solutions

SQL Express SQLState 08001 and Error 17

One of the challenges especially with SQL Express is that you need to enable some protocols on the network level first in order to connect to it. You might see an error message the one below when you try to connect to SQL – stating SQLState 08001 and Error 17.

In order to resolve this, you need to enable named pipes and TCP in the SQL Server Configuration Manager that was installed by default on your system. See the image below on how it should look like. Please note that you need to restart the SQL service in order for those changes to take effect.

Please note – there might be a need of additional configuration like the Windows Firewall or other parameters, the above just addresses a rather common issue.

Microsoft RADIUS / NPS SQL logging

An issue or question I see again and again – proper RADIUS logging with Microsoft NPS / Network Policy Server.

Let’s guide you through a few steps

Install a Microsoft SQL or if not available SQL Express
1. be aware – SQL Express has very tight database size limits and no SQL Agent – this might be an issue
Create a new database via SQL Management Studio in the SQL server
1. name it e.g. RADIUSLogging
run the SQL script from this Microsoft website in a new query window against this database (make sure it is not run against any other database by accident)
1. you could add a line like USE RADIUSLogging to prevent this – in the very top…
configure your RADIUS server to log to this SQL server and database
make sure you have fail-over logging to a text-file – to avoid issues in case your SQL DB grew to big or was not reachable for any reason
1. decide in the text-file configuration if you want to deny access if there is an issue or if you still want to proceed with the logon

Now you have RADIUS logging the information to a SQL database – actually a single table – and you can dig around in it. The IT-Assets database provides a front-end example for this – you don’t need to use it – but it might be of help – see here.

To interpret all those columns and values – look at the following links for additional information:

You will face the issue that the database will grow rapidly – depending on how many requests go to your RADIUS system etc… Keep an close eye on it – use a monitoring software like Paessler / PRTG to monitor the size and keep in mind that SQL Express might have size limits like 10 GB. The full version of Microsoft SQL has no such limits and further can you use SQL Agent to execute tasks. The following script can help you purging data from the RADIUS database to keep its size under control. You can use SQL Agent (not in SQL Express) to run it automatically or if you use SQL Express either run it manually or with another solution somehow automatically against the database delete older entries.

The script actually will purge data older then 14 days – you can adjust the days to your liking / needs.

DELETE FROM dbo.accounting_data
where datediff(day,dbo.accounting_data.timestamp,getdate()) >14

1 2	DELETE FROM dbo.accounting_data where datediff(day,dbo.accounting_data.timestamp,getdate()) >14

September 6, 2018 by Florian Rossmark configuration recommendations security server solutions

Updated domain join script including KeePass / Pleasant Password server entries for local admins

ns a website from a systems administrator for systems administrators Home IT-Admins CMDB IT-Admins tool IT Search EOL Solutions Blog Contact Links Updated domain join script including KeePass / Pleasant Password server entries for local admins

Today I post an updated version of the domain-join script I initially posted here.

In theory you can just replace the script with the new version – assuming you did not make any changes other then adjusting it to your domain / server-names.

What changed in the newer version:

the top lines in the script hold the basic configuration parameters
- line 1: NetBIOS name of your Active Directory domain
- line 2: your DNS domain name
- line 3: your distinguished domain name / root DN of your domain
- line 4: your default OU for new workstations
- line 5: empty
- line 6: KeePass / Pleasant Password Server URL
- line 7: KeePass folder to store the password in
the script now relies on the above parameters rather then specifying them in various areas in the script, making the whole use / adjustment of the script way easier
advanced error handling
- after the user entered the computer name and his domain admin credentials the systems checks if it can connect to the domain and if the computer name already exists
  - if the domain credentials are invalid (can be a non-admin – as long they are valid) you get a message explaining that the script will stop due to wrong credentials
  - if the computer name already exists in the domain, you get a message about it and the script stops
- KeePass or Pleasant Password Server connection – if it fails to connect with the credentials provided, you get a message about it and the script will stop
adjusted messages with various colours
- white text – standard as it was before
- yellow text – highlighted information so it sticks better out for the end-user
- magenta text – handled error / failure message – this is an explanation that something stopped the script from going further
- red text – those are real PowerShell error messages – either due to not handled errors or if the error was handled plotted out to the screen as additional reference and help

For additional information, please look at the original post here.

This script is also mentioned on the API Examples page on the Pleasant Solutions web site here.

$MyDomainNetBIOS="CONTOSO"
$MyDomain="contoso.local"
$MyDomainDN="dc=contoso,dc=local"
$MyDomainOU="OU=Computers,OU=USA,DC=contoso,DC=local"

$KeepassURL = "https://pwdbserver01v.contoso.local:10001"
$PWFolder = "Local Admins"

$ScriptVersion = "1.4 - 9/5/2018 - Florian Rossmark"
Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Welcome to the Domain-Join script"
Write-Host "================================="
Write-Host ""
Write-Host ""
Write-Host "This script will do the following Steps:"
Write-Host "----------------------------------------"
Write-Host "- You enter the Computer Name / Host Name" -ForegroundColor Yellow
Write-Host "- You enter Domain Admin credentials for a Domain-Join" -ForegroundColor Yellow
Write-Host "- You enter credentials to access KeyPass Password server" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Note: always type credentials without any domain-information ($MyDomainNetBIOS\) - the script will fail otherwise."
Write-Host ""
Write-Host ""
Write-Host ""
Write-Host "- The script will automatically create a KeyPass entry with all information" -ForegroundColor Yellow
Write-Host "- The script will automatically create a specific local admin account for this machine" -ForegroundColor Yellow
Write-Host "- The script will automatically rename the system to the given name" -ForegroundColor Yellow
Write-Host "- The script will automatically join the system to the domain $MyDomain" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Script Version: $ScriptVersion"
Write-Host ""
Write-Host ""
pause

#Upper area holds functions..
Function MakeUp-String([Int]$Size = 8, [Char[]]$CharSets = "ULNS", [Char[]]$Exclude) {
    $Chars = @(); $TokenSet = @()
    If (!$TokenSets) {$Global:TokenSets = @{
        U = [Char[]]'ABCDEFGHJKLMNPQRSTUVWXYZ'                                #Upper case
        L = [Char[]]'abcdefghijkmnpqrstuvwxyz'                                #Lower case
        N = [Char[]]'23456789'                                                #Numerals
        S = [Char[]]'!@$!@$!@$!@$'                         #Symbols
    }}
    $CharSets | ForEach {
        $Tokens = $TokenSets."$_" | ForEach {If ($Exclude -cNotContains $_) {$_}}
        If ($Tokens) {
            $TokensSet += $Tokens
            If ($_ -cle [Char]"Z") {$Chars += $Tokens | Get-Random}             #Character sets defined in upper case are mandatory
        }
    }
    While ($Chars.Count -lt $Size) {$Chars += $TokensSet | Get-Random}
    ($Chars | Sort-Object {Get-Random}) -Join ""                                #Mix the (mandatory) characters and output string
}; 
#avoid certificate issues
Add-Type @"
    using System;
    using System.Net;
    using System.Net.Security;
    using System.Security.Cryptography.X509Certificates;
    public class ServerCertificateValidationCallback
    {
        public static void Ignore()
        {
            ServicePointManager.ServerCertificateValidationCallback += 
                delegate
                (
                    Object obj, 
                    X509Certificate certificate, 
                    X509Chain chain, 
                    SslPolicyErrors errors
                )
                {
                    return true;
                };
        }
    }
"@
[ServerCertificateValidationCallback]::Ignore();

#Script starts here...
Clear-Host
Write-Host ""
Write-Host ""
Write-Host "This script must be executed in a power-shell with elevated rights!" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Stop the script with: CTRL + C any time..."
Write-Host ""
Write-Host ""
Pause
Clear-Host

$ComputerName = Read-Host "Please enter new Computer Name"
$DomainJoinCredentials = Get-Credential -Message "Enter your credentials for the domain join ($MyDomainNetBIOS) without the domain part"

Try{
    $ADSISearcherDE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$MyDomain",$($DomainJoinCredentials.UserName),$($DomainJoinCredentials.GetNetworkCredential().password))
    $ADSISearcher = New-Object System.DirectoryServices.DirectorySearcher($ADSISearcherDE,"(&(objectCategory=Computer)(name=$ComputerName))")
    $ADSISearcherResults = $ADSISearcher.FindAll()
    if ($ADSISearcherResults.Count -gt 0)
    {
        Clear-Host
        Write-Host ""
        Write-Host ""
        Write-Host "Computer account with this name '$ComputerName' already exists in the domain '$MyDomain'." -ForegroundColor Magenta
        Write-Host ""
        Write-Host ""
        Write-Host "You need to delete the account first or make sure you entered the right name." -ForegroundColor Magenta
        Write-Host ""
        Write-Host ""
        Write-Host "Script will stop now." -ForegroundColor Magenta
        Write-Host ""
        Write-Host ""
        Pause
        Exit
    }
} Catch {
    Clear-Host
    Write-Host ""
    Write-Host ""
    Write-Host "Your Domain Admin credentials where wrong." -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host "Script will stop now." -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host ""
    Write-Host "================================================================================================================"
    Write-Host "Error Details:"
    Write-Host "=============="
    write-host "Caught exception:" -ForegroundColor Red
    write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red
    write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red
    Write-Host "================================================================================================================"
    Write-Host ""
    Write-Host ""
    Pause
    Exit
}

$KeePassCredentials = Get-Credential -Message “Enter your credentials to access Keepass Server without the domain part” 
$localAdminUser = $("$ComputerName" + "_Admin")
$PW = MakeUp-String(12)
$PWencrypted = ConvertTo-SecureString $PW -AsPlainText -Force

Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Checking KeePass to see if those credentials already exist"
Write-Host ""
Write-Host ""

