I recently ran into an article by Pieter Wigleven, based on an original idea of Jan Van Meirvenne that I simply have to share, and expand upon.
When you go cloud first, and do light MDM management of your Azure AD Joined Windows 10 devices, you will likely enable a Bitlocker policy in Intune. What you’ll quickly discover, is that your policy will not automatically enforce/enable Bitlocker on non-InstantGo capable devices.
So, I expanded upon Jan and Pieter’s script to automatically enable Bitlocker on Windows 10; it has additional error handling, local logging and it will eject removable drives prior to immediately (vs reboot) encrypting your system drive. After this is started, it will register your recovery key in AzureAD. Of course all credit for the original idea goes to Jan van Meirvenne.
Powershell source file
enableBitlockerAndRegisterInAAD.ps1 (right click, save as)
enableBitlockerAndRegisterInAAD_v0.2.msi(right click, save as)
As Intune won’t let you deploy a Powershell script, I’ve also wrapped the script in an MSI file with Advanced Installer for you. What this will do;
- Deploy the PS1 file to the machine
- Register a scheduled task to run this PS1 file at logon each time
- Kick off the scheduled task once so a first reboot isn’t required
Advanced installer package (.aip)
enableBitlockerAndRegisterInAAD.zip (right click, save as)
- Windows 10, AzureAD Joined
- TPM chip
- User should be local admin
Version 0.56 is out, changes since v0.50:
- prevent running twice (if scheduled task hangs for some reason)
- send email notification if logfile is locked
- replace add-adgroupmember and remove-adgroupmember with set-adgroup because of a known bug in these commands
- multi-delete protection
- auto reconnect to Exchange Online when the connection times out + longer timeout
- additional filtering method for groups: extensionAttribute2
- If you want to use this instead of the displayName prefix filter, read up on how to switch
Get it here
Some Windows services can be triggered to start at certain events. These services have ‘Tigger Start’ in their startup name behind whatever you configured (like Manual).
Powershell does not have a native method to register the type of event that triggers such a service, C++ and C# do…..and Powershell can natively run C#.
To trigger a service, you’ll need its guid first:
run sc triggerinfo <SERVICENAME>
This will give you a GUID, for example for the WebClient service:
You can then use this GUID in the following script to trigger your service from Powershell 🙂 Continue reading How to start a “Trigger Start” windows service with Powershell without elevation / admin rights
Are you using aadconnect, but want your users to be able to update your Office 365 distribution lists directly in OWA (Outlook Web Access)? And still keep them in sync with your Active Directory?
Then stay tuned 😉
Version 0.9 of O365Migrator is now available as a free download.
What was changed?
- Differential transfer: upload only changed/new files. (does not process renames, moves and deletes yet!)
- Subfolder targeting: upload to a specific subfolder instead of the root if specified
- Better library name detection when admin and user have different language settings
You can find the new version here.
So, recently a customer installed the Intune client in an image, as my previous post details, causing the client to enter a bricked state.
Reinstallation of the client can fix this, but we wanted minimum user interaction as a large number of machines was already distributed.
For those who remember Winrar, it is a fantastic ZIP tool that can create a self-extracting archive (.EXE) which auto-self elevates (admin rights) and can automatically start a file from the archive after extraction.
Include the Intune setup file and the certificate Microsoft includes, and this script (as .bat), and your Intune installation will be ‘cleaned up’. Note that you may see some file protection dialogs.
Source code: Continue reading Killing and reinstalling the Intune Client without user interaction
This is the first post in a series about moving to Onedrive for Business and/or Sharepoint Online from traditional fileshares and/or homedirectories, in bulk, without user interaction.
- Making your data compliant with Office 365 standards, and keeping it that way
- Moving the data (in bulk)
- User and endpoint transitioning
Many of my employer’s clients are transitioning to a Cloud First IT model. Think triple A, work anywhere, anytime, anyplace.
This poses a number of challenges on Continue reading Migrating files and folders to Onedrive for Business and Sharepoint Online without user interaction part 1
The first public version of the O365BulkDatacleaner has been released.
This script is an addition to O365Datacleaner and will allow you to run the original script over many target locations simultaneously, using a CSV file as input.
This is the simplest and most reliable method currently available to make, for example, all the data on your fileservers spread out over homedirectories completely compliant with Onedrive for Business or Sharepoint Online’s requirements.
In organisations that have moved to Office 365, or are moving to Office 365 while using a hybrid setup with an on-premises Exchange 2010, 2013 or 2016 server and/or Lync/Skype, your helpdesk tools and scripts need to be adjusted.
While previously, you would provision your account in Active Directory, the mailbox on the onpremises Exchange Server and voip functionality on the Lync/Skype server, after your migration, you no longer need to provision mailboxes or lync accounts on premises. After a user has been migrated to Office 365, his ‘user type’ in the Exchange on premises server is ‘Remote Mailbox’. But for new users, this is not set automatically.
If you’re using scripting or tools like ADManager, you can use some simple Powershell commands to set the correct properties on a newly created user.
Configure and run below script Continue reading Automating remote mailbox creation in an Exchange 2010/2013 and Office 365 hybrid setup
I was recently asked to build a Powershell script to fully automate building up a server, including detailed configuration and installation of roles and other software.
Some of these actions required a reboot. After a reboot, the Powershell script had to restart itself. When running a script remotely, Workflows can be used, but when running the script locally I could not get this to work properly. Thus, I built a self-restarting script template that will run each phase as you configure it.
This self-resuming Powershell script writes its own run configuration to a Scheduled task that will run at boot time without user interaction, under the SYSTEM account. It will run all the commands you specify, reboot and resume when necessary, and unregister itself when it has completed.
This is awesome for, for example, building up Terminal Servers or Web Servers in a highly virtualized environment. Of course there are many orchestration tools available, and they may be better suited for this task, but those were not available when I was asked to code this.
Download it here: AutoBuilder_v0.3
Or check out the source code:
Continue reading AutoBuilder, a self restarting Powershell script for orchestration