SCCMOG – Page 4 – SCCMOG

20th May 2017

PowerShell Check Power Adapter Connected Upgrade UEFI/BIOS – SCCM Application

The other month I was asked by one of my clients to deploy a BIOS/UEFI upgrade to the HP Elite x2 1012 G1. Now this as we all know is fine and very normal, the only issue I had was ensuring that the Power adapter was connected before running the BIOS/UEFI upgrade. This is because.. when you use the force switch on the HP upgrade utility it does not check for the Power Adapter state and also bypasses low battery and will install regardless.

So I created a script….

This script is designed to be run with the BIOS/UEFI upgrade package within.

It will check first the Hardware type of the device (2 being Laptop, 1 being Desktop) making sure it is a mobile device.
The script will then check the WMI property “PowerOnLine” to establish whether or not the power adapter is connected.
If the Power Adapter is connected it will continue with the BIOS/UEFI upgrade (Jump to step 5)
If the Power Adapter is not connected it will warn the user 10 times before closing and informing the User to Re-Run the application from Software Center when power is available. (Warning count is customizable)
The script will then identify the BIOS/UEFI version and if it is less that the version being deployed it will then warn and install the new BIOS/UEFI version.
The script also does error checking around the Model of the machine.

Anyway enough already… Here is the script. As always feel free to use it but don’t forget where you got it from!

###########################################################################################################################
#Author:        SCCMOG - Richie Schuster - SCCMOG.COM                                                                     #
#ModdedBy:      Your Name here                                                                                            #
#Date:          20/05/2017                                                                                                #
#Name:          Check-PowerAdapter.ps1                                                                                    #
#ConfigMgr/CMD: Powershell.exe -Executionpolicy Bypass -File Check-PowerAdapterUpgradeUEFI.ps1                            #    
#Description:   This script will check if the power adapter has been connected to a system before it continues. It will   #
#           :   also check hardware type and has been configured to only run on laptops. This can be run as an application#
#           :   set to available deployment and visable to user. All comments as always throughout the script explain each#
#           :   step in detail. This was used to upgrade a BIOS/UEFI.                                                     #
###########################################################################################################################

#Amount of times to warn user before exiting.
$maxRepeat = 10
#Your Organisation for the prompts
$Organisation = "SCCMOG"
#New BIOS/UEFI version to deploy.
$NewBiosVersion = "N85 Ver. 01.19"
#WMI Model name of machines to upgrade
$UpgradeModel = "HP Elite x2 1012 G1"


#Add windows forms assembly
Add-Type -AssemblyName System.Windows.Forms | Out-Null

