recommendations

Tools for WebAnalytics and SEO

SEO and Web Analytics are a very important part of successful web pages and blogs, like this page as well.

You want to use SEO tools and plugins on your website, read up on how to use key phrases and other tools in this constantly changing world of web pages and search engines as well as now mobile first development. Having been in IT over 25 years, I saw a lot of changes.

When creating a website, make sure you engage some tools right away, make sure you have small images, JPG is still a very good idea, engage image optimizer plugins and don’t over-size them – I am guilty of this as well.

Caching or your pages with plugins and other techniques and systems is highly recommended, because SEO judges you also on render time and things like LCP – Largest Contentful Paint.

Keep all the overhead CSS and JavaScript under control, especially side loading is a huge problem when it comes to lagging speed to load websites.

To get a good overview – use Google PageSpeed Insights to see how your page is performing and where you should start improving.

Another important tool Google Analytics – it recently changed to GA4 which you can simply switch too. The data there can give you a good idea how people finding your website and where you should improve your marketing efforts.

Now, marketing is not necessarily spending money on Google Ads, find out where people interested in your page collaborate and exchange and interact with them, if there you have e.g., a good blog entry about a topic, you might be able to link it and get more visitors.

And then there is the Google Search Console – the easiest way to find out how your page is ranking on various search requests and also making sure your page has no issues – what is critical. Make sure Googles algorithms are happy with especially the mobile version of your website, that it is deemed readable and fast. Only then you will get a good SEO rating. Ignoring issues there can cause Google to stop indexing your webpage, what will result in less clicks and a decline in visitors.

Of course, there are other tools and search engines out there, but let’s face it – the DeFacto standard is Google. This does not mean you can ignore the others, but I found that Googles free tools are most of the time already very sufficient.

All of this is just a quick overview, this topic is huge and a whole industry stays behind the SEO and web marketing – my only goal was to give owners of smaller website a good overview and some tips on how they can improve without spending a fortune.

Finally, you also should make sure your website is secured and monitored for threads. Not just the incoming threads, also that your website is not unintentionally causing a thread to your visitors due to malicious plugins or altered content. Engage third party firewalls and scan systems. Yes they will cost you money, but they will save your reputation with your visitors.

April 21, 2022 by Florian Rossmark recommendations web

Useful registry keys to supplement settings not available in standard GPO templates

This blog entry will list some registry keys to control computer and user settings via GPO but aren’t available in the standard ADMX GPO templates.

Below you find always the same data format:

Computer Configuration or User Configuration
HIVE
Kay Path
Value Name
Value Type
Value Data
Short explanation
Link if available

Over the years I also always tried to leave a comment in the GPO’s, especially for the Registry Keys, so I could later identify them quickly and possibly even leaving a link so others could read up on these settings and options without doing long research.

Show Drive Letters first in Windows Explorer

This Registry value is set in two areas – Computer Configuration and User Configuration. See both keys below.

Computer Configuration
HKEY_LOCAL_MACHINE
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
ShowDriveLettersFirst
REG_DWORD
0x4 (4)
Defines if the drive letter is shown first in Windows Explorer
- 0 = After
- 1 = Mixed
- 2 = No drive letter
- 3 = Before

User Configuration
HKEY_CURRENT_USER
Software\Microsoft\Windows\CurrentVersion\Explorer
ShowDriveLettersFirst
REG_DWORD
0x4 (4)
Defines if the drive letter is shown first in Windows Explorer
- 0 = After
- 1 = Mixed
- 2 = No drive letter
- 3 = Before

Support URL

Computer Configuration
HKEY_LOCAL_MACHINE
SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation
SupportURL
REG_SZ
URL to your support system
Set the Windows Support URL shown in the Computer Properties in the Support section – Link is behind the Online Support Website.

Support Hours

Computer Configuration
HKEY_LOCAL_MACHINE
SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation
SupportHours
REG_SZ
e.g.: 0800-1700 Pacific Time
Set the Windows Support Hours shown in the Computer Properties in the Support section.

Support Hours

Computer Configuration
HKEY_LOCAL_MACHINE
SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation
SupportPhone
REG_SZ
your helpdesk phone number
Set the Windows Support Phone Number shown in the Computer Properties in the Support section.

Support Manufacturer

Computer Configuration
HKEY_LOCAL_MACHINE
SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation
Manufacturer
REG_SZ
Suggest to put in your Company name here
Set the Manufacturer Name / Company Name shown in the Computer Properties in the Support section.

Hide Drives with no Media

User Configuration
HKEY_CURRENT_USER
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideDrivesWithNoMedia
REG_DWORD
00000000
If set to 0x0 (0) it will not hide empty drives, if set to 0x1 (1) it will hide empty drive letters from Windows Explorer.

Expand folders to current folder

User Configuration
HKEY_CURRENT_USER
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
NavPaneExpandToCurrentFolder
REG_DWORD
0x1 (1)
This will expand all folders to the current folder in the navigation panel of Windows Explorer, by default it will only navigate to the folder but not expand the path to it in the Navigation Panel. The behavior on this changed back in Windows Vista or Windows 7. This sets it back to a more Windows XP like behavior, what makes it easier to navigate Windows Explorer.

Fast Boot Enabled

Computer Configuration
HKEY_LOCAL_MACHINE
SYSTEM\CurrentControlSet\Control\Session Manager\Power
HiberbootEnabled
REG_DWORD
0x0 (0)
Turns off Windows 10 Fast Startup – meaning a real reboot is done rather then a quick reboot that is actually not a real Windows reboot. A real reboot is slower, but much cleaner.

Office 365 – Update Channel

There is a settings in the Office ADMX files under Microsoft Office 2016 (Machine)/Updates for:

Enable Automatic updates
Update Channel
Update Deadline

Additionally this settings should be set to make sure everything is configured the same and installs the same:

Computer Configuration
HKEY_LOCAL_MACHINE
SOFTWARE\Microsoft\Office\ClickToRun\Configuration
CDNBaseUrl
REG_SZ
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60
This will set the Office 365 channel to current for the click to run installation.

Allow Print Driver Installation

Computer Configuration
HKEY_LOCAL_MACHINE
SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
RestrictDriverInstallationToAdministrators
REG_DWORD
0x0 (0)
Microsoft released KB5005652 which requires admin rights to install printers, and affects some existing printers that will require an admin to install driver update. Work around is to add the registry key below, which disabled this new security feature.
- Value: 0
  - Allow non-admin users to install Point and Print printer drivers
- Value: 1
  - Blocks non-admin users from installing Point and Print printer drivers. If this registry key does not exist, the default with KB installed will be same as Value 1, blocking non-admins from installing Point and Print printer drivers.
https://support.microsoft.com/en-us/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872

Ensure Outlook is the default mail client

User Configuration
HKEY_CURRENT_USER
Software\Clients\mail
(Default)
REG_SZ
Microsoft Outlook
Ensures Microsoft Outlook is the standard mail client

Set Microsoft Teams as the default IM application

See this blog entry as well about this.

User Configuration
HKEY_CURRENT_USER
Software\IM Providers
DefaultIMApp
REG_SZ
Teams
Sets Microsoft Teams as the default Instant Messenger Application.

Set Microsoft Office to read User information from Active Directory

Make sure you set both registry keys for this.

Set this to “Apply once and do not reapply” as well.

This will cause Microsoft Office applications read any user information fresh from Active Directory, as it cleans the current values.

User Configuration
HKEY_CURRENT_USER
Software\Microsoft\Office\Common\UserInfo
UserName
(not set)
(not set)
This will cause the first Office application to read the information from Active Directory and re-create it specifically for the user.

User Configuration
HKEY_CURRENT_USER
Software\Microsoft\Office\Common\UserInfo
UserInitials
(not set)
(not set)
This will cause the first Office application to read the information from Active Directory and re-create it specifically for the user.

Disable the Network Sharing Wizard in Windows Explorer

User Configuration
HKEY_CURRENT_USER
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SharingWizardOn
REG_DWORD
0x0 (0)
Disables the Sharing Wizard in Windows Explorer.

Remove the Network form Windows Explorer

Probably one of the more important security measures you can do, to avoid the standard user browsing other systems on the network to much. It does not really prevent it, but makes it a lot less easy for regular end users, as the network area in Windows Explorer simply vanishes.

User Configuration
HKEY_CURRENT_USER
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
REG_DWORD
0x1 (1)
Remove Network from Windows Explorer.

Remove Administrative Tools from the Start Menu

This is made out of two combined registry keys. You will need to apply both for this to take affect.

Highly recommend to make sure it does not apply to any administrator accounts, as this can be contra productive.

User Configuration
HKEY_CURRENT_USER
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Start_AdminToolsRoot
REG_DWORD
0x0 (0)
Removes administrative tools from the start menu.

User Configuration
HKEY_CURRENT_USER
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
StartMenuAdminTools
REG_DWORD
0x0 (0)
Removes administrative tools from the start menu.

Windows Update Restart Notifications for End Users

Please apply both Registry Keys for this to take affect.

Computer Configuration
HKEY_LOCAL_MACHINE
SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
RestartNotificationsAllowed
REG_DWORD
0x1 (1)
Will display Restart Notifications to End Users.

Computer Configuration
HKEY_LOCAL_MACHINE
SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
RestartNotificationsAllowed2
REG_DWORD
0x1 (1)
Will display Restart Notifications to End Users.

Monitoring relative printer page counts with PRTG

PRTG has many standard sensors, but one I was always missing is a daily page count compare. The standard printer sensor gives you a total page count – but this to some extend will always be a graph that only will go up. You can only estimate the total page counts in those graphs.

If you ever looked in to the IT Assets database project, you will see that in the Printers area there is a possibility to enable detailed graphs for relative page counts.

Why is this important you might wonder. The answer is simple, as an IT Manager you need to know if a certain kind of a printer makes sense at a certain location. If you have a low end printer for only casual print-outs but you have a total over e.g. 10,000 pages printed every month, you might need to reconsider the printer model. The reasons would likely be:

higher cost per page
- constant toner exchange of a compared more expensive toner cartridge
maintenance cost
- you might need to constantly maintenance the printer
- the cost for the maintenance kit are relatively high
downtime issues
- due to toner empty
- printer needs maintenance again
- less pages in paper tray

On the other hand, a printer might also be overkill for a certain area and not be cost efficient. Those conditions also might change over time of course. Further is there often the question – is a single area printer (copier) better or multiple smaller printers. This of course can go pretty far and you want to consider Lean processes, Six Sigma guidelines and others along with this data.

How ever, I started a first draft of a script that provides me at least the total page count relative to each day in PRTG. This sure is not as efficient yet as I do this in the IT Assets database printer module, where I collect data e.g. every 30 minutes in a huge table and then later calculate all the data in a daily range respective monthly range while collecting total page counts and possibly counts per copy vs. print outs and additionally color vs. black and white print. But at least it is a start.

Below you find the first draft of this script.

One thing to know – you will need to run the following command in order to install the PowerShell SNMP module on your PRTG probing server:

Install-Module -Name SNMP

1	Install-Module -Name SNMP

The current version of the PRTG script:

#For PRTG - default parameter list: 
#-deviceID %deviceid -targetHost '%host' -OID '1.3.6.1.2.1.43.10.2.1.4.1.1' 
#find a list with OID examples at the following link as they differ by vendor and partly model
#https://www.it-admins.com/it-assets-database/online-manual/printers/
param(
    [Parameter(
        Mandatory = $true
    )][int]$deviceID,

    [Parameter(
        Mandatory = $true
    )][string]$targetHost,

    [Parameter(
        Mandatory = $true
    )][string]$OID = "",

    [string]$Community = "public"
)

Import-Module -Name SNMP

[string]$ErrorText = "" #will hold error information to be returned to PRTG text field / sensor message
[int]$ErrorValue = 0 #default no errors initiated with 0 (0 = OK | 1 = Warning | 2 = Error)

[string]$LogFile = "$PSScriptRoot\PrinterLog_$deviceID.log"

[int]$result = -2 #standard response would be negative 2 as initialized integer value

try{
    $result = (Get-SNMPdata -IP $targetHost -OID $OID -Community $Community).Data
    #if no error occured, we have the current page count as a result
} catch {
    $result = -1 #if any error happened, we now have the result set to negative 1
    $ErrorText += "error: can't read SNMP OID value from device "
    $ErrorValue = 2
}

[int]$returnValue = 0 #default return value, integer, initialized with 0
[string]$LogFileContent = -1 #default logfilecontent is integer, intialized with negative 1
[string]$LogFileDate 
[int]$LogFileCount = -1

if ($result -gt 0) {
    #we seem to have a page count from SNMP

    if (Test-Path $LogFile -PathType Leaf){
        #we do have an exisiting LogFile
        try{
            $LogFileContent = Get-Content $LogFile -Raw
            if ($LogFileContent.Length -gt 0){
                $LogFileDate = $LogFileContent.Split("|")[0] 
                $LogFileCount = $LogFileContent.Split("|")[1]
            } else {
                #LogFile empty
                $LogFileCount = 0
                $ErrorText += "warning: initial run or no logfile yet "
                $ErrorValue = 1
            }
        } catch {
            $LogFileCount = -2 #negative 2 as error catch
        } finally {
            if ($LogFileCount -gt 0){
                #no error occured as for the LogFile reading
                if (($result - $LogFileCount) -gt -1){
                    #it should be either the same value or higher then the last logfile value
                    $returnValue = $result - $LogFileCount
                } else {
                    #LogFile value is higher then current count - this is weird
                    #still returning this - but it will show a negative count and should raise a flag
                    $returnValue = $result - $LogFileCount
                    $ErrorText += "error: logfile value higher then current printer read "
                    $ErrorValue = 2
                }
            } else {
                #there was some kind of error in the LogFile read - not an integer value or new Logfile started and result was 0
                $ErrorText += "error: can't read logfile for data compare "
                $ErrorValue = 2
            }
        }

    } else {
        #no LogFile yet - will need one but return value as difference initially will stay 0
        #we set the LogFileContent to 0 as this is the current status
        $LogFileCount = 0
        $ErrorText += "warning: initial run or no logfile yet or wrong data format "
        $ErrorValue = 1
    }

    #we need to write the positive SNMP OID result to the LogFile 
    #but only if the date differs more then 1x day

    [bool]$WriteLog = $false
    [string]$CurrentDate = (Get-Date -Format yyyy-MM-dd)

    if ($LogFileDate.Length -gt 0){
        try{
            if ((New-TimeSpan -Start $LogFileDate -End $CurrentDate).Days -gt 1){ 
                #date difference more then 1 day 
                $WriteLog = $true
            } else {
                #date difference not sufficient - same day? Future?
                if ((New-TimeSpan -Start $LogFileDate -End $CurrentDate).Days -lt 0){ 
                    #LogFile newer then current date? That's just wrong
                    $WriteLog = $true
                    $ErrorText += "warning: Logfile date above current date $LogFileDate - rewriting log"
                    $ErrorValue = 1
                } else {
                    #not greater then 1 day (0 and 1) or less must be equal as a result...
                    #nothing to do as WriteLog is initialized false
                }
            }
        } catch {
            #couldn't compare the date - let's write the Log to be save
            $WriteLog = $true
        }
    } else {
        #LogFileDate length 0 means we need to write a logfile as it might not exist
        $WriteLog = $true
    }

    if ($WriteLog){
        try {
            Set-Content -Path $LogFile -Value "$CurrentDate|$result"
            $LogFileDate = $CurrentDate
        } catch {
            #there was an issue writing to the LogFile
            $ErrorText += "error: can't write to logfile "
            $ErrorValue = 2
        }
    }

} else {
    #no pagecount available due to errors or issues
    #uncomment the next line for debugging only
    #$returnValue = $result
    #the returnValue will now show the current result value and point therefor to the error section
    $ErrorText += "error: no pagecount available "
    $ErrorValue = 2
}

#Assuming no errors - the text result will be the last LogFile date
if ($ErrorText.Length -eq 0){
    $ErrorText = "Last LogFile write date: $LogFileDate"
}

$XML = "<prtg>
            <result>
                <channel>last relative Page Count</channel>
                <value>$returnValue</value>
            </result>
            <result>
                <channel>last total from Printer</channel>
                <value>$result</value>
            </result>
            <result>
                <channel>last total from LogFile</channel>
                <value>$LogFileCount</value>
            </result>
            <result>
                <channel>Script Error Status</channel>
                <value>$ErrorValue</value>
                <LimitMode>1</LimitMode>
                <LimitMaxWarning>0</LimitMaxWarning>
                <LimitMaxError>1</LimitMaxError>
            </result>
            <text>$ErrorText</text>
        </prtg>"
 
Function WriteXmlToScreen ([xml]$XML) #just to make it clean XML code...
{
	$StringWriter = New-Object System.IO.StringWriter;
	$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
	$XmlWriter.Formatting = "indented";
	$xml.WriteTo($XmlWriter);
	$XmlWriter.Flush();
	$StringWriter.Flush();
	Write-Output $StringWriter.ToString();
}
 
WriteXmlToScreen $XML;

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

#For PRTG - default parameter list:

#-deviceID %deviceid -targetHost '%host' -OID '1.3.6.1.2.1.43.10.2.1.4.1.1'

#find a list with OID examples at the following link as they differ by vendor and partly model

#https://www.it-admins.com/it-assets-database/online-manual/printers/

param(

[Parameter(

Mandatory = $true

)][int]$deviceID,

[Parameter(

Mandatory = $true

)][string]$targetHost,

[Parameter(

Mandatory = $true

)][string]$OID = "",

[string]$Community = "public"

)

Import-Module -Name SNMP

[string]$ErrorText = "" #will hold error information to be returned to PRTG text field / sensor message

[int]$ErrorValue = 0 #default no errors initiated with 0 (0 = OK | 1 = Warning | 2 = Error)

[string]$LogFile = "$PSScriptRoot\PrinterLog_$deviceID.log"

[int]$result = -2 #standard response would be negative 2 as initialized integer value

try{

$result = (Get-SNMPdata -IP $targetHost -OID $OID -Community $Community).Data

#if no error occured, we have the current page count as a result

} catch {

$result = -1 #if any error happened, we now have the result set to negative 1

$ErrorText += "error: can't read SNMP OID value from device "

$ErrorValue = 2

}

[int]$returnValue = 0 #default return value, integer, initialized with 0

[string]$LogFileContent = -1 #default logfilecontent is integer, intialized with negative 1

[string]$LogFileDate

[int]$LogFileCount = -1

if ($result -gt 0) {

#we seem to have a page count from SNMP

if (Test-Path $LogFile -PathType Leaf){

#we do have an exisiting LogFile

try{

$LogFileContent = Get-Content $LogFile -Raw

if ($LogFileContent.Length -gt 0){

$LogFileDate = $LogFileContent.Split("|")[0]

$LogFileCount = $LogFileContent.Split("|")[1]

} else {

#LogFile empty

$LogFileCount = 0

$ErrorText += "warning: initial run or no logfile yet "

$ErrorValue = 1

}

} catch {

$LogFileCount = -2 #negative 2 as error catch

} finally {

if ($LogFileCount -gt 0){

#no error occured as for the LogFile reading

if (($result - $LogFileCount) -gt -1){

#it should be either the same value or higher then the last logfile value

$returnValue = $result - $LogFileCount

} else {

#LogFile value is higher then current count - this is weird

#still returning this - but it will show a negative count and should raise a flag

$returnValue = $result - $LogFileCount

$ErrorText += "error: logfile value higher then current printer read "

$ErrorValue = 2

}

} else {

#there was some kind of error in the LogFile read - not an integer value or new Logfile started and result was 0

$ErrorText += "error: can't read logfile for data compare "

$ErrorValue = 2

}

} else {

#no LogFile yet - will need one but return value as difference initially will stay 0

#we set the LogFileContent to 0 as this is the current status

$LogFileCount = 0

$ErrorText += "warning: initial run or no logfile yet or wrong data format "

$ErrorValue = 1

}

#we need to write the positive SNMP OID result to the LogFile

#but only if the date differs more then 1x day

[bool]$WriteLog = $false

[string]$CurrentDate = (Get-Date -Format yyyy-MM-dd)

if ($LogFileDate.Length -gt 0){

try{

if ((New-TimeSpan -Start $LogFileDate -End $CurrentDate).Days -gt 1){

#date difference more then 1 day

$WriteLog = $true

} else {

#date difference not sufficient - same day? Future?

if ((New-TimeSpan -Start $LogFileDate -End $CurrentDate).Days -lt 0){

#LogFile newer then current date? That's just wrong

$WriteLog = $true

$ErrorText += "warning: Logfile date above current date $LogFileDate - rewriting log"

$ErrorValue = 1

} else {

#not greater then 1 day (0 and 1) or less must be equal as a result...

#nothing to do as WriteLog is initialized false

}

} catch {

#couldn't compare the date - let's write the Log to be save

$WriteLog = $true

}

} else {

#LogFileDate length 0 means we need to write a logfile as it might not exist

$WriteLog = $true

}

if ($WriteLog){

try {

Set-Content -Path $LogFile -Value "$CurrentDate|$result"

$LogFileDate = $CurrentDate

} catch {

#there was an issue writing to the LogFile

$ErrorText += "error: can't write to logfile "

$ErrorValue = 2

}

} else {

#no pagecount available due to errors or issues

#uncomment the next line for debugging only

#$returnValue = $result

#the returnValue will now show the current result value and point therefor to the error section

$ErrorText += "error: no pagecount available "

$ErrorValue = 2

}

#Assuming no errors - the text result will be the last LogFile date

if ($ErrorText.Length -eq 0){

$ErrorText = "Last LogFile write date: $LogFileDate"

}

$XML = "<prtg>

<channel>last relative Page Count</channel>

<value>$returnValue</value>

</result>

<channel>last total from Printer</channel>

<value>$result</value>

</result>

<channel>last total from LogFile</channel>

<value>$LogFileCount</value>

</result>

<channel>Script Error Status</channel>

<value>$ErrorValue</value>

</result>

<text>$ErrorText</text>

</prtg>"

Function WriteXmlToScreen ([xml]$XML) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen $XML;

June 17, 2020 by Florian Rossmark monitoring prtg recommendations scripts server

Move user Documents and Desktop to OneDrive

The PowerShell script below was design to move Documents, Music, Videos, Pictures, Favorites and Desktop to a sub-folder in a connected OneDrive. In theory the script does not depend on OneDrive and could be adjusted to any other destination.

While it normally is wise to engage GPOs to adjust those paths to internal server resources, this is not possible easily while using OneDrive. The script therefor works better here.

What it does

is the current path per folder accessible
does the target path exist
1. YES: adjust the registry respective folder targets to the target path – FINISHED
2. NO: create the target folders – see 3.
is the source path on the same volume / partition – like C:
1. YES: see below – 4.
2. NO: check if there is enough free space for the amount of data needed to be moved
  1. YES: see below – 4.
  2. ALMOST: YELLOW warning – see below 4.
  3. NO: RED error – you could still proceed or simply close the script
move the data to the new target folder
remove the old folder – if not possible rename it

The script retains the special icons for the folders and engages the Windows API to adjust the folder paths.

What you need to do

Adjust the target-path in the top of the script
If desired, adjust the minimum free space value (2 GB by default) for the warning in regards to the free space – this only matters if the source and target volume / partition aren’t the same

To start the script, either right click and say run with PowerShell or run it directly in a PowerShell. This script will need to execute in the user-context and does NOT need administrative rights.

Clear
$NewRootPath = "$env:USERPROFILE\OneDrive - MYDOMAIN\User Profile"
$regUSF = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
$regSF = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" 

$Folders = "Personal,My Pictures,My Music,My Video,Favorites,Desktop"
$Folders = $Folders.Split(",")
$FolderNames = "Documents,Pictures,Music,Videos,Favorites,Desktop"
$FolderNames = $FolderNames.Split(",")

$AddSize = 2000000000 #free space in Bytes to add if files are on a different volume (2000000000 = about 2 GB)

$ArrayPosition = -1

Function Move-KnownFolderPath {
    Param (
            [Parameter(Mandatory = $true)]
            [ValidateSet('Desktop', 'Documents', 'Downloads', 'Favorites', 'Music', 'Pictures', 'Videos')]
            [string]$KnownFolder,
            [Parameter(Mandatory = $true)]
            [string]$Path
    )

    # Known Folder GUIDs
    $KnownFolders = @{
        'Desktop' = @('B4BFCC3A-DB2C-424C-B029-7FE99A87C641');
        'Documents' = @('FDD39AD0-238F-46AF-ADB4-6C85480369C7','f42ee2d3-909f-4907-8871-4c22fc0bf756');
        'Downloads' = @('374DE290-123F-4565-9164-39C4925E467B','7d83ee9b-2244-4e70-b1f5-5393042af1e4'); #not in use - just in case you want to use it..
        'Favorites' = '1777F761-68AD-4D8A-87BD-30B759FA33DD';
        'Music' = @('4BD8D571-6D19-48D3-BE97-422220080E43','a0c69a99-21c8-4671-8703-7934162fcf1d');
        'Pictures' = @('33E28130-4E1E-4676-835A-98395C3BC3BB','0ddd015d-b06c-45d5-8c4c-f59713854639');
        'Videos' = @('18989B1D-99B5-455B-841C-AB7C74E4DDFC','35286a68-3c57-41a1-bbb1-0eae73d76c95');
    }

    $FolderGUID = ([System.Management.Automation.PSTypeName]'KnownFolders').Type
	#create the Type entry if it does not yet exist / relates to the Registry eventually
    If (-not $FolderGUID) {
        $KnownFolderGUID = @'
[DllImport("shell32.dll")]
public extern static int SHSetKnownFolderPath(ref Guid folderId, uint flags, IntPtr token, [MarshalAs(UnmanagedType.LPWStr)] string path);
'@
        $FolderGUID = Add-Type -MemberDefinition $KnownFolderGUID -Name 'KnownFolders' -Namespace 'SHSetKnownFolderPath' -PassThru
    }

    If(!(Test-Path $Path)){
		#in case folder does yet exist, we create it
		Try {
			New-Item -Path $Path -Type Directory -Force -ErrorAction SilentlyContinue
		} Catch {}
    }
	#set the new folder path
	ForEach ($TmpGUID in $KnownFolders[$KnownFolder]) {
		$tmp = $FolderGUID::SHSetKnownFolderPath([ref]$TmpGUID, 0, 0, $Path)	
	}	
	Attrib +r $Path	#needed to retain the icon 
}

ForEach ($Folder In $Folders)
{	
	$ArrayPosition += 1
    Write-Host "Working on folder"$FolderNames[$ArrayPosition] -BackgroundColor DarkGreen
    $SourcePath = (Get-ItemProperty -Path $regUSF -Name $Folder).$Folder
    If ($SourcePath.Length -gt 0)
    {
		Write-Host "..checking source path: $SourcePath"
		If ((Test-Path -Path $SourcePath)){
			Write-Host "....path is accessible"
			$CompSource = Get-Item -Path $SourcePath
			$CompareResult = $false
			If ((Test-Path -Path ($NewRootPath + "\" + $CompSource.Name))){
				$CompTarget = Get-Item -Path ($NewRootPath + "\" + $CompSource.Name)
				Write-Host "..Comparing Source Path: "$CompSource.FullName
				Write-Host "....with Target Path:    "$CompTarget.FullName
				If ($CompSource.FullName.ToLower() -eq $CompTarget.FullName.ToLower()){
					$CompareResult = $true
				} Else {
					$CompareResult = $false
				}
			} Else {
				Write-Host "..Target Path does not exist"
			}
			If ($CompareResult -eq $true){
				Write-Host "..Source and Target path are identical: $CompTarget" -ForegroundColor Yellow
				Write-Host "....Not applying any changes!" -ForegroundColor Yellow
				Pause
			} Else {
				$SourceFolder = Get-Item -Path $SourcePath
				Write-Host "..accessing source folder $SourceFolder" -ForegroundColor Green
				If (!(Test-Path -Path ($NewRootPath + '\' + $SourceFolder.Name))){
					Move-KnownFolderPath -KnownFolder ("" + $FolderNames[$ArrayPosition] + "") -Path ($NewRootPath + '\' + $FolderNames[$ArrayPosition])
					$TargetPath = Get-Item -Path ("$NewRootPath\" + $FolderNames[$ArrayPosition])
					Write-Host "..created new folder $TargetPath"
					
					#compare source size with target free space here
					Write-Host "..Comparing Source and Target drive letters"
					If ($NewRootPath.SubString(0,2).ToLower() -ne $SourcePath.SubString(0,2).ToLower())
					{
						#source drives are different.. we need to obey the SourceSize against the free space on the target
						Write-Host "....Source and Target drive letters are different"
						Write-Host "......Please wait while calculating the source size"
						$SourceSize = (Get-ChildItem -Path $SourcePath -Recurse | Measure-Object -Property Length -Sum -ErrorAction SilentlyContinue).Sum
						$TargetFree = Get-PSDrive $NewRootPath.SubString(0,1) | Select-Object Free
						If ($SourceSize -gt $TargetFree.Free) {
							Write-Host "......The Source size of $SourceSize Bytes is bigger then the free space on the Target of $TargetFree.Free Bytes" -ForegroundColor Red
						} ElseIf (($SourceSize + $AddSize) -gt $TargetFree.Free) {
							Write-Host "......The Source size of $SourceSize Bytes is close to the free space on the Target of $TargetFree.Free Bytes" -ForegroundColor Yellow
						} Else {
							Write-Host "......The Source size of $TargetFree.Free Bytes is sufficient to hold the data from the Source of $SourceSize Bytes" -ForegroundColor Green
						}
						Pause
					} Else {
						Write-Host "....Source and Targets are on the same drive, all good"
					}
					
					Write-Host "..Moving data from: $SourcePath"
					Write-Host "....to folder:      $TargetPath"
					Write-Host "....This can take several minutes..."
					Move-Item -Path ("" + $SourcePath + "\*") -Destination $TargetPath -Force -ErrorAction SilentlyContinue
					Write-Host "....Done moving data"
				} Else {
					Write-Host "..Warning - Target Path exists already: $CompTarget" -ForegroundColor Yellow
					Write-Host "....Files will not be moved, registry still will be adjusted to the target path!" -ForegroundColor Yellow
					Pause
					Move-KnownFolderPath -KnownFolder ("" + $FolderNames[$ArrayPosition] + "") -Path ($NewRootPath + '\' + $FolderNames[$ArrayPosition])
					Write-Host "....Finished adjusting registry"
				}
				Write-Host "..Trying to remove $SourcePath"
				Pause
				Try {
					Attrib -r -s $SourceFolder.FullName	
					Remove-Item -Path $SourceFolder.FullName -Force -Confirm:$false -Recurse -ErrorAction SilentlyContinue
				} Catch {}	
				Try {
					Attrib -r -s ($SourceFolder + "\desktop.ini")	
					Remove-Item -Path ($SourceFolder + "\desktop.ini") -Force -Confirm:$false -ErrorAction SilentlyContinue
				} Catch {}						
				Try {
					Rename-Item -Path $SourceFolder -NewName ($SourceFolder.Name + ".old") -Force -ErrorAction SilentlyContinue
				} Catch {}		
			}
		} Else {
			Write-Host "....SourceFolder Path invalid: $SourcePath" -ForegroundColor Red
		}
    } 
	Write-Host "..Done processing"$FolderNames[$ArrayPosition] -BackgroundColor Blue
	Pause
}
Write-Host "Script finished processing" -ForegroundColor Green
Pause

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

Clear

$NewRootPath = "$env:USERPROFILE\OneDrive - MYDOMAIN\User Profile"

$regUSF = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"

$regSF = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"

$Folders = "Personal,My Pictures,My Music,My Video,Favorites,Desktop"

$Folders = $Folders.Split(",")

$FolderNames = "Documents,Pictures,Music,Videos,Favorites,Desktop"

$FolderNames = $FolderNames.Split(",")

$AddSize = 2000000000 #free space in Bytes to add if files are on a different volume (2000000000 = about 2 GB)

$ArrayPosition = -1

Function Move-KnownFolderPath {

Param (

[Parameter(Mandatory = $true)]

[ValidateSet('Desktop', 'Documents', 'Downloads', 'Favorites', 'Music', 'Pictures', 'Videos')]

[string]$KnownFolder,

[Parameter(Mandatory = $true)]

[string]$Path

)

# Known Folder GUIDs

$KnownFolders = @{

'Desktop' = @('B4BFCC3A-DB2C-424C-B029-7FE99A87C641');

'Documents' = @('FDD39AD0-238F-46AF-ADB4-6C85480369C7','f42ee2d3-909f-4907-8871-4c22fc0bf756');

'Downloads' = @('374DE290-123F-4565-9164-39C4925E467B','7d83ee9b-2244-4e70-b1f5-5393042af1e4'); #not in use - just in case you want to use it..

