March 2017 – SCCMOG – Deployment Blog

27th March 201727th March 2017

SCCM Auto Snapshot a VM before Patching Task Sequence – PowerCLI

A while ago I mentioned in a post about creating a bespoke patching task sequence for a client who wanted to snap shot every VM before patching. To do this I created a silent install wrapper for PowerCLI using PowerShell.

Anyway, as per the request… here is the script I used to snapshot a VM before patching it during the Task sequence. It must be run as a command line step and using an account that has access to VSphere.

########################################################################################################################
#Author:       SCCMOG - Richie Schuster - SCCMOG.COM                                                                   #
#Date:         05/01/2017                                                                                              #
#Name:         Auto Snapshot VM before Patching                                                                        #
#RunAs CMD:    Powershell.exe -Executionpolicy Bypass -File PrePatchSnapShot.ps1                                       #
#Description:  This script has been created to auto snapshot a VM before patching by a task sequence from SCCM.        #
#              The script must be run as a Command Line in the task sequence by an account with access to VSphere.     #
########################################################################################################################

#Variables
$VMname = "$env:COMPUTERNAME.YOURDOMAIN.COM"
$VIserver = "YOURVISERVER.YOURDOMAIN.COM"
#$Username = "YourDomain\admin-SCCMOG"
#$Password = "CrazyPass"

#Create Credential to pass securely
#$Cred = New-Object System.Management.Automation.PSCredential($Username, (ConvertTo-SecureString $Password -AsPlainText -Force))

#Add the VMware snapin if not added
If ((Get-PSSnapin -Name VMware.VimAutomation.Core -ErrorAction SilentlyContinue) -eq $null ) {
    Add-PSSnapin VMware.VimAutomation.Core
    }

#Connect to VIC001
If ($global:DefaultVIServer -eq $null ) {
    Connect-VIServer -Server $VIserver #-Credential $Cred -Verbose
    }
ElseIF ($global:DefaultVIServer -ne $VIserver ) {
    #Disconnect all server connections
    Disconnect-VIServer -Server $global:DefaultVIServers -Force -Confirm:$false -WarningAction SilentlyContinue -ErrorAction SilentlyContinue | Out-Null
    #Re-connect to specific server
    Connect-VIServer -Server $VIserver
    }

#Reset Connected Variable
$Connected = $global:DefaultVIServer.Name -eq $VIserver

If ($Connected -eq $true) {

    #Snapshot Time
    #Time Date for Snapshot name
    $Date = Get-Date
    $DateShort = $Date.ToShortDateString() -replace '[/]'
    $TimeShort = $Date.ToShortTimeString()
    $Snapshotname = "Before Patching $TimeShort $DateShort"

    #Take Snapshot
    New-Snapshot -VM $VMname -Name $Snapshotname -Description "This Snapshot was taken before patching the VM from the SCCM TaskSequence. $Date" -Verbose

    #Check Snapshot complete
    $SnapShots = Get-Snapshot -VM $VMname
    $Taken = $Snapshots.Name.Contains($Snapshotname)
    
    #If found Disconnect and Exit Script Success 0
    If ($Taken -eq $true) {
        Disconnect-VIServer -Server $VIserver -Force -Confirm:$false -WarningAction SilentlyContinue -ErrorAction SilentlyContinue | Out-Null
        Exit 0
        }
    #If Failed Exit Script 999 Failing the Tasksequence
    Else {
    Exit 999
    }
}

Elseif ($Connected -eq $false) {
    Exit 911
    }
Else {
    Exit 912
    }
    
######################################################################################################################

########################################################################################################################

#Author: SCCMOG - Richie Schuster - SCCMOG.COM #

#Date: 05/01/2017 #

#Name: Auto Snapshot VM before Patching #

#RunAs CMD: Powershell.exe -Executionpolicy Bypass -File PrePatchSnapShot.ps1 #

#Description: This script has been created to auto snapshot a VM before patching by a task sequence from SCCM. #

# The script must be run as a Command Line in the task sequence by an account with access to VSphere. #

########################################################################################################################