#Check hardware is mobile type
$hardwaretype = Get-WmiObject -Class Win32_ComputerSystem -Property PCSystemType
If ($($hardwaretype.PCSystemType) -ne 1) { 
    #Get Power State
    [BOOL]$Power = (Get-WmiObject -Class BatteryStatus -Namespace root\wmi -ComputerName $env:COMPUTERNAME).PowerOnLine
    #If power not connected warn user and re check until it is or the $MaxRepeat has exceeded
    If ($Power -ne $true) {
        #Keep checking power until one of the until states is true
        do 
        {
            #Reduces MAx repeat by 1
            $maxRepeat--
            #Create Message Box
            $ReturnPower = [System.Windows.Forms.MessageBox]::Show("Please connect the power adapter to continue! $maxRepeat tries remaining!", $Organisation,
            [System.Windows.Forms.MessageBoxButtons]::OKCancel,
            [System.Windows.Forms.MessageBoxIcon]::Warning)
            #If user clicks ok check power state again
            If ($ReturnPower -imatch "OK") {
            [BOOL]$Power = (Get-WmiObject -Class BatteryStatus -Namespace root\wmi -ComputerName $env:COMPUTERNAME).PowerOnLine
            }
        }
        until ($Power -eq $true -or $maxRepeat -eq 0 -or $ReturnPower -imatch "Cancel")
        #If Max repeat hits 0 inform user that they did not comply so the application is exiting
        If ($maxRepeat -eq 0) {
            [System.Windows.Forms.MessageBox]::Show("You didnt connect the power adapter! Please re run from Software Center when power is avalable. Exiting...", $Organisation,
            [System.Windows.Forms.MessageBoxButtons]::OK,
            [System.Windows.Forms.MessageBoxIcon]::ERROR)  
            #Write-Host "You didnt connect power! Please re run from Software Center when power is avalable. Exiting..." -ForegroundColor "Magenta"
            Exit 0
            }
        #If User presses cancel inform user that they did not comply so the application is exiting
        Elseif ($ReturnPower -imatch "Cancel"){
            Write-Host "You Canceled the BIOS/UEFI upgrade please re run when power is avalable." -foregroundcolor "green"
            [System.Windows.Forms.MessageBox]::Show("You Canceled the BIOS/UEFI upgrade please re run from Software Center when power is avalable.", $Organisation,
            [System.Windows.Forms.MessageBoxButtons]::OK,
            [System.Windows.Forms.MessageBoxIcon]::Warning)
            Exit 0
            }
        #If the power is connected then continue
        Elseif ($Power -eq $true){
            [System.Windows.Forms.MessageBox]::Show("Thank you for connecting the power to the device. Please wait for the BIOS/UEFI upgrade to complete until removing the power.", $Organisation,
            [System.Windows.Forms.MessageBoxButtons]::OK,
            [System.Windows.Forms.MessageBoxIcon]::Warning)  
        }
        #Shouldnt get here...
        Else {
            [System.Windows.Forms.MessageBox]::Show("Something went wrong. Please contact the service desk to have the situation corrected.", $Organisation,
            [System.Windows.Forms.MessageBoxButtons]::OK,
            [System.Windows.Forms.MessageBoxIcon]::Error)  
            Exit 0
        }
    }
    #If power is already connected continue....
    Else {
        [System.Windows.Forms.MessageBox]::Show("Succesfully found power adapter. Please wait for the BIOS/UEFI upgrade to complete until removing the power. This usually takes 5 minutes.", $Organisation,
        [System.Windows.Forms.MessageBoxButtons]::OK,
        [System.Windows.Forms.MessageBoxIcon]::Warning)      
    }
}
#If machine is not mobile prompt user.
Else {
    [System.Windows.Forms.MessageBox]::Show("This is a Desktop or Server Machine. Please contact the service desk to have the situation corrected.", $Organisation,
    [System.Windows.Forms.MessageBoxButtons]::OK,
    [System.Windows.Forms.MessageBoxIcon]::Error)
    Exit 0  
}
#Finally launch the BIOS/UEFI Executable....
If ($Power -eq $true) {
        #Current Model
        $Model = Get-WmiObject Win32_ComputerSystem | Select-Object Model
        $Model = $Model.Model
        #If model matches continue
        If ($Model -imatch $UpgradeModel) {
            #Get BIOS/UEFI version
            $BIOS = Get-WmiObject Win32_bios | Select-Object SMBIOSBIOSVersion
            $CurrentBiosVersion = $BIOS.SMBIOSBIOSVersion
                #If current version is less than new BIOS/UEFI version continue.
                If ($CurrentBiosVersion -lt $NewBiosVersion) {
                    #Write-Host "$CurrentBiosVersion is less than $NewBiosVersion. Proceeding to upgrade BIOS" -ForegroundColor "Yellow"
                    #Warn User reboot about to occur and give them the option to cancel
                    $Return = [System.Windows.Forms.MessageBox]::Show("The Machine will now reboot to allow the BIOS/UEFI of this machine to upgrade. Please click OK to continue once all you work is saved.", $Organisation,
                    [System.Windows.Forms.MessageBoxButtons]::OKCancel,
                    [System.Windows.Forms.MessageBoxIcon]::Warning)
                        #If they clicked on continue with the upgrade.
                        If ($Return -imatch "OK") {
                        Write-Host "User Clicked OK! Startin BIOS/UEFI upgrade!"
                        #Start-Process "$PSScriptRoot\HPBIOSUPDREC64.exe" -ArgumentList "-a -s -f dp0N85_0119.bin -a -h -b"
                        }
                        #If they clicked cancel warn and exit
                        Elseif ($Return -imatch "Cancel") {
                        #Write-Host "User Clicked Cancel! Stopping BIOS/UEFI upgrade!"
                        [System.Windows.Forms.MessageBox]::Show("The BIOS/UEFI Upgrade has been stopped please re-run when convenient.", $Organisation,
                        [System.Windows.Forms.MessageBoxButtons]::OK,
                        [System.Windows.Forms.MessageBoxIcon]::Information)
                        Exit 0
                        }
                }
                #If the BIOS/UEFI version is eq to the current then quit.
                Elseif ($CurrentBiosVersion -eq $NewBiosVersion) {
                    [System.Windows.Forms.MessageBox]::Show("The BIOS/UEFI Upgrade has been stopped! You machine's UEFI/BIOS version $CurrentBiosVersion is equal to $NewBiosVersion. Please click OK to quit.", $Organisation,
                    [System.Windows.Forms.MessageBoxButtons]::OK,
                    [System.Windows.Forms.MessageBoxIcon]::Information)
                    Exit 0
                }
                #If the current BIOS/UEFI is gt the new BIOS/UEFI version quit and warn
                Elseif ($CurrentBiosVersion -gt $NewBiosVersion) {
                    [System.Windows.Forms.MessageBox]::Show("The BIOS/UEFI Upgrade has been stopped! You machine's UEFI/BIOS version $CurrentBiosVersion is greater than $NewBiosVersion, no need to upgrade. Please click OK to quit.", $Organisation,
                    [System.Windows.Forms.MessageBoxButtons]::OK,
                    [System.Windows.Forms.MessageBoxIcon]::Information)
                    Exit 0                    
                }
        }
        #Wrong model for Upgrade.
        Else {
            [System.Windows.Forms.MessageBox]::Show("The BIOS/UEFI Upgrade has been stopped! You machine is the incorrect model for this upgrade: $Model", $Organisation,
            [System.Windows.Forms.MessageBoxButtons]::OK,
            [System.Windows.Forms.MessageBoxIcon]::Error)
            Exit 0
        }
}
###############################################################################################################

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

###########################################################################################################################

#Author: SCCMOG - Richie Schuster - SCCMOG.COM #

#ModdedBy: Your Name here #

#Date: 20/05/2017 #

#Name: Check-PowerAdapter.ps1 #

#ConfigMgr/CMD: Powershell.exe -Executionpolicy Bypass -File Check-PowerAdapterUpgradeUEFI.ps1 #

#Description: This script will check if the power adapter has been connected to a system before it continues. It will #

# : also check hardware type and has been configured to only run on laptops. This can be run as an application#

# : set to available deployment and visable to user. All comments as always throughout the script explain each#

# : step in detail. This was used to upgrade a BIOS/UEFI. #

###########################################################################################################################

#Amount of times to warn user before exiting.