'Favorites' = '1777F761-68AD-4D8A-87BD-30B759FA33DD';

'Music' = @('4BD8D571-6D19-48D3-BE97-422220080E43','a0c69a99-21c8-4671-8703-7934162fcf1d');

'Pictures' = @('33E28130-4E1E-4676-835A-98395C3BC3BB','0ddd015d-b06c-45d5-8c4c-f59713854639');

'Videos' = @('18989B1D-99B5-455B-841C-AB7C74E4DDFC','35286a68-3c57-41a1-bbb1-0eae73d76c95');

}

$FolderGUID = ([System.Management.Automation.PSTypeName]'KnownFolders').Type

#create the Type entry if it does not yet exist / relates to the Registry eventually

If (-not $FolderGUID) {

$KnownFolderGUID = @'

[DllImport("shell32.dll")]

public extern static int SHSetKnownFolderPath(ref Guid folderId, uint flags, IntPtr token, [MarshalAs(UnmanagedType.LPWStr)] string path);

$FolderGUID = Add-Type -MemberDefinition $KnownFolderGUID -Name 'KnownFolders' -Namespace 'SHSetKnownFolderPath' -PassThru

}

If(!(Test-Path $Path)){

#in case folder does yet exist, we create it

Try {

New-Item -Path $Path -Type Directory -Force -ErrorAction SilentlyContinue

} Catch {}

}

#set the new folder path

ForEach ($TmpGUID in $KnownFolders[$KnownFolder]) {

$tmp = $FolderGUID::SHSetKnownFolderPath([ref]$TmpGUID, 0, 0, $Path)

}

Attrib +r $Path #needed to retain the icon

}

ForEach ($Folder In $Folders)

{

$ArrayPosition += 1

Write-Host "Working on folder"$FolderNames[$ArrayPosition] -BackgroundColor DarkGreen

$SourcePath = (Get-ItemProperty -Path $regUSF -Name $Folder).$Folder

If ($SourcePath.Length -gt 0)

{

Write-Host "..checking source path: $SourcePath"

If ((Test-Path -Path $SourcePath)){

Write-Host "....path is accessible"

$CompSource = Get-Item -Path $SourcePath

$CompareResult = $false

If ((Test-Path -Path ($NewRootPath + "\" + $CompSource.Name))){

$CompTarget = Get-Item -Path ($NewRootPath + "\" + $CompSource.Name)

Write-Host "..Comparing Source Path: "$CompSource.FullName

Write-Host "....with Target Path: "$CompTarget.FullName

If ($CompSource.FullName.ToLower() -eq $CompTarget.FullName.ToLower()){

$CompareResult = $true

} Else {

$CompareResult = $false

}

} Else {

Write-Host "..Target Path does not exist"

}

If ($CompareResult -eq $true){

Write-Host "..Source and Target path are identical: $CompTarget" -ForegroundColor Yellow

Write-Host "....Not applying any changes!" -ForegroundColor Yellow

Pause

} Else {

$SourceFolder = Get-Item -Path $SourcePath

Write-Host "..accessing source folder $SourceFolder" -ForegroundColor Green

If (!(Test-Path -Path ($NewRootPath + '\' + $SourceFolder.Name))){

Move-KnownFolderPath -KnownFolder ("" + $FolderNames[$ArrayPosition] + "") -Path ($NewRootPath + '\' + $FolderNames[$ArrayPosition])

$TargetPath = Get-Item -Path ("$NewRootPath\" + $FolderNames[$ArrayPosition])

Write-Host "..created new folder $TargetPath"

#compare source size with target free space here

Write-Host "..Comparing Source and Target drive letters"

If ($NewRootPath.SubString(0,2).ToLower() -ne $SourcePath.SubString(0,2).ToLower())

{

#source drives are different.. we need to obey the SourceSize against the free space on the target

Write-Host "....Source and Target drive letters are different"

Write-Host "......Please wait while calculating the source size"

$SourceSize = (Get-ChildItem -Path $SourcePath -Recurse | Measure-Object -Property Length -Sum -ErrorAction SilentlyContinue).Sum

$TargetFree = Get-PSDrive $NewRootPath.SubString(0,1) | Select-Object Free

If ($SourceSize -gt $TargetFree.Free) {

Write-Host "......The Source size of $SourceSize Bytes is bigger then the free space on the Target of $TargetFree.Free Bytes" -ForegroundColor Red

} ElseIf (($SourceSize + $AddSize) -gt $TargetFree.Free) {

Write-Host "......The Source size of $SourceSize Bytes is close to the free space on the Target of $TargetFree.Free Bytes" -ForegroundColor Yellow

} Else {

Write-Host "......The Source size of $TargetFree.Free Bytes is sufficient to hold the data from the Source of $SourceSize Bytes" -ForegroundColor Green

}

Pause

} Else {

Write-Host "....Source and Targets are on the same drive, all good"

}

Write-Host "..Moving data from: $SourcePath"

Write-Host "....to folder: $TargetPath"

Write-Host "....This can take several minutes..."

Move-Item -Path ("" + $SourcePath + "\*") -Destination $TargetPath -Force -ErrorAction SilentlyContinue

Write-Host "....Done moving data"

} Else {

Write-Host "..Warning - Target Path exists already: $CompTarget" -ForegroundColor Yellow

Write-Host "....Files will not be moved, registry still will be adjusted to the target path!" -ForegroundColor Yellow

Pause

Move-KnownFolderPath -KnownFolder ("" + $FolderNames[$ArrayPosition] + "") -Path ($NewRootPath + '\' + $FolderNames[$ArrayPosition])

Write-Host "....Finished adjusting registry"

}

Write-Host "..Trying to remove $SourcePath"

Pause

Try {

Attrib -r -s $SourceFolder.FullName

Remove-Item -Path $SourceFolder.FullName -Force -Confirm:$false -Recurse -ErrorAction SilentlyContinue

} Catch {}

Try {

Attrib -r -s ($SourceFolder + "\desktop.ini")

Remove-Item -Path ($SourceFolder + "\desktop.ini") -Force -Confirm:$false -ErrorAction SilentlyContinue

} Catch {}

Try {

Rename-Item -Path $SourceFolder -NewName ($SourceFolder.Name + ".old") -Force -ErrorAction SilentlyContinue

} Catch {}

}

} Else {

Write-Host "....SourceFolder Path invalid: $SourcePath" -ForegroundColor Red

}

Write-Host "..Done processing"$FolderNames[$ArrayPosition] -BackgroundColor Blue

Pause

}

Write-Host "Script finished processing" -ForegroundColor Green

Pause

Please be advised – the script will by default not try to move e.g. DOWNLOADS.

You can adjust this, while adding the folder to the two parameter, see sample below.

$Folders = "Personal,My Pictures,My Music,My Video,Favorites,Desktop<strong>,Downloads</strong>" 
$Folders = $Folders.Split(",") 
$FolderNames = "Documents,Pictures,Music,Videos,Favorites,Desktop<strong>,Downloads</strong>" 
$FolderNames = $FolderNames.Split(",")

$Folders = "Personal,My Pictures,My Music,My Video,Favorites,Desktop<strong>,Downloads</strong>"

$Folders = $Folders.Split(",")

$FolderNames = "Documents,Pictures,Music,Videos,Favorites,Desktop<strong>,Downloads</strong>"

$FolderNames = $FolderNames.Split(",")

If you want more folder, the script would need some special adjustments. It can be used as a base script, if you want.

April 18, 2019 by Florian Rossmark o365 / m365 recommendations scripts windows

Using PRTG to monitor manufacturing machines

ns a website from a systems administrator for systems administrators Home IT-Admins CMDB IT-Admins tool IT Search EOL Solutions Blog Contact Links Using PRTG to monitor manufacturing machines

This is a screenshot of the real-time data map of the PRTG instance that is used to monitor the data collected by the Raspberry PI and processed by PRTG to show how the progress of the production machine in manufacturing

A few weeks ago Paessler published on their blog an article I was part of that talked about a case study and implementation of how to use PRTG to real-time monitor a manufacturing machine / production machine while engaging a Raspberry PI.

The article describes what Dominik Wosiek and I implemented to monitor a manufacturing machine in real time. He started using a Raspberry PI and added eventually some magnetic field sensors to the machines robot arms to detect their movement. The data those sensor collected is interpreted by a script on the Raspberry PI and then send off to various HTTP push sensors on a free Paessler PRTG installation (we needed way less then 100 sensors and wanted to keep the installation independent).

On the PRTG instance, the data is of course collected and PRTG creates various graphs for us. We further added a PowerShell script that calculates the past time of the day. Due to us knowing the work-windows of the manufacturing department and how many parts are their daily target, we where able to use a Sensor Factory Sensor in PRTG to do some calculations and eventually show how the machine and the group controlling it was doing while comparing the output of parts relative to the time of the day – respective work hours past.

#1:Production time passed in percent [%]
((channel(2323,2) - (8 * 60)) / (17 * 60 - 8 * 60) * 100)
#2:Part output vs. time [%]
(channel(3232,2)/25000*100) - ((channel(2323,2) - (7 * 60)) / (16 * 60 - 7 * 60) * 100)
#3:Part output count
channel(3232,2)
#4:Part output in percent [%]
(channel(3232,2)/25000*100)

#1:Production time passed in percent [%]

((channel(2323,2) - (8 * 60)) / (17 * 60 - 8 * 60) * 100)

#2:Part output vs. time [%]

(channel(3232,2)/25000*100) - ((channel(2323,2) - (7 * 60)) / (16 * 60 - 7 * 60) * 100)

#3:Part output count

channel(3232,2)

#4:Part output in percent [%]

(channel(3232,2)/25000*100)

Above is an example configuration of the Sensor Factory Sensor in PRTG. We defined four channels:

Production time passed in percent [%]
1. this sensor pulls the passed time in minutes from the PowerShell Script sensor we created, it then does some math – the formula looks like this
  1. (passed minutes of the day – minutes passed when manufacturing starts) / (minutes passed when manufacturing ends – minutes passed when manufacturing starts) * 100 (to get percent)
  2. what it does in the example above:
    1. pull the passed minutes from the foreign sensor
    2. calculate 8 hours times 60 minutes (start of the day)
    3. subtract start time from passed time of the day (at 10 AM we would end up with 120 minutes)
    4. divide it with 17 hours times 60 or 5 PM in minutes of the day minus 8 AM minutes of the day – this gives you the total minutes between 8 AM and 5 PM – what is the defined manufacturing work time window
    5. multiply the result with 100 to get a percent value that shows the past time relative to the total work time window
Part output vs. time [%]
1. while the formula seems to be longer – it does nothing else then the using the same formula described in channel 4 minus the formula described in channel 2
2. in other words – the value of part output in percent minus the value of work time passed in percent
3. this results in either 0% – meaning the output is exactly at where they should be relative to the time past, or a negative number meaning the output is falling behind while a positive number would mean the part output is higher then expect relative to the time
  1. Note: this is all a bit relative, it might start negative in the morning, catch up to a positive number before lunch break, falling back to a negative number and then catching up to zero by the end of the day.. it depends on various factors but is a pretty good indicator
Part output count
1. this just loads the foreign channel of another sensor to show it in the same table/graph
Part output in percent [%]
1. while 25000 is the daily target amount of produced parts, this channel calculates how much of this was accomplished in percent while dividing the current count with the target count

Here is the script that I created to inject the minutes of the day in to a PRTG sensor – this is above used in channel(2323,2) within the formula.

$CurrentTime = Get-Date -UFormat %R
$CurrentHours = [int]$CurrentTime.ToString().Split(":")[0]
$CurrentMinutes = [int]$CurrentTime.ToString().Split(":")[1]

$MinutesToday = $CurrentMinutes + ($CurrentHours * 60)

$XML = "
<prtg>
    <result>
        <channel>Current Minutes Today</channel>
        <value>$MinutesToday</value>
    </result>
</prtg>
"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}
WriteXmlToScreen "$XML"

$CurrentTime = Get-Date -UFormat %R

$CurrentHours = [int]$CurrentTime.ToString().Split(":")[0]

$CurrentMinutes = [int]$CurrentTime.ToString().Split(":")[1]

$MinutesToday = $CurrentMinutes + ($CurrentHours * 60)

$XML = "

<prtg>

<channel>Current Minutes Today</channel>

<value>$MinutesToday</value>

</result>

</prtg>

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

Further details are described in the blog entry on the Paessler web site.

March 6, 2019 by Florian Rossmark monitoring prtg recommendations scripts solutions

Setting up Windows Search Index

The Windows Search indexing is a solution from Microsoft that will index your file servers and their files full text and allow your end users to get results quickly while actually engaging the fulltext search database seamlessly.

This is accomplish by just using the search box in the upper right of the Windows Explorer while residing on a network share or mapped network drive.

Many people say that the Windows Search does not work right, but my experience is that quite the opposite is true and it only depends on the right set up. This I will explain here further.

Before we go in to details – there is a challenge that goes along with DFS namespaces. I found a way to bypass this, look here to understand how it works.

add an additional drive to your file servers
- I roughly recommend about 10% of the total use size of your file shares that you want to index
- you might be able to go with less or more – but expect 10% to be more on the safe side
give the new drive a drive-letter (e.g. I: for Index) and name it INDEX (to make clear that this is only to be used for the INDEX database)
add the following path to this drive
- I:\ProgramData\Microsoft
- The path above mirrors the default path on the C: drive where the index will reside by default, I recommend to mirror this path on the new target drive to keep things simple and clear
add the feature Windows Search to your server
download the Microsoft Filter Pack 2.0 and install it on your server
- yes – this is a Office 2010 SP2 filter pack and yes that’s okay
- just download the x64 bit version of it and install it
- this will add a iFilter pack to Windows that allows Windows to understand DOCX and XLSX files (and others) and full text index them
enable the new service Windows Search
- set it to start type automatic
- start the service
from your start menu (or Control Panel) open the Indexing Options
- click on ADVANCED
  - select the earlier created path I:\ProgramData\Microsoft as new path for the index
  - after you click on OK Windows will stop the service and move the existing index
    - you might need to manually start the service again
- click now on MODIFY and select the server shares respectively local paths you want to index
- if you leave the Indexing Options open you will see that Windows updates the count constantly
  - Windows will slow down indexing if you work on the console or via RDP on the server Desktop
  - You will see the message INDEXING COMPLETED once all files have been index
    - this can take many days – don’t be surprised and be patient
think about monitoring the index and the partition the index resides on

One challenge resides – if your indexing drive becomes full, Windows Search indexing will crash the index database and likely determine it as corrupt and start from scratch. This can happen within minutes, even before any of your monitoring solutions might warn you about the full drive. There are eventlog entries about and you would easily see that the number of indexed files dropped to a very low number again. The drive becomes suddenly pretty empty as well again. This is sure one of the downsides of how Microsoft implemented this, but if you provide plenty of space in the first place, you likely won’t experience this issue.

iFilters for PDF files seem not to be necessary on current Windows versions. In the past I downloaded a iFilter for PDF files from Adobe but I experienced many issues with temporary files on the C:\ of my file servers. This is a known bug with the Adobe iFilter – as for Windows 2016 those files are full text index, but the same restrictions as in the past apply – PDF file can hold editable text that can be indexed or they hold pictures – what is often due to scans of documents – as long your scanner didn’t due OCR and translate the image to text, those files can’t be full text indexed.

Monitoring

It is almost essential to have proper monitoring in place for this. Actually, you want to monitor everything within your network, but that’s another story. I faced the same challenges and even was able to find out more about how the index database grows and why many people aren’t happy with it. Eventually it comes down to improper configurations and bad or nor monitoring at all. I highly recommend you have a look at this additional blog article about Windows Index Monitoring.

February 9, 2019 by Florian Rossmark configuration recommendations server

Read the UEFI stored Windows key and activate Windows

Ever wanted to read out the UEFI stored Windows key and probably automatically try to activate Windows with a single script?

The UEFI stored Windows license key is essential due to the fact that you don’t have a physical license anymore and you should keep it just in case for situations like your motherboard was exchanged and the key not transferred properly. I came across similar situations and was glad that I had the key.

But the script below does more then just reading and displaying the key – it will try to activate Windows as well.

Please note – it is wise to combine the read out of the key with an export and save method – like writing it to a database – this script will only show the basic functionality – but this is the most important part already.

$service = get-wmiObject -query 'select * from SoftwareLicensingService'
if($key = $service.OA3xOriginalProductKey){
	Write-Host 'Product Key:' $service.OA3xOriginalProductKey
	$service.InstallProductKey($key)
}else{
	Write-Host 'Key not found.'
}

$service = get-wmiObject -query 'select * from SoftwareLicensingService'

if($key = $service.OA3xOriginalProductKey){

Write-Host 'Product Key:' $service.OA3xOriginalProductKey

$service.InstallProductKey($key)

}else{

Write-Host 'Key not found.'

}

The next two lines help additionally – if you create this batch file as well and store both files in the same directory, you simply can right click the .CMD file and execute it with elevated rights (run as administrator) and it will make your live even easier. This is just a simple trick to bypass some restrictions that you might encounter while trying to execute a PowerShell script with elevated rights and bypassing the execution policy for scripts at the same time.

powershell.exe -executionpolicy unrestricted -file "%~dp0\ReadUEFIWindowsKeyAndActivateWindows.ps1"
pause

1 2	powershell.exe -executionpolicy unrestricted -file "%~dp0\ReadUEFIWindowsKeyAndActivateWindows.ps1" pause

December 11, 2018 by Florian Rossmark recommendations scripts web

Microsoft RADIUS / NPS SQL logging

An issue or question I see again and again – proper RADIUS logging with Microsoft NPS / Network Policy Server.

Let’s guide you through a few steps

Install a Microsoft SQL or if not available SQL Express
1. be aware – SQL Express has very tight database size limits and no SQL Agent – this might be an issue
Create a new database via SQL Management Studio in the SQL server
1. name it e.g. RADIUSLogging
run the SQL script from this Microsoft website in a new query window against this database (make sure it is not run against any other database by accident)
1. you could add a line like USE RADIUSLogging to prevent this – in the very top…
configure your RADIUS server to log to this SQL server and database
make sure you have fail-over logging to a text-file – to avoid issues in case your SQL DB grew to big or was not reachable for any reason
1. decide in the text-file configuration if you want to deny access if there is an issue or if you still want to proceed with the logon

Now you have RADIUS logging the information to a SQL database – actually a single table – and you can dig around in it. The IT-Assets database provides a front-end example for this – you don’t need to use it – but it might be of help – see here.

To interpret all those columns and values – look at the following links for additional information:

You will face the issue that the database will grow rapidly – depending on how many requests go to your RADIUS system etc… Keep an close eye on it – use a monitoring software like Paessler / PRTG to monitor the size and keep in mind that SQL Express might have size limits like 10 GB. The full version of Microsoft SQL has no such limits and further can you use SQL Agent to execute tasks. The following script can help you purging data from the RADIUS database to keep its size under control. You can use SQL Agent (not in SQL Express) to run it automatically or if you use SQL Express either run it manually or with another solution somehow automatically against the database delete older entries.

The script actually will purge data older then 14 days – you can adjust the days to your liking / needs.

DELETE FROM dbo.accounting_data
where datediff(day,dbo.accounting_data.timestamp,getdate()) >14

1 2	DELETE FROM dbo.accounting_data where datediff(day,dbo.accounting_data.timestamp,getdate()) >14

September 6, 2018 by Florian Rossmark configuration recommendations security server solutions

Updated domain join script including KeePass / Pleasant Password server entries for local admins

Today I post an updated version of the domain-join script I initially posted here.

In theory you can just replace the script with the new version – assuming you did not make any changes other then adjusting it to your domain / server-names.

What changed in the newer version:

the top lines in the script hold the basic configuration parameters
- line 1: NetBIOS name of your Active Directory domain
- line 2: your DNS domain name
- line 3: your distinguished domain name / root DN of your domain
- line 4: your default OU for new workstations
- line 5: empty
- line 6: KeePass / Pleasant Password Server URL
- line 7: KeePass folder to store the password in
the script now relies on the above parameters rather then specifying them in various areas in the script, making the whole use / adjustment of the script way easier
advanced error handling
- after the user entered the computer name and his domain admin credentials the systems checks if it can connect to the domain and if the computer name already exists
  - if the domain credentials are invalid (can be a non-admin – as long they are valid) you get a message explaining that the script will stop due to wrong credentials
  - if the computer name already exists in the domain, you get a message about it and the script stops
- KeePass or Pleasant Password Server connection – if it fails to connect with the credentials provided, you get a message about it and the script will stop
adjusted messages with various colours
- white text – standard as it was before
- yellow text – highlighted information so it sticks better out for the end-user
- magenta text – handled error / failure message – this is an explanation that something stopped the script from going further
- red text – those are real PowerShell error messages – either due to not handled errors or if the error was handled plotted out to the screen as additional reference and help

For additional information, please look at the original post here.

This script is also mentioned on the API Examples page on the Pleasant Solutions web site here.

$MyDomainNetBIOS="CONTOSO"
$MyDomain="contoso.local"
$MyDomainDN="dc=contoso,dc=local"
$MyDomainOU="OU=Computers,OU=USA,DC=contoso,DC=local"

$KeepassURL = "https://pwdbserver01v.contoso.local:10001"
$PWFolder = "Local Admins"

$ScriptVersion = "1.4 - 9/5/2018 - Florian Rossmark"
Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Welcome to the Domain-Join script"
Write-Host "================================="
Write-Host ""
Write-Host ""
Write-Host "This script will do the following Steps:"
Write-Host "----------------------------------------"
Write-Host "- You enter the Computer Name / Host Name" -ForegroundColor Yellow
Write-Host "- You enter Domain Admin credentials for a Domain-Join" -ForegroundColor Yellow
Write-Host "- You enter credentials to access KeyPass Password server" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Note: always type credentials without any domain-information ($MyDomainNetBIOS\) - the script will fail otherwise."
Write-Host ""
Write-Host ""
Write-Host ""
Write-Host "- The script will automatically create a KeyPass entry with all information" -ForegroundColor Yellow
Write-Host "- The script will automatically create a specific local admin account for this machine" -ForegroundColor Yellow
Write-Host "- The script will automatically rename the system to the given name" -ForegroundColor Yellow
Write-Host "- The script will automatically join the system to the domain $MyDomain" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Script Version: $ScriptVersion"
Write-Host ""
Write-Host ""
pause

#Upper area holds functions..
Function MakeUp-String([Int]$Size = 8, [Char[]]$CharSets = "ULNS", [Char[]]$Exclude) {
    $Chars = @(); $TokenSet = @()
    If (!$TokenSets) {$Global:TokenSets = @{
        U = [Char[]]'ABCDEFGHJKLMNPQRSTUVWXYZ'                                #Upper case
        L = [Char[]]'abcdefghijkmnpqrstuvwxyz'                                #Lower case
        N = [Char[]]'23456789'                                                #Numerals
        S = [Char[]]'!@$!@$!@$!@$'                         #Symbols
    }}
    $CharSets | ForEach {
        $Tokens = $TokenSets."$_" | ForEach {If ($Exclude -cNotContains $_) {$_}}
        If ($Tokens) {
            $TokensSet += $Tokens
            If ($_ -cle [Char]"Z") {$Chars += $Tokens | Get-Random}             #Character sets defined in upper case are mandatory
        }
    }
    While ($Chars.Count -lt $Size) {$Chars += $TokensSet | Get-Random}
    ($Chars | Sort-Object {Get-Random}) -Join ""                                #Mix the (mandatory) characters and output string
}; 
#avoid certificate issues
Add-Type @"
    using System;
    using System.Net;
    using System.Net.Security;
    using System.Security.Cryptography.X509Certificates;
    public class ServerCertificateValidationCallback
    {
        public static void Ignore()
        {
            ServicePointManager.ServerCertificateValidationCallback += 
                delegate
                (
                    Object obj, 
                    X509Certificate certificate, 
                    X509Chain chain, 
                    SslPolicyErrors errors
                )
                {
                    return true;
                };
        }
    }
"@
[ServerCertificateValidationCallback]::Ignore();

#Script starts here...
Clear-Host
Write-Host ""
Write-Host ""
Write-Host "This script must be executed in a power-shell with elevated rights!" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Stop the script with: CTRL + C any time..."
Write-Host ""
Write-Host ""
Pause
Clear-Host

$ComputerName = Read-Host "Please enter new Computer Name"
$DomainJoinCredentials = Get-Credential -Message "Enter your credentials for the domain join ($MyDomainNetBIOS) without the domain part"

Try{
    $ADSISearcherDE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$MyDomain",$($DomainJoinCredentials.UserName),$($DomainJoinCredentials.GetNetworkCredential().password))
    $ADSISearcher = New-Object System.DirectoryServices.DirectorySearcher($ADSISearcherDE,"(&(objectCategory=Computer)(name=$ComputerName))")
    $ADSISearcherResults = $ADSISearcher.FindAll()
    if ($ADSISearcherResults.Count -gt 0)
    {
        Clear-Host
        Write-Host ""
        Write-Host ""
        Write-Host "Computer account with this name '$ComputerName' already exists in the domain '$MyDomain'." -ForegroundColor Magenta
        Write-Host ""
        Write-Host ""
        Write-Host "You need to delete the account first or make sure you entered the right name." -ForegroundColor Magenta
        Write-Host ""
        Write-Host ""
        Write-Host "Script will stop now." -ForegroundColor Magenta
        Write-Host ""
        Write-Host ""
        Pause
        Exit
    }
} Catch {
    Clear-Host
    Write-Host ""
    Write-Host ""
    Write-Host "Your Domain Admin credentials where wrong." -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host "Script will stop now." -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host ""
    Write-Host "================================================================================================================"
    Write-Host "Error Details:"
    Write-Host "=============="
    write-host "Caught exception:" -ForegroundColor Red
    write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red
    write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red
    Write-Host "================================================================================================================"
    Write-Host ""
    Write-Host ""
    Pause
    Exit
}

$KeePassCredentials = Get-Credential -Message “Enter your credentials to access Keepass Server without the domain part” 
$localAdminUser = $("$ComputerName" + "_Admin")
$PW = MakeUp-String(12)
$PWencrypted = ConvertTo-SecureString $PW -AsPlainText -Force

Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Checking KeePass to see if those credentials already exist"
Write-Host ""
Write-Host ""

#Collecting MACs
$colMACItems = get-wmiobject Win32_NetworkAdapter | Where-Object {$_.MACAddress -like "*:*"}
foreach ($objMACItem in $colMACItems) {  
    $MACobj = $objMACItem |select Description,MACAddress   
    $MACs += $MACobj.MACAddress + " - " + $MACobj.Description + "
"
}
#Collecting SN/ServiceTag and HW information
$SN = "ServiceTag / SN: "+(Get-WmiObject win32_bios | select SerialNumber).SerialNumber
$Model = "Model: "+(Get-WmiObject win32_computersystem | select Model).Model
$Manufacturer = "Manufacturer: "+(Get-WmiObject win32_computersystem | select Manufacturer).Manufacturer
$UEFIKey = wmic path softwarelicensingservice get OA3xOriginalProductKey
$PWName = "Individual Admin Account on $ComputerName"
$PWUser = $localAdminUser
$PWPassword = $PW
$PWDescription = "Hardware information:
=====================
$Manufacturer
$Model
$SN

UEFI BIOS Windows Key:
======================
$UEFIKey

Known MAC Addresses:
====================
$MACs
(MACs might be subject to change with Docking-Stations)"

$tokenParams = @{
    grant_type='password';
    username=$KeePassCredentials.UserName;
    password=$KeePassCredentials.GetNetworkCredential().password;}

Try{
    $JSON = Invoke-WebRequest -Uri "$KeepassURL/OAuth2/Token" -Method POST -Body $tokenParams -ContentType "application/x-www-form-urlencoded" -UseBasicParsing 
    $Token = (ConvertFrom-Json $JSON.Content).access_token
} Catch {
    Clear-Host
    Write-Host ""
    Write-Host ""
    Write-Host "Your KeePass credentials did not work." -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host "Script will stop now." -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host ""
    Write-Host "================================================================================================================"
    Write-Host "Error Details:"
    Write-Host "=============="
    write-host "Caught exception:" -ForegroundColor Red
    write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red
    write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red
    Write-Host "================================================================================================================"
    Write-Host ""
    Write-Host ""
    Pause
    Exit
}

$headers = @{
    "Accept" = "application/json"
    "Authorization" = "$Token"}
    
$GroupSearch = @{“search” = $PWFolder}
$Group = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $GroupSearch) -Headers $headers -ContentType 'application/json' -UseBasicParsing
$GroupID = $Group.Groups.Id

$SearchPhrase = $PWUser
$searchbody = @{“search” = $SearchPhrase}
$Search = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $searchbody) -Headers $headers -ContentType 'application/json' -UseBasicParsing
$SearchID = $Search.Credentials.Id

$KeePassResultscnt = 0
ForEach($Result in $Search.credentials)
{
    $CredentialID = $Result.id
    If ($Result.GroupId -eq $GroupID)
    {
        $KeePassResultscnt += 1
    }        
}
If ($KeePassResultscnt -ge 1)
{
    Write-Host "Total number of results found: $cnt" -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host "ALERT - KeePass already has credentials for this system - can not proceed." -ForegroundColor Magenta
    Write-Host "==========================================================================" -ForegroundColor Magenta
    Write-Host ""
    Write-Host "Search-Phrase: $SearchPhrase" -ForegroundColor Magenta
    Write-Host "Search-Folder: $PWFolder" -ForegroundColor Magenta
    Write-Host "Amount of results found: $KeePassResultscnt" -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host ""
    Write-Host "Next Steps:" -ForegroundColor Magenta
    Write-Host "===========" -ForegroundColor Magenta
    Write-Host "- This script will exit now!" -ForegroundColor Magenta
    Write-Host "- No changes to the system of KeePass have been applied" -ForegroundColor Magenta
    Write-Host "- Go to KeePass and check if this is an old entry and can be renamed/moved" -ForegroundColor Magenta
    Write-Host "- Execute the script again" -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    pause
    EXIT
} Else {
    Write-Host ""
    Write-Host ""
    Write-Host "Writing new credentials to the KeePass server/database"
    Write-Host ""
    Write-Host ""
    $PWEntryDT = Get-Date -Format "O"
    $CredEntry = @{
        Id = "00000000-0000-0000-0000-000000000000"
        Name = "$PWName"
        Username = "$PWUser"
        Password = "$PWPassword"
        Created = "$PWEntryDT"
        Modified = "$PWEntryDT"
        GroupId = "$GroupID"
        Notes = "$PWDescription"
        Url = "$ComputerName"
    }
    Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/credential/00000000-0000-0000-0000-000000000000"-body @(ConvertTo-Json $CredEntry) -Headers $headers -ContentType 'application/json' -UseBasicParsing
    Write-Host ""
    Write-Host ""
    Write-Host "Finished writing to KeePass server/database"
    Write-Host ""
    Write-Host ""
}
pause

Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Please check the following information:"
Write-Host "======================================="
Write-Host ""
Write-Host "Computer Name: $ComputerName" -ForegroundColor Yellow
Write-Host "local Admin: $localAdminUser" -ForegroundColor Yellow
Write-Host "Admin-PW: $PW" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Make sure the information above are correct!"
Write-Host ""
Write-Host ""
Write-Host "Verify the local Admin and Admin-PW in KeePass!" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
pause
Write-Host ""
Write-Host ""
Write-Host "All information are verified?"
Write-Host ""
Write-Host ""
pause

Clear-Host
Write-Host "Checking and removing (if exists) old local user: $localAdminUser"
Get-LocalUser -Name $localAdminUser | Remove-LocalUser 
Clear-Host
Write-Host "Adding new local administrator account: $localAdminUser"
New-LocalUser -Name $localAdminUser -Password $PWencrypted -AccountNeverExpires -PasswordNeverExpires -Description "System specific local administrator account"
$NewUser = Get-LocalUser -Name $localAdminUser
$AdminGroup = Get-LocalGroup -Name "Administrators"
Add-LocalGroupMember -Name $AdminGroup -Member $NewUser

Write-Host ""
Write-Host ""
Write-Host "Finished."
Write-Host ""
Write-Host ""
pause

Write-Host ""
Write-Host ""
Write-Host "Joining this system to the domain and reboot automatically - stay put" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Note: The system will not reboot if an error occurs. Check the error message in case you see an error." -ForegroundColor Yellow
Write-Host ""
Write-Host ""

Try{
    Add-Computer -Domain $MyDomain -Credential $DomainJoinCredentials -NewName $ComputerName -Restart -Force -OUPath $MyDomainOU
} Catch {
    Write-Host ""
    Write-Host ""
    Write-Host "Domain-Join did not work - Error:" -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host ""
    Write-Host "================================================================================================================"
    Write-Host "Error Details:"
    Write-Host "=============="
    write-host "Caught exception:" -ForegroundColor Red
    write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red
    write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red
    Write-Host "================================================================================================================"
    Write-Host ""
    Write-Host ""
    Pause
} Finally {
    Exit
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

$MyDomainNetBIOS="CONTOSO"

$MyDomain="contoso.local"

$MyDomainDN="dc=contoso,dc=local"

$MyDomainOU="OU=Computers,OU=USA,DC=contoso,DC=local"

$KeepassURL = "https://pwdbserver01v.contoso.local:10001"

$PWFolder = "Local Admins"

$ScriptVersion = "1.4 - 9/5/2018 - Florian Rossmark"

Clear-Host

Write-Host ""

Write-Host "Welcome to the Domain-Join script"

Write-Host "================================="

Write-Host ""

Write-Host "This script will do the following Steps:"

Write-Host "----------------------------------------"

Write-Host "- You enter the Computer Name / Host Name" -ForegroundColor Yellow

Write-Host "- You enter Domain Admin credentials for a Domain-Join" -ForegroundColor Yellow

Write-Host "- You enter credentials to access KeyPass Password server" -ForegroundColor Yellow

Write-Host ""

Write-Host "Note: always type credentials without any domain-information ($MyDomainNetBIOS\) - the script will fail otherwise."