#Variables

$VMname = "$env:COMPUTERNAME.YOURDOMAIN.COM"

$VIserver = "YOURVISERVER.YOURDOMAIN.COM"

#$Username = "YourDomain\admin-SCCMOG"

#$Password = "CrazyPass"

#Create Credential to pass securely

#$Cred = New-Object System.Management.Automation.PSCredential($Username, (ConvertTo-SecureString $Password -AsPlainText -Force))

#Add the VMware snapin if not added

If ((Get-PSSnapin -Name VMware.VimAutomation.Core -ErrorAction SilentlyContinue) -eq $null ) {

Add-PSSnapin VMware.VimAutomation.Core

}

#Connect to VIC001

If ($global:DefaultVIServer -eq $null ) {

Connect-VIServer -Server $VIserver #-Credential $Cred -Verbose

}

ElseIF ($global:DefaultVIServer -ne $VIserver ) {

#Disconnect all server connections

Disconnect-VIServer -Server $global:DefaultVIServers -Force -Confirm:$false -WarningAction SilentlyContinue -ErrorAction SilentlyContinue | Out-Null

#Re-connect to specific server

Connect-VIServer -Server $VIserver

}

#Reset Connected Variable

$Connected = $global:DefaultVIServer.Name -eq $VIserver

If ($Connected -eq $true) {

#Snapshot Time

#Time Date for Snapshot name

$Date = Get-Date

$DateShort = $Date.ToShortDateString() -replace '[/]'

$TimeShort = $Date.ToShortTimeString()

$Snapshotname = "Before Patching $TimeShort $DateShort"

#Take Snapshot

New-Snapshot -VM $VMname -Name $Snapshotname -Description "This Snapshot was taken before patching the VM from the SCCM TaskSequence. $Date" -Verbose

#Check Snapshot complete

$SnapShots = Get-Snapshot -VM $VMname

$Taken = $Snapshots.Name.Contains($Snapshotname)

#If found Disconnect and Exit Script Success 0

If ($Taken -eq $true) {

Disconnect-VIServer -Server $VIserver -Force -Confirm:$false -WarningAction SilentlyContinue -ErrorAction SilentlyContinue | Out-Null

Exit 0

}

#If Failed Exit Script 999 Failing the Tasksequence

Else {

Exit 999

}

Elseif ($Connected -eq $false) {

Exit 911

}

Else {

Exit 912

}

######################################################################################################################

6th March 2017

SCCM WSUS Proxy – Allow Basic Authentication

I was at a clients today and came across the issue to do with Credentials for a proxy that are required to be sent as clear text. The exact tick box wording is:

“Allow Basic Authentication (password is sent in cleartext)”

Anyway after hunting around to find a solution for SCCM 2012 and above installations, I came to the conclusion that it would be quicker to write a script to check the configuration and change if it has been removed by SCCM. This script runs as a scheduled task and I have included the XML for that also below.

The Script:

################################################################################
# Author  : SCCMOG - Richie Schuster C5                                        #
# Website : www.sccmog.com                                                     #
# Usage   : .\Set-WSUSCredsNonSSL                                              #
# Version : 2.7                                                                #
# Created : 2014/07/17                                                         #
# Purpose : This script was created to be run as a scheduled task to reset the #
#         : "Allow Basic Authentication" in the proxy server settingd of WSUS  #
#         : as SCCM removes this setting while performaing maintanance tasks.  #
################################################################################


#Connect to WSUS Configuration
#Set WSUS server to connect to
$wsusserver = "SCCMOG-CM-01"

#Load required assemblies
[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")

#Connect to WSUS Remote
#$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer($wsusserver,$false)
#Connect to WSUS Local
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer()

#$WSUS | FL *
#$WSUS | Get-Member

$Config = $wsus.GetConfiguration()
$CurrentSetting = $Config.AllowProxyCredentialsOverNonSsl

If ($CurrentSetting -ne $true){
    Write-Host "Incorrect... Correcting!" -ForegroundColor Yellow
    $Config.AllowProxyCredentialsOverNonSsl = $true
    $Config.Save()
    Exit 0
    }
Else {
    Write-Host "Still Correct!" -ForegroundColor Green
    Exit 0
    }