$maxRepeat = 10

#Your Organisation for the prompts

$Organisation = "SCCMOG"

#New BIOS/UEFI version to deploy.

$NewBiosVersion = "N85 Ver. 01.19"

#WMI Model name of machines to upgrade

$UpgradeModel = "HP Elite x2 1012 G1"

#Add windows forms assembly

Add-Type -AssemblyName System.Windows.Forms | Out-Null

#Check hardware is mobile type

$hardwaretype = Get-WmiObject -Class Win32_ComputerSystem -Property PCSystemType

If ($($hardwaretype.PCSystemType) -ne 1) {

#Get Power State

[BOOL]$Power = (Get-WmiObject -Class BatteryStatus -Namespace root\wmi -ComputerName $env:COMPUTERNAME).PowerOnLine

#If power not connected warn user and re check until it is or the $MaxRepeat has exceeded

If ($Power -ne $true) {

#Keep checking power until one of the until states is true

{

#Reduces MAx repeat by 1

$maxRepeat--

#Create Message Box

$ReturnPower = [System.Windows.Forms.MessageBox]::Show("Please connect the power adapter to continue! $maxRepeat tries remaining!", $Organisation,

[System.Windows.Forms.MessageBoxButtons]::OKCancel,

[System.Windows.Forms.MessageBoxIcon]::Warning)

#If user clicks ok check power state again

If ($ReturnPower -imatch "OK") {

[BOOL]$Power = (Get-WmiObject -Class BatteryStatus -Namespace root\wmi -ComputerName $env:COMPUTERNAME).PowerOnLine

}

until ($Power -eq $true -or $maxRepeat -eq 0 -or $ReturnPower -imatch "Cancel")

#If Max repeat hits 0 inform user that they did not comply so the application is exiting

If ($maxRepeat -eq 0) {

[System.Windows.Forms.MessageBox]::Show("You didnt connect the power adapter! Please re run from Software Center when power is avalable. Exiting...", $Organisation,

[System.Windows.Forms.MessageBoxButtons]::OK,

[System.Windows.Forms.MessageBoxIcon]::ERROR)

#Write-Host "You didnt connect power! Please re run from Software Center when power is avalable. Exiting..." -ForegroundColor "Magenta"

Exit 0

}

#If User presses cancel inform user that they did not comply so the application is exiting

Elseif ($ReturnPower -imatch "Cancel"){

Write-Host "You Canceled the BIOS/UEFI upgrade please re run when power is avalable." -foregroundcolor "green"

[System.Windows.Forms.MessageBox]::Show("You Canceled the BIOS/UEFI upgrade please re run from Software Center when power is avalable.", $Organisation,

[System.Windows.Forms.MessageBoxButtons]::OK,

[System.Windows.Forms.MessageBoxIcon]::Warning)

Exit 0

}

#If the power is connected then continue

Elseif ($Power -eq $true){

[System.Windows.Forms.MessageBox]::Show("Thank you for connecting the power to the device. Please wait for the BIOS/UEFI upgrade to complete until removing the power.", $Organisation,

[System.Windows.Forms.MessageBoxButtons]::OK,

[System.Windows.Forms.MessageBoxIcon]::Warning)

}

#Shouldnt get here...

Else {

[System.Windows.Forms.MessageBox]::Show("Something went wrong. Please contact the service desk to have the situation corrected.", $Organisation,

[System.Windows.Forms.MessageBoxButtons]::OK,

[System.Windows.Forms.MessageBoxIcon]::Error)

Exit 0

}

#If power is already connected continue....

Else {

[System.Windows.Forms.MessageBox]::Show("Succesfully found power adapter. Please wait for the BIOS/UEFI upgrade to complete until removing the power. This usually takes 5 minutes.", $Organisation,

[System.Windows.Forms.MessageBoxButtons]::OK,

[System.Windows.Forms.MessageBoxIcon]::Warning)

}

#If machine is not mobile prompt user.

Else {

[System.Windows.Forms.MessageBox]::Show("This is a Desktop or Server Machine. Please contact the service desk to have the situation corrected.", $Organisation,

[System.Windows.Forms.MessageBoxButtons]::OK,

[System.Windows.Forms.MessageBoxIcon]::Error)

Exit 0

}

#Finally launch the BIOS/UEFI Executable....

If ($Power -eq $true) {

#Current Model

$Model = Get-WmiObject Win32_ComputerSystem | Select-Object Model

$Model = $Model.Model

#If model matches continue

If ($Model -imatch $UpgradeModel) {

#Get BIOS/UEFI version

$BIOS = Get-WmiObject Win32_bios | Select-Object SMBIOSBIOSVersion

$CurrentBiosVersion = $BIOS.SMBIOSBIOSVersion

#If current version is less than new BIOS/UEFI version continue.