#Collecting MACs
$colMACItems = get-wmiobject Win32_NetworkAdapter | Where-Object {$_.MACAddress -like "*:*"}
foreach ($objMACItem in $colMACItems) {  
    $MACobj = $objMACItem |select Description,MACAddress   
    $MACs += $MACobj.MACAddress + " - " + $MACobj.Description + "
"
}
#Collecting SN/ServiceTag and HW information
$SN = "ServiceTag / SN: "+(Get-WmiObject win32_bios | select SerialNumber).SerialNumber
$Model = "Model: "+(Get-WmiObject win32_computersystem | select Model).Model
$Manufacturer = "Manufacturer: "+(Get-WmiObject win32_computersystem | select Manufacturer).Manufacturer
$UEFIKey = wmic path softwarelicensingservice get OA3xOriginalProductKey
$PWName = "Individual Admin Account on $ComputerName"
$PWUser = $localAdminUser
$PWPassword = $PW
$PWDescription = "Hardware information:
=====================
$Manufacturer
$Model
$SN

UEFI BIOS Windows Key:
======================
$UEFIKey

Known MAC Addresses:
====================
$MACs
(MACs might be subject to change with Docking-Stations)"

$tokenParams = @{
    grant_type='password';
    username=$KeePassCredentials.UserName;
    password=$KeePassCredentials.GetNetworkCredential().password;}

Try{
    $JSON = Invoke-WebRequest -Uri "$KeepassURL/OAuth2/Token" -Method POST -Body $tokenParams -ContentType "application/x-www-form-urlencoded" -UseBasicParsing 
    $Token = (ConvertFrom-Json $JSON.Content).access_token
} Catch {
    Clear-Host
    Write-Host ""
    Write-Host ""
    Write-Host "Your KeePass credentials did not work." -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host "Script will stop now." -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host ""
    Write-Host "================================================================================================================"
    Write-Host "Error Details:"
    Write-Host "=============="
    write-host "Caught exception:" -ForegroundColor Red
    write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red
    write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red
    Write-Host "================================================================================================================"
    Write-Host ""
    Write-Host ""
    Pause
    Exit
}

$headers = @{
    "Accept" = "application/json"
    "Authorization" = "$Token"}
    
$GroupSearch = @{“search” = $PWFolder}
$Group = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $GroupSearch) -Headers $headers -ContentType 'application/json' -UseBasicParsing
$GroupID = $Group.Groups.Id

$SearchPhrase = $PWUser
$searchbody = @{“search” = $SearchPhrase}
$Search = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $searchbody) -Headers $headers -ContentType 'application/json' -UseBasicParsing
$SearchID = $Search.Credentials.Id

$KeePassResultscnt = 0
ForEach($Result in $Search.credentials)
{
    $CredentialID = $Result.id
    If ($Result.GroupId -eq $GroupID)
    {
        $KeePassResultscnt += 1
    }        
}
If ($KeePassResultscnt -ge 1)
{
    Write-Host "Total number of results found: $cnt" -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host "ALERT - KeePass already has credentials for this system - can not proceed." -ForegroundColor Magenta
    Write-Host "==========================================================================" -ForegroundColor Magenta
    Write-Host ""
    Write-Host "Search-Phrase: $SearchPhrase" -ForegroundColor Magenta
    Write-Host "Search-Folder: $PWFolder" -ForegroundColor Magenta
    Write-Host "Amount of results found: $KeePassResultscnt" -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host ""
    Write-Host "Next Steps:" -ForegroundColor Magenta
    Write-Host "===========" -ForegroundColor Magenta
    Write-Host "- This script will exit now!" -ForegroundColor Magenta
    Write-Host "- No changes to the system of KeePass have been applied" -ForegroundColor Magenta
    Write-Host "- Go to KeePass and check if this is an old entry and can be renamed/moved" -ForegroundColor Magenta
    Write-Host "- Execute the script again" -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    pause
    EXIT
} Else {
    Write-Host ""
    Write-Host ""
    Write-Host "Writing new credentials to the KeePass server/database"
    Write-Host ""
    Write-Host ""
    $PWEntryDT = Get-Date -Format "O"
    $CredEntry = @{
        Id = "00000000-0000-0000-0000-000000000000"
        Name = "$PWName"
        Username = "$PWUser"
        Password = "$PWPassword"
        Created = "$PWEntryDT"
        Modified = "$PWEntryDT"
        GroupId = "$GroupID"
        Notes = "$PWDescription"
        Url = "$ComputerName"
    }
    Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/credential/00000000-0000-0000-0000-000000000000"-body @(ConvertTo-Json $CredEntry) -Headers $headers -ContentType 'application/json' -UseBasicParsing
    Write-Host ""
    Write-Host ""
    Write-Host "Finished writing to KeePass server/database"
    Write-Host ""
    Write-Host ""
}
pause

Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Please check the following information:"
Write-Host "======================================="
Write-Host ""
Write-Host "Computer Name: $ComputerName" -ForegroundColor Yellow
Write-Host "local Admin: $localAdminUser" -ForegroundColor Yellow
Write-Host "Admin-PW: $PW" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Make sure the information above are correct!"
Write-Host ""
Write-Host ""
Write-Host "Verify the local Admin and Admin-PW in KeePass!" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
pause
Write-Host ""
Write-Host ""
Write-Host "All information are verified?"
Write-Host ""
Write-Host ""
pause

Clear-Host
Write-Host "Checking and removing (if exists) old local user: $localAdminUser"
Get-LocalUser -Name $localAdminUser | Remove-LocalUser 
Clear-Host
Write-Host "Adding new local administrator account: $localAdminUser"
New-LocalUser -Name $localAdminUser -Password $PWencrypted -AccountNeverExpires -PasswordNeverExpires -Description "System specific local administrator account"
$NewUser = Get-LocalUser -Name $localAdminUser
$AdminGroup = Get-LocalGroup -Name "Administrators"
Add-LocalGroupMember -Name $AdminGroup -Member $NewUser

Write-Host ""
Write-Host ""
Write-Host "Finished."
Write-Host ""
Write-Host ""
pause

Write-Host ""
Write-Host ""
Write-Host "Joining this system to the domain and reboot automatically - stay put" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Note: The system will not reboot if an error occurs. Check the error message in case you see an error." -ForegroundColor Yellow
Write-Host ""
Write-Host ""

Try{
    Add-Computer -Domain $MyDomain -Credential $DomainJoinCredentials -NewName $ComputerName -Restart -Force -OUPath $MyDomainOU
} Catch {
    Write-Host ""
    Write-Host ""
    Write-Host "Domain-Join did not work - Error:" -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host ""
    Write-Host "================================================================================================================"
    Write-Host "Error Details:"
    Write-Host "=============="
    write-host "Caught exception:" -ForegroundColor Red
    write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red
    write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red
    Write-Host "================================================================================================================"
    Write-Host ""
    Write-Host ""
    Pause
} Finally {
    Exit
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

$MyDomainNetBIOS="CONTOSO"

$MyDomain="contoso.local"

$MyDomainDN="dc=contoso,dc=local"

$MyDomainOU="OU=Computers,OU=USA,DC=contoso,DC=local"

$KeepassURL = "https://pwdbserver01v.contoso.local:10001"

$PWFolder = "Local Admins"

$ScriptVersion = "1.4 - 9/5/2018 - Florian Rossmark"

Clear-Host

Write-Host ""

Write-Host "Welcome to the Domain-Join script"

Write-Host "================================="

Write-Host ""

Write-Host "This script will do the following Steps:"

Write-Host "----------------------------------------"

Write-Host "- You enter the Computer Name / Host Name" -ForegroundColor Yellow

Write-Host "- You enter Domain Admin credentials for a Domain-Join" -ForegroundColor Yellow

Write-Host "- You enter credentials to access KeyPass Password server" -ForegroundColor Yellow

Write-Host ""

Write-Host "Note: always type credentials without any domain-information ($MyDomainNetBIOS\) - the script will fail otherwise."

Write-Host ""

Write-Host "- The script will automatically create a KeyPass entry with all information" -ForegroundColor Yellow

Write-Host "- The script will automatically create a specific local admin account for this machine" -ForegroundColor Yellow

Write-Host "- The script will automatically rename the system to the given name" -ForegroundColor Yellow

Write-Host "- The script will automatically join the system to the domain $MyDomain" -ForegroundColor Yellow

Write-Host ""

Write-Host "Script Version: $ScriptVersion"

Write-Host ""

pause

#Upper area holds functions..

Function MakeUp-String([Int]$Size = 8, [Char[]]$CharSets = "ULNS", [Char[]]$Exclude) {

$Chars = @(); $TokenSet = @()

If (!$TokenSets) {$Global:TokenSets = @{

U = [Char[]]'ABCDEFGHJKLMNPQRSTUVWXYZ' #Upper case

L = [Char[]]'abcdefghijkmnpqrstuvwxyz' #Lower case

N = [Char[]]'23456789' #Numerals

S = [Char[]]'!@$!@$!@$!@$' #Symbols

}}

$CharSets | ForEach {

$Tokens = $TokenSets."$_" | ForEach {If ($Exclude -cNotContains $_) {$_}}

If ($Tokens) {

$TokensSet += $Tokens

If ($_ -cle [Char]"Z") {$Chars += $Tokens | Get-Random} #Character sets defined in upper case are mandatory

}

While ($Chars.Count -lt $Size) {$Chars += $TokensSet | Get-Random}

($Chars | Sort-Object {Get-Random}) -Join "" #Mix the (mandatory) characters and output string

};

#avoid certificate issues

Add-Type @"

using System;

using System.Net;

using System.Net.Security;

using System.Security.Cryptography.X509Certificates;

public class ServerCertificateValidationCallback

{

public static void Ignore()

{

ServicePointManager.ServerCertificateValidationCallback +=

delegate

(

Object obj,

X509Certificate certificate,

X509Chain chain,

SslPolicyErrors errors

)

{

return true;

};

}

[ServerCertificateValidationCallback]::Ignore();

#Script starts here...