Write-Host ""

Write-Host "- The script will automatically create a KeyPass entry with all information" -ForegroundColor Yellow

Write-Host "- The script will automatically create a specific local admin account for this machine" -ForegroundColor Yellow

Write-Host "- The script will automatically rename the system to the given name" -ForegroundColor Yellow

Write-Host "- The script will automatically join the system to the domain $MyDomain" -ForegroundColor Yellow

Write-Host ""

Write-Host "Script Version: $ScriptVersion"

Write-Host ""

pause

#Upper area holds functions..

Function MakeUp-String([Int]$Size = 8, [Char[]]$CharSets = "ULNS", [Char[]]$Exclude) {

$Chars = @(); $TokenSet = @()

If (!$TokenSets) {$Global:TokenSets = @{

U = [Char[]]'ABCDEFGHJKLMNPQRSTUVWXYZ' #Upper case

L = [Char[]]'abcdefghijkmnpqrstuvwxyz' #Lower case

N = [Char[]]'23456789' #Numerals

S = [Char[]]'!@$!@$!@$!@$' #Symbols

}}

$CharSets | ForEach {

$Tokens = $TokenSets."$_" | ForEach {If ($Exclude -cNotContains $_) {$_}}

If ($Tokens) {

$TokensSet += $Tokens

If ($_ -cle [Char]"Z") {$Chars += $Tokens | Get-Random} #Character sets defined in upper case are mandatory

}

While ($Chars.Count -lt $Size) {$Chars += $TokensSet | Get-Random}

($Chars | Sort-Object {Get-Random}) -Join "" #Mix the (mandatory) characters and output string

};

#avoid certificate issues

Add-Type @"

using System;

using System.Net;

using System.Net.Security;

using System.Security.Cryptography.X509Certificates;

public class ServerCertificateValidationCallback

{

public static void Ignore()

{

ServicePointManager.ServerCertificateValidationCallback +=

delegate

(

Object obj,

X509Certificate certificate,

X509Chain chain,

SslPolicyErrors errors

)

{

return true;

};

}

[ServerCertificateValidationCallback]::Ignore();

#Script starts here...

Clear-Host

Write-Host ""

Write-Host "This script must be executed in a power-shell with elevated rights!" -ForegroundColor Yellow

Write-Host ""

Write-Host "Stop the script with: CTRL + C any time..."

Write-Host ""

Pause

Clear-Host

$ComputerName = Read-Host "Please enter new Computer Name"

$DomainJoinCredentials = Get-Credential -Message "Enter your credentials for the domain join ($MyDomainNetBIOS) without the domain part"

Try{

$ADSISearcherDE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$MyDomain",$($DomainJoinCredentials.UserName),$($DomainJoinCredentials.GetNetworkCredential().password))

$ADSISearcher = New-Object System.DirectoryServices.DirectorySearcher($ADSISearcherDE,"(&(objectCategory=Computer)(name=$ComputerName))")

$ADSISearcherResults = $ADSISearcher.FindAll()

if ($ADSISearcherResults.Count -gt 0)

{

Clear-Host

Write-Host ""

Write-Host "Computer account with this name '$ComputerName' already exists in the domain '$MyDomain'." -ForegroundColor Magenta

Write-Host ""

Write-Host "You need to delete the account first or make sure you entered the right name." -ForegroundColor Magenta

Write-Host ""

Write-Host "Script will stop now." -ForegroundColor Magenta

Write-Host ""

Pause

Exit

}

} Catch {

Clear-Host

Write-Host ""

Write-Host "Your Domain Admin credentials where wrong." -ForegroundColor Magenta

Write-Host ""

Write-Host "Script will stop now." -ForegroundColor Magenta

Write-Host ""

Write-Host "================================================================================================================"

Write-Host "Error Details:"

Write-Host "=============="

write-host "Caught exception:" -ForegroundColor Red

write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red

write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red

Write-Host "================================================================================================================"

Write-Host ""

Pause

Exit

}

$KeePassCredentials = Get-Credential -Message “Enter your credentials to access Keepass Server without the domain part”

$localAdminUser = $("$ComputerName" + "_Admin")

$PW = MakeUp-String(12)

$PWencrypted = ConvertTo-SecureString $PW -AsPlainText -Force

Clear-Host

Write-Host ""

Write-Host "Checking KeePass to see if those credentials already exist"

Write-Host ""

#Collecting MACs

$colMACItems = get-wmiobject Win32_NetworkAdapter | Where-Object {$_.MACAddress -like "*:*"}

foreach ($objMACItem in $colMACItems) {

$MACobj = $objMACItem |select Description,MACAddress

$MACs += $MACobj.MACAddress + " - " + $MACobj.Description + "

}

#Collecting SN/ServiceTag and HW information

$SN = "ServiceTag / SN: "+(Get-WmiObject win32_bios | select SerialNumber).SerialNumber

$Model = "Model: "+(Get-WmiObject win32_computersystem | select Model).Model

$Manufacturer = "Manufacturer: "+(Get-WmiObject win32_computersystem | select Manufacturer).Manufacturer

$UEFIKey = wmic path softwarelicensingservice get OA3xOriginalProductKey

$PWName = "Individual Admin Account on $ComputerName"

$PWUser = $localAdminUser

$PWPassword = $PW

$PWDescription = "Hardware information:

=====================

$Manufacturer

$Model

$SN

UEFI BIOS Windows Key:

======================

$UEFIKey

Known MAC Addresses:

====================

$MACs

(MACs might be subject to change with Docking-Stations)"

$tokenParams = @{

grant_type='password';

username=$KeePassCredentials.UserName;

password=$KeePassCredentials.GetNetworkCredential().password;}

Try{

$JSON = Invoke-WebRequest -Uri "$KeepassURL/OAuth2/Token" -Method POST -Body $tokenParams -ContentType "application/x-www-form-urlencoded" -UseBasicParsing

$Token = (ConvertFrom-Json $JSON.Content).access_token

} Catch {

Clear-Host

Write-Host ""

Write-Host "Your KeePass credentials did not work." -ForegroundColor Magenta

Write-Host ""

Write-Host "Script will stop now." -ForegroundColor Magenta

Write-Host ""

Write-Host "================================================================================================================"

Write-Host "Error Details:"

Write-Host "=============="

write-host "Caught exception:" -ForegroundColor Red

write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red

write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red

Write-Host "================================================================================================================"

Write-Host ""

Pause

Exit

}

$headers = @{

"Accept" = "application/json"

"Authorization" = "$Token"}

$GroupSearch = @{“search” = $PWFolder}

$Group = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $GroupSearch) -Headers $headers -ContentType 'application/json' -UseBasicParsing

$GroupID = $Group.Groups.Id

$SearchPhrase = $PWUser

$searchbody = @{“search” = $SearchPhrase}

$Search = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $searchbody) -Headers $headers -ContentType 'application/json' -UseBasicParsing

$SearchID = $Search.Credentials.Id

$KeePassResultscnt = 0

ForEach($Result in $Search.credentials)

{

$CredentialID = $Result.id

If ($Result.GroupId -eq $GroupID)

{

$KeePassResultscnt += 1

}

If ($KeePassResultscnt -ge 1)

{

Write-Host "Total number of results found: $cnt" -ForegroundColor Magenta

Write-Host ""

Write-Host "ALERT - KeePass already has credentials for this system - can not proceed." -ForegroundColor Magenta

Write-Host "==========================================================================" -ForegroundColor Magenta

Write-Host ""

Write-Host "Search-Phrase: $SearchPhrase" -ForegroundColor Magenta

Write-Host "Search-Folder: $PWFolder" -ForegroundColor Magenta

Write-Host "Amount of results found: $KeePassResultscnt" -ForegroundColor Magenta

Write-Host ""

Write-Host "Next Steps:" -ForegroundColor Magenta

Write-Host "===========" -ForegroundColor Magenta

Write-Host "- This script will exit now!" -ForegroundColor Magenta

Write-Host "- No changes to the system of KeePass have been applied" -ForegroundColor Magenta

Write-Host "- Go to KeePass and check if this is an old entry and can be renamed/moved" -ForegroundColor Magenta

Write-Host "- Execute the script again" -ForegroundColor Magenta

Write-Host ""

pause

EXIT

} Else {

Write-Host ""

Write-Host "Writing new credentials to the KeePass server/database"

Write-Host ""

$PWEntryDT = Get-Date -Format "O"

$CredEntry = @{

Id = "00000000-0000-0000-0000-000000000000"

Name = "$PWName"

Username = "$PWUser"

Password = "$PWPassword"

Created = "$PWEntryDT"

Modified = "$PWEntryDT"

GroupId = "$GroupID"

Notes = "$PWDescription"

Url = "$ComputerName"

}

Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/credential/00000000-0000-0000-0000-000000000000"-body @(ConvertTo-Json $CredEntry) -Headers $headers -ContentType 'application/json' -UseBasicParsing

Write-Host ""

Write-Host "Finished writing to KeePass server/database"

Write-Host ""

}

pause

Clear-Host

Write-Host ""

Write-Host "Please check the following information:"

Write-Host "======================================="

Write-Host ""

Write-Host "Computer Name: $ComputerName" -ForegroundColor Yellow

Write-Host "local Admin: $localAdminUser" -ForegroundColor Yellow

Write-Host "Admin-PW: $PW" -ForegroundColor Yellow

Write-Host ""

Write-Host "Make sure the information above are correct!"

Write-Host ""

Write-Host "Verify the local Admin and Admin-PW in KeePass!" -ForegroundColor Yellow

Write-Host ""

pause

Write-Host ""

Write-Host "All information are verified?"

Write-Host ""

pause

Clear-Host

Write-Host "Checking and removing (if exists) old local user: $localAdminUser"

Get-LocalUser -Name $localAdminUser | Remove-LocalUser

Clear-Host

Write-Host "Adding new local administrator account: $localAdminUser"

New-LocalUser -Name $localAdminUser -Password $PWencrypted -AccountNeverExpires -PasswordNeverExpires -Description "System specific local administrator account"

$NewUser = Get-LocalUser -Name $localAdminUser

$AdminGroup = Get-LocalGroup -Name "Administrators"

Add-LocalGroupMember -Name $AdminGroup -Member $NewUser

Write-Host ""

Write-Host "Finished."

Write-Host ""

pause

Write-Host ""

Write-Host "Joining this system to the domain and reboot automatically - stay put" -ForegroundColor Yellow

Write-Host ""

Write-Host "Note: The system will not reboot if an error occurs. Check the error message in case you see an error." -ForegroundColor Yellow

Write-Host ""

Try{

Add-Computer -Domain $MyDomain -Credential $DomainJoinCredentials -NewName $ComputerName -Restart -Force -OUPath $MyDomainOU

} Catch {

Write-Host ""

Write-Host "Domain-Join did not work - Error:" -ForegroundColor Magenta

Write-Host ""

Write-Host "================================================================================================================"

Write-Host "Error Details:"

Write-Host "=============="

write-host "Caught exception:" -ForegroundColor Red

write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red

write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red

Write-Host "================================================================================================================"

Write-Host ""

Pause

} Finally {

Exit

}

September 6, 2018 by Florian Rossmark recommendations scripts server solutions web

How to create an independent backup network

Today we look at independent backup networks especially in regards to LTO 7 and VMware ESX hosts. Be aware – this very example also applies to any backup to disk (B2D / Backup-2-Disk) solution. But a good reseller / vendor would inform you about this right away anyways.

LTO 7 and later like LTO 8 drives have a write speed faster then a 1 GBit network can handle, making it now really necessary to think about options. On top of it, you do not want to over utilize the LAN side of your servers so that the impact on the user / application facing side stays minimal. This leaves you with two options, you can group switch ports assuming you have enough 1 GB ports and use them, you will need at least 3 ports combined, or you create a whole backup network on a 10 GB basis.

Let’s run some numbers:

LTO7 has a write speed of about 300 MB/s uncrompressed and up to 750 MB/s compressed
LTO8 (L8) has a write speed of about 360 MB/s uncrompressed and up to 900 MB/s compressed

Now – your network connection is meassured in MBit/s not MByte/s. Byte to bit is 8 bit are one byte, so we need to multiply those speeds in byte with 8 bit too see the network speed numbers.

LTO7 uncrompressed = 300MB/s * 8 = 2400 MBit/s
LTO7 compressed = 750MB/s * 8 = 6000 MBit/s

LTO8 uncrompressed = 360MB/s * 8 = 2880 MBit/s
LTO8 compressed = 900MB/s * 8 = 7200 MBit/s

Assuming you want to go with grouped ports, you see that with LTO7 you would need 6 ports and LTO8 7 to 8 ports to fully utilize the speed and minimize your backup window. Additionally think about the read speed that might affect you as well – not just for recovery but for the verify of your backup.

Now – this means – add at least one 10 GB switch and one 10 GB NIC to each server – let’s do this with an example:

3x VMware ESX hosts – LAN side and management is configured 1 GB – we assume there is some kind of storage behind them that has the iOPS and speed we need like an SSD based storage
1x Backup media server that has an LTO7 or LTO8 drive connected – 1 GB on the LAN side

What we need – minimal:

4x 10 GB NICs
1x 10 GB switch
4x CAT6e or CAT7 cables

What I would recommend – nice to have:

4x 10 GB NICs – dual port
2x 10 GB switches
10x CAT7 cables – 2x to stack/trunk the switches if not stacked otherwise

This is a nice to have – a fail-over, but the minimal configuration is sufficient as well.

Cable this all in – create a new IP-scope / VLAN on the backup side – you do not need any default Gateway etc. on the Backup-Network side (10 GB). Just an independent IP scope and have every host assigned a static address.

This keeps the regular network traffic and any broadcasts away from this network and your backup will run totally independent. You might need to disable your anti-virus solution on this NIC / IP-scope on the backup media server as well, cause it might actually influence the speed quite drastically. Having it separated and independent helps keeping the security up.

On the VMware hosts – I like to even allow VMware to vMotion on this backup-LAN – simply because it is extremely efficient there – independent from your LAN and if you have it from your iSCSI network as well. But that’s just an idea.

Now – the backup – how will it grab the data from the 10 GB side of your VMware hosts – especially if you have a vSphere cluster and grab the backup through the cluster?

Simple – you adjust the hosts file on your media server. Each and every VMware host needs to be listed in the hosts-file on the media server with the IP that it has in your 10 GB backup network. This way DNS and everything will act normal in your environment, only the backup-media server will reach out to those hosts on the 10 GB network due to the IP resolution of those hosts. This is the easiest way to accomplish this.

You will not to add a 10 GB connection, backup-network IP address etc. to your VMware vSphere controller – it can stay on your LAN or server-management network as is. This also means there is no reason to mention him in the hosts file on the media server.

How this works:
your backup will contact the vSphere controller on the LAN side
it will then be redirected to the host that currently holds the VM you want to backup
the media server now will contact the VMware host directly – due to the hosts-file entry on the 10 GB backup-network
backup will process…

This of course would work with a physical server as well – like a physical file-server etc. – though, today this is rather rare and especially VMware backups are actually large files that benefit most from the LTO7 write speed so the above makes sense there most. It wouldn’t matter if you do the same to an Hyper-V environment or any other VM host/guest solution. In theory it should always work the same.

What real world write speeds can you expect?
This is the big question – here are some real world examples of this – those are single jobs on per VM basis, meaning it includes even the tape-load and tape-unload processing time and udpating the catalogs while using Veritas Backup Exec.

Backup size (VM size)	elapsed time in minutes	job rate write/overall	job rate verify
4 TB	6:47	17,227 MB/min	26,404 MB/min
2 TB	6:47	6,822 MB/min	22,233 MB/min
1.21 TB	3:49	8,271 MB/min	20,235 MB/min
147 GB	0:33	6,491 MB/min	22,655 MB/min
138 GB	0:17	18,403 MB/min	27,726 MB/min
25 GB	0:10	9,172 MB/min	20,700 MB/min

The above list is just an example – realistically we see speeds between about 3,000 MB/min to 18,000 MB/min as for the overall speed. This is due to the VM itself for some part – thin or thick provisioned, what kind of data is it holding, how busy is the host cause we might double trouble him due to multiple drives doing backups at the same time to the same host etc… In average we see around 8,000 to 9,000 MB/min in speed, what is still great – and I wanted to show as well that it can vary quite a bit so don’t be scared. We still did improve the time the backup took from going from an LTO4 LAN based backup scenario to an LTO7 independent backup network while cutting the time in half, actually, even less then half. The slowest speeds we see today are due to systems that can only be backed up on the LAN side, while the ports are grouped there but we still don’t have the same speed as we see on the backup-network side. Many factors come in play but that all depends on the individual situation.

Hoping the information above helps some of you out there – keep in mind that your situation might be different, run some examples and ideas and if you have questions, reach out – this remains an example of what I really implemented at a company and how it affected the backup configuration and management.

September 4, 2018 by Florian Rossmark configuration recommendations solutions

Gathering profile information from computer

Every now an then you might need to know who logged on and when was the last logon of which user to a specific workstation as well as the size of each user profile. For this I once wrote the PowerShell script you can find below. It does a WMI query against a list of one or more target computers and reads out the information reporting it back.

As input parameter use a comma separated list of computer names – those must be reachable and administrative accessible (you need at least admin rights on the target system). You then get a output set per profile.

The output can e.g. be transformed with the parameter |ft to see it in table format – like typical in PowerShell.

Output values are:

ComputerName
ProfileName
ProfilePath
ProfileType
- Temporary
- Roaming
- Mandatory
- Corrupted
- local
IsinUse
IsSystemAccount
Size
- this needs to most processing time – it is a manual size check including even temp files.. – other then what Windows shows you
LastUseTime

[cmdletbinding()]
[cmdletbinding()]
param (
[parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
[string[]]$ComputerName = $env:computername
)            
 
foreach ($Computer in $ComputerName) {
 $Profiles = Get-WmiObject -Class Win32_UserProfile -Computer $Computer -ea 0
 foreach ($profile in $profiles) {
  try {
      $objSID = New-Object System.Security.Principal.SecurityIdentifier($profile.sid)
      $objuser = $objsid.Translate([System.Security.Principal.NTAccount])
      $objusername = $objuser.value
  } catch {
        $objusername = $profile.sid
  }
  switch($profile.status){
   1 { $profileType="Temporary" }
   2 { $profileType="Roaming" }
   4 { $profileType="Mandatory" }
   8 { $profileType="Corrupted" }
   default { $profileType = "LOCAL" }
  }
  $size = 0
  try{
    $profilepath=$profile.localpath -replace "C:","\\$Computer\C$"
    $size=(dir $profilepath -recurse -force -ea silentlycontinue | Measure-Object ‘length’ -sum -Maximum).sum
    $size=[math]::Round(($size/1GB),2)
    #$size={{0:n2} -f $size}
    $size2=[string]::Format("{0:0.00} GB", $size)
  } catch {
    $size = -1
  }

  $User = $objUser.Value
  try {
	$ProfileLastUseTime = ([WMI]"").Converttodatetime($profile.lastusetime)
  } catch {
	$ProfileLastUseTime = ""
  }
  $OutputObj = New-Object -TypeName PSobject
  $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.toUpper()
  $OutputObj | Add-Member -MemberType NoteProperty -Name ProfileName -Value $objusername
  $OutputObj | Add-Member -MemberType NoteProperty -Name ProfilePath -Value $profile.localpath
  $OutputObj | Add-Member -MemberType NoteProperty -Name ProfileType -Value $ProfileType
  $OutputObj | Add-Member -MemberType NoteProperty -Name IsinUse -Value $profile.loaded
  $OutputObj | Add-Member -MemberType NoteProperty -Name IsSystemAccount -Value $profile.special
  $OutputObj | Add-Member -MemberType NoteProperty -Name Size -Value $size2
  $OutputObj | Add-Member -MemberType NoteProperty -Name LastUseTime -Value $ProfileLastUseTime
  $OutputObj
  
 }
}

[cmdletbinding()]

param (

[parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]

[string[]]$ComputerName = $env:computername

)

foreach ($Computer in $ComputerName) {

$Profiles = Get-WmiObject -Class Win32_UserProfile -Computer $Computer -ea 0

foreach ($profile in $profiles) {

try {

$objSID = New-Object System.Security.Principal.SecurityIdentifier($profile.sid)

$objuser = $objsid.Translate([System.Security.Principal.NTAccount])

$objusername = $objuser.value

} catch {

$objusername = $profile.sid

}

switch($profile.status){

1 { $profileType="Temporary" }

2 { $profileType="Roaming" }

4 { $profileType="Mandatory" }

8 { $profileType="Corrupted" }

default { $profileType = "LOCAL" }

}

$size = 0

try{

$profilepath=$profile.localpath -replace "C:","\\$Computer\C$"

$size=(dir $profilepath -recurse -force -ea silentlycontinue | Measure-Object ‘length’ -sum -Maximum).sum

$size=[math]::Round(($size/1GB),2)

#$size={{0:n2} -f $size}

$size2=[string]::Format("{0:0.00} GB", $size)

} catch {

$size = -1

}

$User = $objUser.Value

try {

$ProfileLastUseTime = ([WMI]"").Converttodatetime($profile.lastusetime)

} catch {

$ProfileLastUseTime = ""

}

$OutputObj = New-Object -TypeName PSobject

$OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.toUpper()

$OutputObj | Add-Member -MemberType NoteProperty -Name ProfileName -Value $objusername

$OutputObj | Add-Member -MemberType NoteProperty -Name ProfilePath -Value $profile.localpath

$OutputObj | Add-Member -MemberType NoteProperty -Name ProfileType -Value $ProfileType

$OutputObj | Add-Member -MemberType NoteProperty -Name IsinUse -Value $profile.loaded

$OutputObj | Add-Member -MemberType NoteProperty -Name IsSystemAccount -Value $profile.special

$OutputObj | Add-Member -MemberType NoteProperty -Name Size -Value $size2

$OutputObj | Add-Member -MemberType NoteProperty -Name LastUseTime -Value $ProfileLastUseTime

$OutputObj

}

August 20, 2018 by Florian Rossmark recommendations scripts solutions

The advantage of DFS and how to set up a working structure

File shares are something every IT professional will work with. Many companies have way to complicated and unstructured network file systems with to deep permissions, to many shares and access points, often several connected drives and from an IT perspective nightmares when it comes to migrating to newer servers or having satellite offices and subsidiaries gaining access to it especially on lower speed connections.

Having been in IT for about 20 years by now, I saw a lot and was challenged with it quite a bit. One of the best solutions I came across is the one I am about to show you here. It is very structured while giving you the advantage of leveraging it as you need and go and should allow you to use it in most businesses.

First of all – please note that I will not go as far as explaining and exploring the differences with Active Directory integrated and Stand-A-Lone namespaces. If by any means possible, I suggest you use Active Directory integrated namespaces to simplify the roll out, but both would work.

The structure example:

The structure example will depend on a DFS Root server and a separate File-Server per root-folder on the later network drive. This is just an example, you do not need to split it all up, thought if you can do it to keep it as structured as possible

Example target file system structure:

N:\
- N:\Archive
  - N:\Archive\John Doe
  - N:\Archive\Jane Doe
- N:\Departments
  - N:\Departments\Marketing
    - General
    - Mangement
    - Public (anyone has read access)
  - N:\Departments\Accounting
    - General
    - Mangement
    - Public (anyone has read access)
- N:\Other
  - N:\Other\Manufacturing
  - N:\Other\Projects

The declared goal is to keep the NTFS rights structure as simple as possible and not going any deeper then e.g. level three – e.g. N:\Departments\Marketing\General

Each department folder in this example will have a public folder where a member of the department has read/write access while any non-marketing member has read access to files that are published there.

The archive tree is for terminated employees and archive data. Their information gets collected in a sub-folder in this tree, a group will be created for each of those folders and only people that got approval to access this data will see and be able to read those archived files (read-only is recommended as NTFS permission)

The file servers and their preparation:

DFS Root-Server

create a folder on the data-partition like D:\DFSRoots – there will not be any real data in this folder – but it will hold the actual DFS structure
- create sub folders for the branches on the shared DFS drive like:
  - D:\DFSRoots\Departments
  - D:\DFSRoots\Archive
  - D:\DFSRoots\Other

DFS Department Server

create a folder on the data-partition like D:\SharedFolders\Departments
- remove the everyone or authenticated user groups from this folder – only System and Domain-Admins should have read/write permission here while group N_Departments will have read-only access on this folder.
- create a sub-folder for each main folder you want to see under the path N:\Departments and share it
- add a $ (dollar/string) sign to the share name so it remains hidden a hidden share
- Examples:
  - D:\SharedFolders\Departments\Marketing
  - D:\SharedFolders\Departments\Accounting
now create the following sub-folders for each department folder as shown on the example Marketing
- D:\SharedFolders\Departments\Marketing\General
- D:\SharedFolders\Departments\Marketing\Management
- D:\SharedFolders\Departments\Marketing\Public
create two groups in Active Directory for Marketing
- N_Departments_Marketing_General
- N_Departments_Marketing_Management
create a general group N_Departments to use it for all Public folders
assign the groups to their according sub-folders General and Management with read/write rights you probably will need to remove the read-access that the group N_Departments inherited from this folder
assign the group N_Departments to the Public folder in all departments with read-only rights (if not inherited)
assign the group N_Departments_Marketing_General to the Marketing\Public folder with read/write access – allowing each member of marketing to publish information for access to other people – only marketing can write in this folder, other people only have read-access to it

DFS Archive Server

create a folder on the data-partition like D:\SharedFolders\Archive
- create a sub-folder for each main folder you want to see under the path N:\Archive and share it
- add a $ (dollar/string) sign to the share name so it remains hidden a hidden share
- Examples:
  - D:\SharedFolders\Archive\John Doe
  - D:\SharedFolders\Archive\Jane Doe

DFS Other Server

create a folder on the data-partition like D:\SharedFolders\Other
- create a sub-folder for each main folder you want to see under the path N:\Other and share it
- add a $ (dollar/string) sign to the share name so it remains hidden a hidden share
- Examples:
  - D:\SharedFolders\Other\Manufacturing
  - D:\SharedFolders\Other\Projects

The DFS namespace set up and configuration

add the Namespace \\domain.local\N for the N: drive (just an example)
add the folders Archive, Departments and Other to the namespace
for each of those folders you add the shared sub-folders like indicated in the list below as sub-folders (they will appear on the Namespace tab when you click on the folder in the DFS Management) and set the target to the according file-share on the specific DFS server where the data will reside
- Departments\Marketing
- Departments\Accounting
- Archive\John Doe
- Archive\Jane Doe
- Other\Manufacturing
- Other\Projects
- This will actually create a shared sub-folder on the DFS Root server for each of those folders in D:\DFSRoot\

Note – information about the above example

The example below is kept simple – I did not go in to each and every right you would need to assign for the sole purpose of keeping it simple and understandable. Please investigate and set the rights as you really need them.

As for the Archive tree, it might be beneficial to have PowerShell script automate the folder creation, group creating and rights assignment for those NTFS paths, so you limit the possible failure-rate in case you are going to archive terminated employee data and other stuff in this tree branch.

What are the real benefits of this

add multiple folder targets for replication
- replication can be beneficial in a server-migration scenario as well as in a subsidiary scenario
- you can add replications on the departments-branch example per department folder – not each subsidiary will need a mirror folder of each department, rather then just a few – this decreases the amount of data and load on the connection and size of the server respective it’s disk-space and reduce cost as well
a simple rights structure fully based on groups
- in general you should never ever use a user account to assign any rights – always create a group, whether for a drive-share, NTFS rights or any other purpose. Always create a group!
- you can add and remove users from those groups
- you can audit the permissions on the NTFS side rather quick cause they should relate to strong group names
- the groups can be audited against HR lists of members of the department or by department managers and directors to make sure only people that need to have certain access levels will have them
while limiting access to certain folders you limit the amount of damage a possible attack by malware could cause
you can divide or summarize the actual file-servers that hold the data as needed in the long run
a simple group design with limited depth permissions is easier to maintain and audit
you have one central network drive that you will assign in order to give everyone access – all data will be centrally on this path independent from any file-server host-name. This can be a huge advantage cause some applications might not relate to the mapped drive rather than a UNC path what could cause you major headache when ever you want to migrate/upgrade or retire your file-servers later on
possible other file-shares within the corporation in other locations could be made accessible by linking them in as a folder in e.g. the others-namespace avoiding that users would need to know and remember the UNC path and you even allowing them to access any UNC path – it will act like a mapped drive while pointing in the background to an UNC path

There are many more advantages to DFS and the whole design. I hope this gives you a good overview and idea of how to design or re-design your file-server structure and simplify the whole access structure.

Full text search and DFS drive mappings

This is a challenge that is not easy to overcome. Still, thought there is no official and directly implemented solution from Microsoft for this, I was able develop and provide a solution that will access the Windows Search Index and provide it back to the end user only using standard Windows components. All you need to know and do is described in the IT Search section of this web site.

August 16, 2018 by Florian Rossmark configuration recommendations server solutions

Build your own lab environment with VMware

If you have a virtual system, like VMware, and a storage device behind it you might be able to mirror your whole real / live environment and create a complete playground or shadow network to simulate any of your guest VMs like the real system and being able to change, update and adjust the configuration within this lab environment.. This is actually rather easy to accomplish and can save you a lot of headache while using it.

This is just an example, you might be able to accomplish something similar while just cloning single VMs and in theory it wouldn’t even matter if you use VMware vSphere or something like Microsoft Hyper-V. Still, it has advantages to do it this way, but let me explain it.

Assumed scenario:

You work with an VMware environment with one or more host systems and several guest VMs. You need to update software and configurations on those guest VMs but need to test this beforehand to ensure everything runs smooth. The VMs are stored on a central storage device that can do volume-level snapshots.

Prepare the environment

you need one NIC per host that you will connect to a switch
best use an independent switch that has no other network connections then to the 1x NIC per host
create an Shadow-LAN virtual switch in your VMware cluster and use the 1x NIC per host so VMs through the cluster can communicate proper

What you do:

create a snapshot and mount it to the VMware host systems as an additional volume
go to the clone-volume file system and add the VMs you need to the inventory (you might want to rename to shadow-<servername> so you can easily identify them)
re-configure their network connection from your regular LAN virtual switch to the shadow-LAN virtual switch you prepared
start the added guest VM
1. if you are asked if you moved or copied the guest just say you moved it – to avoid hardware / MAC and other changes possibly causing Windows to want to re-activate
2. VMware might complain about a duplicate MAC address – you can ignore this, cause you are on two different / independent networks

Real usage example:

Let me give you a more detailed example on this with a few more details on what I personally used and did with this. The example you find below should help you understand the whole principle better.

VMware cluster with e.g. 10x host systems – we had enough RAM and CPU power that we could have 3x hosts go down – you won’t need that much, but of course you would have buffer for RAM and CPU usage
Nimble All-Flash storage arrays in the background connected to all the VMware hosts and using the Nimble VMware plugins (Note: Nimble was bought by HP / HPE as off today)
- the Nimbles are configured to do volume level snapshots multiple times per day
all physical host systems had a dedicated network card (NIC) connected to an independent physical switch that was NOT connected to any other network switch
a virtual switch SHADOW-LAN was created and those physical NICs of the hosts systems had been assigned to it
- this allowed any VM connected to this virtual switch to communicate with other VMs connected to the same virtual switch on other hosts

Due to migrations, software updates and quality controlled systems we constantly had the challenge to test and changes and adjustments thoroughly. So I came up with the solution to just clone a snapshot on the Nimble storage array the VM resided and mounting it to the VMware cluster, taking only minutes and then moving forward to add e.g. domain controllers, DHCP servers, necessary file-system servers and the target guest system to the inventory in VMware, adjusting their name so we could quickly identify them (even adding them to resource pools if necessary) and of course most important just changing their virtual switch configuration to the shadow switch.

