en-us/library/windows/desktop/aa366217(v=vs.85).aspx .Notes NAME: New-IsoFile AUTHOR: Chris Wu LASTEDIT: 03/23/2016 14:46:50 #>

[CmdletBinding(DefaultParameterSetName=’Source’)]Param(
[parameter(Position=1,Mandatory=$true,ValueFromPipeline=$true, ParameterSetName=’Source’)]$Source,
[parameter(Position=2)][string]$Path = “$env:temp\$((Get-Date).ToString(‘yyyyMMdd-HHmmss.ffff’)).iso”,
[ValidateScript({Test-Path -LiteralPath $_ -PathType Leaf})][string]$BootFile = $null,
[ValidateSet(‘CDR’,’CDRW’,’DVDRAM’,’DVDPLUSR’,’DVDPLUSRW’,’DVDPLUSR_DUALLAYER’,’DVDDASHR’,’DVDDASHRW’,’DVDDASHR_DUALLAYER’,’DISK’,’DVDPLUSRW_DUALLAYER’,’BDR’,’BDRE’)][string] $Media = ‘DVDPLUSRW_DUALLAYER’,
[string]$Title = (Get-Date).ToString(“yyyyMMdd-HHmmss.ffff”),
[switch]$Force,
[parameter(ParameterSetName=’Clipboard’)][switch]$FromClipboard
)

Begin {
($cp = new-object System.CodeDom.Compiler.CompilerParameters).CompilerOptions = ‘/unsafe’
if (!(‘ISOFile’ -as [type])) {
Add-Type -CompilerParameters $cp -TypeDefinition @’
public class ISOFile
{
public unsafe static void Create(string Path, object Stream, int BlockSize, int TotalBlocks)
{
int bytes = 0;
byte[] buf = new byte[BlockSize];
var ptr = (System.IntPtr)(&bytes);
var o = System.IO.File.OpenWrite(Path);
var i = Stream as System.Runtime.InteropServices.ComTypes.IStream;

if (o != null) {
while (TotalBlocks– > 0) {
i.Read(buf, BlockSize, ptr); o.Write(buf, 0, bytes);
}
o.Flush(); o.Close();
}
}
}
‘@
}

if ($BootFile) {
if(‘BDR’,’BDRE’ -contains $Media) { Write-Warning “Bootable image doesn’t seem to work with media type $Media” }
($Stream = New-Object -ComObject ADODB.Stream -Property @{Type=1}).Open() # adFileTypeBinary
$Stream.LoadFromFile((Get-Item -LiteralPath $BootFile).Fullname)
($Boot = New-Object -ComObject IMAPI2FS.BootOptions).AssignBootImage($Stream)
}

$MediaType = @(‘UNKNOWN’,’CDROM’,’CDR’,’CDRW’,’DVDROM’,’DVDRAM’,’DVDPLUSR’,’DVDPLUSRW’,’DVDPLUSR_DUALLAYER’,’DVDDASHR’,’DVDDASHRW’,’DVDDASHR_DUALLAYER’,’DISK’,’DVDPLUSRW_DUALLAYER’,’HDDVDROM’,’HDDVDR’,’HDDVDRAM’,’BDROM’,’BDR’,’BDRE’)

Write-Verbose -Message “Selected media type is $Media with value $($MediaType.IndexOf($Media))”
($Image = New-Object -com IMAPI2FS.MsftFileSystemImage -Property @{VolumeName=$Title}).ChooseImageDefaultsForMediaType($MediaType.IndexOf($Media))

if (!($Target = New-Item -Path $Path -ItemType File -Force:$Force -ErrorAction SilentlyContinue)) { Write-Error -Message “Cannot create file $Path. Use -Force parameter to overwrite if the target file already exists.”; break }
}

Process {
if($FromClipboard) {
if($PSVersionTable.PSVersion.Major -lt 5) { Write-Error -Message ‘The -FromClipboard parameter is only supported on PowerShell v5 or higher’; break }
$Source = Get-Clipboard -Format FileDropList
}

foreach($item in $Source) {
if($item -isnot [System.IO.FileInfo] -and $item -isnot [System.IO.DirectoryInfo]) {
$item = Get-Item -LiteralPath $item
}

if($item) {
Write-Verbose -Message “Adding item to the target image: $($item.FullName)”
try { $Image.Root.AddTree($item.FullName, $true) } catch { Write-Error -Message ($_.Exception.Message.Trim() + ‘ Try a different media type.’) }
}
}
}

End {
if ($Boot) { $Image.BootImageOptions=$Boot }
$Result = $Image.CreateResultImage()
[ISOFile]::Create($Target.FullName,$Result.ImageStream,$Result.BlockSize,$Result.TotalBlocks)
Write-Verbose -Message “Target image ($($Target.FullName)) has been created”
$Target
}
}


Ben goes on to share how he was able to create a variable for the source data, and use get-childitem to get that location and pipe that to creating the ISO. See below:


$source_dir = “Z:\Install\App123”
get-childitem “$source_dir” | New-ISOFile -path e:\iso\app123.iso

 

Client failed to RDP to RDS server following Windows Server Patching – CredSSP updates for CVE-2018-0886

CredSSP updates for CVE-2018-0886

That Monday morning issue when servers were patched on a Sunday… All Windows 10 clients fail to RDP to the RDS server following Windows Server Patching.

The cause?

“By default, after this update is installed, patched clients cannot communicate with unpatched servers. Use the interoperability matrix and group policy settings described in this article to enable an “allowed” configuration.”

https://support.microsoft.com/en-us/help/4093492/credssp-updates-for-cve-2018-0886-march-13-2018

Temp Solution until clients are patched

Create a registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters

CredSSP and Parameters keys had to be created
Create the AllowEncryptionOracle DWORD and give it a value of 2

or Command lined:

REG  ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters\ /v AllowEncryptionOracle /t REG_DWORD /d 2

 

Tested on Windows 7 and Windows 10.
No reboot required.

Note this reduces the security the patch was put in to fix

See an advert of interest, CLICK IT!  This site is funded by AD clicks.

Check / Set / Sync Time Source for Windows Servers

To set the time ( Tested against Windows 2016)

Launch CMD as administrator
exampled c:\time 09:00:00 AM   – This will set the time to 9am

Note a time source if domain joined will up date the time clock again
Check the source
c:\w32tm /query /status Will show the time “Source”

To set an internet based NTP

c:\w32tm /config /syncfromflags:manual /manualpeerlist:”0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org
3.pool.ntp.org”

This will take effect after stopping and starting the W32Time service

Powershell….
stop-service w32time
start-service w32time

for settings to take effect

check status
c:\w32tm /query /status Will show the new time “Source”

To check sync is working
c:\w32tm /resync (Check the time sync)

 

See an advert of interest, click it, this site is funded by ad clicks.

iPhone backups on Window 10

Is your iPhone backups filling your hard disk? Locate and relocate your back up files

Below is the locations of iPhone backups for each Windows OS.

Windows 8, Windows 10:

\Users\YOURUSERNAME\AppData\Roaming\Apple Computer\MobileSync\Backup

Windows 7 and Windows Vista:

C:\Users\<username>\AppData\Roaming\Apple Computer\MobileSync\Backup\

Windows XP:

C:\Documents and Settings\user\Application Data\Apple Computer\MobileSync\Backup”

Original detail can be found at igeeksblog.com