Clear-Host

Write-Host ""

Write-Host "This script must be executed in a power-shell with elevated rights!" -ForegroundColor Yellow

Write-Host ""

Write-Host "Stop the script with: CTRL + C any time..."

Write-Host ""

Pause

Clear-Host

$ComputerName = Read-Host "Please enter new Computer Name"

$DomainJoinCredentials = Get-Credential -Message "Enter your credentials for the domain join ($MyDomainNetBIOS) without the domain part"

Try{

$ADSISearcherDE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$MyDomain",$($DomainJoinCredentials.UserName),$($DomainJoinCredentials.GetNetworkCredential().password))

$ADSISearcher = New-Object System.DirectoryServices.DirectorySearcher($ADSISearcherDE,"(&(objectCategory=Computer)(name=$ComputerName))")

$ADSISearcherResults = $ADSISearcher.FindAll()

if ($ADSISearcherResults.Count -gt 0)

{

Clear-Host

Write-Host ""

Write-Host "Computer account with this name '$ComputerName' already exists in the domain '$MyDomain'." -ForegroundColor Magenta

Write-Host ""

Write-Host "You need to delete the account first or make sure you entered the right name." -ForegroundColor Magenta

Write-Host ""

Write-Host "Script will stop now." -ForegroundColor Magenta

Write-Host ""

Pause

Exit

}

} Catch {

Clear-Host

Write-Host ""

Write-Host "Your Domain Admin credentials where wrong." -ForegroundColor Magenta

Write-Host ""

Write-Host "Script will stop now." -ForegroundColor Magenta

Write-Host ""

Write-Host "================================================================================================================"

Write-Host "Error Details:"

Write-Host "=============="

write-host "Caught exception:" -ForegroundColor Red

write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red

write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red

Write-Host "================================================================================================================"

Write-Host ""

Pause

Exit

}

$KeePassCredentials = Get-Credential -Message “Enter your credentials to access Keepass Server without the domain part”

$localAdminUser = $("$ComputerName" + "_Admin")

$PW = MakeUp-String(12)

$PWencrypted = ConvertTo-SecureString $PW -AsPlainText -Force

Clear-Host

Write-Host ""

Write-Host "Checking KeePass to see if those credentials already exist"

Write-Host ""

#Collecting MACs

$colMACItems = get-wmiobject Win32_NetworkAdapter | Where-Object {$_.MACAddress -like "*:*"}

foreach ($objMACItem in $colMACItems) {

$MACobj = $objMACItem |select Description,MACAddress

$MACs += $MACobj.MACAddress + " - " + $MACobj.Description + "

}

#Collecting SN/ServiceTag and HW information

$SN = "ServiceTag / SN: "+(Get-WmiObject win32_bios | select SerialNumber).SerialNumber

$Model = "Model: "+(Get-WmiObject win32_computersystem | select Model).Model

$Manufacturer = "Manufacturer: "+(Get-WmiObject win32_computersystem | select Manufacturer).Manufacturer

$UEFIKey = wmic path softwarelicensingservice get OA3xOriginalProductKey

$PWName = "Individual Admin Account on $ComputerName"

$PWUser = $localAdminUser

$PWPassword = $PW

$PWDescription = "Hardware information:

=====================

$Manufacturer

$Model

$SN

UEFI BIOS Windows Key:

======================

$UEFIKey

Known MAC Addresses:

====================

$MACs

(MACs might be subject to change with Docking-Stations)"

$tokenParams = @{

grant_type='password';

username=$KeePassCredentials.UserName;

password=$KeePassCredentials.GetNetworkCredential().password;}

Try{

$JSON = Invoke-WebRequest -Uri "$KeepassURL/OAuth2/Token" -Method POST -Body $tokenParams -ContentType "application/x-www-form-urlencoded" -UseBasicParsing

$Token = (ConvertFrom-Json $JSON.Content).access_token

} Catch {

Clear-Host

Write-Host ""

Write-Host "Your KeePass credentials did not work." -ForegroundColor Magenta

Write-Host ""

Write-Host "Script will stop now." -ForegroundColor Magenta

Write-Host ""

Write-Host "================================================================================================================"

Write-Host "Error Details:"

Write-Host "=============="

write-host "Caught exception:" -ForegroundColor Red

write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red

write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red

Write-Host "================================================================================================================"

Write-Host ""

Pause

Exit

}

$headers = @{

"Accept" = "application/json"

"Authorization" = "$Token"}

$GroupSearch = @{“search” = $PWFolder}

$Group = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $GroupSearch) -Headers $headers -ContentType 'application/json' -UseBasicParsing

$GroupID = $Group.Groups.Id

$SearchPhrase = $PWUser

$searchbody = @{“search” = $SearchPhrase}

$Search = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $searchbody) -Headers $headers -ContentType 'application/json' -UseBasicParsing

$SearchID = $Search.Credentials.Id

$KeePassResultscnt = 0

ForEach($Result in $Search.credentials)

{

$CredentialID = $Result.id

If ($Result.GroupId -eq $GroupID)

{

$KeePassResultscnt += 1

}

If ($KeePassResultscnt -ge 1)

{

Write-Host "Total number of results found: $cnt" -ForegroundColor Magenta

Write-Host ""

Write-Host "ALERT - KeePass already has credentials for this system - can not proceed." -ForegroundColor Magenta

Write-Host "==========================================================================" -ForegroundColor Magenta

Write-Host ""

Write-Host "Search-Phrase: $SearchPhrase" -ForegroundColor Magenta

Write-Host "Search-Folder: $PWFolder" -ForegroundColor Magenta

Write-Host "Amount of results found: $KeePassResultscnt" -ForegroundColor Magenta

Write-Host ""

Write-Host "Next Steps:" -ForegroundColor Magenta

Write-Host "===========" -ForegroundColor Magenta

Write-Host "- This script will exit now!" -ForegroundColor Magenta

Write-Host "- No changes to the system of KeePass have been applied" -ForegroundColor Magenta

Write-Host "- Go to KeePass and check if this is an old entry and can be renamed/moved" -ForegroundColor Magenta

Write-Host "- Execute the script again" -ForegroundColor Magenta

Write-Host ""

pause

EXIT

} Else {

Write-Host ""

Write-Host "Writing new credentials to the KeePass server/database"

Write-Host ""

$PWEntryDT = Get-Date -Format "O"

$CredEntry = @{

Id = "00000000-0000-0000-0000-000000000000"

Name = "$PWName"

Username = "$PWUser"

Password = "$PWPassword"

Created = "$PWEntryDT"

Modified = "$PWEntryDT"

GroupId = "$GroupID"

Notes = "$PWDescription"

Url = "$ComputerName"

}

Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/credential/00000000-0000-0000-0000-000000000000"-body @(ConvertTo-Json $CredEntry) -Headers $headers -ContentType 'application/json' -UseBasicParsing

Write-Host ""

Write-Host "Finished writing to KeePass server/database"

Write-Host ""

}

pause

Clear-Host

Write-Host ""

Write-Host "Please check the following information:"

Write-Host "======================================="

Write-Host ""

Write-Host "Computer Name: $ComputerName" -ForegroundColor Yellow

Write-Host "local Admin: $localAdminUser" -ForegroundColor Yellow

Write-Host "Admin-PW: $PW" -ForegroundColor Yellow

Write-Host ""

Write-Host "Make sure the information above are correct!"

Write-Host ""

Write-Host "Verify the local Admin and Admin-PW in KeePass!" -ForegroundColor Yellow

Write-Host ""

pause

Write-Host ""

Write-Host "All information are verified?"

Write-Host ""

pause

Clear-Host

Write-Host "Checking and removing (if exists) old local user: $localAdminUser"

Get-LocalUser -Name $localAdminUser | Remove-LocalUser

Clear-Host

Write-Host "Adding new local administrator account: $localAdminUser"

New-LocalUser -Name $localAdminUser -Password $PWencrypted -AccountNeverExpires -PasswordNeverExpires -Description "System specific local administrator account"

$NewUser = Get-LocalUser -Name $localAdminUser

$AdminGroup = Get-LocalGroup -Name "Administrators"

Add-LocalGroupMember -Name $AdminGroup -Member $NewUser

Write-Host ""

Write-Host "Finished."

Write-Host ""

pause

Write-Host ""

Write-Host "Joining this system to the domain and reboot automatically - stay put" -ForegroundColor Yellow

Write-Host ""

Write-Host "Note: The system will not reboot if an error occurs. Check the error message in case you see an error." -ForegroundColor Yellow

Write-Host ""

Try{

Add-Computer -Domain $MyDomain -Credential $DomainJoinCredentials -NewName $ComputerName -Restart -Force -OUPath $MyDomainOU

} Catch {

Write-Host ""

Write-Host "Domain-Join did not work - Error:" -ForegroundColor Magenta

Write-Host ""

Write-Host "================================================================================================================"

Write-Host "Error Details:"

Write-Host "=============="

write-host "Caught exception:" -ForegroundColor Red

write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red

write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red

Write-Host "================================================================================================================"

Write-Host ""

Pause

} Finally {

Exit

}

September 6, 2018 by Florian Rossmark recommendations scripts server solutions web

How to create an independent backup network

Today we look at independent backup networks especially in regards to LTO 7 and VMware ESX hosts. Be aware – this very example also applies to any backup to disk (B2D / Backup-2-Disk) solution. But a good reseller / vendor would inform you about this right away anyways.

LTO 7 and later like LTO 8 drives have a write speed faster then a 1 GBit network can handle, making it now really necessary to think about options. On top of it, you do not want to over utilize the LAN side of your servers so that the impact on the user / application facing side stays minimal. This leaves you with two options, you can group switch ports assuming you have enough 1 GB ports and use them, you will need at least 3 ports combined, or you create a whole backup network on a 10 GB basis.