Advantages and possibilities:

This now allowed to simulate the whole real world system (VMs) and simulate every change that we wanted. In order to get software there we attached if necessary VHDs that did hold what we needed or we even used a secondary internet connection to briefly connect to licensing services or update services that Vendors only provided online. The advantages of the solutions go even further:

simulate everything you have in your VMware environment available and have it working like the real / live system
if necessary, provide internet access while connecting a SECONDARY internet connection (router / firewall) to physical shadow network switch
adding real printers to the shadow switch to be able to test print-outs (we had those cases)
add physical workstations to simulate whole production environments
update / refresh the whole system in only a few minutes by using a fresh-snapshot clone
only minimal to almost none impact on the storage / free space of your storage device
- this is due to grabbing a Nimble snapshot that was cloned and therefor created a new branch and only the deltas (changes) had an impact on the storage – we talk even for “bigger” simulations only about a few gigabyte changed data – if at all that much – of course depending on your storage and what you do
we installed VMware console connections on quality testing workstations so they could access the system directly on the console
- of course only granting them minimal rights to this specific pool of VMs
- avoiding that their access to the VMware environment had any impact to the real system
documenting any changes, challenges faced and solutions found
due to a physical switch, and best practice using a layer-3 switch, we where able to simulate whole VLANs, routing etc. within the environment and even connecting various physical systems like printers, workstations and temporarily an internet-connection to this environment

It is only a small amount of effort to initially prepare for those simulations, cause the virtual shadow switch, the physical shadow switch and the hosts network card connections to this physical switch are a one time effort. After this you just clone and mount snapshots and add the actual VMs you need while adjusting their network connection to the virtual shadow switch.

Once setup, preparing simulations usually takes less then 30 minutes till everything is cloned, mounted, added to the inventory (incl. NIC adjust to the shadow switch) and booted up.

Why not just clone all VMs via VMware?

Good questions – the answer is simple, this would have an impact on your storage capacity, cause it would create an actual clone. And it actually takes longer to clone individual VMs then to just grab a storage-level snapshot and being able to adjust what you want down to the volume level on the storage. Even the clean-up might be more intense or leave some unwanted data back – while a clone on off the volume only needs you to remove the VM guest system from the inventory and then unmount and delete the whole shadow volume.

I did write this all up cause I wanted to share it – the whole idea is not that special in theory, but I thought it is an good example on how you can accomplish having a huge and decent lab environment with only minimal effort. In any case, I hope the idea behind it will help some off you out there 🙂

July 31, 2018 by Florian Rossmark configuration recommendations server solutions

Windows 2016 DHCP load balancer and it’s quirks

Windows 2016 or probably even 2012 allows you to create a real load balanced / full failover DHCP server configuration, other then Windows 2008 that only allowed you to split the scopes.

Now, this works pretty great for the most part – but it has actually two major flaws you need to be aware of and actually take action on.

Neither reservations nor server / scope options are replicated.

This actually is a big deal. Assuming you are changing settings on server A for the pool, you end up that clients depending on which DHCP answered them might apply the new settings from server A or pull the old ones from server B.

Further might a reservation work when you put it in place, and then – all of a sudden a few days later you get a ticket in telling you there is an issue and you find out that the reservation didn’t pull anymore. What happened? Well – you might have set the reservation on server B but not on server A – depending on which server answered the client, you run again in to an issue.

Microsoft seems to have put a quick and dirty synchronization in place and the only true way around is to force the two DHCPs to synchronize with the following PowerShell command:

Invoke-DhcpServerv4FailoverReplication -force

1	Invoke-DhcpServerv4FailoverReplication -force

This could be automated via the Task Scheduler by using invoking the command from a DOS prompt via:

powershell.exe -command "Invoke-DhcpServerv4FailoverReplication -force"

1	powershell.exe -command "Invoke-DhcpServerv4FailoverReplication -force"

But even then, you better check all your DHCP servers and always make sure any changes are made on all DHCP servers or at least correctly replicated. Otherwise you might encounter the weirdest issues.

July 27, 2018 by Florian Rossmark recommendations scripts server solutions

Automate Outlook signature roll outs while pulling the information from Active Directory / LDAP

The Outlook signature script you will find below is a bit more complicated then most other scripts I post, cause you might need to adjust a bit more. I used it for several years (as you can see in the script when it comes to Outlook versions and registry keys) in many networks and in most cases it worked just flawless once it was set up.

What does this script do exactly?

Good question – it actually writes every time a user logs on a signature file to his profile. The information in the file are pulled from Active Directory – where you are able to e.g. change the phone number, cell phone number or e.g. last name because the employee married. The signature file will automatically update. Even more important is the onboarding process, you actually can forget about setting up the signature. Assuming you don’t use roaming profiles, well – no worries – the signature will auto create everywhere, if you call it via a login script / logon script. In theory you could call it via a GPO as well.

What you need to do – simply said

get an approved example signature from HR or marketing or who ever can provide you the signature and actually put it in your Outlook as signature.
then replace names, phone numbers with variables (I come to that) and save it in your Outlook.
go to your %appdata%\Microsoft\Signatures folder and grab the three files (.txt / .htm / .rtf) and the sub-folder with the name of the signature you saved
copy them to your \\mydomain\netlogon\signatures folder (you might need to create it – any other location would need some adjustment in the script)
you will need to open the all three file formats (.txt / .htm / .rtf) in a regular text editor – plain text editor like NOTEPAD.EXE (Windows) or Notepad ++
make sure the variables are a complete word and not somehow divided or have characters replaced – if something is not how it should be, adjust it and save the files
Copy the OutlookSignatures.vbs file to the same path and adjust it especially in the header-section with your domain information and execute the script in a CMD / command prompt via \\mydomain\netlogon\signatures\OutlookSignatures.vbs “my signature” 1 1
Now go back to your Outlook (probably close and re-open) and create a new email – you should see your signature was auto-generated and the variables have been replaced with you user-specific values from Active Directory / LDAP.
you should switch your email format to all three formats – HTML / Plain Text / RTF and check the signature in all three formats – to make sure all three files where generated correctly
If something is not as expected, check the source-signature files and their variables and if needed adjust the variable-replacement section of the script

What you gain from this

The signatures will auto-generate and you actually have a cheap way to roll out corporate identity conform signatures, without spending a lot of money for tools that might provide you an easier to use configuration and some more fancy features – but if you don’t need those features and you can live with a more technical way to approach this you actually have a cheap way to implement this.

The variables

The script will pull certain properties / attributes from the currently logged on user object from Active Directory – those are configured in line 33 and if you need more you will need to add them here.

Between the lines 145 and 181 you see that the script is replacing place-holder variables in the source files (.TXT / .HTM / .RTF) with the information pulled from Active Directory – all those place holders in your source files need to be @@AnyName@@ – this is to make sure you have a unique definition of what the script will replace.

Example:

strCurrentLine = Replace(strCurrentLine, "@@GivenName@@", NZ(objrecordset.Fields("givenName"), ""))

1	strCurrentLine = Replace(strCurrentLine, "@@GivenName@@", NZ(objrecordset.Fields("givenName"), ""))

This does nothing else then:

replace the variable strCurrentLine with
1. search in variable strCurrentLine
2. for the value @@GivenName@@
3. replace it with LDAP attribute “givenName“

There are a few special examples for putting e.g. a HTML conform line-break after Job-Title in the .HTM file only in the script (I had situations where only the HTML signature did not do a Line-Break, or the Text-Version alone was not doing something, etc..) – in the end this allows you to adjust something in a one of the three signature formats.

Another example in the script writes an additional line with the cell phone / mobile number if available. If the number is set in the user object, a new line will be created depending on the file format – if the number is not set the search-variable will be removed from the signature (you off course don’t want it there) instead of writing the information out. In this case we add a “Cell: ” as prefix before the number so the signature indicates clearly what this number is about. Simply said, since we replace a variable and not a whole line – we have to write out more then just the number – in this case we want to add text.

Can you execute the script with various signatures per department?

Yes – you actually can – but you would need to do this with an additional script and e.g. IFMEMBER from Microsoft or group based GPOs etc…

Can you create more then one signature?

Yes – you can execute the script in various ways – you can roll out a NEW MAIL signature (full length signature) and a second version for REPLIES (short signature) and additional signatures that the user could choose from that aren’t set as either NEW MAIL or REPLY signature. The script header explains how to call the script and what parameters it will expect and how to set them.

Feel free to use the script below, adjust it for your needs. I know some of the stuff like your domain-name could be searched automatically instead of putting it hard-coded in the script – even the reg-keys could be more advanced, feel free to do so – but in the end it is not that much work and it does its job either way.

Debugging the script

At line 79 the statement “On Error Resume Next” avoids that you see errors that might arise. This is good for production so that the client/user does see as little as possible messages due to timeouts or special circumstances – but if you want to debug something or in the process to test the script itself, please remark the line so errors actually occur. They might not mean much in some cases, but they might also give you the hint you need to see what is going wrong.

'Parameters to execute the script:
'OutlookSignatures.VBS strInputFilePrefix bolUseAsDefaultNewMail bolUseAsDefaultReplyMail
' parameters are separated by spaces - use "" for input-file-names with spaces
' strInputFilePrefix: file name of the signature file - do not add any extensions (.txt / .htm / .rtf)
' bolUseAsDefaultNewMail: TRUE = 1 or -1 / FALSE = 0 - use numeric values
' bolUseAsDefaultReplyMail: TRUE = 1 or -1 / FALSE = 0 - use numeric values
'Example
'SIGNATUR.VBS MySignature 1 1

'generic variables - do not adjust
'Const HKEY_CLASSES_ROOT=&H80000000
'Const HKEY_LOCAL_MACHINE=&H80000002
'Const HKEY_USERS=&H80000003
'Const HKEY_CURRENT_CONFIG=&H80000005
Const HKEY_CURRENT_USER = &H80000001

Dim strLogonServer
Dim strDomain
Dim strEX
Dim strSignaturName
Dim strLDAPPath
Dim strFelder
Dim bolUseAsDefaultNewMail
Dim bolUseAsDefaultReplyMail

'Settings you need to adjust
'------------- BEGIN OF SETTINGS -------------
strDomain = "MyDomain" 'short NetBIOS domain name should be sufficient
strLDAPPath = "dc=MyDomain,dc=local"
'------------- SPECIAL SETTINGS -------------
'Those are the fields / attributes from AD that the script will obey and try to replace
'Additionally there is another special settings section further below that will do the acutal replacement
strFelder = "streetAddress,l,info,postalCode,telephoneNumber,facsimileTelephoneNumber,mail,sn,givenName,department,mobile"
'------------- END OF SETTINGS -------------

'the script assumes it is started from the logonserver respective from the \\mydomain\netlogon directory
Dim oShell
Set oShell = CreateObject("WScript.Shell")
strLogonServer = oShell.expandEnvironmentStrings("%LogonServer%")
strLogonServer = Replace(strLogonServer, "\\", "")
Set oShell = Nothing

'read parameters
strInputFilePrefix = WScript.Arguments.Item(0)
bolUseAsDefaultNewMail = CBool(WScript.Arguments.Item(1))
bolUseAsDefaultReplyMail = CBool(WScript.Arguments.Item(2))

'read files and adjust them
strEX = ".htm"
Convert
strEX = ".rtf"
Convert
strEX = ".txt"
Convert

Sub Convert()

Dim objNetwork
Dim strDestinationPath
Dim strInputFile
Dim strOutputFile
Dim strUser
Dim strUserProfile
Dim i
Dim j
Dim cn
Dim rs
Dim strSignaturNameHex
Dim cmdParam
Dim strUserstrDomain
Dim strAppData
Dim strSignaturePath
Dim fso
Dim strCurrentLine

Set objNetwork = CreateObject("WScript.Network")
Set WSHShell = WScript.CreateObject("WScript.Shell")

On Error Resume Next

'find current Windows user and profile path
strUserDomain = WSHShell.Environment("PROCESS").Item("userdomain")
If LCase(strUserDomain) = LCase(strDomain) Then
strUser = objNetwork.UserName
Else
strUser = WSHShell.Environment("PROCESS").Item("userdomain")
End If

strUserProfile = WSHShell.Environment("PROCESS").Item("userprofile")
strAppData = WSHShell.Environment("PROCESS").Item("appdata")

'LDAP connection
Set objConnection = CreateObject("ADODB.Connection")
objConnection.Open "Provider=ADsDSOObject;"

Set objCommand = CreateObject("ADODB.Command")
objCommand.ActiveConnection = objConnection

objCommand.CommandText = _
"<LDAP://" & strLDAPPath & ">;(&(objectCategory=User)" & _
"(samAccountName=" & strUser & "));" & strFelder & ";subtree"

Set objRecordset = objCommand.Execute
If Not objRecordset.RecordCount = 0 Then
strSignaturName = strInputFilePrefix

'if you pull the signatures from a different path then \\mydomain\netlogon adjust the following line accordingly
strInputFile = "\\" & strLogonServer & "\NetLogon\Signatures\" & strSignaturName & strEX 

'this will write the signature to the user profile - should not need adjustment
strSignaturePath = strAppData & "\Microsoft\Signatures\"
strOutputFile = strSignaturePath & strSignaturName & strEX

Set fso = CreateObject("Scripting.FileSystemObject")
If Not fso.FileExists(strInputFile) Then
MsgBox "Outlook-Signatures input file '" & strInputFile & "' not found or access denied - contact the helpdesk please!"
Exit Sub
End If

If Not fso.FolderExists(strSignaturePath) Then
fso.CreateFolder (strSignaturePath)
End If

'let's see if there is a special sub-folder that comes with the signatures
'note that this might depend on your language - it might be "-Dateien" (german) or "_files" in english - in the end it
'is the signature name plus an Windows language specific extension as a sub-folder 
'both languages are already obeyed - adjust if you have additional versions
'the script will copy the folder to the destination
If strEX = ".htm" Then
If fso.FolderExists("\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "-Dateien") Then
fso.CopyFolder "\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "-Dateien", strAppData & "\Microsoft\Signatures\", True
End If 
If fso.FolderExists("\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "_files") Then
fso.CopyFolder "\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "_files", strAppData & "\Microsoft\Signatures\", True
End If
End If

Set TS = fso.OpenTextFile(strInputFile, 1, False, -2) 'Change 0 to -1 or -2 for unicode files.
Set MyFile = fso.CreateTextFile(strOutputFile, True, False)

While Not TS.AtendOfStream
linesource = Trim(TS.ReadLine)
strCurrentLine = linesource
If InStr(strCurrentLine, "@@") > 0 Then
'------------- SPECIAL SETTINGS -------------
'the code in this section will replace variables in the source files with fields from Active Directory/LDAP. In some cases you might want special 
'replacements or e.g. write extra information - like if mobile number exists write "Cell: " + mobile - if not - do nothing - this might also depend on the current 
'file extension strEX - see examples below

'regular replacements
strCurrentLine = Replace(strCurrentLine, "@@GivenName@@", NZ(objrecordset.Fields("givenName"), ""))
strCurrentLine = Replace(strCurrentLine, "@@LastName@@", NZ(objrecordset.Fields("sn"), ""))
strCurrentLine = Replace(strCurrentLine, "@@Department@@", NZ(objrecordset.Fields("department"), ""))

'file specific and value specific replacement exmaples
If strEX = ".htm" then
'this will ad a line break after in HTML code
strCurrentLine = Replace(Replace(strCurrentLine, "@@Title@@", NZ(objrecordset.Fields("title"), "")),chr(13),"<br>")
Else
'non html files don't need this line-break in this example - you could add a VBNewLine or CHR(10) & CHR(13) etc..
strCurrentLine = Replace(strCurrentLine, "@@Title@@", NZ(objrecordset.Fields("title"), "")) 
End If

strCurrentLine = Replace(strCurrentLine, "@@eMail@@", NZ(objrecordset.Fields("mail"), ""))
strCurrentLine = Replace(strCurrentLine, "@@Phone@@", NZ(objrecordset.Fields("telephoneNumber"), ""))
strCurrentLine = Replace(strCurrentLine, "@@Fax@@", NZ(objrecordset.Fields("facsimileTelephoneNumber"), ""))
strCurrentLine = Replace(strCurrentLine, "@@Street@@", NZ(objrecordset.Fields("streetAddress"), ""))
strCurrentLine = Replace(strCurrentLine, "@@ZIPandCity@@", NZ(objrecordset.Fields("postalCode"), "") & " " & NZ(objrecordset.Fields("l"), ""))

'file specific and value specific replacement exmaples for mobile / cell number or not - the line will only appear if there is a cell phone number in LDAP
If Len(Trim(NZ(objrecordset.Fields("mobile"), ""))) > 0 Then
If strEX = ".htm" Then
strCurrentLine = Replace(strCurrentLine, "@@Mobile@@", "<br>Cell: " & NZ(objrecordset.Fields("mobile"), ""))
Else
strCurrentLine = Replace(strCurrentLine, "@@Mobile@@", "Cell: " & NZ(objrecordset.Fields("mobile"), ""))
End If
Else
strCurrentLine = Replace(strCurrentLine, "@@Mobile@@", "")
End If

'------------- END OF SPECIAL SETTINGS -------------
End If
MyFile.WriteLine strCurrentLine
Wend
Else
MsgBox ("Outlook-Signatures: User object not found in LDAP - please contact the helpdesk!")
End If

objConnection.Close

If strSignaturName <> "" Then
'Registry settings - version specific
'Outlook 2000/2002/XP
If bolUseAsDefaultNewMail Then
WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\NewSignature", strSignaturName
Else
WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\NewSignature", ""
End If
If bolUseAsDefaultReplyMail Then
WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\ReplySignature", strSignaturName
Else
WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\ReplySignature", ""
End If

'Outlook 2003 (sorry - might be I lost the correct RegKey - but I doubgt anyone is still using 2003 - might be the same os the 2007 
'we need some special calculations here - convert the regular strings to a reg-key formar / binary for Outlook 2007 and newer
ReDim arr((Len(strSignaturName) * 2) + 1)
For i = 1 To Len(strSignaturName)
arr((i - 1) * 2) = Asc(Mid(strSignaturName, i, 1))
arr(((i - 1) * 2) + 1) = 0
Next
arr((i - 1) * 2) = 0
arr(((i - 1) * 2) + 1) = 0

ReDim arrClean((Len("") * 2) + 1)
For i = 1 To Len("") 
arrClean((i - 1) * 2) = Asc(Mid("", i, 1))
arrClean(((i - 1) * 2) + 1) = 0
Next
arrClean((i - 1) * 2) = 0
arrClean(((i - 1) * 2) + 1) = 0

'Outlook 2007
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")
RegKeyName = "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002"
RegName = "New Signature"
If bolUseAsDefaultNewMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
RegName = "Reply-Forward Signature"
If bolUseAsDefaultReplyMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

'Outlook 2010
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")
RegKeyName = "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003" 
RegName = "New Signature"
If bolUseAsDefaultNewMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
RegName = "Reply-Forward Signature"
If bolUseAsDefaultReplyMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

'Outlook 2013
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")
RegKeyName = "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002" 
RegName = "New Signature"
If bolUseAsDefaultNewMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
RegName = "Reply-Forward Signature"
If bolUseAsDefaultReplyMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

'Outlook 2016
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")
RegKeyName = "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002" 
RegName = "New Signature"
If bolUseAsDefaultNewMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
RegName = "Reply-Forward Signature"
If bolUseAsDefaultReplyMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv") 
End If

MyFile.Close
TS.Close

Set fso = Nothing
Set TS = Nothing
Set MyFile = Nothing

End Sub

Function NZ(ValueIfNotNull, ValueIfNull)
NZ = ValueIfNotNull
If (IsNull(NZ)) Then NZ = ValueIfNull
End Function

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

'Parameters to execute the script:

'OutlookSignatures.VBS strInputFilePrefix bolUseAsDefaultNewMail bolUseAsDefaultReplyMail

' parameters are separated by spaces - use "" for input-file-names with spaces

' strInputFilePrefix: file name of the signature file - do not add any extensions (.txt / .htm / .rtf)

' bolUseAsDefaultNewMail: TRUE = 1 or -1 / FALSE = 0 - use numeric values

' bolUseAsDefaultReplyMail: TRUE = 1 or -1 / FALSE = 0 - use numeric values

'Example

'SIGNATUR.VBS MySignature 1 1

'generic variables - do not adjust

'Const HKEY_CLASSES_ROOT=&H80000000

'Const HKEY_LOCAL_MACHINE=&H80000002

'Const HKEY_USERS=&H80000003

'Const HKEY_CURRENT_CONFIG=&H80000005

Const HKEY_CURRENT_USER = &H80000001

Dim strLogonServer

Dim strDomain

Dim strEX

Dim strSignaturName

Dim strLDAPPath

Dim strFelder

Dim bolUseAsDefaultNewMail

Dim bolUseAsDefaultReplyMail

'Settings you need to adjust

'------------- BEGIN OF SETTINGS -------------

strDomain = "MyDomain" 'short NetBIOS domain name should be sufficient

strLDAPPath = "dc=MyDomain,dc=local"

'------------- SPECIAL SETTINGS -------------

'Those are the fields / attributes from AD that the script will obey and try to replace

'Additionally there is another special settings section further below that will do the acutal replacement

strFelder = "streetAddress,l,info,postalCode,telephoneNumber,facsimileTelephoneNumber,mail,sn,givenName,department,mobile"

'------------- END OF SETTINGS -------------

'the script assumes it is started from the logonserver respective from the \\mydomain\netlogon directory

Dim oShell

Set oShell = CreateObject("WScript.Shell")

strLogonServer = oShell.expandEnvironmentStrings("%LogonServer%")

strLogonServer = Replace(strLogonServer, "\\", "")

Set oShell = Nothing

'read parameters

strInputFilePrefix = WScript.Arguments.Item(0)

bolUseAsDefaultNewMail = CBool(WScript.Arguments.Item(1))

bolUseAsDefaultReplyMail = CBool(WScript.Arguments.Item(2))

'read files and adjust them

strEX = ".htm"

Convert

strEX = ".rtf"

Convert

strEX = ".txt"

Convert

Sub Convert()

Dim objNetwork

Dim strDestinationPath

Dim strInputFile

Dim strOutputFile

Dim strUser

Dim strUserProfile

Dim i

Dim j

Dim cn

Dim rs

Dim strSignaturNameHex

Dim cmdParam

Dim strUserstrDomain

Dim strAppData

Dim strSignaturePath

Dim fso

Dim strCurrentLine

Set objNetwork = CreateObject("WScript.Network")

Set WSHShell = WScript.CreateObject("WScript.Shell")

On Error Resume Next

'find current Windows user and profile path

strUserDomain = WSHShell.Environment("PROCESS").Item("userdomain")

If LCase(strUserDomain) = LCase(strDomain) Then

strUser = objNetwork.UserName

Else

strUser = WSHShell.Environment("PROCESS").Item("userdomain")

End If

strUserProfile = WSHShell.Environment("PROCESS").Item("userprofile")

strAppData = WSHShell.Environment("PROCESS").Item("appdata")

'LDAP connection

Set objConnection = CreateObject("ADODB.Connection")

objConnection.Open "Provider=ADsDSOObject;"

Set objCommand = CreateObject("ADODB.Command")

objCommand.ActiveConnection = objConnection

objCommand.CommandText = _

"<LDAP://" & strLDAPPath & ">;(&(objectCategory=User)" & _

"(samAccountName=" & strUser & "));" & strFelder & ";subtree"

Set objRecordset = objCommand.Execute

If Not objRecordset.RecordCount = 0 Then

strSignaturName = strInputFilePrefix

'if you pull the signatures from a different path then \\mydomain\netlogon adjust the following line accordingly

strInputFile = "\\" & strLogonServer & "\NetLogon\Signatures\" & strSignaturName & strEX

'this will write the signature to the user profile - should not need adjustment

strSignaturePath = strAppData & "\Microsoft\Signatures\"

strOutputFile = strSignaturePath & strSignaturName & strEX

Set fso = CreateObject("Scripting.FileSystemObject")

If Not fso.FileExists(strInputFile) Then

MsgBox "Outlook-Signatures input file '" & strInputFile & "' not found or access denied - contact the helpdesk please!"

Exit Sub

End If

If Not fso.FolderExists(strSignaturePath) Then

fso.CreateFolder (strSignaturePath)

End If

'let's see if there is a special sub-folder that comes with the signatures

'note that this might depend on your language - it might be "-Dateien" (german) or "_files" in english - in the end it

'is the signature name plus an Windows language specific extension as a sub-folder

'both languages are already obeyed - adjust if you have additional versions

'the script will copy the folder to the destination

If strEX = ".htm" Then

If fso.FolderExists("\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "-Dateien") Then

fso.CopyFolder "\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "-Dateien", strAppData & "\Microsoft\Signatures\", True

End If

If fso.FolderExists("\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "_files") Then

fso.CopyFolder "\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "_files", strAppData & "\Microsoft\Signatures\", True

End If

Set TS = fso.OpenTextFile(strInputFile, 1, False, -2) 'Change 0 to -1 or -2 for unicode files.

Set MyFile = fso.CreateTextFile(strOutputFile, True, False)

While Not TS.AtendOfStream

linesource = Trim(TS.ReadLine)

strCurrentLine = linesource

If InStr(strCurrentLine, "@@") > 0 Then

'------------- SPECIAL SETTINGS -------------

'the code in this section will replace variables in the source files with fields from Active Directory/LDAP. In some cases you might want special

'replacements or e.g. write extra information - like if mobile number exists write "Cell: " + mobile - if not - do nothing - this might also depend on the current

'file extension strEX - see examples below

'regular replacements

strCurrentLine = Replace(strCurrentLine, "@@GivenName@@", NZ(objrecordset.Fields("givenName"), ""))

strCurrentLine = Replace(strCurrentLine, "@@LastName@@", NZ(objrecordset.Fields("sn"), ""))

strCurrentLine = Replace(strCurrentLine, "@@Department@@", NZ(objrecordset.Fields("department"), ""))

'file specific and value specific replacement exmaples

If strEX = ".htm" then

'this will ad a line break after in HTML code

strCurrentLine = Replace(Replace(strCurrentLine, "@@Title@@", NZ(objrecordset.Fields("title"), "")),chr(13),"<br>")

Else

'non html files don't need this line-break in this example - you could add a VBNewLine or CHR(10) & CHR(13) etc..

strCurrentLine = Replace(strCurrentLine, "@@Title@@", NZ(objrecordset.Fields("title"), ""))

End If

strCurrentLine = Replace(strCurrentLine, "@@eMail@@", NZ(objrecordset.Fields("mail"), ""))

strCurrentLine = Replace(strCurrentLine, "@@Phone@@", NZ(objrecordset.Fields("telephoneNumber"), ""))

strCurrentLine = Replace(strCurrentLine, "@@Fax@@", NZ(objrecordset.Fields("facsimileTelephoneNumber"), ""))

strCurrentLine = Replace(strCurrentLine, "@@Street@@", NZ(objrecordset.Fields("streetAddress"), ""))

strCurrentLine = Replace(strCurrentLine, "@@ZIPandCity@@", NZ(objrecordset.Fields("postalCode"), "") & " " & NZ(objrecordset.Fields("l"), ""))

'file specific and value specific replacement exmaples for mobile / cell number or not - the line will only appear if there is a cell phone number in LDAP

If Len(Trim(NZ(objrecordset.Fields("mobile"), ""))) > 0 Then

If strEX = ".htm" Then

strCurrentLine = Replace(strCurrentLine, "@@Mobile@@", "<br>Cell: " & NZ(objrecordset.Fields("mobile"), ""))

Else

strCurrentLine = Replace(strCurrentLine, "@@Mobile@@", "Cell: " & NZ(objrecordset.Fields("mobile"), ""))

End If

Else

strCurrentLine = Replace(strCurrentLine, "@@Mobile@@", "")

End If

'------------- END OF SPECIAL SETTINGS -------------

End If

MyFile.WriteLine strCurrentLine

Wend

Else

MsgBox ("Outlook-Signatures: User object not found in LDAP - please contact the helpdesk!")

End If

objConnection.Close

If strSignaturName <> "" Then

'Registry settings - version specific

'Outlook 2000/2002/XP

If bolUseAsDefaultNewMail Then

WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\NewSignature", strSignaturName

Else

WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\NewSignature", ""

End If

If bolUseAsDefaultReplyMail Then

WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\ReplySignature", strSignaturName

Else

WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\ReplySignature", ""

End If

'Outlook 2003 (sorry - might be I lost the correct RegKey - but I doubgt anyone is still using 2003 - might be the same os the 2007

'we need some special calculations here - convert the regular strings to a reg-key formar / binary for Outlook 2007 and newer

ReDim arr((Len(strSignaturName) * 2) + 1)

For i = 1 To Len(strSignaturName)

arr((i - 1) * 2) = Asc(Mid(strSignaturName, i, 1))

arr(((i - 1) * 2) + 1) = 0

arr((i - 1) * 2) = 0

arr(((i - 1) * 2) + 1) = 0

ReDim arrClean((Len("") * 2) + 1)

For i = 1 To Len("")

arrClean((i - 1) * 2) = Asc(Mid("", i, 1))

arrClean(((i - 1) * 2) + 1) = 0

arrClean((i - 1) * 2) = 0

arrClean(((i - 1) * 2) + 1) = 0

'Outlook 2007

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

RegKeyName = "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002"

RegName = "New Signature"

If bolUseAsDefaultNewMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

RegName = "Reply-Forward Signature"

If bolUseAsDefaultReplyMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

'Outlook 2010

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

RegKeyName = "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003"

RegName = "New Signature"

If bolUseAsDefaultNewMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

RegName = "Reply-Forward Signature"

If bolUseAsDefaultReplyMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

'Outlook 2013

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

RegKeyName = "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002"

RegName = "New Signature"

If bolUseAsDefaultNewMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

RegName = "Reply-Forward Signature"

If bolUseAsDefaultReplyMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

'Outlook 2016

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

RegKeyName = "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002"

RegName = "New Signature"

If bolUseAsDefaultNewMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

RegName = "Reply-Forward Signature"

If bolUseAsDefaultReplyMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

End If

MyFile.Close

TS.Close

Set fso = Nothing

Set TS = Nothing

Set MyFile = Nothing

End Sub

Function NZ(ValueIfNotNull, ValueIfNull)

NZ = ValueIfNotNull

If (IsNull(NZ)) Then NZ = ValueIfNull

End Function

June 28, 2018 by Florian Rossmark recommendations scripts solutions

Print Server backup script

Print servers need to backed up. This is because of two main reasons. One is that users heavily depend on printers and a not properly working print server will cause imediate helpdesk tickets and unhappy users. The other one is that installing a new driver, might it be a new version, a new model or even an additional manufacturer, can cause other print drivers to act up or even stop working – many administrators know and fear that.

Windows server actually allows you to backup the current print drivers, installed printers and their configuration. You can use this to migrate your printers or to back them up. Of course, you can simply depend on e.g. VMware snapshots, storage level snapshots or other backups of your server. But you also could just export the whole print server configuration while using the scripts below. Those will actually call the Windows API to back up the printers and store it all in a file that you can keep centrally. You don’t just rely on snapshots or a full server backup for e.g. your SQL databases as well, do you?

The script uses a .CMD file that will execute the actual backup and send a email report, while using the SMTPSEND program from Michael Kocum (https://www.dataenter.com/download.asp) for this since I already ad it flying around – you could replace the mail send option with another prepared SMTPSEND client, a VBS script or just remove it completely. Additionally there is a .VBS script that will do a clean up of the target backup files depending on the age of the files in the specified directory.

All the parameters are explained and set in the top part of the .CMD file – I therefor will not explain them here again – you should not need to modify the scripts by default – but feel free to do so. Of course, you should create a scheduled task and execute the .CMD periodically. This can save you time and headache in case you have a malfunctioning print server system. The restore can be easily done through the Print Management MMC that Windows provides you, cause the actual backup files are createed using the same Windows APIs. Your end users will be happy that their printers got back to work in no time, hopefully.