If ($CurrentBiosVersion -lt $NewBiosVersion) {

#Write-Host "$CurrentBiosVersion is less than $NewBiosVersion. Proceeding to upgrade BIOS" -ForegroundColor "Yellow"

#Warn User reboot about to occur and give them the option to cancel

$Return = [System.Windows.Forms.MessageBox]::Show("The Machine will now reboot to allow the BIOS/UEFI of this machine to upgrade. Please click OK to continue once all you work is saved.", $Organisation,

[System.Windows.Forms.MessageBoxButtons]::OKCancel,

[System.Windows.Forms.MessageBoxIcon]::Warning)

#If they clicked on continue with the upgrade.

If ($Return -imatch "OK") {

Write-Host "User Clicked OK! Startin BIOS/UEFI upgrade!"

#Start-Process "$PSScriptRoot\HPBIOSUPDREC64.exe" -ArgumentList "-a -s -f dp0N85_0119.bin -a -h -b"

}

#If they clicked cancel warn and exit

Elseif ($Return -imatch "Cancel") {

#Write-Host "User Clicked Cancel! Stopping BIOS/UEFI upgrade!"

[System.Windows.Forms.MessageBox]::Show("The BIOS/UEFI Upgrade has been stopped please re-run when convenient.", $Organisation,

[System.Windows.Forms.MessageBoxButtons]::OK,

[System.Windows.Forms.MessageBoxIcon]::Information)

Exit 0

}

#If the BIOS/UEFI version is eq to the current then quit.

Elseif ($CurrentBiosVersion -eq $NewBiosVersion) {

[System.Windows.Forms.MessageBox]::Show("The BIOS/UEFI Upgrade has been stopped! You machine's UEFI/BIOS version $CurrentBiosVersion is equal to $NewBiosVersion. Please click OK to quit.", $Organisation,

[System.Windows.Forms.MessageBoxButtons]::OK,

[System.Windows.Forms.MessageBoxIcon]::Information)

Exit 0

}

#If the current BIOS/UEFI is gt the new BIOS/UEFI version quit and warn

Elseif ($CurrentBiosVersion -gt $NewBiosVersion) {

[System.Windows.Forms.MessageBox]::Show("The BIOS/UEFI Upgrade has been stopped! You machine's UEFI/BIOS version $CurrentBiosVersion is greater than $NewBiosVersion, no need to upgrade. Please click OK to quit.", $Organisation,

[System.Windows.Forms.MessageBoxButtons]::OK,

[System.Windows.Forms.MessageBoxIcon]::Information)

Exit 0

}

#Wrong model for Upgrade.

Else {

[System.Windows.Forms.MessageBox]::Show("The BIOS/UEFI Upgrade has been stopped! You machine is the incorrect model for this upgrade: $Model", $Organisation,

[System.Windows.Forms.MessageBoxButtons]::OK,

[System.Windows.Forms.MessageBoxIcon]::Error)

Exit 0

}

###############################################################################################################

3rd May 2017

Get Current or old Machine Name from WinPE VBScript

This script was designed to get the current or old computer name from WinPE and apply it to the Task Sequence Variable OSDComputerName.

It has been written in VBScript to not require PowerShell in the boot image.

Here is the script:

'====================================================
'Author: Richie Schuster - SCCMOG.com
'Date  : 24-03-2017
'Info  : Script finds old machine name for refresh Scenario and prepopulates it
'====================================================

Option Explicit
'On Error Resume Next

Dim oShell, env, objWMIService, colItems, objItem, strWinDrive, strCurrentComputer
Const strComputer = "."

Set oShell = WScript.CreateObject("WScript.Shell")
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set env = CreateObject("Microsoft.SMS.TSEnvironment")

'End Header

' Worker

'Get Windows drive
Set colItems = objWMIService.ExecQuery ("Select * From Win32_LogicalDisk Where VolumeName = 'Windows'")
For Each objItem in colItems
	strWinDrive = objItem.DeviceID
Next

'Check Task Sequence found a Windows Drive
If IsNull(strWinDrive)  Or  IsEmpty(strWinDrive) Then
   MsgBox "The TaskSequence could not locate a previous Machine Name. Please PXE again and deploy this as a new machine!", 6, "No Previous Machine Name"
   WScript.Quit 1
Else
'Mount Registry from Windows Drive
oShell.Run "cmd.exe /c REG LOAD HKLM\TempHive " & strWinDrive & "\windows\system32\config\system",0,True
strCurrentComputer = oShell.RegRead("HKLM\TempHive\ControlSet001\Control\ComputerName\ComputerName\computername")
env("OSDComputerName") = strCurrentComputer
WScript.Quit 0
End If

'====================================================

'Author: Richie Schuster - SCCMOG.com

'Date : 24-03-2017

'Info : Script finds old machine name for refresh Scenario and prepopulates it

'====================================================

Option Explicit

'On Error Resume Next

Dim oShell, env, objWMIService, colItems, objItem, strWinDrive, strCurrentComputer

Const strComputer = "."