Let’s run some numbers:

LTO7 has a write speed of about 300 MB/s uncrompressed and up to 750 MB/s compressed
LTO8 (L8) has a write speed of about 360 MB/s uncrompressed and up to 900 MB/s compressed

Now – your network connection is meassured in MBit/s not MByte/s. Byte to bit is 8 bit are one byte, so we need to multiply those speeds in byte with 8 bit too see the network speed numbers.

LTO7 uncrompressed = 300MB/s * 8 = 2400 MBit/s
LTO7 compressed = 750MB/s * 8 = 6000 MBit/s

LTO8 uncrompressed = 360MB/s * 8 = 2880 MBit/s
LTO8 compressed = 900MB/s * 8 = 7200 MBit/s

Assuming you want to go with grouped ports, you see that with LTO7 you would need 6 ports and LTO8 7 to 8 ports to fully utilize the speed and minimize your backup window. Additionally think about the read speed that might affect you as well – not just for recovery but for the verify of your backup.

Now – this means – add at least one 10 GB switch and one 10 GB NIC to each server – let’s do this with an example:

3x VMware ESX hosts – LAN side and management is configured 1 GB – we assume there is some kind of storage behind them that has the iOPS and speed we need like an SSD based storage
1x Backup media server that has an LTO7 or LTO8 drive connected – 1 GB on the LAN side

What we need – minimal:

4x 10 GB NICs
1x 10 GB switch
4x CAT6e or CAT7 cables

What I would recommend – nice to have:

4x 10 GB NICs – dual port
2x 10 GB switches
10x CAT7 cables – 2x to stack/trunk the switches if not stacked otherwise

This is a nice to have – a fail-over, but the minimal configuration is sufficient as well.

Cable this all in – create a new IP-scope / VLAN on the backup side – you do not need any default Gateway etc. on the Backup-Network side (10 GB). Just an independent IP scope and have every host assigned a static address.

This keeps the regular network traffic and any broadcasts away from this network and your backup will run totally independent. You might need to disable your anti-virus solution on this NIC / IP-scope on the backup media server as well, cause it might actually influence the speed quite drastically. Having it separated and independent helps keeping the security up.

On the VMware hosts – I like to even allow VMware to vMotion on this backup-LAN – simply because it is extremely efficient there – independent from your LAN and if you have it from your iSCSI network as well. But that’s just an idea.

Now – the backup – how will it grab the data from the 10 GB side of your VMware hosts – especially if you have a vSphere cluster and grab the backup through the cluster?

Simple – you adjust the hosts file on your media server. Each and every VMware host needs to be listed in the hosts-file on the media server with the IP that it has in your 10 GB backup network. This way DNS and everything will act normal in your environment, only the backup-media server will reach out to those hosts on the 10 GB network due to the IP resolution of those hosts. This is the easiest way to accomplish this.

You will not to add a 10 GB connection, backup-network IP address etc. to your VMware vSphere controller – it can stay on your LAN or server-management network as is. This also means there is no reason to mention him in the hosts file on the media server.

How this works:
your backup will contact the vSphere controller on the LAN side
it will then be redirected to the host that currently holds the VM you want to backup
the media server now will contact the VMware host directly – due to the hosts-file entry on the 10 GB backup-network
backup will process…

This of course would work with a physical server as well – like a physical file-server etc. – though, today this is rather rare and especially VMware backups are actually large files that benefit most from the LTO7 write speed so the above makes sense there most. It wouldn’t matter if you do the same to an Hyper-V environment or any other VM host/guest solution. In theory it should always work the same.

What real world write speeds can you expect?
This is the big question – here are some real world examples of this – those are single jobs on per VM basis, meaning it includes even the tape-load and tape-unload processing time and udpating the catalogs while using Veritas Backup Exec.

Backup size (VM size)	elapsed time in minutes	job rate write/overall	job rate verify
4 TB	6:47	17,227 MB/min	26,404 MB/min
2 TB	6:47	6,822 MB/min	22,233 MB/min
1.21 TB	3:49	8,271 MB/min	20,235 MB/min
147 GB	0:33	6,491 MB/min	22,655 MB/min
138 GB	0:17	18,403 MB/min	27,726 MB/min
25 GB	0:10	9,172 MB/min	20,700 MB/min

The above list is just an example – realistically we see speeds between about 3,000 MB/min to 18,000 MB/min as for the overall speed. This is due to the VM itself for some part – thin or thick provisioned, what kind of data is it holding, how busy is the host cause we might double trouble him due to multiple drives doing backups at the same time to the same host etc… In average we see around 8,000 to 9,000 MB/min in speed, what is still great – and I wanted to show as well that it can vary quite a bit so don’t be scared. We still did improve the time the backup took from going from an LTO4 LAN based backup scenario to an LTO7 independent backup network while cutting the time in half, actually, even less then half. The slowest speeds we see today are due to systems that can only be backed up on the LAN side, while the ports are grouped there but we still don’t have the same speed as we see on the backup-network side. Many factors come in play but that all depends on the individual situation.

Hoping the information above helps some of you out there – keep in mind that your situation might be different, run some examples and ideas and if you have questions, reach out – this remains an example of what I really implemented at a company and how it affected the backup configuration and management.

September 4, 2018 by Florian Rossmark configuration recommendations solutions

WDS respective PXE boot and VMware

If you try to PXE boot a VMware guest system that e.g. uses WDS / Windows Deployment Services or similar, you might encounter that the boot.wim etc. download unbelievable slow. This can take several hours. This has especially to do with booting via the VMware EFI environment. VMware BIOS does not cause this issue. You could switch a EFI system to BIOS to capture/deploy the image – but this is not really a solution rather then bypassing it.

The solution for this is pretty simple, while the download is transferred through a TFTP, VMware has an issue with the blocksize and this gets a bit messed up due to the variable blocksize between the VM guest system and your PXE server.

Set the Maximum Block Size to 1456 – what is the exact value VMware needs to work properly. Disable further the Variable Window Extension and try to PXE boot again – you will see it will load in about a minute now – depending on your WinPE image size and your issues are in the past.

In detail:

open your Windows Deployment Services
right click on the server and select Properties
navigate to the register card TFTP
set the Maximum Block Size to 1456
uncheck the Enable Variable Window Extension checkbox

August 24, 2018 by Florian Rossmark configuration server solutions

Gathering profile information from computer

Every now an then you might need to know who logged on and when was the last logon of which user to a specific workstation as well as the size of each user profile. For this I once wrote the PowerShell script you can find below. It does a WMI query against a list of one or more target computers and reads out the information reporting it back.

As input parameter use a comma separated list of computer names – those must be reachable and administrative accessible (you need at least admin rights on the target system). You then get a output set per profile.

The output can e.g. be transformed with the parameter |ft to see it in table format – like typical in PowerShell.

Output values are:

ComputerName
ProfileName
ProfilePath
ProfileType
- Temporary
- Roaming
- Mandatory
- Corrupted
- local
IsinUse
IsSystemAccount
Size
- this needs to most processing time – it is a manual size check including even temp files.. – other then what Windows shows you
LastUseTime

[cmdletbinding()]
[cmdletbinding()]
param (
[parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
[string[]]$ComputerName = $env:computername
)            
 
foreach ($Computer in $ComputerName) {
 $Profiles = Get-WmiObject -Class Win32_UserProfile -Computer $Computer -ea 0
 foreach ($profile in $profiles) {
  try {
      $objSID = New-Object System.Security.Principal.SecurityIdentifier($profile.sid)
      $objuser = $objsid.Translate([System.Security.Principal.NTAccount])
      $objusername = $objuser.value
  } catch {
        $objusername = $profile.sid
  }
  switch($profile.status){
   1 { $profileType="Temporary" }
   2 { $profileType="Roaming" }
   4 { $profileType="Mandatory" }
   8 { $profileType="Corrupted" }
   default { $profileType = "LOCAL" }
  }
  $size = 0
  try{
    $profilepath=$profile.localpath -replace "C:","\\$Computer\C$"
    $size=(dir $profilepath -recurse -force -ea silentlycontinue | Measure-Object ‘length’ -sum -Maximum).sum
    $size=[math]::Round(($size/1GB),2)
    #$size={{0:n2} -f $size}
    $size2=[string]::Format("{0:0.00} GB", $size)
  } catch {
    $size = -1
  }

  $User = $objUser.Value
  try {
	$ProfileLastUseTime = ([WMI]"").Converttodatetime($profile.lastusetime)
  } catch {
	$ProfileLastUseTime = ""
  }
  $OutputObj = New-Object -TypeName PSobject
  $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.toUpper()
  $OutputObj | Add-Member -MemberType NoteProperty -Name ProfileName -Value $objusername
  $OutputObj | Add-Member -MemberType NoteProperty -Name ProfilePath -Value $profile.localpath
  $OutputObj | Add-Member -MemberType NoteProperty -Name ProfileType -Value $ProfileType
  $OutputObj | Add-Member -MemberType NoteProperty -Name IsinUse -Value $profile.loaded
  $OutputObj | Add-Member -MemberType NoteProperty -Name IsSystemAccount -Value $profile.special
  $OutputObj | Add-Member -MemberType NoteProperty -Name Size -Value $size2
  $OutputObj | Add-Member -MemberType NoteProperty -Name LastUseTime -Value $ProfileLastUseTime
  $OutputObj
  
 }
}

[cmdletbinding()]

param (

[parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]

[string[]]$ComputerName = $env:computername

)

foreach ($Computer in $ComputerName) {

$Profiles = Get-WmiObject -Class Win32_UserProfile -Computer $Computer -ea 0

foreach ($profile in $profiles) {

try {

$objSID = New-Object System.Security.Principal.SecurityIdentifier($profile.sid)