@ECHO OFF
SETLOCAL
REM Printer Backup Script
REM This script creates a Printer Backup on a Windows 2008 or newer Server System
REM (might work as well on Windows Vista or newer)
REM The Script uses Standard Windows Procedures to create a Standard Windows Printer Backup File
REM The Backup will include Printer Settings and Drivers
REM Use "Print Management" to restore the backup 
REM 
REM WARNING
REM -------
REM The Script will automatically search and delete all Files older than intAge in the destination Folder!
REM Always set a destination Folder just for the System you are going to Backup.
REM SubFolders will be ignored.
REM 
REM CONFIG Values
REM -------------
REM strPrintServer = string value / PrintServer to backup - localhost or hostname
REM intAge = integer value / max Age in Days for the Backup Files, the script will automatically delete older Backup Files
REM strPath = string value / SMB or UNC Path to the Backup-Folder, the executing User needs Read/Write access to this path
REM strMailServer = string value / SMTP Server
REM intMailServerPort = integer value / SMTP Server Port
REM strMailFrom = string value / from address, must be able to send Mail over the SMTP
REM strMailTo = string value / mail recipient
REM strMailSuject = string value / mail subject line


REM CONFIG Values
REM =============================================================================================
SET strPrintServer=server.domain.local
SET intAge=3
SET strPath=\\server.domain.local\backup$\Printer\SERVER
SET strMailServer=smtp.domain.com
SET intMailServerPort=25
SET strMailFrom=admin@domain.local
SET strMailTo=admin@domain.local
SET strMailSubject=Printer Backup - SERVERNAME
REM =============================================================================================
REM End CONFIG Values

REM Script-System-Variables, do not change from here on!
SET ScriptLog=%~dp0\Printer_Backup_Log.txt

DEL %ScriptLog% 
ECHO Script-Log Start Date/Time: %Date% / Time: %Time% >> %ScriptLog%
ECHO Script-Parameter: >> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%
ECHO strPrintServer: %strPrintServer% >> %ScriptLog%
ECHO intAge: %intAge% >> %ScriptLog%
ECHO strPath: %strPath% >> %ScriptLog%
ECHO strMailServer: %strMailServer% >> %ScriptLog%
ECHO intMailServerPort: %intMailServerPort% >> %ScriptLog%
ECHO strMailFrom: %strMailFrom% >> %ScriptLog%
ECHO strMailTo: %strMailTo% >> %ScriptLog%
ECHO strMailSubject: %strMailSubject% >> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%

ECHO Get date in format YYYY-MM-DD (assumes the locale is the United States) >> %ScriptLog%
FOR /F "tokens=1,2,3,4 delims=/ " %%A IN ('Date /T') DO SET NowDate=%%D%%C%%B>> %ScriptLog%
FOR /F "tokens=1,2 delims=: " %%A IN ('Time /T') DO SET NowDate=%NowDate%_%%A%%B>> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%

ECHO Starting Printer Backup: >> %ScriptLog% 
%windir%\System32\Spool\Tools\PrintBRM.EXE -B -S %strPrintServer% -F %strPath%\%NowDate%_%strPrintServer%.bak >>"%ScriptLog%"
ECHO =========================================================================== >> %ScriptLog%

ECHO Backup CleanUp >> %ScriptLog%
CSCRIPT %~dp0\Printer_Backup_CleanUp.vbs %intAge% "%strPath%" >> %ScriptLog%
ECHO Backup CleanUp finished >>%ScriptLog%
ECHO =========================================================================== >> %ScriptLog%
ECHO Current Files in Backup Path: >>%ScriptLog%
DIR %strPath% >>%ScriptLog%
ECHO =========================================================================== >> %ScriptLog%

ECHO Script-Log End Date/Time: %Date% / Time: %Time% >> %ScriptLog%
ECHO Sending Info Mail >> %ScriptLog%
%~dp0\SMTPSEND.EXE -f%strMailFrom% -t%strMailTo% -h%strMailServer% -p%intMailServerPort% -s%strMailSubject% -i%ScriptLog% >> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%

ENDLOCAL

@ECHO OFF

SETLOCAL

REM Printer Backup Script

REM This script creates a Printer Backup on a Windows 2008 or newer Server System

REM (might work as well on Windows Vista or newer)

REM The Script uses Standard Windows Procedures to create a Standard Windows Printer Backup File

REM The Backup will include Printer Settings and Drivers

REM Use "Print Management" to restore the backup

REM

REM WARNING

REM -------

REM The Script will automatically search and delete all Files older than intAge in the destination Folder!

REM Always set a destination Folder just for the System you are going to Backup.

REM SubFolders will be ignored.

REM

REM CONFIG Values

REM -------------

REM strPrintServer = string value / PrintServer to backup - localhost or hostname

REM intAge = integer value / max Age in Days for the Backup Files, the script will automatically delete older Backup Files

REM strPath = string value / SMB or UNC Path to the Backup-Folder, the executing User needs Read/Write access to this path

REM strMailServer = string value / SMTP Server

REM intMailServerPort = integer value / SMTP Server Port

REM strMailFrom = string value / from address, must be able to send Mail over the SMTP

REM strMailTo = string value / mail recipient

REM strMailSuject = string value / mail subject line

REM CONFIG Values

REM =============================================================================================

SET strPrintServer=server.domain.local

SET intAge=3

SET strPath=\\server.domain.local\backup$\Printer\SERVER

SET strMailServer=smtp.domain.com

SET intMailServerPort=25

SET strMailFrom=admin@domain.local

SET strMailTo=admin@domain.local

SET strMailSubject=Printer Backup - SERVERNAME

REM =============================================================================================

REM End CONFIG Values

REM Script-System-Variables, do not change from here on!

SET ScriptLog=%~dp0\Printer_Backup_Log.txt

DEL %ScriptLog%

ECHO Script-Log Start Date/Time: %Date% / Time: %Time% >> %ScriptLog%

ECHO Script-Parameter: >> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO strPrintServer: %strPrintServer% >> %ScriptLog%

ECHO intAge: %intAge% >> %ScriptLog%

ECHO strPath: %strPath% >> %ScriptLog%

ECHO strMailServer: %strMailServer% >> %ScriptLog%

ECHO intMailServerPort: %intMailServerPort% >> %ScriptLog%

ECHO strMailFrom: %strMailFrom% >> %ScriptLog%

ECHO strMailTo: %strMailTo% >> %ScriptLog%

ECHO strMailSubject: %strMailSubject% >> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO Get date in format YYYY-MM-DD (assumes the locale is the United States) >> %ScriptLog%

FOR /F "tokens=1,2,3,4 delims=/ " %%A IN ('Date /T') DO SET NowDate=%%D%%C%%B>> %ScriptLog%

FOR /F "tokens=1,2 delims=: " %%A IN ('Time /T') DO SET NowDate=%NowDate%_%%A%%B>> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO Starting Printer Backup: >> %ScriptLog%

%windir%\System32\Spool\Tools\PrintBRM.EXE -B -S %strPrintServer% -F %strPath%\%NowDate%_%strPrintServer%.bak >>"%ScriptLog%"

ECHO =========================================================================== >> %ScriptLog%

ECHO Backup CleanUp >> %ScriptLog%

CSCRIPT %~dp0\Printer_Backup_CleanUp.vbs %intAge% "%strPath%" >> %ScriptLog%

ECHO Backup CleanUp finished >>%ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO Current Files in Backup Path: >>%ScriptLog%

DIR %strPath% >>%ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO Script-Log End Date/Time: %Date% / Time: %Time% >> %ScriptLog%

ECHO Sending Info Mail >> %ScriptLog%

%~dp0\SMTPSEND.EXE -f%strMailFrom% -t%strMailTo% -h%strMailServer% -p%intMailServerPort% -s%strMailSubject% -i%ScriptLog% >> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ENDLOCAL

Set objArgs = WScript.Arguments

If objArgs.Count > 0 Then

Dim strPath
Dim intAge

intAge = objArgs(0)
strPath = objArgs(1)

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFolder = objFSO.GetFolder(strPath)

For Each objFile in objFolder.Files
If DateDiff("d", objFile.DateLastModified, Now()) > Cint(intAge) Then
On Error Resume Next
objFile.Delete
On Error Goto 0
End If
Next

End If

Set objArgs = WScript.Arguments

If objArgs.Count > 0 Then

Dim strPath

Dim intAge

intAge = objArgs(0)

strPath = objArgs(1)

Set objFSO = CreateObject("Scripting.FileSystemObject")

Set objFolder = objFSO.GetFolder(strPath)

For Each objFile in objFolder.Files

If DateDiff("d", objFile.DateLastModified, Now()) > Cint(intAge) Then

On Error Resume Next

objFile.Delete

On Error Goto 0

End If

June 27, 2018 by Florian Rossmark recommendations scripts server solutions

Password expiration notifications for end users

Today I wanted to share a script with you that allows you to inform your users per email that their password will expire or even is expired and reminds them about your password policies like complex passwords and how to chose a password. This is a simple VBScript and can easily be adjusted. The email will be generated from a file, in this case a HTML file that you provide. You can adjust the content of this HTML file as you need it. There are sure many commercial solutions out there that can do more then this script, but if you want to save the money and are satisfied with the provided options, this sure can be a good alternative.

Let me mention one thing about passwords first – most of us live with the usual policy that passwords should be changed periodically and need to be of a certain length and complexity. We all live with the daily calls of the help-desk about forgotten passwords, not changed passwords (pretty much why I wrote the script) and so on – what changed was a new recommendation in late 2017 or early 2018 that actually is based on statistics and data and now says – yes – complex passwords and certain lengths – but do not enforce periodic changes of those passwords due to this actually resulting in to less secure passwords while users might only change a number or even write those passwords more likely down and therefor compromising the whole attempt to secure the system.

Anyways – the next few lines will explain the parameters you can adjust in the top section of the VBS script – further below I will post the script and an example HTML file so you can start right away.

The options are between the lines 7 and 61 – don’t be scared – most of them are pretty simple to understand and are actually explained in the script itself. You should not need to modify anything outside those two lines.

About the parameter naming convention and possible values:

starting with str as strings – those expect text-markers and alphanumeric values “text”
starting with int as integer values – those are direct numeric values – e.g. 123
starting with bol are boolean values – those can be either TRUE or FALSE – meaning on or off

Here are the options you can set:

strSMTPServer: SMTP mail server DNS name or IP address
intSMTPServerPort: SMTP mail server port – normally 25
strFrom: SMTP mail from address
strToAdmin: SMTP mail to address for administrator emails
strAdminMailSubject: subject for mail to administrators
strUserMailSubjectExpired: subject for mails to user when password is expired
strUserMailSubjectWillExpire: subject for mail to user when password will expire – the exact word REPLACEWITHDAYS will be replaced by the days left value so mention it in the subject line if you want to see the value there
strBodyURL: URL or full file-path (HTML file path e.g. file://) to import for body, the entire content of this URL/FILE will be imported to the body of the email and should explain ways how to change the password
strAttachment: full file-path to an attachment for the email to the users / leave empty if no attachment
strLDAPSortColumn: per default: pwdLastSet / sort column for LDAP query
intStartWithPWexpiresInDays: If the passwords expires in days N or less, the script will inform the user – keep in mind – if you run the script daily, those users will get an email every day once their password will expire in less then the indicated days. 5 is sure a good start.
bolIgnoreDisabledAccounts: Disabled accounts should always be ignored
bolInformAdminAboutPWexpires: this will inform the admin about expiring passwords
bolInformAdminAboutPWisExpired: this will inform the admin about accounts with expired passwords
bolInformAdminAboutPWneverExpires: this will inform the admin about accounts with password set to never expire
bolInformAdminAboutUserCantChangePW: this will inform the admin about users who are not allowed to change their password
bolInformAdminAboutAccountDisabled: this will inform the admin about disabled accounts found – this would have been done in ADS by an administrator
bolInformAdminAboutExpiredUserAccount: this will inform the admin if the user account has an expiration date and the account is expired
bolInformAdminAboutAccountWithoutEMail: this will inform the admin about accounts without a set email address
bolInformAdminAboutStillGoodPasswords: this will inform the admin about users/passwords that are still valid
bolInformAdminAboutIgnoredUsersExcludedByGroup: this will inform the admin about users that have been ignored by the strGroupsExclude filter
Please Note: the status account locked will not be checked, this should be corrected automatically by the default security GPO instead (will be in most cases by default)
strSearchOUs: Filter Priority 1 – only users in those OU paths will be processed. Use LDAP DN like: “OU=Folder,OU=Folder,DC=Domain,DC=local”, you do not need to include the DC=Domain,DC=local – the script will add this information if necessary. Use | (pipe) if you want to add more then one LDAP DN path. Leave empty (“”) to disable this filter
strGroupsExclude : Filter Priority 2 – if the user object is still not excluded, this group exclude filter will be applied. If the user is member of one of those groups (if multiple groups are defined), he will be ignored. Use | (pipe) if you want to add more then one GroupName. Leave empty (“”) to disable this filter. Example: “Group Number1|GroupNumber2”
strGroupsInclude: Filter Priority 3 – if the user object is still not excluded, this group Include filter will be applied. The user has to be a member of one of those groups (if multiple groups are defined). Use | (pipe) if you want to add more then one GroupName. Leave empty (“”) to disable this filter. Example: “Group Number1|GroupNumber2”
bolDebug: set TRUE for script-output, highly recommended to execute the Script in CMD with CSCRIPT <ScriptName> so you see it in a command window instead of dialog boxes.
bolAttachDebugToAdminMail: the debug output will be attached to the admin-mail (independent from bolDebug)
bolTestDebugOutputToConsoleOnly: this will disable the mail.send – only output to the CMD will be generated, please enable bolDebug
bolRedirectMailToAdmin: this will redirect all mails to the admin, instead of sending them to the user – the subject line will include the user-mail address in this case – this allows you to do a real test and actually see what would be send out to whom – without actually sending the emails to the end user
bolAdminMailOnly: this will send the admin-mail only, no user mail will be generated

'This VBScript will run aggainst the ActiveDirectory Domain the executing User is a Member of. 
'The executing User does not need to be an Domain-Administrator of any kind, a simply User is able to read the necessary information from ActiveDirectory
'
'Please configure the following Options - the Script does not accept or expect any Start-Parameter
'
'Version 2.2 - 04/12/2017: Florian Rossmark
'---------------------------------- START OPTIONS ----------------------------------

Const strSMTPServer = "relay.domain.com" 'SMTP Mail-Server to use
Const intSMTPServerPort = 25 'SMTP Mail-Server connection Port Number
Const strFrom = "pwdscript@domain.com" 'SMTP Mail From Address
Const strToAdmin = "helpdesk@domain.com" 'SMTP Mail To Address for Administrator 
Const strAdminMailSubject = "Company Name - User Password Script Results to Admin" 'Subject for Mail to Admin
Const strUserMailSubjectExpired = "Your password has expired!" 'Subject for Mail to User when Password is expired
Const strUserMailSubjectWillExpire = "Your password will expire in REPLACEWITHDAYS days" 'Subject for Mail to User when Password will expire - the exact word REPLACEWITHDAYS will be replaced by the days left value
Const strBodyURL = "file://C:/scripts/PWD/PWDExpire.html" 'URL or full file-path (HTML) to import for Body, the entire content of this URL/FILE will be imported to the Body of the email and should explain ways how to change the password
Const strAttachment = "" 'full File-Path to an attachment for the email to the users / leave empty if no attachment

Const strLDAPSortColumn = "pwdLastSet" 'per default: pwdLastSet / sort column for LDAP query

Const intStartWithPWexpiresInDays = 5 'If the Passwords expires in days N or less, the script will inform the user

Const bolIgnoreDisabledAccounts = True 'Disabled accounts should always be ignored

Const bolInformAdminAboutPWexpires = True 'This will inform the Admin about expiring passwords
Const bolInformAdminAboutPWisExpired = True 'This will inform the Admin about accounts with expired Passwords
Const bolInformAdminAboutPWneverExpires = True 'This will inform the Admin about accounts with password set to never expire
Const bolInformAdminAboutUserCantChangePW = True 'This will inform the Admin about users who are not allowed to change their password
Const bolInformAdminAboutAccountDisabled = True 'This will inform the Admin about disabled accounts found - this would have been done in ADS by an administrator
Const bolInformAdminAboutExpiredUserAccount = True 'This will inform the admin if the User Account has an expiration date and the account is expired
Const bolInformAdminAboutAccountWithoutEMail = True 'This will inform the Admin about accounts without a set email address
Const bolInformAdminAboutStillGoodPasswords = True 'This will inform the Admin about Users/Passwords that are still valid
Const bolInformAdminAboutIgnoredUsersExcludedByGroup = True 'This will inform the Admin about Users that have been ignored by the strGroupsExclude filter
'Please Note: Status Account Locked will not be checked, this should be corrected automatically by the Default Security GPO instead (will be in most cases by default)

'Filter Priority 1 - only Users in those OU Paths will be processed
'Use LDAP DN like: "OU=Folder,OU=Folder,DC=Domain,DC=local", you do not need to include the DC=Domain,DC=local - the Script will add this information if necessary
'Use | (pipe) if you want to add more then one LDAP DN Path
'Leave empty ("") to disable this filter
Const strSearchOUs = "" '"OU=Users,OU=Site,DC=domain,DC=local"

'Filter Priority 2 - if the User Object is still not excluded, this Group Exclude filter will be applied
'If the user is member of one of those groups (if multiple groups are defined), he will be ignored
'Use | (pipe) if you want to add more then one GroupName
'Leave empty ("") to disable this filter
'Example: "Group Number1|GroupNumber2"
Const strGroupsExclude = "No Password notification emails"

'Filter Priority 3 - if the User Object is still not excluded, this Group Include filter will be applied
'The user has to be a member of one of those groups (if multiple groups are defined)
'Use | (pipe) if you want to add more then one GroupName
'Leave empty ("") to disable this filter
'Example: "Group Number1|GroupNumber2"
Const strGroupsInclude = ""

Const bolDebug = True 'Set TRUE for Script-Output, highly recommended to execute the Script in CMD with CSCRIPT <ScriptName>
Const bolAttachDebugToAdminMail = False 'The Debug Output will be attached to the Admin-Mail (independent from bolDebug)
Const bolTestDebugOutputToConsoleOnly = False 'This will disable the Mail.Send - only output to the CMD will be generated, please enable bolDebug 
Const bolRedirectMailToAdmin = True 'This will redirect all Mails to the Admin, instead of sending them to the User - the Subject line will include the User-Mail Address in this case
Const bolAdminMailOnly = False 'This will send the Admin-Mail only, no User Mail will be generated
'---------------------------------- END OPTIONS ----------------------------------

'---------------------------------- Script starts here ----------------------------------
'---------------------------------- please do not modify after this line ----------------------------------

'Reference: https://msdn.microsoft.com/en-us/library/aa772300(v=vs.85).aspx
Const ADS_UF_DONT_EXPIRE_PASSWD = 65536
Const ADS_UF_PASSWD_CANT_CHANGE = 64
Const ADS_UF_PASSWORD_EXPIRED = 8388608
Const ADS_ACETYPE_ACCESS_DENIED_OBJECT = 6
Const CHANGE_PASSWORD_GUID = "{ab721a53-1e2f-11d0-9819-00aa0040529b}"

'A few Global Variables for the Admin-Mail
Dim strAdminPWexpires, strAdminPWisExpired, strAdminPWneverExpires, strAdminUserCantChangePW, strAdminAccountDisabled, strAdminExpiredUserAccount, strAdminAccountWithoutEMail, strAdminPWstillGood, strAdminIgnoredUsersExcludedByGroup
Dim strAdminErrorUsers
Dim strAdminDebug

SearchADS() 'Let's Start the actual process

'starts the actual search procedure - in a sub so it is easier to keep overview of the script
Sub SearchADS()

Dim objADSRoot, objADSDomain, objADSConnection, objADSCommand, objMaxPWDage, objUser
Dim intMaxPWDage, intDaysLeft
Dim bolProcessUser
Dim cntArray
Dim arrSearchOUs, arrGroupsExclude, arrGroupsInclude
Dim iADSCommand
Dim strFirstFoundGroupMembership

arrGroupsExclude = Split(strGroupsExclude, "|")
arrGroupsInclude = Split(strGroupsInclude, "|")

'Connect to ADS and get Users
Set objADSRoot = GetObject("LDAP://rootDSE") 
Set objADSDomain = GetObject("LDAP://" & objADSRoot.Get("defaultNamingContext"))
Set objMaxPWDage = objADSDomain.Get("maxPwdAge") 'please note, this script can't obey the latest ADS multible password GPO rules, it will only follow the standard with only one password rule
intMaxPWDage = CCur((objMaxPWDage.HighPart * 2 ^ 32) + objMaxPWDage.LowPart) / CCur(-864000000000) 
If Not intMaxPWDage > 0 Then 'Passwords won't expire at all
ScriptDebug("intMaxPWDage is set to: " & intMaxPWDage & " - Script stopped")
SendEmailNotification True, "", True, 0, "intMaxPWDage is incorrect, please check ADS configuration. Script aborded" 'Inform that there is no expiration configuration in Active Directory
Exit Sub 'Stop the Sub / End the Search
End If
Set objADSConnection = CreateObject("ADODB.Connection")
objADSConnection.Open "Provider=ADsDSOObject;"
Set objADSCommand = CreateObject("ADODB.Command")
objADSCommand.ActiveConnection = objADSConnection
If Not Len(strSearchOUs) > 0 Then
ReDim arrSearchOUs(0) 'we still need an array to run the For Next 
arrSearchOUs(0) = ""
Else
arrSearchOUs = Split(strSearchOUs, "|")
End If
For iADSCommand = 0 To UBound(arrSearchOUs) 'we already filter OUs if necessary - filter priority 1
If Len(strSearchOUs) > 0 Then 'we need everytime a new objADSDomain to set the Filter based on the OU
If Not Right(arrSearchOUs(iADSCommand),Len(objADSRoot.Get("defaultNamingContext"))) = objADSRoot.Get("defaultNamingContext") Then
If Not Right(arrSearchOUs(iADSCommand),1) = "'" Then
arrSearchOUs(iADSCommand) = arrSearchOUs(iADSCommand) & ","
End If
arrSearchOUs(iADSCommand) = arrSearchOUs(iADSCommand) & objADSRoot.Get("defaultNamingContext")
End If
ScriptDebug("Searching LDAP Path: " & arrSearchOUs(iADSCommand))
Set objADSDomain = GetObject("LDAP://" & arrSearchOUs(iADSCommand))
End If
'samAccountType=805306368 / this is the correct value for USERS only - a search for the ObjectClass USER will also list Contacts
objADSCommand.CommandText = "<" & objADSDomain.ADsPath & ">;(&(samAccountType=805306368));userAccountControl,sAMAccountName,givenName,sn,mail,distinguishedName,lockoutTime;subtree"
objADSCommand.Properties("Sort on") = strLDAPSortColumn
Set rs = objADSCommand.Execute
If Not rs.EOF Then
Do While Not rs.EOF
ScriptDebug("") 'Empty Line before each run for easier to read output
ScriptDebug("PROCESSING USER: " & NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")")
intDaysLeft = 0
bolProcessUser = True

'Priority 2 - Exclude the following groups
If Len(strGroupsExclude) > 0 Then 
strFirstFoundGroupMembership = "" 'just to make sure, lets clean the variable
If IsUserInGroup(rs("distinguishedName"), arrGroupsExclude, strFirstFoundGroupMembership) Then 'User is Member of the Group, we ignore him
ScriptDebug("..USER IS MEMBER OF EXCLUDED GROUP: " & strFirstFoundGroupMembership & " - IGNORING USER")
bolProcessUser = False
'old info - 'We don't inform the Admin in this case, would be done over the Debug Info
If bolInformAdminAboutIgnoredUsersExcludedByGroup Then
strAdminIgnoredUsersExcludedByGroup = AddAdminInfoTo(strAdminIgnoredUsersExcludedByGroup, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info
End If
End If
End If

'Priority 3 - Include the following groups
If bolProcessUser Then 'do we still go on with this User?
If Len(strGroupsInclude) > 0 Then
strFirstFoundGroupMembership = "" 'just to make sure, lets clean the variable
If Not IsUserInGroup(rs("distinguishedName"), arrGroupsInclude, strFirstFoundGroupMembership) Then 'User is Member of the Group, we ignore him
ScriptDebug("..USER IS NOT A MEMBER OF ANY OF THE INCLUDED GROUPS - IGNORING USER")
bolProcessUser = False
'old info - 'We don't inform the Admin in this case, would be done over the Debug Info
If bolInformAdminAboutIgnoredUsersExcludedByGroup Then
strAdminIgnoredUsersExcludedByGroup = AddAdminInfoTo(strAdminIgnoredUsersExcludedByGroup, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info
End If 
Else 'User will be noramlly proccessed, we still inform about it in the Script-Debug
ScriptDebug("..USER IS MEMBER OF INCLUDED GROUP: " & strFirstFoundGroupMembership & " - PROCESSING USER")
End If 
End If
End If

'Priority 4 - disabled account? this would have been done by an administrator
If bolProcessUser Then 'do we still go on with this User?
If IsAccountDisabled(rs("distinguishedName")) Then 'Account is disabled
ScriptDebug("..DISABLED USER ACCOUNT FOUND")
If bolIgnoreDisabledAccounts Then 'do we ignore this Account?
bolProcessUser = False
End If
If bolInformAdminAboutAccountDisabled Then
'strAdminAccountDisabled = AddAdminInfoTo(strAdminAccountDisabled, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info
strAdminAccountDisabled = AddAdminInfoTo(strAdminAccountDisabled, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), ""), True) 'Add to Admin Info
End If
End If
End If

'Priority 5 - Will User Account expire? (we only check if it is expired, if yes we take action)
If bolProcessUser Then 'do we still go on with this User?
If IsUserAccountExpired(rs("distinguishedName"), dtmExpiration) Then
bolProcessUser = False
ScriptDebug("..USER ACCOUNT IS EXPIRED SINCE: " & dtmExpiration)
If bolInformAdminAboutExpiredUserAccount Then
'strAdminExpiredUserAccount = AddAdminInfoTo(strAdminExpiredUserAccount, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - User expired since: " & dtmExpiration) 'Add to Admin Info
strAdminExpiredUserAccount = AddAdminInfoTo(strAdminExpiredUserAccount, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat(dtmExpiration), True) 'Add to Admin Info
End If
End If
End If

'Priority 6 - password never expires? this would have been done by an administrator
If bolProcessUser Then 'do we still go on with this User?
If PasswordDoesExpire(rs("userAccountControl")) Then 'Password does not expire
ScriptDebug("..USER WITH PASSWORD WILL NOT EXPIRE FOUND")
bolProcessUser = False
If bolInformAdminAboutPWneverExpires Then
'strAdminPWneverExpires = AddAdminInfoTo(strAdminPWneverExpires, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info
strAdminPWneverExpires = AddAdminInfoTo(strAdminPWneverExpires, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), ""), True) 'Add to Admin Info
End If
End If 
End If

'Priority 7 - User can't even change the password? this would have been done by an administrator
If bolProcessUser Then 'do we still go on with this User?
If UserCantChangePassword(rs("distinguishedName")) Then 'User can't change Password
ScriptDebug("..USER WITH CAN'T CHANGE PASSWORD FOUND")
bolProcessUser = False
If bolInformAdminAboutUserCantChangePW Then
'strAdminUserCantChangePW = AddAdminInfoTo(strAdminUserCantChangePW, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info
strAdminUserCantChangePW = AddAdminInfoTo(strAdminUserCantChangePW, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), ""), True) 'Add to Admin Info
End If
End If
End If

'Priority 8 - User does not have an EMail Address? can't inform User if PW is about to expire what shall we do?
If bolProcessUser Then 'do we still go on with this User?
If Not Len(NZ(rs("mail"), "")) > 0 Then 'User is missing email address
ScriptDebug("..USER WITHOUT EMAIL ADDRESS FOUND")
bolProcessUser = False
If bolInformAdminAboutAccountWithoutEMail Then
'strAdminAccountWithoutEMail = AddAdminInfoTo(strAdminAccountWithoutEMail, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days Left: " & (GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)) 'Add to Admin Info
strAdminAccountWithoutEMail = AddAdminInfoTo(strAdminAccountWithoutEMail, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info
End If
End If 
End If

'Priority 9 - now we check the Password Age and take action
If bolProcessUser Then 'do we still go on with this User?
If PasswordIsExpired(rs("userAccountControl")) Then 'The Password is already expired? We need to take action / this will be double checked later on with a calculation
ScriptDebug("..PASSWORD IS EXPIRED")
SendEmailNotification False, NZ(rs("mail"), ""), True, 0, "" 'Inform the USER about the expired Password 
If bolInformAdminAboutPWisExpired Then
'strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info
strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info
End If
Else 'Password is not expired yet, how many days does the User have left?
Set objUser = GetObject("LDAP://" & rs("distinguishedName"))

intDaysLeft = GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage)

If intDaysLeft <= 0 Then 'we have a number of days left
If intStartWithPWexpiresInDays >= (intDaysLeft * -1) Then 'User is to be informed, his days left are less then defined
ScriptDebug("..PASSWORD FOR USER WILL EXPIRE IN: " & (intDaysLeft * -1) & " DAYS")
SendEmailNotification False, NZ(rs("mail"), ""), False, (intDaysLeft * -1), "" 'Inform the USER that the Password will expire
If bolInformAdminAboutPWexpires Then
'strAdminPWexpires = AddAdminInfoTo(strAdminPWexpires, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days Left: " & (intDaysLeft * -1)) 'Add to Admin Info
strAdminPWexpires = AddAdminInfoTo(strAdminPWexpires, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((intDaysLeft * -1)), True) 'Add to Admin Info
End If
Else 'User has more days left then needed by Script Configuration
'we do not need to take action - we do not even send Mail to the Admin
ScriptDebug("..USER PASSWORD IS STILL GOOD - DAYS LEFT: " & (intDaysLeft * -1))
If bolInformAdminAboutStillGoodPasswords Then
'strAdminPWstillGood = AddAdminInfoTo(strAdminPWstillGood, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days Left: " & (intDaysLeft * -1)) 'Add to Admin Info
strAdminPWstillGood = AddAdminInfoTo(strAdminPWstillGood, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((intDaysLeft * -1)), True) 'Add to Admin Info
End If
End If
Else 'Password is already expired and needs to be changed now / second check, first one might not give the needed information
ScriptDebug("..PASSWORD IS EXPIRED FOR: " & (intDaysLeft * -1) & " DAYS")
SendEmailNotification False, NZ(rs("mail"), ""), True, 0, "" 'Inform the USER about the expired Password 
If bolInformAdminAboutPWisExpired Then
'strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days expired: " & (intDaysLeft * -1)) 'Add to Admin Info
strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((intDaysLeft * -1)), True) 'Add to Admin Info
End If
End If

Set objUser = Nothing 'to make sure the Object is release
End If
End If 

rs.MoveNext
Loop
End If
Set rs = Nothing
Next 'Next from arrSearchOUs
Set objADSCommand = Nothing
Set objADSConnection = Nothing
Set objADSDomain = Nothing
Set objADSRoot = Nothing

ScriptDebug("")
ScriptDebug("SCRIPT ENDED SUCCESSFULLY => Sending Admin Mail")
SendEmailNotification True, "", True, 0, GenerateAdminMailBody 'Send the final admin notification with the requested information

End Sub

'Function returns days left for Password of User-Object (uses default Value intDaysLeft)
Function GetPWDaysLeft(strDistinguishedName, strGivenName, strSN, strsAMAccountName, intDaysLeft, intMaxPWDage)

Dim objUser

Set objUser = GetObject("LDAP://" & strDistinguishedName)

On Error Resume Next
'intDaysLeft will be negative, like a countdown, T minus DAYS
intDaysLeft = DateDiff("d", objUser.PasswordLastChanged, Now) - intMaxPWDage
If Err Then
If Err.Number = &h8000500d Then 'PWD was just changed
intDaysLeft = intMaxPWDage
ScriptDebug("..USER PASSWORD WAS JUST CHANGED")
'we don't send any Mails about this
Else 'unexpexted Error occured - this shouldn't happen at all!
ScriptDebug("..UNEXPECTED ERROR (UserPasswordLastChanged)")
'strAdminErrorUsers = AddAdminInfoTo(strAdminErrorUsers, strGivenName & " " & strSN & " (" & strsAMAccountName & ")") 'Add to Admin Info
strAdminErrorUsers = AddAdminInfoTo(strAdminErrorUsers, strGivenName & "</td><td>" & strSN & "</td><td>" & strsAMAccountName, True) 'Add to Admin Info
End If
End If
Err.Clear
On Error Goto 0

Set objUser = Nothing

GetPWDaysLeft = Round(intDaysLeft, 0)

End Function

Function IsUserAccountExpired(distinguishedName, dtmExpirationDate)

Dim bolReturn
Dim objUser
Dim dtmAccountExpiration

bolReturn = False

If NZ(distinguishedName, "") <> "" Then
Set objUser = GetObject("LDAP://" & distinguishedName)
On Error Resume Next
dtmAccountExpiration = objUser.AccountExpirationDate
If Err.Number = -2147467259 Or dtmAccountExpiration = "1/1/1970" Then 'Account has no expiration date specified
'we do nothing - not even a debug message
Else 'Account has expireation date
If DateDiff("d", dtmAccountExpiration, Now) > 0 Then
bolReturn = True
dtmExpirationDate = dtmAccountExpiration
End If 
End If
On Error Goto 0
Set objUser = Nothing
End If

IsUserAccountExpired = bolReturn

End Function

'Is the User Member of one of the Groups in the Array? Give back first GroupName found if possible
Function IsUserInGroup(distinguishedName, arrGroups, FirstFoundGroupMembership)

Dim objUser, objGroup
Dim i
Dim strGroupName
Dim bolFound

bolFound = False
If NZ(distinguishedName, "") <> "" Then
Set objUser = GetObject("LDAP://" & distinguishedName)
On Error Resume Next
For Each objGroup In objUser.GetEx("memberOf")
strGroupName = Split(objGroup,",")(0)
strGroupName = Right(strGroupName, (Len(strGroupName)-3))
For i = 0 To UBound(arrGroups)
If LCase(strGroupName) = LCase(arrGroups(i)) Then
bolFound = True
FirstFoundGroupMembership = strGroupName
IsUserInGroup = True
Exit For
End If
Next
If bolFound Then
Exit For
End If
Next
On Error Goto 0
Set objUser = Nothing
Else
IsUserInGroup = False 'couldn't find User distinguishedName - not really possible
End If

End Function

'Is the Password Expired?
Function PasswordIsExpired(userAccountControl)
If NZ(userAccountControl, "") <> "" Then
If ADS_UF_PASSWORD_EXPIRED And userAccountControl Then
PasswordIsExpired = True
Else
PasswordIsExpired = False
End If
Else
PasswordIsExpired = False
End If
End Function