################################################################################

################################################################################

# Author : SCCMOG - Richie Schuster C5 #

# Website : www.sccmog.com #

# Usage : .\Set-WSUSCredsNonSSL #

# Version : 2.7 #

# Created : 2014/07/17 #

# Purpose : This script was created to be run as a scheduled task to reset the #

# : "Allow Basic Authentication" in the proxy server settingd of WSUS #

# : as SCCM removes this setting while performaing maintanance tasks. #

################################################################################

#Connect to WSUS Configuration

#Set WSUS server to connect to

$wsusserver = "SCCMOG-CM-01"

#Load required assemblies

[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")

#Connect to WSUS Remote

#$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer($wsusserver,$false)

#Connect to WSUS Local

$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer()

#$WSUS | FL *

#$WSUS | Get-Member

$Config = $wsus.GetConfiguration()

$CurrentSetting = $Config.AllowProxyCredentialsOverNonSsl

If ($CurrentSetting -ne $true){

Write-Host "Incorrect... Correcting!" -ForegroundColor Yellow

$Config.AllowProxyCredentialsOverNonSsl = $true

$Config.Save()

Exit 0

}

Else {

Write-Host "Still Correct!" -ForegroundColor Green

Exit 0

}

################################################################################

The Scheduled Task XML to be imported:

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2017-03-06T20:11:59.7036984</Date>
    <Author>LAB\SCCM-Admin</Author>
  </RegistrationInfo>
  <Triggers>
    <TimeTrigger>
      <Repetition>
        <Interval>PT1M</Interval>
        <StopAtDurationEnd>false</StopAtDurationEnd>
      </Repetition>
      <StartBoundary>2017-03-06T20:13:05</StartBoundary>
      <Enabled>true</Enabled>
    </TimeTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>S-1-5-18</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>false</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>P3D</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>Powershell.exe</Command>
      <Arguments>-Executionpolicy Bypass -file E:\Change\ToYourLocation\Set-WSUSCredsNonSSL.ps1</Arguments>
    </Exec>
  </Actions>
</Task>

<?xml version="1.0" encoding="UTF-16"?>

<Author>LAB\SCCM-Admin</Author>

</RegistrationInfo>

<StopAtDurationEnd>false</StopAtDurationEnd>

</Repetition>

</TimeTrigger>

</Triggers>

<RunLevel>HighestAvailable</RunLevel>

</Principal>

</Principals>

<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>

<StartWhenAvailable>false</StartWhenAvailable>

<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>

<RestartOnIdle>false</RestartOnIdle>

</IdleSettings>

<Hidden>false</Hidden>

<RunOnlyIfIdle>false</RunOnlyIfIdle>

<WakeToRun>false</WakeToRun>

</Settings>

<Exec>

<Command>Powershell.exe</Command>

<Arguments>-Executionpolicy Bypass -file E:\Change\ToYourLocation\Set-WSUSCredsNonSSL.ps1</Arguments>

</Exec>

</Actions>

</Task>

4th March 20174th March 2017

Get Logged On User WMI PowerShell

Ever needed to figure out who is logged on when deploying software to a machine with SCCM?
Maybe you needed to do so… like me… to copy a specific file into that users AppData?

Anyway quick PowerShell script to figure out the currently logged on user of a Machine.

################################################################################
#Author: SCCMOG.COM - Richie Schuster                                          #
#Date: 04/03/2017                                                              #
#Script Name: Get Logged on User                                               #
################################################################################

#Get logged on User
$Loggedon = Get-WmiObject -ComputerName $env:COMPUTERNAME -Class Win32_Computersystem | Select-Object UserName
#Split User and Domain
$Domain,$User = $Loggedon.Username.split('\',2)
Write-Host $Domain
Write-Host $User

################################################################################

################################################################################

#Author: SCCMOG.COM - Richie Schuster #

#Date: 04/03/2017 #

#Script Name: Get Logged on User #

################################################################################

#Get logged on User

$Loggedon = Get-WmiObject -ComputerName $env:COMPUTERNAME -Class Win32_Computersystem | Select-Object UserName

#Split User and Domain

$Domain,$User = $Loggedon.Username.split('\',2)

Write-Host $Domain

Write-Host $User

################################################################################

3rd March 20173rd March 2017

Disable or Enable Sophos Services PowerShell Script

I was working at a clients the other month and was getting frustrated with Sophos interfering with what I was try to accomplish.