$objuser = $objsid.Translate([System.Security.Principal.NTAccount])

$objusername = $objuser.value

} catch {

$objusername = $profile.sid

}

switch($profile.status){

1 { $profileType="Temporary" }

2 { $profileType="Roaming" }

4 { $profileType="Mandatory" }

8 { $profileType="Corrupted" }

default { $profileType = "LOCAL" }

}

$size = 0

try{

$profilepath=$profile.localpath -replace "C:","\\$Computer\C$"

$size=(dir $profilepath -recurse -force -ea silentlycontinue | Measure-Object ‘length’ -sum -Maximum).sum

$size=[math]::Round(($size/1GB),2)

#$size={{0:n2} -f $size}

$size2=[string]::Format("{0:0.00} GB", $size)

} catch {

$size = -1

}

$User = $objUser.Value

try {

$ProfileLastUseTime = ([WMI]"").Converttodatetime($profile.lastusetime)

} catch {

$ProfileLastUseTime = ""

}

$OutputObj = New-Object -TypeName PSobject

$OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.toUpper()

$OutputObj | Add-Member -MemberType NoteProperty -Name ProfileName -Value $objusername

$OutputObj | Add-Member -MemberType NoteProperty -Name ProfilePath -Value $profile.localpath

$OutputObj | Add-Member -MemberType NoteProperty -Name ProfileType -Value $ProfileType

$OutputObj | Add-Member -MemberType NoteProperty -Name IsinUse -Value $profile.loaded

$OutputObj | Add-Member -MemberType NoteProperty -Name IsSystemAccount -Value $profile.special

$OutputObj | Add-Member -MemberType NoteProperty -Name Size -Value $size2

$OutputObj | Add-Member -MemberType NoteProperty -Name LastUseTime -Value $ProfileLastUseTime

$OutputObj

}

August 20, 2018 by Florian Rossmark recommendations scripts solutions

The advantage of DFS and how to set up a working structure

File shares are something every IT professional will work with. Many companies have way to complicated and unstructured network file systems with to deep permissions, to many shares and access points, often several connected drives and from an IT perspective nightmares when it comes to migrating to newer servers or having satellite offices and subsidiaries gaining access to it especially on lower speed connections.

Having been in IT for about 20 years by now, I saw a lot and was challenged with it quite a bit. One of the best solutions I came across is the one I am about to show you here. It is very structured while giving you the advantage of leveraging it as you need and go and should allow you to use it in most businesses.

First of all – please note that I will not go as far as explaining and exploring the differences with Active Directory integrated and Stand-A-Lone namespaces. If by any means possible, I suggest you use Active Directory integrated namespaces to simplify the roll out, but both would work.

The structure example:

The structure example will depend on a DFS Root server and a separate File-Server per root-folder on the later network drive. This is just an example, you do not need to split it all up, thought if you can do it to keep it as structured as possible

Example target file system structure:

N:\
- N:\Archive
  - N:\Archive\John Doe
  - N:\Archive\Jane Doe
- N:\Departments
  - N:\Departments\Marketing
    - General
    - Mangement
    - Public (anyone has read access)
  - N:\Departments\Accounting
    - General
    - Mangement
    - Public (anyone has read access)
- N:\Other
  - N:\Other\Manufacturing
  - N:\Other\Projects

The declared goal is to keep the NTFS rights structure as simple as possible and not going any deeper then e.g. level three – e.g. N:\Departments\Marketing\General

Each department folder in this example will have a public folder where a member of the department has read/write access while any non-marketing member has read access to files that are published there.

The archive tree is for terminated employees and archive data. Their information gets collected in a sub-folder in this tree, a group will be created for each of those folders and only people that got approval to access this data will see and be able to read those archived files (read-only is recommended as NTFS permission)

The file servers and their preparation:

DFS Root-Server

create a folder on the data-partition like D:\DFSRoots – there will not be any real data in this folder – but it will hold the actual DFS structure
- create sub folders for the branches on the shared DFS drive like:
  - D:\DFSRoots\Departments
  - D:\DFSRoots\Archive
  - D:\DFSRoots\Other

DFS Department Server

create a folder on the data-partition like D:\SharedFolders\Departments
- remove the everyone or authenticated user groups from this folder – only System and Domain-Admins should have read/write permission here while group N_Departments will have read-only access on this folder.
- create a sub-folder for each main folder you want to see under the path N:\Departments and share it
- add a $ (dollar/string) sign to the share name so it remains hidden a hidden share
- Examples:
  - D:\SharedFolders\Departments\Marketing
  - D:\SharedFolders\Departments\Accounting
now create the following sub-folders for each department folder as shown on the example Marketing
- D:\SharedFolders\Departments\Marketing\General
- D:\SharedFolders\Departments\Marketing\Management
- D:\SharedFolders\Departments\Marketing\Public
create two groups in Active Directory for Marketing
- N_Departments_Marketing_General
- N_Departments_Marketing_Management
create a general group N_Departments to use it for all Public folders
assign the groups to their according sub-folders General and Management with read/write rights you probably will need to remove the read-access that the group N_Departments inherited from this folder
assign the group N_Departments to the Public folder in all departments with read-only rights (if not inherited)
assign the group N_Departments_Marketing_General to the Marketing\Public folder with read/write access – allowing each member of marketing to publish information for access to other people – only marketing can write in this folder, other people only have read-access to it

DFS Archive Server

create a folder on the data-partition like D:\SharedFolders\Archive
- create a sub-folder for each main folder you want to see under the path N:\Archive and share it
- add a $ (dollar/string) sign to the share name so it remains hidden a hidden share
- Examples:
  - D:\SharedFolders\Archive\John Doe
  - D:\SharedFolders\Archive\Jane Doe

DFS Other Server

create a folder on the data-partition like D:\SharedFolders\Other
- create a sub-folder for each main folder you want to see under the path N:\Other and share it
- add a $ (dollar/string) sign to the share name so it remains hidden a hidden share
- Examples:
  - D:\SharedFolders\Other\Manufacturing
  - D:\SharedFolders\Other\Projects

The DFS namespace set up and configuration

add the Namespace \\domain.local\N for the N: drive (just an example)
add the folders Archive, Departments and Other to the namespace
for each of those folders you add the shared sub-folders like indicated in the list below as sub-folders (they will appear on the Namespace tab when you click on the folder in the DFS Management) and set the target to the according file-share on the specific DFS server where the data will reside
- Departments\Marketing
- Departments\Accounting
- Archive\John Doe
- Archive\Jane Doe
- Other\Manufacturing
- Other\Projects
- This will actually create a shared sub-folder on the DFS Root server for each of those folders in D:\DFSRoot\

Note – information about the above example

The example below is kept simple – I did not go in to each and every right you would need to assign for the sole purpose of keeping it simple and understandable. Please investigate and set the rights as you really need them.

As for the Archive tree, it might be beneficial to have PowerShell script automate the folder creation, group creating and rights assignment for those NTFS paths, so you limit the possible failure-rate in case you are going to archive terminated employee data and other stuff in this tree branch.

What are the real benefits of this

add multiple folder targets for replication
- replication can be beneficial in a server-migration scenario as well as in a subsidiary scenario
- you can add replications on the departments-branch example per department folder – not each subsidiary will need a mirror folder of each department, rather then just a few – this decreases the amount of data and load on the connection and size of the server respective it’s disk-space and reduce cost as well
a simple rights structure fully based on groups
- in general you should never ever use a user account to assign any rights – always create a group, whether for a drive-share, NTFS rights or any other purpose. Always create a group!
- you can add and remove users from those groups
- you can audit the permissions on the NTFS side rather quick cause they should relate to strong group names
- the groups can be audited against HR lists of members of the department or by department managers and directors to make sure only people that need to have certain access levels will have them
while limiting access to certain folders you limit the amount of damage a possible attack by malware could cause
you can divide or summarize the actual file-servers that hold the data as needed in the long run
a simple group design with limited depth permissions is easier to maintain and audit
you have one central network drive that you will assign in order to give everyone access – all data will be centrally on this path independent from any file-server host-name. This can be a huge advantage cause some applications might not relate to the mapped drive rather than a UNC path what could cause you major headache when ever you want to migrate/upgrade or retire your file-servers later on
possible other file-shares within the corporation in other locations could be made accessible by linking them in as a folder in e.g. the others-namespace avoiding that users would need to know and remember the UNC path and you even allowing them to access any UNC path – it will act like a mapped drive while pointing in the background to an UNC path

There are many more advantages to DFS and the whole design. I hope this gives you a good overview and idea of how to design or re-design your file-server structure and simplify the whole access structure.

Full text search and DFS drive mappings

This is a challenge that is not easy to overcome. Still, thought there is no official and directly implemented solution from Microsoft for this, I was able develop and provide a solution that will access the Windows Search Index and provide it back to the end user only using standard Windows components. All you need to know and do is described in the IT Search section of this web site.

August 16, 2018 by Florian Rossmark configuration recommendations server solutions

Enable SMBv1 on Windows 10 per GPO

SMBv1 is an insecure protocol that you should not use if by any means possible. Windows 10 has SMBv1 disabled by default. In order to enable it you would need to go to the Control Panel and activate the Windows Feature “SMB 1.0/CIFS File Sharing Support” and at a bare minim the “SMB 1.0/CIFS Client“. You actually might just want to do that cause you really shouldn’t add more SMBv1 servers to your network.

Before you proceed reading – if you really need to enable this protocol – please make sure your systems are all patched! Especially your target servers should be patched as well – assuming they are Windows XP / 2003 / Vista / 2008 / 7 / 2008 R2 / 8 / 8.1 / 2012 / 2012 R2 / 2016 and 10. I highly recommend to look at this Microsoft link: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010. Additionally do I want to mention that Windows XP and Windows 2003 can be patched as well – though they are not on the list of the previous link. Look at Microsoft KB4012598 for more information or use this download link https://www.microsoft.com/en-us/download/details.aspx?id=55245. I can not warn enough about SMBv1 – you open the doors for malware here that can bring down your network in minutes and cause huge damage!