'Is the User able to change to Password?
Function UserCantChangePassword(distinguishedName)

Dim bolReturn
Dim objUser, objSD, objDACL, objACE

bolReturn = False
If NZ(distinguishedName, "") <> "" Then
On Error Resume Next
Set objUser = GetObject("LDAP://" & distinguishedName)
Set objSD = objUser.Get("nTSecurityDescriptor")
Set objDACL = objSD.DiscretionaryAcl
For Each objACE in objDACL
If objACE.AceType = ADS_ACETYPE_ACCESS_DENIED_OBJECT And LCase(objACE.ObjectType) = CHANGE_PASSWORD_GUID Then
bolReturn = True
Exit For
End If
Next
Set objDACL = Nothing
Set objSD = Nothing
Set objUser = Nothing
On Error Goto 0
End If
UserCantChangePassword = bolReturn

End Function

'Does the Account PW expire or not?
Function PasswordDoesExpire(userAccountControl)
If NZ(userAccountControl, "") <> "" Then
If ADS_UF_DONT_EXPIRE_PASSWD And userAccountControl Then
PasswordDoesExpire = True
Else
PasswordDoesExpire = False
End If
Else
PasswordDoesExpire = False
End If
End Function

'Account Disabled or not
Function IsAccountDisabled(distinguishedName)

Dim bolReturn
Dim objUser

bolReturn = False
If NZ(distinguishedName, "") <> "" Then
On Error Resume Next
Set objUser = GetObject("LDAP://" & distinguishedName)
bolReturn = objUser.AccountDisabled 
Set objUser = Nothing
On Error Goto 0
End If
IsAccountDisabled = bolReturn

End Function

'NZ equivalent to VBA
Function NZ(Value,alternativeValue)
If IsNull(Value) Then
NZ = alternativeValue
Else
NZ = Value
End If
End Function

'Adds the Information as needed to the specified Variable as a new Line and returns the complete new string
Function AddAdminInfoTo(CurrentString, NewTextLine, IsTable)
If Not Len(NZ(CurrentString, "")) > 0 Then
'AddAdminInfoTo = NewTextLine
If Not IsTable Then
AddAdminInfoTo = NewTextLine
Else
AddAdminInfoTo = CurrentString & "<tr><td>" & Replace(NewTextLine, vbNewLine, "") & "</td></tr>"
End If 
Else
'AddAdminInfoTo = CurrentString & vbNewLine & NewTextLine
If Not IsTable Then
AddAdminInfoTo = CurrentString & vbNewLine & NewTextLine
Else
AddAdminInfoTo = CurrentString & "<tr><td>" & Replace(NewTextLine, vbNewLine, "") & "</td></tr>"
End If
End If
End Function

'Reformatts the Days-Left into a special div tag if it is negative/positive
Function AdminInfoDaysLeftHTMLFormat(DaysLeft)
If DaysLeft > 0 Then
AdminInfoDaysLeftHTMLFormat = "<div class=""dayspositive"">" & DaysLeft & "</div>"
Else
AdminInfoDaysLeftHTMLFormat = "<div class=""daysnegative"">" & DaysLeft & "</div>"
End If
End Function

'Generates the Mail-Body for the Admin Mail
Function GenerateAdminMailBody()

Dim strReturn
strReturn = ""

strReturn = strReturn & "<style>" & vbNewLine
strReturn = strReturn & "table { font-family: Calibri; font-size: 11pt; }" & vbNewLine
strReturn = strReturn & "th { font: bold; background-color: light-blue; }" & vbNewLine
strReturn = strReturn & "th, td { border-bottom: 1px solid black; text-align: left; }" & vbNewLine
strReturn = strReturn & "tr:nth-child(even) { background-color: #f2f2f2; }" & vbNewLine
strReturn = strReturn & "tr:hover { background-color: #f5f5f5 }" & vbNewLine
strReturn = strReturn & "td.right { text-align: right; }" & vbNewLine
strReturn = strReturn & "div.dayspositive { }" & vbNewLine
strReturn = strReturn & "div.daysnegative { color: #FF0000; font: bold; }" & vbNewLine
strReturn = strReturn & "h1 { font: bold; font-size: 12pt; text-decoration: underline; }" & vbNewLine
strReturn = strReturn & "</style>" & vbNewLine

If Len(NZ(strAdminErrorUsers, "")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING USERS GENERATED SCRIPT ERRORS:</u>" & vbNewLine
strReturn = strReturn & "<h1>USERS THAT GENERATED SCRIPT ERRORS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminErrorUsers & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminErrorUsers & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolInformAdminAboutPWexpires And Len(NZ(strAdminPWexpires,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING PASSWORDS WILL EXPIRE:</u>" & vbNewLine
strReturn = strReturn & "<h1>NOTIFIED USERS WITH EXPIRING PASSWORDS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminPWexpires & vbNewLine
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminPWexpires & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolInformAdminAboutPWisExpired And Len(NZ(strAdminPWisExpired,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING PASSWORDS ARE EXPIRED ALREADY:</u>" & vbNewLine
strReturn = strReturn & "<h1>NOTIFIED USERS WITH EXPIRED PASSWORDS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminPWisExpired & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminPWisExpired & "</table><br><br>" 
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolInformAdminAboutAccountWithoutEMail And Len(NZ(strAdminAccountWithoutEMail,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS DON'T HAVE A VALID EMAIL ADDRESS:</u>" & vbNewLine
strReturn = strReturn & "<h1>USER ACCOUNTS WITH NO VALID EMAIL ADDRESS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminAccountWithoutEMail & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminAccountWithoutEMail & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If 

If bolInformAdminAboutPWneverExpires And Len(NZ(strAdminPWneverExpires,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING PASSWORDS NEVER EXPIRE:</u>" & vbNewLine
strReturn = strReturn & "<h1>PASSWORD NEVER EXPIRES USERS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminPWneverExpires & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminPWneverExpires & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If 

If bolInformAdminAboutUserCantChangePW And Len(NZ(strAdminUserCantChangePW,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING USERS CAN'T CHANGE THEIR PASSWORDS:</u>" & vbNewLine
strReturn = strReturn & "<h1>THE FOLLOWING USERS CAN'T CHANGE THEIR PASSWORDS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminUserCantChangePW & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminUserCantChangePW & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolInformAdminAboutAccountDisabled And Len(NZ(strAdminAccountDisabled,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS ARE DISABLED:</u>" & vbNewLine
strReturn = strReturn & "<h1>DISABLED USER ACCOUNTS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminAccountDisabled & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminAccountDisabled & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolInformAdminAboutExpiredUserAccount And Len(NZ(strAdminExpiredUserAccount,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS ARE EXPIRED:</u>" & vbNewLine
strReturn = strReturn & "<h1>EXPIRED USER ACCOUNTS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminExpiredUserAccount & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminExpiredUserAccount & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If 

If bolInformAdminAboutIgnoredUsersExcludedByGroup And Len(NZ(strAdminIgnoredUsersExcludedByGroup,"")) > 0 Then
strReturn = strReturn & "<h1>EXCLUDED USER ACCOUNTS (GROUP-FILTER):</h1>" & vbNewLine
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminIgnoredUsersExcludedByGroup & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolInformAdminAboutStillGoodPasswords And Len(NZ(strAdminPWstillGood,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS HAVE VALID PASSWORDS:</u>" & vbNewLine
strReturn = strReturn & "<h1>THE FOLLOWING USER ACCOUNTS HAVE VALID PASSWORDS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminPWstillGood & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminPWstillGood & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolAttachDebugToAdminMail Then
'strReturn = strReturn & "<u>DEBUG OUTPUT:</u>" & vbNewLine
strReturn = strReturn & "<h1>DEBUG OUTPUT:</h1>" & vbNewLine
'strReturn = strReturn & strAdminDebug & vbNewLine
strReturn = strReturn & Replace(strAdminDebug, vbNewLine, "<br>") & vbNewLine
End If

GenerateAdminMailBody = "<div style=""font-family: calibri; font-size: 11pt;"">" & strReturn & "</div>"

End Function

'Sends out EMails, to the User (False, UserMailAddress, True or False, DaysLeft for Password, "") or the Admin (TRUE, "", True or False, 0, AdminTextBody)
Sub SendEmailNotification(AdminMail, UserMailAddress, IsExpired, DaysLeft, AdminTextBody)

Dim objMail

Set objMail = CreateObject("CDO.Message")

objMail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2 
objMail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = strSMTPServer
objMail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = intSMTPServerPort 
objMail.Configuration.Fields.Update 

objMail.From = strFrom

If AdminMail Then 'is Admin Mail
objMail.Subject = strAdminMailSubject 
objMail.To = strToAdmin
'objMail.TextBody = AdminTextBody
'objMail.HTMLBody = Replace(AdminTextBody, vbNewLine, "<br>")
objMail.HTMLBody = AdminTextBody
Else 'is User Mail
If Not bolAdminMailOnly Then 'only the Admin Mail will be send
If IsExpired Then 
objMail.Subject = strUserMailSubjectExpired
Else
objMail.Subject = Replace(strUserMailSubjectWillExpire, "REPLACEWITHDAYS", DaysLeft)
End If
If bolRedirectMailToAdmin Then 'redirect Mails to Admin - add User Mail Address to Subject
objMail.To = strToAdmin
objMail.Subject = objMail.Subject & " - REDIRECTED TO ADMIN INSTEAD OF: " & UserMailAddress
Else
objMail.To = UserMailAddress
End If
objMail.CreateMHTMLBody strBodyURL
End If
End If

If Not bolTestDebugOutputToConsoleOnly Then
If Len(strAttachment) > 0 Then 'we do have an attachment to add?
objMail.AddAttachment strAttachment
End If
If bolAdminMailOnly Then 'only Admin Mail?
If AdminMail Then 'Then only if it is the Admin Mail
objMail.Send
End If
Else 'User Mail as well as Admin Mail
objMail.Send
End If
Else
ScriptDebug("=>DEBUG ONLY MODE - A EMAIL WOULD HAVE BEEN SEND TO: " & objMail.To & " - Subject: " & objMail.Subject)
End If

Set objMail = Nothing

End Sub

'Any Debug-Information will be proccessed here, easier to do it central and being able to change it to a LogFile or what ever...
Sub ScriptDebug(strDebugMessage)
If bolDebug Then
WScript.Echo strDebugMessage
End If
If bolAttachDebugToAdminMail Then
strAdminDebug = AddAdminInfoTo(strAdminDebug, strDebugMessage, False)
End If 
End Sub

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

596

597

598

599

600

601

602

603

604

605

606

607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

628

629

630

631

632

633

634

635

636

637

638

639

640

641

642

643

644

645

646

647

648

649

650

651

652

653

654

655

656

657

658

659

'This VBScript will run aggainst the ActiveDirectory Domain the executing User is a Member of.

'The executing User does not need to be an Domain-Administrator of any kind, a simply User is able to read the necessary information from ActiveDirectory

'Please configure the following Options - the Script does not accept or expect any Start-Parameter

'Version 2.2 - 04/12/2017: Florian Rossmark

'---------------------------------- START OPTIONS ----------------------------------

Const strSMTPServer = "relay.domain.com" 'SMTP Mail-Server to use

Const intSMTPServerPort = 25 'SMTP Mail-Server connection Port Number

Const strFrom = "pwdscript@domain.com" 'SMTP Mail From Address

Const strToAdmin = "helpdesk@domain.com" 'SMTP Mail To Address for Administrator

Const strAdminMailSubject = "Company Name - User Password Script Results to Admin" 'Subject for Mail to Admin

Const strUserMailSubjectExpired = "Your password has expired!" 'Subject for Mail to User when Password is expired

Const strUserMailSubjectWillExpire = "Your password will expire in REPLACEWITHDAYS days" 'Subject for Mail to User when Password will expire - the exact word REPLACEWITHDAYS will be replaced by the days left value

Const strBodyURL = "file://C:/scripts/PWD/PWDExpire.html" 'URL or full file-path (HTML) to import for Body, the entire content of this URL/FILE will be imported to the Body of the email and should explain ways how to change the password

Const strAttachment = "" 'full File-Path to an attachment for the email to the users / leave empty if no attachment

Const strLDAPSortColumn = "pwdLastSet" 'per default: pwdLastSet / sort column for LDAP query

Const intStartWithPWexpiresInDays = 5 'If the Passwords expires in days N or less, the script will inform the user

Const bolIgnoreDisabledAccounts = True 'Disabled accounts should always be ignored

Const bolInformAdminAboutPWexpires = True 'This will inform the Admin about expiring passwords

Const bolInformAdminAboutPWisExpired = True 'This will inform the Admin about accounts with expired Passwords

Const bolInformAdminAboutPWneverExpires = True 'This will inform the Admin about accounts with password set to never expire

Const bolInformAdminAboutUserCantChangePW = True 'This will inform the Admin about users who are not allowed to change their password

Const bolInformAdminAboutAccountDisabled = True 'This will inform the Admin about disabled accounts found - this would have been done in ADS by an administrator

Const bolInformAdminAboutExpiredUserAccount = True 'This will inform the admin if the User Account has an expiration date and the account is expired

Const bolInformAdminAboutAccountWithoutEMail = True 'This will inform the Admin about accounts without a set email address

Const bolInformAdminAboutStillGoodPasswords = True 'This will inform the Admin about Users/Passwords that are still valid

Const bolInformAdminAboutIgnoredUsersExcludedByGroup = True 'This will inform the Admin about Users that have been ignored by the strGroupsExclude filter

'Please Note: Status Account Locked will not be checked, this should be corrected automatically by the Default Security GPO instead (will be in most cases by default)

'Filter Priority 1 - only Users in those OU Paths will be processed

'Use LDAP DN like: "OU=Folder,OU=Folder,DC=Domain,DC=local", you do not need to include the DC=Domain,DC=local - the Script will add this information if necessary

'Use | (pipe) if you want to add more then one LDAP DN Path

'Leave empty ("") to disable this filter

Const strSearchOUs = "" '"OU=Users,OU=Site,DC=domain,DC=local"

'Filter Priority 2 - if the User Object is still not excluded, this Group Exclude filter will be applied

'If the user is member of one of those groups (if multiple groups are defined), he will be ignored

'Use | (pipe) if you want to add more then one GroupName

'Leave empty ("") to disable this filter

'Example: "Group Number1|GroupNumber2"

Const strGroupsExclude = "No Password notification emails"

'Filter Priority 3 - if the User Object is still not excluded, this Group Include filter will be applied

'The user has to be a member of one of those groups (if multiple groups are defined)

'Use | (pipe) if you want to add more then one GroupName

'Leave empty ("") to disable this filter

'Example: "Group Number1|GroupNumber2"

Const strGroupsInclude = ""

Const bolDebug = True 'Set TRUE for Script-Output, highly recommended to execute the Script in CMD with CSCRIPT <ScriptName>

Const bolAttachDebugToAdminMail = False 'The Debug Output will be attached to the Admin-Mail (independent from bolDebug)

Const bolTestDebugOutputToConsoleOnly = False 'This will disable the Mail.Send - only output to the CMD will be generated, please enable bolDebug

Const bolRedirectMailToAdmin = True 'This will redirect all Mails to the Admin, instead of sending them to the User - the Subject line will include the User-Mail Address in this case

Const bolAdminMailOnly = False 'This will send the Admin-Mail only, no User Mail will be generated

'---------------------------------- END OPTIONS ----------------------------------

'---------------------------------- Script starts here ----------------------------------

'---------------------------------- please do not modify after this line ----------------------------------

'Reference: https://msdn.microsoft.com/en-us/library/aa772300(v=vs.85).aspx

Const ADS_UF_DONT_EXPIRE_PASSWD = 65536

Const ADS_UF_PASSWD_CANT_CHANGE = 64

Const ADS_UF_PASSWORD_EXPIRED = 8388608

Const ADS_ACETYPE_ACCESS_DENIED_OBJECT = 6

Const CHANGE_PASSWORD_GUID = "{ab721a53-1e2f-11d0-9819-00aa0040529b}"

'A few Global Variables for the Admin-Mail

Dim strAdminPWexpires, strAdminPWisExpired, strAdminPWneverExpires, strAdminUserCantChangePW, strAdminAccountDisabled, strAdminExpiredUserAccount, strAdminAccountWithoutEMail, strAdminPWstillGood, strAdminIgnoredUsersExcludedByGroup

Dim strAdminErrorUsers

Dim strAdminDebug

SearchADS() 'Let's Start the actual process

'starts the actual search procedure - in a sub so it is easier to keep overview of the script

Sub SearchADS()

Dim objADSRoot, objADSDomain, objADSConnection, objADSCommand, objMaxPWDage, objUser

Dim intMaxPWDage, intDaysLeft

Dim bolProcessUser

Dim cntArray

Dim arrSearchOUs, arrGroupsExclude, arrGroupsInclude

Dim iADSCommand

Dim strFirstFoundGroupMembership

arrGroupsExclude = Split(strGroupsExclude, "|")

arrGroupsInclude = Split(strGroupsInclude, "|")

'Connect to ADS and get Users

Set objADSRoot = GetObject("LDAP://rootDSE")

Set objADSDomain = GetObject("LDAP://" & objADSRoot.Get("defaultNamingContext"))

Set objMaxPWDage = objADSDomain.Get("maxPwdAge") 'please note, this script can't obey the latest ADS multible password GPO rules, it will only follow the standard with only one password rule

intMaxPWDage = CCur((objMaxPWDage.HighPart * 2 ^ 32) + objMaxPWDage.LowPart) / CCur(-864000000000)

If Not intMaxPWDage > 0 Then 'Passwords won't expire at all

ScriptDebug("intMaxPWDage is set to: " & intMaxPWDage & " - Script stopped")

SendEmailNotification True, "", True, 0, "intMaxPWDage is incorrect, please check ADS configuration. Script aborded" 'Inform that there is no expiration configuration in Active Directory

Exit Sub 'Stop the Sub / End the Search

End If

Set objADSConnection = CreateObject("ADODB.Connection")

objADSConnection.Open "Provider=ADsDSOObject;"

Set objADSCommand = CreateObject("ADODB.Command")

objADSCommand.ActiveConnection = objADSConnection

If Not Len(strSearchOUs) > 0 Then

ReDim arrSearchOUs(0) 'we still need an array to run the For Next

arrSearchOUs(0) = ""

Else

arrSearchOUs = Split(strSearchOUs, "|")

End If

For iADSCommand = 0 To UBound(arrSearchOUs) 'we already filter OUs if necessary - filter priority 1

If Len(strSearchOUs) > 0 Then 'we need everytime a new objADSDomain to set the Filter based on the OU

If Not Right(arrSearchOUs(iADSCommand),Len(objADSRoot.Get("defaultNamingContext"))) = objADSRoot.Get("defaultNamingContext") Then

If Not Right(arrSearchOUs(iADSCommand),1) = "'" Then

arrSearchOUs(iADSCommand) = arrSearchOUs(iADSCommand) & ","

End If

arrSearchOUs(iADSCommand) = arrSearchOUs(iADSCommand) & objADSRoot.Get("defaultNamingContext")

End If

ScriptDebug("Searching LDAP Path: " & arrSearchOUs(iADSCommand))

Set objADSDomain = GetObject("LDAP://" & arrSearchOUs(iADSCommand))

End If

'samAccountType=805306368 / this is the correct value for USERS only - a search for the ObjectClass USER will also list Contacts

objADSCommand.CommandText = "<" & objADSDomain.ADsPath & ">;(&(samAccountType=805306368));userAccountControl,sAMAccountName,givenName,sn,mail,distinguishedName,lockoutTime;subtree"

objADSCommand.Properties("Sort on") = strLDAPSortColumn

Set rs = objADSCommand.Execute

If Not rs.EOF Then

Do While Not rs.EOF

ScriptDebug("") 'Empty Line before each run for easier to read output

ScriptDebug("PROCESSING USER: " & NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")")

intDaysLeft = 0

bolProcessUser = True

'Priority 2 - Exclude the following groups

If Len(strGroupsExclude) > 0 Then

strFirstFoundGroupMembership = "" 'just to make sure, lets clean the variable

If IsUserInGroup(rs("distinguishedName"), arrGroupsExclude, strFirstFoundGroupMembership) Then 'User is Member of the Group, we ignore him

ScriptDebug("..USER IS MEMBER OF EXCLUDED GROUP: " & strFirstFoundGroupMembership & " - IGNORING USER")

bolProcessUser = False

'old info - 'We don't inform the Admin in this case, would be done over the Debug Info

If bolInformAdminAboutIgnoredUsersExcludedByGroup Then

strAdminIgnoredUsersExcludedByGroup = AddAdminInfoTo(strAdminIgnoredUsersExcludedByGroup, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info

End If

'Priority 3 - Include the following groups

If bolProcessUser Then 'do we still go on with this User?

If Len(strGroupsInclude) > 0 Then

strFirstFoundGroupMembership = "" 'just to make sure, lets clean the variable

If Not IsUserInGroup(rs("distinguishedName"), arrGroupsInclude, strFirstFoundGroupMembership) Then 'User is Member of the Group, we ignore him

ScriptDebug("..USER IS NOT A MEMBER OF ANY OF THE INCLUDED GROUPS - IGNORING USER")

bolProcessUser = False

'old info - 'We don't inform the Admin in this case, would be done over the Debug Info

If bolInformAdminAboutIgnoredUsersExcludedByGroup Then

End If

Else 'User will be noramlly proccessed, we still inform about it in the Script-Debug

ScriptDebug("..USER IS MEMBER OF INCLUDED GROUP: " & strFirstFoundGroupMembership & " - PROCESSING USER")

End If

'Priority 4 - disabled account? this would have been done by an administrator

If bolProcessUser Then 'do we still go on with this User?

If IsAccountDisabled(rs("distinguishedName")) Then 'Account is disabled

ScriptDebug("..DISABLED USER ACCOUNT FOUND")

If bolIgnoreDisabledAccounts Then 'do we ignore this Account?

bolProcessUser = False

End If

If bolInformAdminAboutAccountDisabled Then

'strAdminAccountDisabled = AddAdminInfoTo(strAdminAccountDisabled, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info

strAdminAccountDisabled = AddAdminInfoTo(strAdminAccountDisabled, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), ""), True) 'Add to Admin Info

End If

'Priority 5 - Will User Account expire? (we only check if it is expired, if yes we take action)

If bolProcessUser Then 'do we still go on with this User?

If IsUserAccountExpired(rs("distinguishedName"), dtmExpiration) Then

bolProcessUser = False

ScriptDebug("..USER ACCOUNT IS EXPIRED SINCE: " & dtmExpiration)

If bolInformAdminAboutExpiredUserAccount Then

'strAdminExpiredUserAccount = AddAdminInfoTo(strAdminExpiredUserAccount, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - User expired since: " & dtmExpiration) 'Add to Admin Info

strAdminExpiredUserAccount = AddAdminInfoTo(strAdminExpiredUserAccount, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat(dtmExpiration), True) 'Add to Admin Info

End If

'Priority 6 - password never expires? this would have been done by an administrator

If bolProcessUser Then 'do we still go on with this User?

If PasswordDoesExpire(rs("userAccountControl")) Then 'Password does not expire

ScriptDebug("..USER WITH PASSWORD WILL NOT EXPIRE FOUND")

bolProcessUser = False

If bolInformAdminAboutPWneverExpires Then

'strAdminPWneverExpires = AddAdminInfoTo(strAdminPWneverExpires, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info

strAdminPWneverExpires = AddAdminInfoTo(strAdminPWneverExpires, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), ""), True) 'Add to Admin Info

End If

'Priority 7 - User can't even change the password? this would have been done by an administrator

If bolProcessUser Then 'do we still go on with this User?

If UserCantChangePassword(rs("distinguishedName")) Then 'User can't change Password

ScriptDebug("..USER WITH CAN'T CHANGE PASSWORD FOUND")

bolProcessUser = False

If bolInformAdminAboutUserCantChangePW Then

'strAdminUserCantChangePW = AddAdminInfoTo(strAdminUserCantChangePW, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info

strAdminUserCantChangePW = AddAdminInfoTo(strAdminUserCantChangePW, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), ""), True) 'Add to Admin Info

End If

'Priority 8 - User does not have an EMail Address? can't inform User if PW is about to expire what shall we do?

If bolProcessUser Then 'do we still go on with this User?

If Not Len(NZ(rs("mail"), "")) > 0 Then 'User is missing email address

ScriptDebug("..USER WITHOUT EMAIL ADDRESS FOUND")

bolProcessUser = False

If bolInformAdminAboutAccountWithoutEMail Then

'strAdminAccountWithoutEMail = AddAdminInfoTo(strAdminAccountWithoutEMail, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days Left: " & (GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)) 'Add to Admin Info

strAdminAccountWithoutEMail = AddAdminInfoTo(strAdminAccountWithoutEMail, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info

End If

'Priority 9 - now we check the Password Age and take action

If bolProcessUser Then 'do we still go on with this User?

If PasswordIsExpired(rs("userAccountControl")) Then 'The Password is already expired? We need to take action / this will be double checked later on with a calculation

ScriptDebug("..PASSWORD IS EXPIRED")

SendEmailNotification False, NZ(rs("mail"), ""), True, 0, "" 'Inform the USER about the expired Password

If bolInformAdminAboutPWisExpired Then

'strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info

strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info

End If

Else 'Password is not expired yet, how many days does the User have left?

Set objUser = GetObject("LDAP://" & rs("distinguishedName"))

intDaysLeft = GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage)

If intDaysLeft <= 0 Then 'we have a number of days left

If intStartWithPWexpiresInDays >= (intDaysLeft * -1) Then 'User is to be informed, his days left are less then defined

ScriptDebug("..PASSWORD FOR USER WILL EXPIRE IN: " & (intDaysLeft * -1) & " DAYS")

SendEmailNotification False, NZ(rs("mail"), ""), False, (intDaysLeft * -1), "" 'Inform the USER that the Password will expire

If bolInformAdminAboutPWexpires Then

'strAdminPWexpires = AddAdminInfoTo(strAdminPWexpires, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days Left: " & (intDaysLeft * -1)) 'Add to Admin Info

strAdminPWexpires = AddAdminInfoTo(strAdminPWexpires, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((intDaysLeft * -1)), True) 'Add to Admin Info

End If

Else 'User has more days left then needed by Script Configuration

'we do not need to take action - we do not even send Mail to the Admin

ScriptDebug("..USER PASSWORD IS STILL GOOD - DAYS LEFT: " & (intDaysLeft * -1))

If bolInformAdminAboutStillGoodPasswords Then

'strAdminPWstillGood = AddAdminInfoTo(strAdminPWstillGood, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days Left: " & (intDaysLeft * -1)) 'Add to Admin Info

strAdminPWstillGood = AddAdminInfoTo(strAdminPWstillGood, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((intDaysLeft * -1)), True) 'Add to Admin Info

End If

Else 'Password is already expired and needs to be changed now / second check, first one might not give the needed information

ScriptDebug("..PASSWORD IS EXPIRED FOR: " & (intDaysLeft * -1) & " DAYS")

SendEmailNotification False, NZ(rs("mail"), ""), True, 0, "" 'Inform the USER about the expired Password

If bolInformAdminAboutPWisExpired Then

'strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days expired: " & (intDaysLeft * -1)) 'Add to Admin Info

End If

Set objUser = Nothing 'to make sure the Object is release

End If

rs.MoveNext

Loop

End If

Set rs = Nothing

Next 'Next from arrSearchOUs

Set objADSCommand = Nothing

Set objADSConnection = Nothing

Set objADSDomain = Nothing

Set objADSRoot = Nothing

ScriptDebug("")

ScriptDebug("SCRIPT ENDED SUCCESSFULLY => Sending Admin Mail")

SendEmailNotification True, "", True, 0, GenerateAdminMailBody 'Send the final admin notification with the requested information

End Sub

'Function returns days left for Password of User-Object (uses default Value intDaysLeft)

Function GetPWDaysLeft(strDistinguishedName, strGivenName, strSN, strsAMAccountName, intDaysLeft, intMaxPWDage)

Dim objUser

Set objUser = GetObject("LDAP://" & strDistinguishedName)

On Error Resume Next

'intDaysLeft will be negative, like a countdown, T minus DAYS

intDaysLeft = DateDiff("d", objUser.PasswordLastChanged, Now) - intMaxPWDage

If Err Then

If Err.Number = &h8000500d Then 'PWD was just changed

intDaysLeft = intMaxPWDage

ScriptDebug("..USER PASSWORD WAS JUST CHANGED")

'we don't send any Mails about this

Else 'unexpexted Error occured - this shouldn't happen at all!

ScriptDebug("..UNEXPECTED ERROR (UserPasswordLastChanged)")

'strAdminErrorUsers = AddAdminInfoTo(strAdminErrorUsers, strGivenName & " " & strSN & " (" & strsAMAccountName & ")") 'Add to Admin Info

strAdminErrorUsers = AddAdminInfoTo(strAdminErrorUsers, strGivenName & "</td><td>" & strSN & "</td><td>" & strsAMAccountName, True) 'Add to Admin Info

End If

Err.Clear

On Error Goto 0

Set objUser = Nothing

GetPWDaysLeft = Round(intDaysLeft, 0)

End Function

Function IsUserAccountExpired(distinguishedName, dtmExpirationDate)

Dim bolReturn

Dim objUser

Dim dtmAccountExpiration

bolReturn = False

If NZ(distinguishedName, "") <> "" Then

Set objUser = GetObject("LDAP://" & distinguishedName)

On Error Resume Next

dtmAccountExpiration = objUser.AccountExpirationDate

If Err.Number = -2147467259 Or dtmAccountExpiration = "1/1/1970" Then 'Account has no expiration date specified

'we do nothing - not even a debug message

Else 'Account has expireation date

If DateDiff("d", dtmAccountExpiration, Now) > 0 Then

bolReturn = True

dtmExpirationDate = dtmAccountExpiration

End If

On Error Goto 0

Set objUser = Nothing

End If

IsUserAccountExpired = bolReturn

End Function

'Is the User Member of one of the Groups in the Array? Give back first GroupName found if possible

Function IsUserInGroup(distinguishedName, arrGroups, FirstFoundGroupMembership)

Dim objUser, objGroup

Dim i

Dim strGroupName

Dim bolFound

bolFound = False

If NZ(distinguishedName, "") <> "" Then

Set objUser = GetObject("LDAP://" & distinguishedName)

On Error Resume Next

For Each objGroup In objUser.GetEx("memberOf")

strGroupName = Split(objGroup,",")(0)

strGroupName = Right(strGroupName, (Len(strGroupName)-3))

For i = 0 To UBound(arrGroups)

If LCase(strGroupName) = LCase(arrGroups(i)) Then

bolFound = True

FirstFoundGroupMembership = strGroupName

IsUserInGroup = True

Exit For

End If

If bolFound Then

Exit For

End If

On Error Goto 0

Set objUser = Nothing

Else

IsUserInGroup = False 'couldn't find User distinguishedName - not really possible

End If

End Function

'Is the Password Expired?

Function PasswordIsExpired(userAccountControl)

If NZ(userAccountControl, "") <> "" Then

If ADS_UF_PASSWORD_EXPIRED And userAccountControl Then

PasswordIsExpired = True

Else

PasswordIsExpired = False

End If

Else

PasswordIsExpired = False

End If

End Function

'Is the User able to change to Password?

Function UserCantChangePassword(distinguishedName)

Dim bolReturn

Dim objUser, objSD, objDACL, objACE

bolReturn = False

If NZ(distinguishedName, "") <> "" Then

On Error Resume Next

Set objUser = GetObject("LDAP://" & distinguishedName)

Set objSD = objUser.Get("nTSecurityDescriptor")

Set objDACL = objSD.DiscretionaryAcl

For Each objACE in objDACL

If objACE.AceType = ADS_ACETYPE_ACCESS_DENIED_OBJECT And LCase(objACE.ObjectType) = CHANGE_PASSWORD_GUID Then

bolReturn = True

Exit For

End If

Set objDACL = Nothing

Set objSD = Nothing

Set objUser = Nothing

On Error Goto 0

End If

UserCantChangePassword = bolReturn

End Function

'Does the Account PW expire or not?