Here is a quick script to Disable the Sophos services when needed and then Enable the Sophos services when you have finished. Commands are in the info of the script.

#########################################################################################################
#Script Name:   Disable/Enable Sophos                                                                   #
#Script Author: SCCMOG - Richie Schuster 03/03/2017 WWW.SCCMOG.COM                                      #
#########################################################################################################
#Script Usage: "Disable-Enable_Sophos.ps1 -Mode Disable" to disable and "-Mode enable" to enable.       #
#########################################################################################################
 
 #Install Mode Parameter
PARAM (
    [string]$MODE
)
 
#Sophos Service names
$SophosServices = @("Sophos Agent", "SAVService", "SAVAdminService",`
                    "Sophos AutoUpdate Service", "Sophos Device Control Service",`
                    "Sophos Message Router", "SntpService", "sophossps",`
                    "Sophos Web Control Service", "swi_service", "swi_update_64")

#If entry is input run script
If ($mode -ne $null){   
    #If Mode input is Enable - Enable sophos services
    If ($MODE -eq "Enable"){
        foreach ($Service in $SophosServices){
                Set-Service -Name $Service -StartupType Automatic
                start-Service -Name $Service -Force
                }
        }
    #If Model is Disable - Disable sophos  services
    If ($MODE -eq "Disable"){                
        foreach ($Service in $SophosServices){
                Set-Service -Name $Service -StartupType Disabled
                Stop-Service -Name $Service -Force
                }
        }
    #If mode input does not match inform user.
    Else{
        Write-host 'Incorrect Params please format this way: "Disable-Enable_Sophos.ps1 -Mode Disable"`
                    to disable and "-Mode enable" to enable.'
    }
}
#If params are not specified then inform.
Else{
    Write-host 'Script Params must be used : "Disable-Enable_Sophos.ps1 -Mode Disable" to disable and`
               "-Mode enable" to enable.'
    }
#########################################################################################################

#########################################################################################################

#Script Name: Disable/Enable Sophos #

#Script Author: SCCMOG - Richie Schuster 03/03/2017 WWW.SCCMOG.COM #

#########################################################################################################

#Script Usage: "Disable-Enable_Sophos.ps1 -Mode Disable" to disable and "-Mode enable" to enable. #

#########################################################################################################

#Install Mode Parameter

PARAM (

[string]$MODE

)

#Sophos Service names

$SophosServices = @("Sophos Agent", "SAVService", "SAVAdminService",`

"Sophos AutoUpdate Service", "Sophos Device Control Service",`

"Sophos Message Router", "SntpService", "sophossps",`

"Sophos Web Control Service", "swi_service", "swi_update_64")

#If entry is input run script

If ($mode -ne $null){

#If Mode input is Enable - Enable sophos services

If ($MODE -eq "Enable"){

foreach ($Service in $SophosServices){

Set-Service -Name $Service -StartupType Automatic

start-Service -Name $Service -Force

}

#If Model is Disable - Disable sophos services

If ($MODE -eq "Disable"){

foreach ($Service in $SophosServices){

Set-Service -Name $Service -StartupType Disabled

Stop-Service -Name $Service -Force

}

#If mode input does not match inform user.

Else{

Write-host 'Incorrect Params please format this way: "Disable-Enable_Sophos.ps1 -Mode Disable"`

to disable and "-Mode enable" to enable.'

}

#If params are not specified then inform.

Else{

Write-host 'Script Params must be used : "Disable-Enable_Sophos.ps1 -Mode Disable" to disable and`

"-Mode enable" to enable.'

}

#########################################################################################################