Please note – I did not research in detail if other previous Windows versions did disabled SMBv1 already by default, this article might in any case apply to Windows 7, 8 and 8.1 as well and be applicable to Windows 2008, 2008 R2, 2012, 2012 R2 and 2016 as well as newer Windows versions to come.

Now, the issue with Windows 10 and SMBv1 disabled is that often old legacy Windows 2003 servers are around that can’t just be upgraded or replaced. In order to access any file share you would need to enable SMBv1 on the client workstations. This could sure be done by preparing your installation image etc. – but if you did not plan for this or want to have more granular control, you might consider using Group Policies / GPO to enabled this Windows Feature.

It is further worth noting that the easiest way to find the issue is not trying to access the UNC share via the server-name rather then directly typing in the IP address in your attempt. This way you actually get a way clearer error-message from Windows. I mention this, to show you and explain that there actually is a difference between trying to access a server-name and an IP address per UNC path – especially when it comes down to Windows 10 and the error messages you might see.

Officially enabling a Windows Feature is not supported per GPOs nor is there much information out there on how to enable SMBv1 per GPO. Having faced this challenge recently, I found a good working way that is pretty easy to implement.

enable the feature on 1x Windows 10 client
1. export / document the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb10
2. copy the file %windir%\system32\drivers\mrxsmb10.sys
create a GPO
1. put the mrxsmb10.sys in the GPO or a central accessible file (the target computer account must be able to read the file! – I often put it in either NETLOGON or directly in the GPO / scripts folder)
2. Computer Configuration \ Preferences \ Windows Settings \ Files
  1. create a new entry to copy the file to the target system
  2. Source file: where you centrally placed the mrxsmb10.sys
  3. Destination file: %windir%\system32\drivers\mrxsmb10.sys
3. Computer Configuration \ Preferences \ Windows Settings \ Registry
  1. Create or import all the registry keys from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb10

A registry hive export would look like this:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb10]
"DisplayName"="@%systemroot%\\system32\\wkssvc.dll,-1004"
"ErrorControl"=dword:00000001
"Group"="Network"
"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\
  52,00,49,00,56,00,45,00,52,00,53,00,5c,00,6d,00,72,00,78,00,73,00,6d,00,62,\
  00,31,00,30,00,2e,00,73,00,79,00,73,00,00,00
"Start"=dword:00000002
"Tag"=dword:00000006
"Type"=dword:00000002
"Description"="@%systemroot%\\system32\\wkssvc.dll,-1005"
"DependOnService"=hex(7):6d,00,72,00,78,00,73,00,6d,00,62,00,00,00,00,00

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb10]

"DisplayName"="@%systemroot%\\system32\\wkssvc.dll,-1004"

"ErrorControl"=dword:00000001

"Group"="Network"

"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\

52,00,49,00,56,00,45,00,52,00,53,00,5c,00,6d,00,72,00,78,00,73,00,6d,00,62,\

00,31,00,30,00,2e,00,73,00,79,00,73,00,00,00

"Start"=dword:00000002

"Tag"=dword:00000006

"Type"=dword:00000002

"Description"="@%systemroot%\\system32\\wkssvc.dll,-1005"

"DependOnService"=hex(7):6d,00,72,00,78,00,73,00,6d,00,62,00,00,00,00,00

Apply the GPO to your target systems / workstations and reboot them – after that you will be able to access the necessary shares. The downside is – you don’t really see the feature as enabled in the Windows-Features. It will work nevertheless.

August 3, 2018 by Florian Rossmark configuration security server solutions windows

Build your own lab environment with VMware

If you have a virtual system, like VMware, and a storage device behind it you might be able to mirror your whole real / live environment and create a complete playground or shadow network to simulate any of your guest VMs like the real system and being able to change, update and adjust the configuration within this lab environment.. This is actually rather easy to accomplish and can save you a lot of headache while using it.

This is just an example, you might be able to accomplish something similar while just cloning single VMs and in theory it wouldn’t even matter if you use VMware vSphere or something like Microsoft Hyper-V. Still, it has advantages to do it this way, but let me explain it.

Assumed scenario:

You work with an VMware environment with one or more host systems and several guest VMs. You need to update software and configurations on those guest VMs but need to test this beforehand to ensure everything runs smooth. The VMs are stored on a central storage device that can do volume-level snapshots.

Prepare the environment

you need one NIC per host that you will connect to a switch
best use an independent switch that has no other network connections then to the 1x NIC per host
create an Shadow-LAN virtual switch in your VMware cluster and use the 1x NIC per host so VMs through the cluster can communicate proper

What you do:

create a snapshot and mount it to the VMware host systems as an additional volume
go to the clone-volume file system and add the VMs you need to the inventory (you might want to rename to shadow-<servername> so you can easily identify them)
re-configure their network connection from your regular LAN virtual switch to the shadow-LAN virtual switch you prepared
start the added guest VM
1. if you are asked if you moved or copied the guest just say you moved it – to avoid hardware / MAC and other changes possibly causing Windows to want to re-activate
2. VMware might complain about a duplicate MAC address – you can ignore this, cause you are on two different / independent networks

Real usage example:

Let me give you a more detailed example on this with a few more details on what I personally used and did with this. The example you find below should help you understand the whole principle better.

VMware cluster with e.g. 10x host systems – we had enough RAM and CPU power that we could have 3x hosts go down – you won’t need that much, but of course you would have buffer for RAM and CPU usage
Nimble All-Flash storage arrays in the background connected to all the VMware hosts and using the Nimble VMware plugins (Note: Nimble was bought by HP / HPE as off today)
- the Nimbles are configured to do volume level snapshots multiple times per day
all physical host systems had a dedicated network card (NIC) connected to an independent physical switch that was NOT connected to any other network switch
a virtual switch SHADOW-LAN was created and those physical NICs of the hosts systems had been assigned to it
- this allowed any VM connected to this virtual switch to communicate with other VMs connected to the same virtual switch on other hosts

Due to migrations, software updates and quality controlled systems we constantly had the challenge to test and changes and adjustments thoroughly. So I came up with the solution to just clone a snapshot on the Nimble storage array the VM resided and mounting it to the VMware cluster, taking only minutes and then moving forward to add e.g. domain controllers, DHCP servers, necessary file-system servers and the target guest system to the inventory in VMware, adjusting their name so we could quickly identify them (even adding them to resource pools if necessary) and of course most important just changing their virtual switch configuration to the shadow switch.

Advantages and possibilities:

This now allowed to simulate the whole real world system (VMs) and simulate every change that we wanted. In order to get software there we attached if necessary VHDs that did hold what we needed or we even used a secondary internet connection to briefly connect to licensing services or update services that Vendors only provided online. The advantages of the solutions go even further:

simulate everything you have in your VMware environment available and have it working like the real / live system
if necessary, provide internet access while connecting a SECONDARY internet connection (router / firewall) to physical shadow network switch
adding real printers to the shadow switch to be able to test print-outs (we had those cases)
add physical workstations to simulate whole production environments
update / refresh the whole system in only a few minutes by using a fresh-snapshot clone
only minimal to almost none impact on the storage / free space of your storage device
- this is due to grabbing a Nimble snapshot that was cloned and therefor created a new branch and only the deltas (changes) had an impact on the storage – we talk even for “bigger” simulations only about a few gigabyte changed data – if at all that much – of course depending on your storage and what you do
we installed VMware console connections on quality testing workstations so they could access the system directly on the console
- of course only granting them minimal rights to this specific pool of VMs
- avoiding that their access to the VMware environment had any impact to the real system
documenting any changes, challenges faced and solutions found
due to a physical switch, and best practice using a layer-3 switch, we where able to simulate whole VLANs, routing etc. within the environment and even connecting various physical systems like printers, workstations and temporarily an internet-connection to this environment

It is only a small amount of effort to initially prepare for those simulations, cause the virtual shadow switch, the physical shadow switch and the hosts network card connections to this physical switch are a one time effort. After this you just clone and mount snapshots and add the actual VMs you need while adjusting their network connection to the virtual shadow switch.

Once setup, preparing simulations usually takes less then 30 minutes till everything is cloned, mounted, added to the inventory (incl. NIC adjust to the shadow switch) and booted up.

Why not just clone all VMs via VMware?

Good questions – the answer is simple, this would have an impact on your storage capacity, cause it would create an actual clone. And it actually takes longer to clone individual VMs then to just grab a storage-level snapshot and being able to adjust what you want down to the volume level on the storage. Even the clean-up might be more intense or leave some unwanted data back – while a clone on off the volume only needs you to remove the VM guest system from the inventory and then unmount and delete the whole shadow volume.

I did write this all up cause I wanted to share it – the whole idea is not that special in theory, but I thought it is an good example on how you can accomplish having a huge and decent lab environment with only minimal effort. In any case, I hope the idea behind it will help some off you out there 🙂

July 31, 2018 by Florian Rossmark configuration recommendations server solutions

Windows 2016 DHCP load balancer and it’s quirks

Windows 2016 or probably even 2012 allows you to create a real load balanced / full failover DHCP server configuration, other then Windows 2008 that only allowed you to split the scopes.

Now, this works pretty great for the most part – but it has actually two major flaws you need to be aware of and actually take action on.

Neither reservations nor server / scope options are replicated.

This actually is a big deal. Assuming you are changing settings on server A for the pool, you end up that clients depending on which DHCP answered them might apply the new settings from server A or pull the old ones from server B.

Further might a reservation work when you put it in place, and then – all of a sudden a few days later you get a ticket in telling you there is an issue and you find out that the reservation didn’t pull anymore. What happened? Well – you might have set the reservation on server B but not on server A – depending on which server answered the client, you run again in to an issue.