Function PasswordDoesExpire(userAccountControl)

If NZ(userAccountControl, "") <> "" Then

If ADS_UF_DONT_EXPIRE_PASSWD And userAccountControl Then

PasswordDoesExpire = True

Else

PasswordDoesExpire = False

End If

Else

PasswordDoesExpire = False

End If

End Function

'Account Disabled or not

Function IsAccountDisabled(distinguishedName)

Dim bolReturn

Dim objUser

bolReturn = False

If NZ(distinguishedName, "") <> "" Then

On Error Resume Next

Set objUser = GetObject("LDAP://" & distinguishedName)

bolReturn = objUser.AccountDisabled

Set objUser = Nothing

On Error Goto 0

End If

IsAccountDisabled = bolReturn

End Function

'NZ equivalent to VBA

Function NZ(Value,alternativeValue)

If IsNull(Value) Then

NZ = alternativeValue

Else

NZ = Value

End If

End Function

'Adds the Information as needed to the specified Variable as a new Line and returns the complete new string

Function AddAdminInfoTo(CurrentString, NewTextLine, IsTable)

If Not Len(NZ(CurrentString, "")) > 0 Then

'AddAdminInfoTo = NewTextLine

If Not IsTable Then

AddAdminInfoTo = NewTextLine

Else

AddAdminInfoTo = CurrentString & "<tr><td>" & Replace(NewTextLine, vbNewLine, "") & "</td></tr>"

End If

Else

'AddAdminInfoTo = CurrentString & vbNewLine & NewTextLine

If Not IsTable Then

AddAdminInfoTo = CurrentString & vbNewLine & NewTextLine

Else

AddAdminInfoTo = CurrentString & "<tr><td>" & Replace(NewTextLine, vbNewLine, "") & "</td></tr>"

End If

End Function

'Reformatts the Days-Left into a special div tag if it is negative/positive

Function AdminInfoDaysLeftHTMLFormat(DaysLeft)

If DaysLeft > 0 Then

AdminInfoDaysLeftHTMLFormat = "<div class=""dayspositive"">" & DaysLeft & "</div>"

Else

AdminInfoDaysLeftHTMLFormat = "<div class=""daysnegative"">" & DaysLeft & "</div>"

End If

End Function

'Generates the Mail-Body for the Admin Mail

Function GenerateAdminMailBody()

Dim strReturn

strReturn = ""

strReturn = strReturn & "<style>" & vbNewLine

strReturn = strReturn & "table { font-family: Calibri; font-size: 11pt; }" & vbNewLine

strReturn = strReturn & "th { font: bold; background-color: light-blue; }" & vbNewLine

strReturn = strReturn & "th, td { border-bottom: 1px solid black; text-align: left; }" & vbNewLine

strReturn = strReturn & "tr:nth-child(even) { background-color: #f2f2f2; }" & vbNewLine

strReturn = strReturn & "tr:hover { background-color: #f5f5f5 }" & vbNewLine

strReturn = strReturn & "td.right { text-align: right; }" & vbNewLine

strReturn = strReturn & "div.dayspositive { }" & vbNewLine

strReturn = strReturn & "div.daysnegative { color: #FF0000; font: bold; }" & vbNewLine

strReturn = strReturn & "h1 { font: bold; font-size: 12pt; text-decoration: underline; }" & vbNewLine

strReturn = strReturn & "</style>" & vbNewLine

If Len(NZ(strAdminErrorUsers, "")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING USERS GENERATED SCRIPT ERRORS:</u>" & vbNewLine

strReturn = strReturn & "<h1>USERS THAT GENERATED SCRIPT ERRORS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminErrorUsers & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminErrorUsers & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutPWexpires And Len(NZ(strAdminPWexpires,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING PASSWORDS WILL EXPIRE:</u>" & vbNewLine

strReturn = strReturn & "<h1>NOTIFIED USERS WITH EXPIRING PASSWORDS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminPWexpires & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminPWexpires & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutPWisExpired And Len(NZ(strAdminPWisExpired,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING PASSWORDS ARE EXPIRED ALREADY:</u>" & vbNewLine

strReturn = strReturn & "<h1>NOTIFIED USERS WITH EXPIRED PASSWORDS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminPWisExpired & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminPWisExpired & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutAccountWithoutEMail And Len(NZ(strAdminAccountWithoutEMail,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS DON'T HAVE A VALID EMAIL ADDRESS:</u>" & vbNewLine

strReturn = strReturn & "<h1>USER ACCOUNTS WITH NO VALID EMAIL ADDRESS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminAccountWithoutEMail & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminAccountWithoutEMail & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutPWneverExpires And Len(NZ(strAdminPWneverExpires,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING PASSWORDS NEVER EXPIRE:</u>" & vbNewLine

strReturn = strReturn & "<h1>PASSWORD NEVER EXPIRES USERS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminPWneverExpires & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminPWneverExpires & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutUserCantChangePW And Len(NZ(strAdminUserCantChangePW,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING USERS CAN'T CHANGE THEIR PASSWORDS:</u>" & vbNewLine

strReturn = strReturn & "<h1>THE FOLLOWING USERS CAN'T CHANGE THEIR PASSWORDS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminUserCantChangePW & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminUserCantChangePW & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutAccountDisabled And Len(NZ(strAdminAccountDisabled,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS ARE DISABLED:</u>" & vbNewLine

strReturn = strReturn & "<h1>DISABLED USER ACCOUNTS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminAccountDisabled & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminAccountDisabled & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutExpiredUserAccount And Len(NZ(strAdminExpiredUserAccount,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS ARE EXPIRED:</u>" & vbNewLine

strReturn = strReturn & "<h1>EXPIRED USER ACCOUNTS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminExpiredUserAccount & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminExpiredUserAccount & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutIgnoredUsersExcludedByGroup And Len(NZ(strAdminIgnoredUsersExcludedByGroup,"")) > 0 Then

strReturn = strReturn & "<h1>EXCLUDED USER ACCOUNTS (GROUP-FILTER):</h1>" & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminIgnoredUsersExcludedByGroup & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutStillGoodPasswords And Len(NZ(strAdminPWstillGood,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS HAVE VALID PASSWORDS:</u>" & vbNewLine

strReturn = strReturn & "<h1>THE FOLLOWING USER ACCOUNTS HAVE VALID PASSWORDS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminPWstillGood & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminPWstillGood & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolAttachDebugToAdminMail Then

'strReturn = strReturn & "<u>DEBUG OUTPUT:</u>" & vbNewLine

strReturn = strReturn & "<h1>DEBUG OUTPUT:</h1>" & vbNewLine

'strReturn = strReturn & strAdminDebug & vbNewLine

strReturn = strReturn & Replace(strAdminDebug, vbNewLine, "<br>") & vbNewLine

End If

GenerateAdminMailBody = "<div style=""font-family: calibri; font-size: 11pt;"">" & strReturn & "</div>"

End Function

'Sends out EMails, to the User (False, UserMailAddress, True or False, DaysLeft for Password, "") or the Admin (TRUE, "", True or False, 0, AdminTextBody)

Sub SendEmailNotification(AdminMail, UserMailAddress, IsExpired, DaysLeft, AdminTextBody)

Dim objMail

Set objMail = CreateObject("CDO.Message")

objMail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2

objMail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = strSMTPServer

objMail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = intSMTPServerPort

objMail.Configuration.Fields.Update

objMail.From = strFrom

If AdminMail Then 'is Admin Mail

objMail.Subject = strAdminMailSubject

objMail.To = strToAdmin

'objMail.TextBody = AdminTextBody

'objMail.HTMLBody = Replace(AdminTextBody, vbNewLine, "<br>")

objMail.HTMLBody = AdminTextBody

Else 'is User Mail

If Not bolAdminMailOnly Then 'only the Admin Mail will be send

If IsExpired Then

objMail.Subject = strUserMailSubjectExpired

Else

objMail.Subject = Replace(strUserMailSubjectWillExpire, "REPLACEWITHDAYS", DaysLeft)

End If

If bolRedirectMailToAdmin Then 'redirect Mails to Admin - add User Mail Address to Subject

objMail.To = strToAdmin

objMail.Subject = objMail.Subject & " - REDIRECTED TO ADMIN INSTEAD OF: " & UserMailAddress

Else

objMail.To = UserMailAddress

End If

objMail.CreateMHTMLBody strBodyURL

End If

If Not bolTestDebugOutputToConsoleOnly Then

If Len(strAttachment) > 0 Then 'we do have an attachment to add?

objMail.AddAttachment strAttachment

End If

If bolAdminMailOnly Then 'only Admin Mail?

If AdminMail Then 'Then only if it is the Admin Mail

objMail.Send

End If

Else 'User Mail as well as Admin Mail

objMail.Send

End If

Else

ScriptDebug("=>DEBUG ONLY MODE - A EMAIL WOULD HAVE BEEN SEND TO: " & objMail.To & " - Subject: " & objMail.Subject)

End If

Set objMail = Nothing

End Sub

'Any Debug-Information will be proccessed here, easier to do it central and being able to change it to a LogFile or what ever...

Sub ScriptDebug(strDebugMessage)

If bolDebug Then

WScript.Echo strDebugMessage

End If

If bolAttachDebugToAdminMail Then

strAdminDebug = AddAdminInfoTo(strAdminDebug, strDebugMessage, False)

End If

End Sub

<html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Your password will expire in “X” days</title>
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p.sectiontitle, li.sectiontitle, div.sectiontitle
{margin-top:12.0pt;
margin-right:0in;
margin-bottom:12.0pt;
margin-left:0in;
font-size:12.0pt;
font-family:Verdana;
font-variant:small-caps;
font-weight:bold;}
p.sectioncontent, li.sectioncontent, div.sectioncontent
{margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:9.0pt;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:Verdana;}
span.sectiontitlechar
{font-family:Verdana;
font-variant:small-caps;
font-weight:bold;}
@page Section1
{size:8.5in 11.0in;
margin:81.35pt 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
/* List Definitions */
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>

</head>

<body lang="EN-US" link="blue" vlink="purple">

<div class="Section1">
<table width="100%"><tr><td>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana;
color:blue">This is an automated password expiration notification. </span></b></p>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana;
color:blue">Please change your password as soon as possible.</span></b></p>
</td><td>
<div text-align=right>
<img src="logo.jpg" width="150px">
</div>
</td></tr></table>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></b></p>

<p class="MsoNormal"><b><u><span style="font-size:10.0pt;font-family:Verdana">Password
Policy</span></u></b></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="sectioncontent"><b>Password Rules</b></p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">1.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

</span>Your password must be changed every 90 days</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">2.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>The system will remember the last 8 passwords used and will not allow
them again</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">3.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Minimum password age is 1 day. A password cannot be changed until it is
1 day old.</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">4.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Account lockout duration is 15 minutes</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">5.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Account lockout threshold is 6 invalid login attempts</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">6.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Reset account lockout counter after 15 minutes</p>

<p class="sectioncontent">&nbsp;</p>

<p class="sectioncontent"><b>Complexity Rules</b></p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">1.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

</span>It must be at least 8 characters in length</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">2.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>It cannot contain a significant portion of the username or the person’s
full name</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">3.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>It cannot contain a complete dictionary word</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">4.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>It must contain at least one character from 3 of the 4 following groups:</p>

<p class="sectioncontent" style="margin-left:63.0pt;text-indent:-.25in">a.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Lower-case alpha character (a-z)</p>

<p class="sectioncontent" style="margin-left:63.0pt;text-indent:-.25in">b.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Upper-case alpha character (A-Z)</p>

<p class="sectioncontent" style="margin-left:63.0pt;text-indent:-.25in">c.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Numeric digit (0-9)</p>

<p class="sectioncontent" style="margin-left:63.0pt;text-indent:-.25in">d.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

</span>Special character ( { } [ ] , . &lt; &gt; ; : ' " ? / | \ ` ~ ! @ #
$ <br>
% ^ &amp; * ( ) _ - + = )</p>

<p class="sectioncontent">&nbsp;</p>

<p class="sectioncontent"><b>Suggestions</b></p>

<p class="sectioncontent">Use a password that you can remember. One common
practice is to model your password after a sentence or a phrase. It can also be
useful to replace letter with numbers. </p>

<p class="sectioncontent">&nbsp;</p>

<p class="sectioncontent">Steve might use the well-known statement, “I can eat
sushi for lunch every day” to come up with the following password:</p>

<p class="sectioncontent" style="text-indent:27.0pt">Ic3s4led!</p>

<p class="sectioncontent">&nbsp;</p>

<p class="sectioncontent">Ray might use “My motorcycle is way too fast for you!”</p>

<p class="sectioncontent" style="text-indent:27.0pt">MmiW2f4u!</p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="MsoNormal"><b><u><span style="font-size:10.0pt;font-family:Verdana">How
to Change Your Password</span></u></b></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Method
1 – Directly From Windows</span></b></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">If you
have a computer with direct connectivity to corporate network, changing
your password is very easy. </span></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<ol style="margin-top:0in" start="1" type="1">
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">After
you are logged into your computer, enter the keyboard combination “Ctrl +
ALT + Del” (this is the same combination used&nbsp; when logging onto your
computer)</span></li>
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">In the
Windows Security popup window click “Change Password”</span></li>
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">The 1<sup>st</sup>
two fields will be auto-filled. Please enter your current “OLD” password
followed by your “NEW” password in the last two fields.</span></li>

</ol>

<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt;
font-family:Verdana">&nbsp;</span></p>

<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="289" style="width:216.6pt;margin-left:41.4pt;border-collapse:collapse">
<tbody><tr>
<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Description</span></b></p>
</td>
<td width="153" valign="top" style="width:114.6pt;border:solid windowtext 1.0pt;
border-left:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Your
Answer</span></b></p>

</td>
</tr>
<tr>
<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Username</span></p>
</td>
<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your
userID e.g. jsmith</span></p>

</td>
</tr>
<tr>
<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Log on
to</span></p>
</td>
<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Company Name</span></p>

</td>
</tr>
<tr>
<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Old
password</span></p>
</td>
<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your
OLD password</span></p>

</td>
</tr>
<tr>
<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">New
password</span></p>
</td>
<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your
NEW password</span></p>

</td>
</tr>
<tr>
<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Confirm
new password</span></p>
</td>
<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your
New Password</span></p>

</td>
</tr>
</tbody></table>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<ol style="margin-top:0in" start="4" type="1">
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Click
OK </span></li>
</ol>

<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt;
font-family:Verdana">Your new password is now set and will be valid for 90 days</span></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Method
2 – Contact the Helpdesk</span></b></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">If you
require assistance in changing your password, please submit a help desk request
and we will be more than happy to help you out. </span></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<ol style="margin-top:0in" start="1" type="1">
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Create
a helpdesk ticket </span></li>

<ol style="margin-top:0in" start="1" type="a">
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Open
your web browser and type <a href="http://helpdesk.domain.com/">http://helpdesk.domain.com</a></span></li>
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Create
a new ticket and label it “I Need Help”</span></li>
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">In the
Notes field, please provide a phone number and the best time to reach you</span></li>
</ol>
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">An IT associate will contact you to assist in changing your password</span></li>

</ol>

<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt;
font-family:Verdana">NOTE: If you are unable to access helpdesk website,
please call 888-888-8888 or x8888</span></p>

</div>


</body></html>

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

<title>Your password will expire in “X” days</title>

<style>

<!--

/* Font Definitions */

@font-face

{font-family:Verdana;

panose-1:2 11 6 4 3 5 4 4 2 4;}

/* Style Definitions */

p.MsoNormal, li.MsoNormal, div.MsoNormal

{margin:0in;

margin-bottom:.0001pt;

font-size:12.0pt;

font-family:"Times New Roman";}

a:link, span.MsoHyperlink

{color:blue;

text-decoration:underline;}

a:visited, span.MsoHyperlinkFollowed

{color:purple;

text-decoration:underline;}

p.sectiontitle, li.sectiontitle, div.sectiontitle

{margin-top:12.0pt;

margin-right:0in;

margin-bottom:12.0pt;

margin-left:0in;

font-size:12.0pt;

font-family:Verdana;

font-variant:small-caps;

font-weight:bold;}

p.sectioncontent, li.sectioncontent, div.sectioncontent

{margin-top:0in;

margin-right:0in;

margin-bottom:0in;

margin-left:9.0pt;

margin-bottom:.0001pt;

font-size:10.0pt;

font-family:Verdana;}

span.sectiontitlechar

{font-family:Verdana;

font-variant:small-caps;

font-weight:bold;}

@page Section1

{size:8.5in 11.0in;

margin:81.35pt 1.0in 1.0in 1.0in;}

div.Section1

{page:Section1;}

/* List Definitions */

{margin-bottom:0in;}

-->

</style>

</head>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana;

color:blue">This is an automated password expiration notification. </span></b></p>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana;

color:blue">Please change your password as soon as possible.</span></b></p>

</td><td>

</div>

</td></tr></table>

<p class="MsoNormal"><b><u><span style="font-size:10.0pt;font-family:Verdana">Password

Policy</span></u></b></p>

<p class="sectioncontent"><b>Password Rules</b></p>

</span>Your password must be changed every 90 days</p>

</span>The system will remember the last 8 passwords used and will not allow

them again</p>

</span>Minimum password age is 1 day. A password cannot be changed until it is

1 day old.</p>

</span>Account lockout duration is 15 minutes</p>

</span>Account lockout threshold is 6 invalid login attempts</p>

</span>Reset account lockout counter after 15 minutes</p>

<p class="sectioncontent"><b>Complexity Rules</b></p>

</span>It must be at least 8 characters in length</p>

</span>It cannot contain a significant portion of the username or the person’s

full name</p>

</span>It cannot contain a complete dictionary word</p>

</span>It must contain at least one character from 3 of the 4 following groups:</p>

</span>Lower-case alpha character (a-z)</p>

</span>Upper-case alpha character (A-Z)</p>

</span>Numeric digit (0-9)</p>

</span>Special character ( { } [ ] , . < > ; : ' " ? / | \ ` ~ ! @ #

$ <br>

% ^ & * ( ) _ - + = )</p>

<p class="sectioncontent"><b>Suggestions</b></p>

<p class="sectioncontent">Use a password that you can remember. One common

practice is to model your password after a sentence or a phrase. It can also be

useful to replace letter with numbers. </p>

<p class="sectioncontent">Steve might use the well-known statement, “I can eat

sushi for lunch every day” to come up with the following password:</p>

<p class="sectioncontent">Ray might use “My motorcycle is way too fast for you!”</p>

<p class="MsoNormal"><b><u><span style="font-size:10.0pt;font-family:Verdana">How

to Change Your Password</span></u></b></p>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Method

1 – Directly From Windows</span></b></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">If you

have a computer with direct connectivity to corporate network, changing

your password is very easy. </span></p>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">After

you are logged into your computer, enter the keyboard combination “Ctrl +

ALT + Del” (this is the same combination used  when logging onto your

computer)</span></li>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">In the

Windows Security popup window click “Change Password”</span></li>

two fields will be auto-filled. Please enter your current “OLD” password

followed by your “NEW” password in the last two fields.</span></li>

</ol>

<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt;

font-family:Verdana"> </span></p>

<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;

padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Description</span></b></p>

</td>

<td width="153" valign="top" style="width:114.6pt;border:solid windowtext 1.0pt;

border-left:none;padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Your

Answer</span></b></p>

</td>

</tr>

<tr>

<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;

border-top:none;padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Username</span></p>

</td>

<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:

none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;

padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your

userID e.g. jsmith</span></p>

</td>

</tr>

<tr>

<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;

border-top:none;padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Log on

to</span></p>

</td>

<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:

none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;

padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Company Name</span></p>

</td>

</tr>

<tr>

<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;

border-top:none;padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Old

password</span></p>

</td>

<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:

none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;

padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your

OLD password</span></p>

</td>

</tr>

<tr>

<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;

border-top:none;padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">New

password</span></p>

</td>

<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:

none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;

padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your

NEW password</span></p>

</td>

</tr>

<tr>

<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;

border-top:none;padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Confirm

new password</span></p>

</td>

<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:

none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;

padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your

New Password</span></p>

</td>

</tr>

</tbody></table>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Click

OK </span></li>

</ol>

<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt;

font-family:Verdana">Your new password is now set and will be valid for 90 days</span></p>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Method

2 – Contact the Helpdesk</span></b></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">If you

require assistance in changing your password, please submit a help desk request

and we will be more than happy to help you out. </span></p>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Create

a helpdesk ticket </span></li>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Open

your web browser and type <a href="http://helpdesk.domain.com/">http://helpdesk.domain.com</a></span></li>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Create

a new ticket and label it “I Need Help”</span></li>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">In the

Notes field, please provide a phone number and the best time to reach you</span></li>

</ol>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">An IT associate will contact you to assist in changing your password</span></li>

</ol>

<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt;

font-family:Verdana">NOTE: If you are unable to access helpdesk website,

please call 888-888-8888 or x8888</span></p>

</div>

</body></html>

As always – feel free to reach out to me if you have any questions or comments.

June 22, 2018 by Florian Rossmark recommendations scripts security server solutions

Script based SQL Express backups

SQL Express is widely used but has huge downside, there is no SQL Agent available. Even Windows internal databases, especially WSUS / Windows Update Services / Microsoft Update Services are in the end SQL Express like databases that do not have a SQL Agent.

Now, you can have central SQL Servers with Agents have them backed up – and I recommend on doing so if possible. But for the many times this is not possible, you will need to find another way to create those nice little .BAK files for SQL internal backups aka. SQL Maintenance Plan Backups. To work around this issue, I once wrote a script that automates this for each database found on a specific SQL server. It creates the backups via SQLCMD commands and even does a clean up of obsolete files (files older than x days), almost like SQL Maintenance Plans do it.

The script is divided in to a .CMD file that executes the actual backup and where you set the configuration/parameters and a .VBS file that is controlled by the actual .CMD script and will perform the backup cleanup. In the end you can have the .CMD send a email report – I used the SMTPSEND program from Michael Kocum (https://www.dataenter.com/download.asp) for this since I already ad it flying around – you could replace the mail send option with another prepared SMTPSEND client, a VBS script or just remove it completely.

Adjusting the settings / parameter:

This is all done in the SQLBACKUP.CMD file – the header section pretty much will explain all you need to know, from SQL Server to SQL-User and Password over Mail-Server to recipients.

If you want to execute the SQLBackups as the Windows-User that is executing the script, you need to exchange the REM (remarks) for the following two lines further down in the scripts. I apologize for the inconvenience, this is a old script I never updated to have those settings in the header (more automated), I always just changed the lines.

REM the following line user SQL User / PW - SQL authentication - REM it if you want to switch to Windows User authentication
SqlCmd -U %SQLUser% -P %SQLPW% -S %SQLServer% -h-1 -W -Q "SET NoCount ON; SELECT Name FROM master.dbo.sysDatabases WHERE [Name] NOT IN ('tempdb')" &gt; "%DBList%"
REM the following line uses Windows User authentication - remove the REM if you want to use this instead
REM SqlCmd -S %SQLServer% -h-1 -W -Q "SET NoCount ON; SELECT Name FROM master.dbo.sysDatabases WHERE [Name] NOT IN ('tempdb')" &gt; "%DBList%"

REM the following line user SQL User / PW - SQL authentication - REM it if you want to switch to Windows User authentication

SqlCmd -U %SQLUser% -P %SQLPW% -S %SQLServer% -h-1 -W -Q "SET NoCount ON; SELECT Name FROM master.dbo.sysDatabases WHERE [Name] NOT IN ('tempdb')" > "%DBList%"

REM the following line uses Windows User authentication - remove the REM if you want to use this instead

REM SqlCmd -S %SQLServer% -h-1 -W -Q "SET NoCount ON; SELECT Name FROM master.dbo.sysDatabases WHERE [Name] NOT IN ('tempdb')" > "%DBList%"

Everything else should be rather easy. Of course you will need sufficient access rights to the SQL databases and your destination backup folder. The task-scheduler might work best if you execute the script with “cmd /c c:\scripts\sqlbackup.cmd” (change the path as you need it) and set the working directory / startup folder right. It might help to execute the task with elevated rights etc. – all depending on your systems configuration.

Below are the two scripts – I hope this helps some of you. The generated .BAK files can simply be restored in SQL services via the GUI cause they are native SQL backup files.

@ECHO OFF
SETLOCAL

REM Variables - please adjust
REM =============================================================================================
REM Server or Server\Instance
SET SQLServer=SERVER\INSTANANCEifNEEDED
REM local Path or UNC Path (must be accessible under the executing user!)
SET SQLBackupPath=D:\Backup\SubFolderName----\\SERVER\SHARE\FOLDER-----EitherLocalOrUNC
REM max age the files can be in days before they get deleted
SET SQLBackupMaxAge=1 
SET SQLUser=sa
SET SQLPW=
SET MailServer=relay.domain.local
SET MailServerPort=25
SET MailFrom=sqlbackup@domain.com
SET MailTo=backups@domain.com
SET MailSubject=SQL Express Backup (INSTANCENAME/DESCRIPTION)
REM =============================================================================================

REM Script-System-Variables - do not change after this point!
SET ScriptLog=%~dp0\SQLBackup_Script_Log.txt
REM Running Script 
DEL %ScriptLog% 
ECHO Script-Log Date: %Date% / Time: %Time% >> %ScriptLog%
ECHO Script-Parameter: >> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%
ECHO SQLServer: %SQLServer% >> %ScriptLog%
ECHO SQLBackupPath: %SQLBackupPath% >> %ScriptLog%
ECHO SQLBackupMaxAge: %SQLBackupMaxAge% >> %ScriptLog%
ECHO SQLUser: %SQLUser% >> %ScriptLog%
ECHO SQLPW: %SQLPW% >> %ScriptLog%
ECHO MailServer: %MailServer% >> %ScriptLog%
ECHO MailServerPort: %MailServerPort% >> %ScriptLog%
ECHO MailFrom: %MailFrom% >> %ScriptLog%
ECHO MailTo: %MailTo% >> %ScriptLog%
ECHO MailSubject: %MailSubject% >> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%
ECHO Script executing: >> %ScriptLog%

ECHO Delete old Backup Info File >> %ScriptLog%
DEL %SQLBackupPath%\SQLBackupStatus.txt >> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%

ECHO Get date in format YYYY-MM-DD (assumes the locale is the United States) >> %ScriptLog%
FOR /F "tokens=1,2,3,4 delims=. " %%A IN ('Date /T') DO SET NowDate=%%C-%%B-%%A >> %ScriptLog%
FOR /F "tokens=1,2 delims=: " %%A IN ('Time /T') DO SET NowDate=%NowDate%_%%A-%%B >> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%

ECHO Build a list of databases to backup >> %ScriptLog%
SET DBList=%SQLBackupPath%\SQLDBList.txt
REM the following line user SQL User / PW - SQL authentication - REM it if you want to switch to Windows User authentication
SqlCmd -U %SQLUser% -P %SQLPW% -S %SQLServer% -h-1 -W -Q "SET NoCount ON; SELECT Name FROM master.dbo.sysDatabases WHERE [Name] NOT IN ('tempdb')" > "%DBList%"
REM the following line uses Windows User authentication - remove the REM if you want to use this instead
REM SqlCmd -S %SQLServer% -h-1 -W -Q "SET NoCount ON; SELECT Name FROM master.dbo.sysDatabases WHERE [Name] NOT IN ('tempdb')" > "%DBList%"
ECHO =========================================================================== >> %ScriptLog%

ECHO Backup each database, prepending the date to the filename >> %ScriptLog%
FOR /F "tokens=*" %%I IN (%DBList%) DO (
ECHO Backing up database: %%I >> %ScriptLog%
ECHO Backing up database: %%I >>%SQLBackupPath%\SQLBackupStatus.txt
ECHO Destination: %SQLBackupPath%\%NowDate%_%%I.bak >>%SQLBackupPath%\SQLBackupStatus.txt
SqlCmd -U %SQLUser% -P %SQLPW% -S %SQLServer% -Q "BACKUP DATABASE [%%I] TO Disk='%SQLBackupPath%\ %NowDate%_%%I.bak'" >>%SQLBackupPath%\SQLBackupStatus.txt
ECHO. >>%SQLBackupPath%\SQLBackupStatus.txt
)
ECHO =========================================================================== >> %ScriptLog%
ECHO Clean up the temp file >> %ScriptLog%
IF EXIST "%DBList%" DEL /F /Q "%DBList%" >> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%

ECHO Old Backups Clean Up >> %ScriptLog%
CSCRIPT %~dp0\SQLBackup.vbs %SQLBackupMaxAge% "%SQLBackupPath%" >> %ScriptLog%
ECHO SQL Backup CleanUp executed >>%SQLBackupPath%\SQLBackupStatus.txt
ECHO. >>%SQLBackupPath%\SQLBackupStatus.txt
ECHO. >>%SQLBackupPath%\SQLBackupStatus.txt
ECHO Currently available Backup-Files: >>%SQLBackupPath%\SQLBackupStatus.txt
DIR %SQLBackupPath% >>%SQLBackupPath%\SQLBackupStatus.txt
ECHO =========================================================================== >> %ScriptLog%

ECHO Send Info Mail >> %ScriptLog%
%~dp0\SMTPSEND -f%MailFrom% -t%MailTo% -h%MailServer% -p%MailServerPort% -s%MailSubject% -i%SQLBackupPath%\SQLBackupStatus.txt >> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%

ENDLOCAL

@ECHO OFF

SETLOCAL

REM Variables - please adjust

REM =============================================================================================

REM Server or Server\Instance

SET SQLServer=SERVER\INSTANANCEifNEEDED

REM local Path or UNC Path (must be accessible under the executing user!)

SET SQLBackupPath=D:\Backup\SubFolderName----\\SERVER\SHARE\FOLDER-----EitherLocalOrUNC

REM max age the files can be in days before they get deleted

SET SQLBackupMaxAge=1

SET SQLUser=sa

SET SQLPW=

SET MailServer=relay.domain.local

SET MailServerPort=25

SET MailFrom=sqlbackup@domain.com

SET MailTo=backups@domain.com

SET MailSubject=SQL Express Backup (INSTANCENAME/DESCRIPTION)

REM =============================================================================================

REM Script-System-Variables - do not change after this point!

SET ScriptLog=%~dp0\SQLBackup_Script_Log.txt

REM Running Script

DEL %ScriptLog%

ECHO Script-Log Date: %Date% / Time: %Time% >> %ScriptLog%

ECHO Script-Parameter: >> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO SQLServer: %SQLServer% >> %ScriptLog%

ECHO SQLBackupPath: %SQLBackupPath% >> %ScriptLog%

ECHO SQLBackupMaxAge: %SQLBackupMaxAge% >> %ScriptLog%

ECHO SQLUser: %SQLUser% >> %ScriptLog%

ECHO SQLPW: %SQLPW% >> %ScriptLog%

ECHO MailServer: %MailServer% >> %ScriptLog%

ECHO MailServerPort: %MailServerPort% >> %ScriptLog%

ECHO MailFrom: %MailFrom% >> %ScriptLog%

ECHO MailTo: %MailTo% >> %ScriptLog%

ECHO MailSubject: %MailSubject% >> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO Script executing: >> %ScriptLog%

ECHO Delete old Backup Info File >> %ScriptLog%

DEL %SQLBackupPath%\SQLBackupStatus.txt >> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO Get date in format YYYY-MM-DD (assumes the locale is the United States) >> %ScriptLog%

FOR /F "tokens=1,2,3,4 delims=. " %%A IN ('Date /T') DO SET NowDate=%%C-%%B-%%A >> %ScriptLog%

FOR /F "tokens=1,2 delims=: " %%A IN ('Time /T') DO SET NowDate=%NowDate%_%%A-%%B >> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO Build a list of databases to backup >> %ScriptLog%

SET DBList=%SQLBackupPath%\SQLDBList.txt

REM the following line user SQL User / PW - SQL authentication - REM it if you want to switch to Windows User authentication

SqlCmd -U %SQLUser% -P %SQLPW% -S %SQLServer% -h-1 -W -Q "SET NoCount ON; SELECT Name FROM master.dbo.sysDatabases WHERE [Name] NOT IN ('tempdb')" > "%DBList%"

REM the following line uses Windows User authentication - remove the REM if you want to use this instead

REM SqlCmd -S %SQLServer% -h-1 -W -Q "SET NoCount ON; SELECT Name FROM master.dbo.sysDatabases WHERE [Name] NOT IN ('tempdb')" > "%DBList%"

ECHO =========================================================================== >> %ScriptLog%

ECHO Backup each database, prepending the date to the filename >> %ScriptLog%

FOR /F "tokens=*" %%I IN (%DBList%) DO (

ECHO Backing up database: %%I >> %ScriptLog%

ECHO Backing up database: %%I >>%SQLBackupPath%\SQLBackupStatus.txt

ECHO Destination: %SQLBackupPath%\%NowDate%_%%I.bak >>%SQLBackupPath%\SQLBackupStatus.txt

SqlCmd -U %SQLUser% -P %SQLPW% -S %SQLServer% -Q "BACKUP DATABASE [%%I] TO Disk='%SQLBackupPath%\ %NowDate%_%%I.bak'" >>%SQLBackupPath%\SQLBackupStatus.txt

ECHO. >>%SQLBackupPath%\SQLBackupStatus.txt

)

ECHO =========================================================================== >> %ScriptLog%

ECHO Clean up the temp file >> %ScriptLog%

IF EXIST "%DBList%" DEL /F /Q "%DBList%" >> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO Old Backups Clean Up >> %ScriptLog%

CSCRIPT %~dp0\SQLBackup.vbs %SQLBackupMaxAge% "%SQLBackupPath%" >> %ScriptLog%

ECHO SQL Backup CleanUp executed >>%SQLBackupPath%\SQLBackupStatus.txt

ECHO. >>%SQLBackupPath%\SQLBackupStatus.txt

ECHO Currently available Backup-Files: >>%SQLBackupPath%\SQLBackupStatus.txt

DIR %SQLBackupPath% >>%SQLBackupPath%\SQLBackupStatus.txt

ECHO =========================================================================== >> %ScriptLog%

ECHO Send Info Mail >> %ScriptLog%

%~dp0\SMTPSEND -f%MailFrom% -t%MailTo% -h%MailServer% -p%MailServerPort% -s%MailSubject% -i%SQLBackupPath%\SQLBackupStatus.txt >> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ENDLOCAL

Set objArgs = WScript.Arguments

If objArgs.Count > 0 Then

Dim strPath
Dim intAge

intAge = objArgs(0)
strPath = objArgs(1)

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFolder = objFSO.GetFolder(strPath)

For Each objFile in objFolder.Files
If DateDiff("d", objFile.DateLastModified, Now()) > Cint(intAge) Then
On Error Resume Next
objFile.Delete
On Error Goto 0
End If
Next

End If

Set objArgs = WScript.Arguments

If objArgs.Count > 0 Then

Dim strPath

Dim intAge

intAge = objArgs(0)

strPath = objArgs(1)

Set objFSO = CreateObject("Scripting.FileSystemObject")

Set objFolder = objFSO.GetFolder(strPath)

For Each objFile in objFolder.Files

If DateDiff("d", objFile.DateLastModified, Now()) > Cint(intAge) Then

On Error Resume Next

objFile.Delete

On Error Goto 0

End If

June 19, 2018 by Florian Rossmark recommendations scripts server

Join systems to a domain and create KeePass server entries for local admin’s

Please note – this script was updated – you find the updated post here.