Set oShell = WScript.CreateObject("WScript.Shell")

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set env = CreateObject("Microsoft.SMS.TSEnvironment")

'End Header

' Worker

'Get Windows drive

Set colItems = objWMIService.ExecQuery ("Select * From Win32_LogicalDisk Where VolumeName = 'Windows'")

For Each objItem in colItems

strWinDrive = objItem.DeviceID

'Check Task Sequence found a Windows Drive

If IsNull(strWinDrive) Or IsEmpty(strWinDrive) Then

MsgBox "The TaskSequence could not locate a previous Machine Name. Please PXE again and deploy this as a new machine!", 6, "No Previous Machine Name"

WScript.Quit 1

Else

'Mount Registry from Windows Drive

oShell.Run "cmd.exe /c REG LOAD HKLM\TempHive " & strWinDrive & "\windows\system32\config\system",0,True

strCurrentComputer = oShell.RegRead("HKLM\TempHive\ControlSet001\Control\ComputerName\ComputerName\computername")

env("OSDComputerName") = strCurrentComputer

WScript.Quit 0

End If

3rd May 2017

Scheduled Task Set ADR Disabled or Enabled SCCM ConfigMgr

When I setup a customers SCCM (ConfigMgr) site for patching I use ADR’s (Automatic Deployment Rules) to create a no hassle patching cycle each month.
This is done by automatically creating the monthly Software Update groups and then creating the deployments but NOT enabling them to the customer’s Pilot collections, Release Collections and Production Collections. This allows the customer to effectively “right click, enable” the deployment to that collection when ready.

The problem you have with this is the “Critical” security patches that are released out of the usual time period. You know the patches that cover that hole that no one noticed before release!
Anyway to get round that I create more ADR’s that run every day checking for a “Critical” Patch release. The issue with this is if left… Yep you guessed it, it will run on the monthly schedule day as well, which will just duplicate content.

So I came up with this Script to be run as a Scheduled Task by a service account just before the main ADR’s run and then later that day when they are complete.

Here is the Script:

##############################################################################################################################################
#Author: C5 Richie Schuster - SCCMOG.COM
#Script: Set-ADREnableDisabled
#Usage : "Set-ADREnableDisabled -State Enabled -SiteCode S0G" or "Set-ADREnableDisabled -State Disabled -SiteCode S0G"
#Info  : This script was writtent to run as a scheduled task to automatically disable and enable ADR Rules specified in the variable $ADRNames
##############################################################################################################################################
#Parameters
Param
(
[parameter(mandatory=$true,HelpMessage="Please, provide your SiteCode.")][ValidateNotNullOrEmpty()][String]$SiteCode = "",
[parameter(mandatory=$true,HelpMessage="Please, provide a state for the script to Run e.g. Enable or Disable")][ValidateNotNullOrEmpty()][String]$State = ""
)

#ADR Names stored in ARRAY -  Copy and Pasted name of ADR Bellow.
$ADRNames = @("ADR Critical Security Releases Windows 10 1607",`
            "ADR Critical Security Releases Windows 10 1511")

#Disable warnings for Fast switch
$CMPSSuppressFastNotUsedCheck = $true

# Check for elevation
Write-Host "Checking for elevation"
If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(`
    [Security.Principal.WindowsBuiltInRole] "Administrator"))
{
    Write-Warning "Oupps, you need to run this script from an elevated PowerShell prompt!`nPlease start the PowerShell prompt as an Administrator and re-run the script."
    Write-Warning "Aborting script..."
    Break
}
#Import Module but check if user entered sitecode
If ($SiteCode -ne "") {
#[string]$SiteCode = "P01"
# Import the ConfigurationManager.psd1 module 
Write-Host "Importing ConfigMgr Module..." -ForegroundColor Yellow
Import-Module "$($ENV:SMS_ADMIN_UI_PATH)\..\ConfigurationManager.psd1"
# Set the current location to be the site code.
Write-Host "Setting Location to ConfigMgr Drive..." -ForegroundColor Yellow
Set-Location "$SiteCode`:"
}
Else {
    Write-Warning "Oupps, you need to enter a Site code!`nPlease use the -SiteCode followed by your sitecode."
    Write-Warning "Aborting script..."
    Break
}

#If State set to Disable
If ($State -eq "Disable") {
    Foreach ($ADR in $ADRNames) {
        #Retrieve ADR information
        $RetADR = Get-CMSoftwareUpdateAutoDeploymentRule -Name $ADR
            #Check if ADR is Enabled and if so disable
            If ($RetADR.AutoDeploymentEnabled -eq $True) {
                Write-Host "Its On... Disabling...." -ForegroundColor Yellow
                #Disable ADR
                Set-CMSoftwareUpdateAutoDeploymentRule -Name $RetADR.Name -Enable $false
                #Check Action successfully completed.
                $Check = Get-CMSoftwareUpdateAutoDeploymentRule -Name $ADR
                If ($Check.AutoDeploymentEnabled -eq $False) {
                    Write-Host "Successfully Disabled $($Check.Name)!" -ForegroundColor Green
                    }
            }
            #If ADR Already Enabled Warn User and move onto next.
            ElseIf ($RetADR.AutoDeploymentEnabled -eq $false) {
                    Write-Host "$($Check.Name) is already disabled!" -ForegroundColor Green
            }
            #If ADR same as previous name or not pupulated then warn user.
            Elseif (($RetADR.Name -ne $ADR) -or ($RetADR -eq $null)) {
                    Write-Host "ADR $ADR cannot be found!" -ForegroundColor Red        
            }
            #If you hit this something fishy is going on!
            Else {
                Write-Host "Error please message Richie Schuster C5 - SCCMOG.com" -ForegroundColor Red 
            }
    }
}