Microsoft seems to have put a quick and dirty synchronization in place and the only true way around is to force the two DHCPs to synchronize with the following PowerShell command:

Invoke-DhcpServerv4FailoverReplication -force

1	Invoke-DhcpServerv4FailoverReplication -force

This could be automated via the Task Scheduler by using invoking the command from a DOS prompt via:

powershell.exe -command "Invoke-DhcpServerv4FailoverReplication -force"

1	powershell.exe -command "Invoke-DhcpServerv4FailoverReplication -force"

But even then, you better check all your DHCP servers and always make sure any changes are made on all DHCP servers or at least correctly replicated. Otherwise you might encounter the weirdest issues.

July 27, 2018 by Florian Rossmark recommendations scripts server solutions

Inserting tables as pictures

Microsoft Office has since a very long time a bug when it comes to copied data from Excel that you try to past as a picture in to a other Office application. The table often gets totally messed up might miss rows and columns even. This happens when you copy the data from Excel and try to insert it in to e.g. Microsoft Word with the special insert option Insert as Picture.

The issue is well known and the solution is actually pretty simple – you don’t copy the data from Excel, you copy a picture with a specific setting.

This also allows you to insert the copied data respective image in to any other application as an picture without using screenshot tools like the Windows internal Snipping tool.

Instructions:

select the rows and columns you want to copy in Excel (mark them)
while on the Home ribbon, click the little drop down icon next to the Copy button
select Copy as Picture…
switch the appearance to As shown when printed
and click OK
now insert the PICTURE that you copied where you need it – this will not be a formatted table / text-data

Please note – you can also change your quick access menu in Excel and add the Copy As Image there for easier access to it.

July 16, 2018 by Florian Rossmark solutions

Monitor DFS replication backlog between servers in PRTG

One of the challenges with DFS is to monitor the DFS replication backlog. There are various scripts out there to accomplish this. Unfortunately I found nothing I really liked and giving me the simple insight I wanted.

The goal was simple – a script that will monitor the backlog between two systems in both directions – meaning Server-A to Server-B and Server-B to Server-A. For both directions I wanted to see the amount of files as well as the size of those files. I did not care about what DFS groups and or DFS folders are affected in detail – this is because the amount of groups might change, the amount of folders will likely change rather frequently, meaning it would be a challenge to monitor it per group or even on a folder level very efficient. Monitoring the amounts of groups and folders alone has no really advantage, cause this would have been changed by an administrator.

Below you will find my script that actually expects three parameter – the two server names and a limit integer value. The limit will not influence the XML response of the script, you could add the <text>$Response</text> and <text>$Response2</text> tags in lines 77 and 79 after the </unit> and before the </result> tag if you want, I removed them currently.

See the picture below as an example of how the result looks like in PRTG.

Create the following script in C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML and make sure you have the C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Dfsr\ and the C:\Windows\SysWow64\WindowsPowerShell\v1.0\Modules\Dfsr\ folders – you might need to copy them over. If you miss them at all, you might need to add the needed Windows Roles/Features or install the RSAT (Remote Server Administration Tools) on your system.

Param(
$SourceComputer=$args[0],
$DestinationComputer=$args[1],
$MaxBackLog=$args[2]
)

Import-Module Dfsr
#Import-Module -FullyQualifiedName "C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Dfsr\DfsrPowerShell.dll"
#Module needs to be in System32 and SysWow64 directory - make sure the path exists in both cases

$Count=-1
$TotalSize=0
$Count2=-1
$TotalSize2=0
$Response="-1:Script did not execute right"
$Response2="-1:Script did not execute right"

$err = $null 
$BackLog = Get-DfsrBacklog -SourceComputerName "$SourceComputer" -DestinationComputerName "$DestinationComputer" -ea SilentlyContinue -ev err; 
If ($err -ne $null) 
{ 
$Response="-2:Script error with GET-DFSRBACKLOG"
} 
Else
{
$Response = "-3:Error getting count"
$Count = $BackLog.Count
If ($Count -gt $MaxBackLog)
{
$Response = "Alarm - Backlog is over defined maximum of $MaxBackLog"
}
Else
{
$Response = "OK"
}
ForEach($Item in $BackLog)
{ 
$file = $Item.FullPathName
$file = $file -replace ":", "$"
$file = "\\$SourceComputer\$file"
If (Test-Path $file)
{
$TotalSize += (Get-Item $file).Length
}
}
}
$err = $null 
$BackLog2 = Get-DfsrBacklog -DestinationComputerName "$SourceComputer" -SourceComputerName "$DestinationComputer" -ea SilentlyContinue -ev err; 
If ($err -ne $null) 
{ 
$Response2="-2:Script error with GET-DFSRBACKLOG"
} 
Else
{
$Response2 = "-3:Error getting count"
$Count2 = $BackLog2.Count
If ($Count2 -gt $MaxBackLog)
{
$Response2 = "Alarm - Backlog is over defined maximum of $MaxBackLog"
}
Else
{
$Response2 = "OK"
}
ForEach($Item in $BackLog2)
{ 
$file = $Item.FullPathName
$file = $file -replace ":", "$"
$file = "\\$DestinationComputer\$file"
If (Test-Path $file)
{
$TotalSize2 += (Get-Item $file).Length
}
}
}
$XML = "<prtg>"
$XML += "<result><channel>BackLog count 1</channel><value>$Count</value><unit>Count</unit></result>"
$XML += "<result><channel>BackLog size 1</channel><value>$TotalSize</value><unit>BytesFile</unit></result>"
$XML += "<result><channel>BackLog count 2</channel><value>$Count2</value><unit>Count</unit></result>"
$XML += "<result><channel>BackLog size 2</channel><value>$TotalSize2</value><unit>BytesFile</unit></result>"
$XML += "</prtg>"

Function WriteXmlToScreen ([xml]$xml)
{
$StringWriter = New-Object System.IO.StringWriter;
$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
$XmlWriter.Formatting = "indented";
$xml.WriteTo($XmlWriter);
$XmlWriter.Flush();
$StringWriter.Flush();
Write-Output $StringWriter.ToString();
}

WriteXmlToScreen $XML

Param(

$SourceComputer=$args[0],

$DestinationComputer=$args[1],

$MaxBackLog=$args[2]

)

Import-Module Dfsr

#Import-Module -FullyQualifiedName "C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Dfsr\DfsrPowerShell.dll"

#Module needs to be in System32 and SysWow64 directory - make sure the path exists in both cases

$Count=-1

$TotalSize=0

$Count2=-1

$TotalSize2=0

$Response="-1:Script did not execute right"

$Response2="-1:Script did not execute right"

$err = $null

$BackLog = Get-DfsrBacklog -SourceComputerName "$SourceComputer" -DestinationComputerName "$DestinationComputer" -ea SilentlyContinue -ev err;

If ($err -ne $null)

{

$Response="-2:Script error with GET-DFSRBACKLOG"

}

Else

{

$Response = "-3:Error getting count"

$Count = $BackLog.Count

If ($Count -gt $MaxBackLog)

{

$Response = "Alarm - Backlog is over defined maximum of $MaxBackLog"

}

Else

{

$Response = "OK"

}

ForEach($Item in $BackLog)

{

$file = $Item.FullPathName

$file = $file -replace ":", "$"

$file = "\\$SourceComputer\$file"

If (Test-Path $file)

{

$TotalSize += (Get-Item $file).Length

}

$err = $null

$BackLog2 = Get-DfsrBacklog -DestinationComputerName "$SourceComputer" -SourceComputerName "$DestinationComputer" -ea SilentlyContinue -ev err;

If ($err -ne $null)

{

$Response2="-2:Script error with GET-DFSRBACKLOG"

}

Else

{

$Response2 = "-3:Error getting count"

$Count2 = $BackLog2.Count

If ($Count2 -gt $MaxBackLog)

{

$Response2 = "Alarm - Backlog is over defined maximum of $MaxBackLog"

}

Else

{

$Response2 = "OK"

}

ForEach($Item in $BackLog2)

{

$file = $Item.FullPathName

$file = $file -replace ":", "$"

$file = "\\$DestinationComputer\$file"

If (Test-Path $file)

{

$TotalSize2 += (Get-Item $file).Length

}

$XML = "<prtg>"

$XML += "<result><channel>BackLog count 1</channel><value>$Count</value><unit>Count</unit></result>"

$XML += "<result><channel>BackLog size 1</channel><value>$TotalSize</value><unit>BytesFile</unit></result>"

$XML += "<result><channel>BackLog count 2</channel><value>$Count2</value><unit>Count</unit></result>"

$XML += "<result><channel>BackLog size 2</channel><value>$TotalSize2</value><unit>BytesFile</unit></result>"

$XML += "</prtg>"

Function WriteXmlToScreen ([xml]$xml)

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen $XML

July 10, 2018 by Florian Rossmark monitoring prtg scripts server solutions

Prevent ScreenSaver coming up with a PowerShell script

In our daily business, we often have the issue that a GPO enforces a screensaver after a certain amount of time. This can become very annoying and actually even be an issue if you are remote in on a end-user system and don’t know their password. After doing quite some research I found out that PowerShell actually is able to help here and I wrote a script to prevent the screensaver from coming up.

First I thought, let’s see if I can control the mouse cursor, cause I thought it would be less invasive, this is actually possible – but interestingly did not have the expected effect and the screensaver kept coming up. So I did go with keystrokes, but of course I was worried about what key would be save to send. Doing some research on Microsoft websites (here the link), I found the F16 – testing around with it I found it the least invasive key to send periodically to a system – it does not even exist on a regular keyboard and can only be simulated with a key-combination. To simulate F16 you need to press SHIFT + F4 – there might be a Windows 10 (may be even earlier) combination out of WINDOWS + SHIFT + F4 respective WINDOWS + F16 what would cause a shutdown. Once I found out about that, I decided to adjust the script to F17 what seemed to bypass even that small chance of an issue that would be more problematic then the screensaver itself – you sure don’t want the system to shutdown :-).