One of the challenges in most daily IT operations is onboarding of workstations and servers (respective domain join). Over the years I came across and tried many ways to accomplish this. Today I wanted to share a script and solution others might find helpful, but first lets get down to some theory and background.

The goals and challenges:

simple domain join after a system was imaged
- this is in theory possible in a fully automated process via various imaging solutions – I found that WDS (Microsoft Windows Deployment Services are in most cases the easiest way to accomplish this while having the possibility to use this in consulting for various clients, in enterprise for various departments etc. Since Windows 10 came in to the equation some of the automation with WDS became more challenging – so keeping it simple with some additional manual labor is often the easiest way to accomplish this – to simplify the process a PowerShell script became a perfect solution).
systems should have a local admin account (not administrator / SID 500 / who should remain disabled) with an individual password
- typing this manual you always risk that the password is misspelled either in your password database or on the actual operating system
- if you think it is a good idea to have the same password on all your clients I actually suggest you do some security related research!

The PowerShell script below will do the following for you:

Ask for the name of the system (this will change the hostname/computername)
Ask for credentials for KeePass / Pleasant Password Server
Ask for credentials to join the system to the domain
Create a local admin user account on the system
Generate a password for this account
Check if there is an existing KeePass / Pleasant Password Server entry for this system
If not – it will proceed and create a entry with the machine name, username, password and various additional information like
1. manufacturer
2. model
3. serial number / service tag
4. UEFI BIOS Windows license key
5. MAC addresses of all network cards Windows knows about
And finally it will join the domain and put the system right away in to the defined OU

The whole script is only an example – you don’t have to use KeePass / Pleasant Password Server nor is the script perfect for any situation – you can take it and modify it as you need it – point it to various IT Asset databases or let you chose from predefined OUs etc. – adjust it as you needed – in general it is a very useful baseline and I wanted to share it.

One of the challenges is to execute the script as administrator (elevated rights) and as well bypass the script execution restrictions without compromising them in a default image, like disabling this important security feature on the image itself. To accomplish this, a simple CMD-Script actually will execute the PowerShell script. CMD-Script can right-clicked and executed as administrator and gain elevated rights. This is as of today not possible by default with PowerShell scripts (.ps1).

Create the following two files “Execute-DomainJoin.cmd” and “Execute-DomainJoin.ps1” and save them in the same directory or e.g. a portable flash drive. Adjust the PowerShell script so it connects to your domain and local systems.

powershell.exe -executionpolicy unrestricted -file "%~dp0\Execute-DomainJoin.ps1"
pause

1 2	powershell.exe -executionpolicy unrestricted -file "%~dp0\Execute-DomainJoin.ps1" pause

Please note – this script was updated – you find the updated post here.

$ScriptVersion = "1.0 - 6/15/2018 - Florian Rossmark
Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Welcome to the Execute Domain-Join script"
Write-Host "========================================="
Write-Host ""
Write-Host ""
Write-Host "This script will do the following Steps:"
Write-Host "----------------------------------------"
Write-Host "- You enter the Computer Name / Host Name"
Write-Host "- You enter Domain Admin credentials for a Domain-Join"
Write-Host "- You enter credentials to access KeyPass Password server"
Write-Host ""
Write-Host ""
Write-Host "Note: always type credentials without any domain-information (MYDOMAIN\) - the script will fail otherwise."
Write-Host ""
Write-Host ""
Write-Host ""
Write-Host "- The script will automatically create a KeyPass entry with all information"
Write-Host "- The script will automatically create a specific local admin account for this machine"
Write-Host "- The script will automatically rename the system to the given name"
Write-Host "- The script will automatically join the system to the domain"
Write-Host ""
Write-Host ""
Write-Host "Script Version: $ScriptVersion"
Write-Host ""
Write-Host ""
pause

#Upper area holds functions..
Function MakeUp-String([Int]$Size = 8, [Char[]]$CharSets = "ULNS", [Char[]]$Exclude) {
$Chars = @(); $TokenSet = @()
If (!$TokenSets) {$Global:TokenSets = @{
U = [Char[]]'ABCDEFGHJKLMNPQRSTUVWXYZ' #Upper case
L = [Char[]]'abcdefghijkmnpqrstuvwxyz' #Lower case
N = [Char[]]'23456789' #Numerals
S = [Char[]]'!@$!@$!@$!@$' #Symbols
}}
$CharSets | ForEach {
$Tokens = $TokenSets."$_" | ForEach {If ($Exclude -cNotContains $_) {$_}}
If ($Tokens) {
$TokensSet += $Tokens
If ($_ -cle [Char]"Z") {$Chars += $Tokens | Get-Random} #Character sets defined in upper case are mandatory
}
}
While ($Chars.Count -lt $Size) {$Chars += $TokensSet | Get-Random}
($Chars | Sort-Object {Get-Random}) -Join "" #Mix the (mandatory) characters and output string
};

#bypass/avoid certificate issues
Add-Type @"
using System;
using System.Net;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;
public class ServerCertificateValidationCallback
{
public static void Ignore()
{
ServicePointManager.ServerCertificateValidationCallback +=
delegate
(
Object obj,
X509Certificate certificate,
X509Chain chain,
SslPolicyErrors errors
)
{
return true;
};
}
}
"@
[ServerCertificateValidationCallback]::Ignore();

#Script starts here...
Clear-Host
Write-Host ""
Write-Host ""
Write-Host "This script must be executed in a PowerShell with elevated rights!"
Write-Host ""
Write-Host ""
Write-Host "Stop the script with: CTRL + C any time..."
Write-Host ""
Write-Host ""
pause
Clear-Host

$ComputerName = Read-Host "Please enter the new Computer Name"
$DomainJoinCredentials = Get-Credential -Message "Enter your credentials for the domain join"
$KeePassCredentials = Get-Credential -Message “Enter your credentials to access Keepass Server”
$localAdminUser = $("$ComputerName" + "_Admin")
$PW = MakeUp-String(12)
$PWencrypted = ConvertTo-SecureString $PW -AsPlainText -Force

Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Checking KeePass to see if those credentials already exist"
Write-Host ""
Write-Host ""

#Collecting MACs
$colMACItems = get-wmiobject Win32_NetworkAdapter | Where-Object {$_.MACAddress -like "*:*"}
foreach ($objMACItem in $colMACItems) {
$MACobj = $objMACItem |select Description,MACAddress
$MACs += $MACobj.MACAddress + " - " + $MACobj.Description + "
"
}
#Collecting SN/ServiceTag and HW information
$SN = "ServiceTag / SN: "+(Get-WmiObject win32_bios | select SerialNumber).SerialNumber
$Model = "Model: "+(Get-WmiObject win32_computersystem | select Model).Model
$Manufacturer = "Manufacturer: "+(Get-WmiObject win32_computersystem | select Manufacturer).Manufacturer
$UEFIKey = wmic path softwarelicensingservice get OA3xOriginalProductKey
$KeepassURL = "https://passwordserver.mydomain.local:10001"
$PWFolder = "Local Admin Accounts"
$PWName = "Individual Admin Account on $ComputerName"
$PWUser = $localAdminUser
$PWPassword = $PW
$PWDescription = "Hardware information:
=====================
$Manufacturer
$Model
$SN

UEFI BIOS Windows Key:
======================
$UEFIKey

Known MAC Addresses:
====================
$MACs
(MACs might be subject to change with Docking-Stations)"

$tokenParams = @{
grant_type='password';
username=$KeePassCredentials.UserName;
password=$KeePassCredentials.GetNetworkCredential().password;}

$JSON = Invoke-WebRequest -Uri "$KeepassURL/OAuth2/Token" -Method POST -Body $tokenParams -ContentType "application/x-www-form-urlencoded"
$Token = (ConvertFrom-Json $JSON.Content).access_token

$headers = @{
"Accept" = "application/json"
"Authorization" = "$Token"}

$GroupSearch = @{“search” = $PWFolder}
$Group = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $GroupSearch) -Headers $headers -ContentType 'application/json'
$GroupID = $Group.Groups.Id

$SearchPhrase = $PWUser
$searchbody = @{“search” = $SearchPhrase}
$Search = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $searchbody) -Headers $headers -ContentType 'application/json'
$SearchID = $Search.Credentials.Id

$KeePassResultscnt = 0
ForEach($Result in $Search.credentials)
{
$CredentialID = $Result.id
If ($Result.GroupId -eq $GroupID)
{
$KeePassResultscnt += 1
}
}
If ($KeePassResultscnt -ge 1)
{
Write-Host "Total number of results found: $cnt"
Write-Host ""
Write-Host ""
Write-Host "ALERT - KeePass already has credentials for this system - can not proceed."
Write-Host "=========================================================================="
Write-Host ""
Write-Host "Search-Phrase: $SearchPhrase"
Write-Host "Search-Folder: $PWFolder"
Write-Host "Amount of results found: $KeePassResultscnt"
Write-Host ""
Write-Host ""
Write-Host ""
Write-Host "Next Steps:"
Write-Host "==========="
Write-Host "- This script will exit now!"
Write-Host "- No changes to the system of KeePass have been applied"
Write-Host "- Go to KeePass and check if this is an old entry and can be renamed/moved"
Write-Host "- Execute the script again"
Write-Host ""
Write-Host ""
pause
EXIT
} Else {
Write-Host ""
Write-Host ""
Write-Host "Writing new credentials to the KeePass server/database"
Write-Host ""
Write-Host ""
$PWEntryDT = Get-Date -Format "O"
$CredEntry = @{
Id = "00000000-0000-0000-0000-000000000000"
Name = "$PWName"
Username = "$PWUser"
Password = "$PWPassword"
Created = "$PWEntryDT"
Modified = "$PWEntryDT"
GroupId = "$GroupID"
Notes = "$PWDescription"
Url = "$ComputerName"
}
Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/credential/00000000-0000-0000-0000-000000000000"-body @(ConvertTo-Json $CredEntry) -Headers $headers -ContentType 'application/json'
Write-Host ""
Write-Host ""
Write-Host "Finished writing to KeePass server/database"
Write-Host ""
Write-Host ""
}
pause

Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Please check the following information:"
Write-Host "======================================="
Write-Host ""
Write-Host "Computer Name: $ComputerName"
Write-Host "local Admin: $localAdminUser"
Write-Host "Admin-PW: $PW"
Write-Host ""
Write-Host ""
Write-Host "Make sure the information above are correct!"
Write-Host ""
Write-Host ""
Write-Host "Verify the local Admin and Admin-PW in KeePass!"
Write-Host ""
Write-Host ""
pause
Write-Host ""
Write-Host ""
Write-Host "All information are verified?"
Write-Host ""
Write-Host ""
pause

Clear-Host
Write-Host "Checking and removing (if exists) old local user: $localAdminUser"
Get-LocalUser -Name $localAdminUser | Remove-LocalUser
Clear-Host
Write-Host "Adding new local administrator account: $localAdminUser"
New-LocalUser -Name $localAdminUser -Password $PWencrypted -AccountNeverExpires -PasswordNeverExpires -Description "System specific local administrator account"
$NewUser = Get-LocalUser -Name $localAdminUser
$AdminGroup = Get-LocalGroup -Name "Administrators"
Add-LocalGroupMember -Name $AdminGroup -Member $NewUser

Write-Host ""
Write-Host ""
Write-Host "Finished."
Write-Host ""
Write-Host ""
pause

Write-Host ""
Write-Host ""
Write-Host "Joining this system to the domain and reboot automatically - stay put"
Write-Host ""
Write-Host ""
Write-Host "Note: The system will not reboot if an error occurs. Check the error message in case you see a error."
Write-Host ""
Write-Host ""

Add-Computer -Domain "mydomain.local" -Credential $DomainJoinCredentials -NewName $ComputerName -Restart -Force -OUPath "OU=Computers,OU=San Diego,OU=USA,DC=mydomain,DC=local"

Write-Host ""
Write-Host ""
Write-Host "Computer exists already:"
Write-Host " Check Domain - remove Computer if needed"
Write-Host " Reboot this system"
Write-Host " Rename this system manually after the reboot"
Write-Host ""
Write-Host "Credentials for Domain are wrong:"
Write-Host " Start the script over"
Write-Host ""
Write-Host ""
pause

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

$ScriptVersion = "1.0 - 6/15/2018 - Florian Rossmark

Clear-Host

Write-Host ""

Write-Host "Welcome to the Execute Domain-Join script"

Write-Host "========================================="

Write-Host ""

Write-Host "This script will do the following Steps:"

Write-Host "----------------------------------------"

Write-Host "- You enter the Computer Name / Host Name"

Write-Host "- You enter Domain Admin credentials for a Domain-Join"

Write-Host "- You enter credentials to access KeyPass Password server"

Write-Host ""

Write-Host "Note: always type credentials without any domain-information (MYDOMAIN\) - the script will fail otherwise."

Write-Host ""

Write-Host "- The script will automatically create a KeyPass entry with all information"

Write-Host "- The script will automatically create a specific local admin account for this machine"

Write-Host "- The script will automatically rename the system to the given name"

Write-Host "- The script will automatically join the system to the domain"

Write-Host ""

Write-Host "Script Version: $ScriptVersion"

Write-Host ""

pause

#Upper area holds functions..

Function MakeUp-String([Int]$Size = 8, [Char[]]$CharSets = "ULNS", [Char[]]$Exclude) {

$Chars = @(); $TokenSet = @()

If (!$TokenSets) {$Global:TokenSets = @{

U = [Char[]]'ABCDEFGHJKLMNPQRSTUVWXYZ' #Upper case

L = [Char[]]'abcdefghijkmnpqrstuvwxyz' #Lower case

N = [Char[]]'23456789' #Numerals

S = [Char[]]'!@$!@$!@$!@$' #Symbols

}}

$CharSets | ForEach {

$Tokens = $TokenSets."$_" | ForEach {If ($Exclude -cNotContains $_) {$_}}

If ($Tokens) {

$TokensSet += $Tokens

If ($_ -cle [Char]"Z") {$Chars += $Tokens | Get-Random} #Character sets defined in upper case are mandatory

}

While ($Chars.Count -lt $Size) {$Chars += $TokensSet | Get-Random}

($Chars | Sort-Object {Get-Random}) -Join "" #Mix the (mandatory) characters and output string

};

#bypass/avoid certificate issues

Add-Type @"

using System;

using System.Net;

using System.Net.Security;

using System.Security.Cryptography.X509Certificates;

public class ServerCertificateValidationCallback

{

public static void Ignore()

{

ServicePointManager.ServerCertificateValidationCallback +=

delegate

(

Object obj,

X509Certificate certificate,

X509Chain chain,

SslPolicyErrors errors

)

{

return true;

};

}

[ServerCertificateValidationCallback]::Ignore();

#Script starts here...

Clear-Host

Write-Host ""

Write-Host "This script must be executed in a PowerShell with elevated rights!"

Write-Host ""

Write-Host "Stop the script with: CTRL + C any time..."

Write-Host ""

pause

Clear-Host

$ComputerName = Read-Host "Please enter the new Computer Name"

$DomainJoinCredentials = Get-Credential -Message "Enter your credentials for the domain join"

$KeePassCredentials = Get-Credential -Message “Enter your credentials to access Keepass Server”

$localAdminUser = $("$ComputerName" + "_Admin")

$PW = MakeUp-String(12)

$PWencrypted = ConvertTo-SecureString $PW -AsPlainText -Force

Clear-Host

Write-Host ""

Write-Host "Checking KeePass to see if those credentials already exist"

Write-Host ""

#Collecting MACs

$colMACItems = get-wmiobject Win32_NetworkAdapter | Where-Object {$_.MACAddress -like "*:*"}

foreach ($objMACItem in $colMACItems) {

$MACobj = $objMACItem |select Description,MACAddress

$MACs += $MACobj.MACAddress + " - " + $MACobj.Description + "

}

#Collecting SN/ServiceTag and HW information

$SN = "ServiceTag / SN: "+(Get-WmiObject win32_bios | select SerialNumber).SerialNumber

$Model = "Model: "+(Get-WmiObject win32_computersystem | select Model).Model

$Manufacturer = "Manufacturer: "+(Get-WmiObject win32_computersystem | select Manufacturer).Manufacturer

$UEFIKey = wmic path softwarelicensingservice get OA3xOriginalProductKey

$KeepassURL = "https://passwordserver.mydomain.local:10001"

$PWFolder = "Local Admin Accounts"

$PWName = "Individual Admin Account on $ComputerName"

$PWUser = $localAdminUser

$PWPassword = $PW

$PWDescription = "Hardware information:

=====================

$Manufacturer

$Model

$SN

UEFI BIOS Windows Key:

======================

$UEFIKey

Known MAC Addresses:

====================

$MACs

(MACs might be subject to change with Docking-Stations)"

$tokenParams = @{

grant_type='password';

username=$KeePassCredentials.UserName;

password=$KeePassCredentials.GetNetworkCredential().password;}

$JSON = Invoke-WebRequest -Uri "$KeepassURL/OAuth2/Token" -Method POST -Body $tokenParams -ContentType "application/x-www-form-urlencoded"

$Token = (ConvertFrom-Json $JSON.Content).access_token

$headers = @{

"Accept" = "application/json"

"Authorization" = "$Token"}

$GroupSearch = @{“search” = $PWFolder}

$Group = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $GroupSearch) -Headers $headers -ContentType 'application/json'

$GroupID = $Group.Groups.Id

$SearchPhrase = $PWUser

$searchbody = @{“search” = $SearchPhrase}

$Search = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $searchbody) -Headers $headers -ContentType 'application/json'

$SearchID = $Search.Credentials.Id

$KeePassResultscnt = 0

ForEach($Result in $Search.credentials)

{

$CredentialID = $Result.id

If ($Result.GroupId -eq $GroupID)

{

$KeePassResultscnt += 1

}

If ($KeePassResultscnt -ge 1)

{

Write-Host "Total number of results found: $cnt"

Write-Host ""

Write-Host "ALERT - KeePass already has credentials for this system - can not proceed."

Write-Host "=========================================================================="

Write-Host ""

Write-Host "Search-Phrase: $SearchPhrase"

Write-Host "Search-Folder: $PWFolder"

Write-Host "Amount of results found: $KeePassResultscnt"

Write-Host ""

Write-Host "Next Steps:"

Write-Host "==========="

Write-Host "- This script will exit now!"

Write-Host "- No changes to the system of KeePass have been applied"

Write-Host "- Go to KeePass and check if this is an old entry and can be renamed/moved"

Write-Host "- Execute the script again"

Write-Host ""

pause

EXIT

} Else {

Write-Host ""

Write-Host "Writing new credentials to the KeePass server/database"

Write-Host ""

$PWEntryDT = Get-Date -Format "O"

$CredEntry = @{

Id = "00000000-0000-0000-0000-000000000000"

Name = "$PWName"

Username = "$PWUser"

Password = "$PWPassword"

Created = "$PWEntryDT"

Modified = "$PWEntryDT"

GroupId = "$GroupID"

Notes = "$PWDescription"

Url = "$ComputerName"

}

Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/credential/00000000-0000-0000-0000-000000000000"-body @(ConvertTo-Json $CredEntry) -Headers $headers -ContentType 'application/json'

Write-Host ""

Write-Host "Finished writing to KeePass server/database"

Write-Host ""

}

pause

Clear-Host

Write-Host ""

Write-Host "Please check the following information:"

Write-Host "======================================="

Write-Host ""

Write-Host "Computer Name: $ComputerName"

Write-Host "local Admin: $localAdminUser"

Write-Host "Admin-PW: $PW"

Write-Host ""

Write-Host "Make sure the information above are correct!"

Write-Host ""

Write-Host "Verify the local Admin and Admin-PW in KeePass!"

Write-Host ""

pause

Write-Host ""

Write-Host "All information are verified?"

Write-Host ""

pause

Clear-Host

Write-Host "Checking and removing (if exists) old local user: $localAdminUser"

Get-LocalUser -Name $localAdminUser | Remove-LocalUser

Clear-Host

Write-Host "Adding new local administrator account: $localAdminUser"

New-LocalUser -Name $localAdminUser -Password $PWencrypted -AccountNeverExpires -PasswordNeverExpires -Description "System specific local administrator account"

$NewUser = Get-LocalUser -Name $localAdminUser

$AdminGroup = Get-LocalGroup -Name "Administrators"

Add-LocalGroupMember -Name $AdminGroup -Member $NewUser

Write-Host ""

Write-Host "Finished."

Write-Host ""

pause

Write-Host ""

Write-Host "Joining this system to the domain and reboot automatically - stay put"

Write-Host ""

Write-Host "Note: The system will not reboot if an error occurs. Check the error message in case you see a error."

Write-Host ""

Add-Computer -Domain "mydomain.local" -Credential $DomainJoinCredentials -NewName $ComputerName -Restart -Force -OUPath "OU=Computers,OU=San Diego,OU=USA,DC=mydomain,DC=local"

Write-Host ""

Write-Host "Computer exists already:"

Write-Host " Check Domain - remove Computer if needed"

Write-Host " Reboot this system"

Write-Host " Rename this system manually after the reboot"

Write-Host ""

Write-Host "Credentials for Domain are wrong:"

Write-Host " Start the script over"

Write-Host ""

pause

Explaining, adjusting and guiding your through the PowerShell script

It is important that you understand the script so you can make adjustments to it. I will try to explain everything that is important and reference some line-numbers while doing so.

Lines 1-30 are just a general introduction and show some generic information
Lines 31-76 hold some functions to generate a password, to bypass some certificate issues etc
1. Lines 35-38 are worth taking a look at, here are all the characters of the four categories that will be used to generate a password. Excluded are already usually hard to read characters in some fonts and other characters that might cause issues – of course, adjust especially line 38 to your preferences and add more symbols or remove what you don’t want to use
Lines 77-89 are just informational
Lines 90-96 expect some user-input
1. new computername
2. get credentials for the domain join (admin)
  1. the script will not validate the credentials, in theory this could be done but I never found it that important
3. get credentials to read/write on the password database server (often not the actual admin-credentials, therefor I separated those two)
  1. the script will not validate the credentials, in theory this could be done but I never found it that important
4. the local admin username that will be created
  1. $localAdminUser = $(“$ComputerName” + “_Admin”)
  2. the above line will create a hostname_admin account – you can adjust this to your preferences
5. 94-95 will generate a password and encrypt it so it can be used to create the local account
Lines 97-103 are just informational
Lines 104-216 – this is actually the whole password server communication and entry check and generation
1. 104-115 those lines gather various information from your current system like serial number, UEFI Windows keys, etc. – you can keep em as is
2. 116 – please enter the URL to your password server here
3. 117 – here your need to enter the folder where the generated credentials are going to be put in on your password server
4. 118 – this is the subject of the entry that will be generated – adjust this to your preferences
5. 119-120 – those are username/password for the entry – you should leave this as is
6. 121-134 – those lines are the details in your password server entry – adjust them to your likes
7. 135-165 – this actually will execute the following on the REST API on your password server
  1. connect to it
  2. check if a entry with the same username already exists
8. 166-189 – this will raise an alert that this user already exists on your password server – 189 will actually exit the whole script
9. 190-216 – this block will write to the password server – cause it did not find an entry with the new username
Lines 217-241 this shows the new created username and password – it actually suggests you compare the entries on your password server to the information shown to make sure everything is correct
Lines 242-251 will create the new local admin account on the system and set the password
Lines 252-267 are informational
Line 268 will execute the actual domain join
1. please adjust the -Domain and the -OUPath parameter to your specific needs
2. note that the command will automatically restart the system
Lines 269-282 Those lines are informational – actually – if anything would go wrong those lines would be shown and help to take further steps after the failed domain join – in most cases those suggestions will help – in the end the error output shown by the command for the domain join (line 268) would indicate what went wrong. The restart of the system actually would bypass this message in the end (more or less)

If you have any questions, feel free to reach out to me. The script could be cleaned up more – but I wanted to provide a working version of it – so I just did a quick clean up or some special stuff and posted it here. Personally I like things a bit more structured, but as said – this is just a general example.

Please note – this script was updated – you find the updated post here.

This script is also mentioned on the API Examples page on the Pleasant Solutions web site here.

June 15, 2018 by Florian Rossmark configuration recommendations scripts security server solutions windows

Monitor your projectors and light bulbs with PJLink

Below is a solution rather than a question. Just thought I share it with the rest of the Paessler/PRTG world. This was originally posted here by myself: https://kb.paessler.com/en/topic/76639-monitor-your-projectors-and-light-bulbs-with-pjlink

Our challenge:

Projectors are having issues “out of now where” and of course always urgent – IT department didn’t have monitoring on it. Of course, normally you already have a conference going on or it is urgent and the projector might be really down already – most likely due to an end of life light bulb.

What we have:

NEC and Optima projectors – with Ethernet interfaces

Research and work:

We found out that there is a PJLink protocol (http://pjlink.jbmia.or.jp/english/index.html) that is supported by those devices. A little more research and we found a library on GitHub for Visual Studio (C#) (https://github.com/uow-dmurrell/ProjectorControl). We took it, modified the LAMPHOURS so we could get it public (only one lamp for now – but we only have projectors with one lamp). Modified the TEST-Project that comes with it to accept IP addresses as parameter and modified the output in to a PRTG XML format. Further modified the output so it is numeric. (We are not aware that any of that stuff is copyright protected, if so – we apologize and will stop using those components)

Result:

We added a PRTG sensor based on XML data that monitors (advanced EXE/XML) with the IP of the device as parameter and get the following information:

LampHours – we set ours to max. 4000 as error level
CoverStatus (0 OK / 1 ERROR)
FanStatus (0 OK / 1 ERROR)
FilterStatus (0 OK / 1 ERROR)
LampStatus (0 OK / 1 ERROR)
PowerStatus (0 off / 1 on = OK 2 cool down / 3 warm up = WARNING (we don’t get alerts there) 4 unknown = ERROR)

This actually helps us to keep an as close as possible eye on the projectors and being proactive if something is already reported as defect and the LampHours (adjustable, depending on manufacturer/model) are coming close to an issue, so we are ready for it.

Code changes:

ProjectorInfo.cs – added this:

        public int LampHours
        {
            get { return _multiLampHours[0]; }
            set {  }
        }

public int LampHours

{

get { return _multiLampHours[0]; }

set { }

}

Program.cs (or create your own project)

using System;
using rv; 

namespace ConsoleApplication1
{
    class Program
    {
        static void Main(string[] args)
        {
            PJLinkConnection c = new PJLinkConnection(args[0], "rv");

            if (args.Length != 1)
            {
                Console.WriteLine("Wrong arguments detected:");
                foreach(string arg in args)
                {
                    Console.WriteLine(arg);
                }
            }

            ProjectorInfo pi = ProjectorInfo.create(c);

            string powerstatus = "0";
            string fanstatus = "0";
            string lampstatus = "0";
            string coverstatus = "0";
            string filterstatus = "0";

            //PowerStatus:
            //OFF 0
            //ON 1
            //COOLING 2
            //WARMUP 3
            //UNKNOWN 4
            if (pi.PowerStatus.ToString() == "OFF") { powerstatus = "0"; };
            if (pi.PowerStatus.ToString() == "ON") { powerstatus = "1"; };
            if (pi.PowerStatus.ToString() == "COOLING") { powerstatus = "2"; };
            if (pi.PowerStatus.ToString() == "WARMUP") { powerstatus = "3"; };
            if (pi.PowerStatus.ToString() == "UNKNOWN") { powerstatus = "4"; };

            if (pi.FanStatus.ToString() != "OK") { fanstatus = "1"; };
            if (pi.LampStatus.ToString() != "OK") { lampstatus = "1"; };
            if (pi.CoverStatus.ToString() != "OK") { coverstatus = "1"; };
            if (pi.FilterStatus.ToString() != "OK") { filterstatus = "1"; };

            string prtg = "<prtg>\n" +
                "<result><channel>PowerStatus</channel><value>" + powerstatus.ToString() + "</value></result>\n" + 
                "<result><channel>LampHours</channel><value>" + pi.LampHours.ToString() + "</value></result>\n" +
                "<result><channel>FanStatus</channel><value>" + fanstatus.ToString() + "</value></result>\n" +
                "<result><channel>LampStatus</channel><value>" + lampstatus.ToString() + "</value></result>\n" +
                "<result><channel>CoverStatus</channel><value>" + coverstatus.ToString() + "</value></result>\n" +
                "<result><channel>FilterStatus</channel><value>" + filterstatus.ToString() + "</value></result>\n" +
                "</prtg>";

            Console.WriteLine(prtg);

            //Console.ReadKey(); // this is only for debug to pause the output window / stop closing it
        }
    }
}

using System;

using rv;

namespace ConsoleApplication1

{

class Program

{

static void Main(string[] args)

{

PJLinkConnection c = new PJLinkConnection(args[0], "rv");

if (args.Length != 1)

{

Console.WriteLine("Wrong arguments detected:");

foreach(string arg in args)

{

Console.WriteLine(arg);

}

ProjectorInfo pi = ProjectorInfo.create(c);

string powerstatus = "0";

string fanstatus = "0";

string lampstatus = "0";

string coverstatus = "0";

string filterstatus = "0";

//PowerStatus:

//OFF 0

//ON 1

//COOLING 2

//WARMUP 3

//UNKNOWN 4

if (pi.PowerStatus.ToString() == "OFF") { powerstatus = "0"; };

if (pi.PowerStatus.ToString() == "ON") { powerstatus = "1"; };

if (pi.PowerStatus.ToString() == "COOLING") { powerstatus = "2"; };

if (pi.PowerStatus.ToString() == "WARMUP") { powerstatus = "3"; };

if (pi.PowerStatus.ToString() == "UNKNOWN") { powerstatus = "4"; };

if (pi.FanStatus.ToString() != "OK") { fanstatus = "1"; };

if (pi.LampStatus.ToString() != "OK") { lampstatus = "1"; };

if (pi.CoverStatus.ToString() != "OK") { coverstatus = "1"; };

if (pi.FilterStatus.ToString() != "OK") { filterstatus = "1"; };

string prtg = "<prtg>\n" +

"<result><channel>PowerStatus</channel><value>" + powerstatus.ToString() + "</value></result>\n" +

"<result><channel>LampHours</channel><value>" + pi.LampHours.ToString() + "</value></result>\n" +

"<result><channel>FanStatus</channel><value>" + fanstatus.ToString() + "</value></result>\n" +

"<result><channel>LampStatus</channel><value>" + lampstatus.ToString() + "</value></result>\n" +

"<result><channel>CoverStatus</channel><value>" + coverstatus.ToString() + "</value></result>\n" +

"<result><channel>FilterStatus</channel><value>" + filterstatus.ToString() + "</value></result>\n" +

"</prtg>";

Console.WriteLine(prtg);

//Console.ReadKey(); // this is only for debug to pause the output window / stop closing it

}

June 1, 2018 by Florian Rossmark monitoring prtg recommendations scripts

recommendations

Show Drive Letters first in Windows Explorer

Support URL

Support Hours

Support Hours

Support Manufacturer

Hide Drives with no Media

Expand folders to current folder

Fast Boot Enabled

Office 365 – Update Channel

Allow Print Driver Installation

Ensure Outlook is the default mail client

Set Microsoft Teams as the default IM application

Set Microsoft Office to read User information from Active Directory

Disable the Network Sharing Wizard in Windows Explorer

Remove the Network form Windows Explorer

Remove Administrative Tools from the Start Menu

Windows Update Restart Notifications for End Users

Monitoring

The structure example:

Example target file system structure:

The file servers and their preparation:

DFS Root-Server

DFS Department Server

DFS Archive Server

DFS Other Server

The DFS namespace set up and configuration

Note – information about the above example

What are the real benefits of this

Full text search and DFS drive mappings

Recent blog posts

Blog Archives

Tags