#If State set to Enable
ElseIf ($State -eq "Enable") {
    Foreach ($ADR in $ADRNames) {
        #Retrieve ADR information
        $RetADR = Get-CMSoftwareUpdateAutoDeploymentRule -Name $ADR
            #Check if ADR is Disabled and if so enable
            If ($RetADR.AutoDeploymentEnabled -eq $False) {
                Write-Host "Its Off... Enabling...." -ForegroundColor Yellow
                #Enable ADR
                Set-CMSoftwareUpdateAutoDeploymentRule -Name $RetADR.Name -Enable $True
                #Check Action successfully completed.
                $Check = Get-CMSoftwareUpdateAutoDeploymentRule -Name $ADR
                If ($Check.AutoDeploymentEnabled -eq $True) {
                    Write-Host "Successfully Enabled $($Check.Name)!" -ForegroundColor Green
                    }
            }
            #If ADR Already Disabled Warn User and move onto next.
            ElseIf ($RetADR.AutoDeploymentEnabled -eq $True) {
                    Write-Host "$($Check.Name) is already enabled!" -ForegroundColor Green
            }
            #If ADR same as previous name or not pupulated then warn user.
            Elseif (($RetADR.Name -ne $ADR) -or ($RetADR -eq $null)) {
                    Write-Host "ADR $ADR cannot be found!" -ForegroundColor Red        
            }
            #If you hit this something fishy is going on!
            Else {
                Write-Host "Error please message Richie Schuster C5 - SCCMOG.com" -ForegroundColor Red 
            }
    }
}
#If Input empty or does not match write warning.
Else {
    Write-Host "Please use Enable or Disable param e.g. Set-ADREnableDisabled -State Enable  -SiteCode S0G" -ForegroundColor Red
    Set-Location $PSScriptRoot
}
################################################################

100

101

102

103

104

105

106

107

108

109

110

111

112

##############################################################################################################################################

#Author: C5 Richie Schuster - SCCMOG.COM

#Script: Set-ADREnableDisabled

#Usage : "Set-ADREnableDisabled -State Enabled -SiteCode S0G" or "Set-ADREnableDisabled -State Disabled -SiteCode S0G"

#Info : This script was writtent to run as a scheduled task to automatically disable and enable ADR Rules specified in the variable $ADRNames

##############################################################################################################################################

#Parameters

Param

(

[parameter(mandatory=$true,HelpMessage="Please, provide your SiteCode.")][ValidateNotNullOrEmpty()][String]$SiteCode = "",

[parameter(mandatory=$true,HelpMessage="Please, provide a state for the script to Run e.g. Enable or Disable")][ValidateNotNullOrEmpty()][String]$State = ""

)

#ADR Names stored in ARRAY - Copy and Pasted name of ADR Bellow.

$ADRNames = @("ADR Critical Security Releases Windows 10 1607",`

"ADR Critical Security Releases Windows 10 1511")

#Disable warnings for Fast switch

$CMPSSuppressFastNotUsedCheck = $true

# Check for elevation

Write-Host "Checking for elevation"

If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(`

[Security.Principal.WindowsBuiltInRole] "Administrator"))

{

Write-Warning "Oupps, you need to run this script from an elevated PowerShell prompt!`nPlease start the PowerShell prompt as an Administrator and re-run the script."

Write-Warning "Aborting script..."

Break

}

#Import Module but check if user entered sitecode

If ($SiteCode -ne "") {

#[string]$SiteCode = "P01"

# Import the ConfigurationManager.psd1 module

Write-Host "Importing ConfigMgr Module..." -ForegroundColor Yellow

Import-Module "$($ENV:SMS_ADMIN_UI_PATH)\..\ConfigurationManager.psd1"

# Set the current location to be the site code.

Write-Host "Setting Location to ConfigMgr Drive..." -ForegroundColor Yellow

Set-Location "$SiteCode`:"

}

Else {

Write-Warning "Oupps, you need to enter a Site code!`nPlease use the -SiteCode followed by your sitecode."

Write-Warning "Aborting script..."

Break

}

#If State set to Disable

If ($State -eq "Disable") {

Foreach ($ADR in $ADRNames) {

#Retrieve ADR information

$RetADR = Get-CMSoftwareUpdateAutoDeploymentRule -Name $ADR

#Check if ADR is Enabled and if so disable

If ($RetADR.AutoDeploymentEnabled -eq $True) {

Write-Host "Its On... Disabling...." -ForegroundColor Yellow

#Disable ADR

Set-CMSoftwareUpdateAutoDeploymentRule -Name $RetADR.Name -Enable $false

#Check Action successfully completed.

$Check = Get-CMSoftwareUpdateAutoDeploymentRule -Name $ADR

If ($Check.AutoDeploymentEnabled -eq $False) {

Write-Host "Successfully Disabled $($Check.Name)!" -ForegroundColor Green

}

#If ADR Already Enabled Warn User and move onto next.

ElseIf ($RetADR.AutoDeploymentEnabled -eq $false) {

Write-Host "$($Check.Name) is already disabled!" -ForegroundColor Green

}

#If ADR same as previous name or not pupulated then warn user.

Elseif (($RetADR.Name -ne $ADR) -or ($RetADR -eq $null)) {

Write-Host "ADR $ADR cannot be found!" -ForegroundColor Red

}

#If you hit this something fishy is going on!

Else {

Write-Host "Error please message Richie Schuster C5 - SCCMOG.com" -ForegroundColor Red

}

#If State set to Enable

ElseIf ($State -eq "Enable") {

Foreach ($ADR in $ADRNames) {

#Retrieve ADR information

$RetADR = Get-CMSoftwareUpdateAutoDeploymentRule -Name $ADR

#Check if ADR is Disabled and if so enable

If ($RetADR.AutoDeploymentEnabled -eq $False) {

Write-Host "Its Off... Enabling...." -ForegroundColor Yellow

#Enable ADR

Set-CMSoftwareUpdateAutoDeploymentRule -Name $RetADR.Name -Enable $True

#Check Action successfully completed.

$Check = Get-CMSoftwareUpdateAutoDeploymentRule -Name $ADR

If ($Check.AutoDeploymentEnabled -eq $True) {

Write-Host "Successfully Enabled $($Check.Name)!" -ForegroundColor Green

}

#If ADR Already Disabled Warn User and move onto next.

ElseIf ($RetADR.AutoDeploymentEnabled -eq $True) {

Write-Host "$($Check.Name) is already enabled!" -ForegroundColor Green

}

#If ADR same as previous name or not pupulated then warn user.

Elseif (($RetADR.Name -ne $ADR) -or ($RetADR -eq $null)) {

Write-Host "ADR $ADR cannot be found!" -ForegroundColor Red

}

#If you hit this something fishy is going on!

Else {

Write-Host "Error please message Richie Schuster C5 - SCCMOG.com" -ForegroundColor Red

}

#If Input empty or does not match write warning.

Else {

Write-Host "Please use Enable or Disable param e.g. Set-ADREnableDisabled -State Enable -SiteCode S0G" -ForegroundColor Red

Set-Location $PSScriptRoot

}

################################################################

Here is the XML for the Scheduled Task to disable the daily ADRs. You will have to change some details but this should get you going. When you want to re-enable it in the evening just change line 65 from Disable to enable:

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2017-05-02T16:06:29.8383361</Date>
    <Author>SCCMOG\Administrator</Author>
    <Description>This task runs one a month to disable the critical security ADRs.</Description>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger>
      <StartBoundary>2017-05-02T01:00:00</StartBoundary>
      <Enabled>true</Enabled>
      <ScheduleByMonthDayOfWeek>
        <Weeks>
          <Week>2</Week>
        </Weeks>
        <DaysOfWeek>
          <Wednesday />
        </DaysOfWeek>
        <Months>
          <January />
          <February />
          <March />
          <April />
          <May />
          <June />
          <July />
          <August />
          <September />
          <October />
          <November />
          <December />
        </Months>
      </ScheduleByMonthDayOfWeek>
    </CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>YourDomain\SCCMAdmin</UserId>
      <LogonType>Password</LogonType>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>false</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>P3D</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>Powershell.exe</Command>
      <Arguments>-ExecutionPolicy Bypass -File D:\Setup\Scripts\Set-ADREnableDisabled.ps1 .\Set-ADREnableDisabled.ps1 -State Disable -SiteCode P01</Arguments>
    </Exec>
  </Actions>
</Task>

<?xml version="1.0" encoding="UTF-16"?>

<Author>SCCMOG\Administrator</Author>

<Description>This task runs one a month to disable the critical security ADRs.</Description>

</RegistrationInfo>

<Weeks>

</Weeks>

</DaysOfWeek>

<May />

</Months>

</ScheduleByMonthDayOfWeek>

</CalendarTrigger>

</Triggers>

<UserId>YourDomain\SCCMAdmin</UserId>

<LogonType>Password</LogonType>

<RunLevel>HighestAvailable</RunLevel>

</Principal>

</Principals>

<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>

<StartWhenAvailable>false</StartWhenAvailable>

<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>

<RestartOnIdle>false</RestartOnIdle>

</IdleSettings>

<Hidden>false</Hidden>

<RunOnlyIfIdle>false</RunOnlyIfIdle>

<WakeToRun>false</WakeToRun>

</Settings>

<Exec>

<Command>Powershell.exe</Command>

<Arguments>-ExecutionPolicy Bypass -File D:\Setup\Scripts\Set-ADREnableDisabled.ps1 .\Set-ADREnableDisabled.ps1 -State Disable -SiteCode P01</Arguments>

</Exec>

</Actions>

</Task>

3rd May 20173rd May 2017

Import IP Boundaries and Boundary Groups PowerShell SCCM ConfigMgr

This script is designed to work in harmony with the Export Sites and Subnets to CSV script I blogged about recently. The CSV file that is created by that script can then be used to import IP Subnet Boundaries and Groups with this PowerShell script.

Each Site will be Created as a Boundary Group and each Subnet listed with that Site in the CSV will be created as a IP Subnet Boundary associated to the Boundary Group.

Here is the Script:

#########################################################################################################
#Script Name:   Import Boundaries and Boundary Groups from CSV                                          #
#Script Author: SCCMOG - Richie Schuster 06/03/2017 WWW.SCCMOG.COM                                      #
#########################################################################################################
#Script Usage: ImportBoundariesandGroups.ps1 -CSVParam MyCSV.csv                                  #
#########################################################################################################

#CSV Name accepted as first PARAM
Param
(
[parameter(mandatory=$true,HelpMessage="Please, provide your SiteCode.")][ValidateNotNullOrEmpty()][String]$SiteCode,
[parameter(mandatory=$true,HelpMessage="Please, provide a CSV to import. It must be in the same folder as the script e.g. Sites.CSV")][ValidateNotNullOrEmpty()][String]$CSVParam
)

# Check for elevation
Write-Host "Checking for elevation"
If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(`
    [Security.Principal.WindowsBuiltInRole] "Administrator"))
{
    Write-Warning "Oupps, you need to run this script from an elevated PowerShell prompt!`nPlease start the PowerShell prompt as an Administrator and re-run the script."
    Write-Warning "Aborting script..."
    Break
}

If ($CSVParam -ne ""){

    #Import CSV
    $path     = Split-Path -parent $MyInvocation.MyCommand.Definition 
    $newpath  = $path + "\$CSVParam"
    #Check location of CSV is valid.
    If (Test-Path $newpath){
    $BoundaryList = Import-Csv -Path $newpath
    #Import ConfigMgr Module
    Import-Module "$($ENV:SMS_ADMIN_UI_PATH)\..\ConfigurationManager.psd1"
    #Set the current location to be the site code.
    Set-Location "$SiteCode`:"

        foreach ($_ in $BoundaryList){
            #Check If Boundary Group Already Created
            $getbg = Get-CMBoundaryGroup -Name $($_.Name)
 
            #If no bounday group maching that name create it
            if ($getbg -eq $null){
                New-CMBoundaryGroup -Description $($_.Name) -Name $($_.Name)
                }

            #Split on /
            $Subnet,$Bit = $_.Subnet.split('/',2)

            #Check if Boundary is already Created
            $getbn = Get-CMBoundary | where Value -eq $Subnet
    
            #If it is not then create new boundry and add it to Boundary Group
            if ($getbn -eq $null){
            New-CMBoundary -DisplayName $($_.Name) -BoundaryType IPSubnet -Value $Subnet
            Add-CMBoundaryToGroup -BoundaryGroupName $($_.Name) -BoundaryName $($_.Name)
                }
            }
        }
    Else{
    Write-Host "Please enter VALID CSV Name. Make sure it is in the same folder as this script." -ForegroundColor Cyan
    }
}
Else{
    Write-Host "Please enter CSV Name. Make sure it is in the same folder as this script." -ForegroundColor Cyan
}
###############################################################################################################

#########################################################################################################

#Script Name: Import Boundaries and Boundary Groups from CSV #

#Script Author: SCCMOG - Richie Schuster 06/03/2017 WWW.SCCMOG.COM #

#########################################################################################################

#Script Usage: ImportBoundariesandGroups.ps1 -CSVParam MyCSV.csv #

#########################################################################################################

#CSV Name accepted as first PARAM

Param

(

[parameter(mandatory=$true,HelpMessage="Please, provide your SiteCode.")][ValidateNotNullOrEmpty()][String]$SiteCode,

[parameter(mandatory=$true,HelpMessage="Please, provide a CSV to import. It must be in the same folder as the script e.g. Sites.CSV")][ValidateNotNullOrEmpty()][String]$CSVParam

)

# Check for elevation

Write-Host "Checking for elevation"

If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(`

[Security.Principal.WindowsBuiltInRole] "Administrator"))

{

Write-Warning "Oupps, you need to run this script from an elevated PowerShell prompt!`nPlease start the PowerShell prompt as an Administrator and re-run the script."

Write-Warning "Aborting script..."

Break

}

If ($CSVParam -ne ""){

#Import CSV

$path = Split-Path -parent $MyInvocation.MyCommand.Definition

$newpath = $path + "\$CSVParam"

#Check location of CSV is valid.

If (Test-Path $newpath){

$BoundaryList = Import-Csv -Path $newpath

#Import ConfigMgr Module

Import-Module "$($ENV:SMS_ADMIN_UI_PATH)\..\ConfigurationManager.psd1"

#Set the current location to be the site code.

Set-Location "$SiteCode`:"

foreach ($_ in $BoundaryList){

#Check If Boundary Group Already Created

$getbg = Get-CMBoundaryGroup -Name $($_.Name)

#If no bounday group maching that name create it

if ($getbg -eq $null){

New-CMBoundaryGroup -Description $($_.Name) -Name $($_.Name)

}

#Split on /

$Subnet,$Bit = $_.Subnet.split('/',2)

#Check if Boundary is already Created

$getbn = Get-CMBoundary | where Value -eq $Subnet

#If it is not then create new boundry and add it to Boundary Group

if ($getbn -eq $null){

New-CMBoundary -DisplayName $($_.Name) -BoundaryType IPSubnet -Value $Subnet

Add-CMBoundaryToGroup -BoundaryGroupName $($_.Name) -BoundaryName $($_.Name)

}

Else{

Write-Host "Please enter VALID CSV Name. Make sure it is in the same folder as this script." -ForegroundColor Cyan

}

Else{

Write-Host "Please enter CSV Name. Make sure it is in the same folder as this script." -ForegroundColor Cyan

}

###############################################################################################################

Below is a demonstration of the Script complete:

Import Boundaries and Groups PowerShell Script output