The script you find below can be simply executed. It has a setting $minutes that you could add as a parameter and therefor adjust it when you start it – by default it will use 9999 what is a pretty long time. To be clear – this is actually not a minute interval, it is a 30 second interval and ends up in half minutes. Why? Simple – Windows has a minimum setting of 1 minute that an screensaver can come up. If the script would fire in a minute interval, there is a theoretical chance the screensaver would still win.

This is further not pure PowerShell code – well it is but actually the key stroke is send via a Windows Scripting Host WSH / WScript command SendKeys. The PowerShell only surrounds to command. It has the nice habit of having a PowerShell window open that you simply can close to end the script. If you would do the same in WSH you would need to execute the script more manual with CSCRIPT rather then just double-clicking the file what would execute it via VBSCRIPT instead causing a hidden window / process and you would need to identify it in the task-manager to kill the process. Therefor, PowerShell was the best choice in the end to accomplish the task.

param($minutes = 9999)

$myShell = New-Object -com "Wscript.Shell"

for ($i = 0; $i -lt $minutes; $i++) {
Start-Sleep -Seconds 30
$myShell.sendkeys("{F13}")
}

param($minutes = 9999)

$myShell = New-Object -com "Wscript.Shell"

for ($i = 0; $i -lt $minutes; $i++) {

Start-Sleep -Seconds 30

$myShell.sendkeys("{F13}")

}

Additionally you could use the below more advanced script that will control the screensaver only during a defined time window. This is a more advanced way and more usable in certain situation, cause it would automatically allow the screensaver to come up outside the defined time window and minimize the exposure of the system more. It is also more effective then completely disabling any screensaver GPO settings, cause it is more specific and adjustable.

Update: As of 10/202 I updated the script below from F13 to F10, as this works better for most situations. Be aware, it all depends on what your foreground windows will react too. Make sure the keystroke you use does not cause you any harm.

param($minutes = 9999)

$myShell = New-Object -com "Wscript.Shell"

for ($i = 0; $i -lt $minutes; $i++) {
  $min = Get-Date "05:30"
  $max = Get-Date "17:30"
  $now = Get-Date
  if ($min.TimeOfDay -le $now.TimeOfDay -and $max.TimeOfDay -ge $now.TimeOfDay) {
    Write-Host "$now - Time between $min and $max - preventing screensaver" -ForegroundColor DarkGreen -BackgroundColor White
    $i = 0
    $myShell.sendkeys("{F10}")
  } else {
    Write-Host "$now - Time outside off $min and $max - allowing screensaver" -ForegroundColor DarkRed -BackgroundColor White
  }
  Start-Sleep -Seconds 30
}

param($minutes = 9999)

$myShell = New-Object -com "Wscript.Shell"

for ($i = 0; $i -lt $minutes; $i++) {

$min = Get-Date "05:30"

$max = Get-Date "17:30"

$now = Get-Date

if ($min.TimeOfDay -le $now.TimeOfDay -and $max.TimeOfDay -ge $now.TimeOfDay) {

Write-Host "$now - Time between $min and $max - preventing screensaver" -ForegroundColor DarkGreen -BackgroundColor White

$i = 0

$myShell.sendkeys("{F10}")

} else {

Write-Host "$now - Time outside off $min and $max - allowing screensaver" -ForegroundColor DarkRed -BackgroundColor White

}

Start-Sleep -Seconds 30

}

June 29, 2018 by Florian Rossmark scripts solutions windows

Automate Outlook signature roll outs while pulling the information from Active Directory / LDAP

The Outlook signature script you will find below is a bit more complicated then most other scripts I post, cause you might need to adjust a bit more. I used it for several years (as you can see in the script when it comes to Outlook versions and registry keys) in many networks and in most cases it worked just flawless once it was set up.

What does this script do exactly?

Good question – it actually writes every time a user logs on a signature file to his profile. The information in the file are pulled from Active Directory – where you are able to e.g. change the phone number, cell phone number or e.g. last name because the employee married. The signature file will automatically update. Even more important is the onboarding process, you actually can forget about setting up the signature. Assuming you don’t use roaming profiles, well – no worries – the signature will auto create everywhere, if you call it via a login script / logon script. In theory you could call it via a GPO as well.

What you need to do – simply said

get an approved example signature from HR or marketing or who ever can provide you the signature and actually put it in your Outlook as signature.
then replace names, phone numbers with variables (I come to that) and save it in your Outlook.
go to your %appdata%\Microsoft\Signatures folder and grab the three files (.txt / .htm / .rtf) and the sub-folder with the name of the signature you saved
copy them to your \\mydomain\netlogon\signatures folder (you might need to create it – any other location would need some adjustment in the script)
you will need to open the all three file formats (.txt / .htm / .rtf) in a regular text editor – plain text editor like NOTEPAD.EXE (Windows) or Notepad ++
make sure the variables are a complete word and not somehow divided or have characters replaced – if something is not how it should be, adjust it and save the files
Copy the OutlookSignatures.vbs file to the same path and adjust it especially in the header-section with your domain information and execute the script in a CMD / command prompt via \\mydomain\netlogon\signatures\OutlookSignatures.vbs “my signature” 1 1
Now go back to your Outlook (probably close and re-open) and create a new email – you should see your signature was auto-generated and the variables have been replaced with you user-specific values from Active Directory / LDAP.
you should switch your email format to all three formats – HTML / Plain Text / RTF and check the signature in all three formats – to make sure all three files where generated correctly
If something is not as expected, check the source-signature files and their variables and if needed adjust the variable-replacement section of the script

What you gain from this

The signatures will auto-generate and you actually have a cheap way to roll out corporate identity conform signatures, without spending a lot of money for tools that might provide you an easier to use configuration and some more fancy features – but if you don’t need those features and you can live with a more technical way to approach this you actually have a cheap way to implement this.

The variables

The script will pull certain properties / attributes from the currently logged on user object from Active Directory – those are configured in line 33 and if you need more you will need to add them here.

Between the lines 145 and 181 you see that the script is replacing place-holder variables in the source files (.TXT / .HTM / .RTF) with the information pulled from Active Directory – all those place holders in your source files need to be @@AnyName@@ – this is to make sure you have a unique definition of what the script will replace.

Example:

strCurrentLine = Replace(strCurrentLine, "@@GivenName@@", NZ(objrecordset.Fields("givenName"), ""))

1	strCurrentLine = Replace(strCurrentLine, "@@GivenName@@", NZ(objrecordset.Fields("givenName"), ""))

This does nothing else then:

replace the variable strCurrentLine with
1. search in variable strCurrentLine
2. for the value @@GivenName@@
3. replace it with LDAP attribute “givenName“

There are a few special examples for putting e.g. a HTML conform line-break after Job-Title in the .HTM file only in the script (I had situations where only the HTML signature did not do a Line-Break, or the Text-Version alone was not doing something, etc..) – in the end this allows you to adjust something in a one of the three signature formats.

Another example in the script writes an additional line with the cell phone / mobile number if available. If the number is set in the user object, a new line will be created depending on the file format – if the number is not set the search-variable will be removed from the signature (you off course don’t want it there) instead of writing the information out. In this case we add a “Cell: ” as prefix before the number so the signature indicates clearly what this number is about. Simply said, since we replace a variable and not a whole line – we have to write out more then just the number – in this case we want to add text.

Can you execute the script with various signatures per department?

Yes – you actually can – but you would need to do this with an additional script and e.g. IFMEMBER from Microsoft or group based GPOs etc…

Can you create more then one signature?

Yes – you can execute the script in various ways – you can roll out a NEW MAIL signature (full length signature) and a second version for REPLIES (short signature) and additional signatures that the user could choose from that aren’t set as either NEW MAIL or REPLY signature. The script header explains how to call the script and what parameters it will expect and how to set them.

Feel free to use the script below, adjust it for your needs. I know some of the stuff like your domain-name could be searched automatically instead of putting it hard-coded in the script – even the reg-keys could be more advanced, feel free to do so – but in the end it is not that much work and it does its job either way.

Debugging the script

At line 79 the statement “On Error Resume Next” avoids that you see errors that might arise. This is good for production so that the client/user does see as little as possible messages due to timeouts or special circumstances – but if you want to debug something or in the process to test the script itself, please remark the line so errors actually occur. They might not mean much in some cases, but they might also give you the hint you need to see what is going wrong.

'Parameters to execute the script:
'OutlookSignatures.VBS strInputFilePrefix bolUseAsDefaultNewMail bolUseAsDefaultReplyMail
' parameters are separated by spaces - use "" for input-file-names with spaces
' strInputFilePrefix: file name of the signature file - do not add any extensions (.txt / .htm / .rtf)
' bolUseAsDefaultNewMail: TRUE = 1 or -1 / FALSE = 0 - use numeric values
' bolUseAsDefaultReplyMail: TRUE = 1 or -1 / FALSE = 0 - use numeric values
'Example
'SIGNATUR.VBS MySignature 1 1

'generic variables - do not adjust
'Const HKEY_CLASSES_ROOT=&H80000000
'Const HKEY_LOCAL_MACHINE=&H80000002
'Const HKEY_USERS=&H80000003
'Const HKEY_CURRENT_CONFIG=&H80000005
Const HKEY_CURRENT_USER = &H80000001

Dim strLogonServer
Dim strDomain
Dim strEX
Dim strSignaturName
Dim strLDAPPath
Dim strFelder
Dim bolUseAsDefaultNewMail
Dim bolUseAsDefaultReplyMail

'Settings you need to adjust
'------------- BEGIN OF SETTINGS -------------
strDomain = "MyDomain" 'short NetBIOS domain name should be sufficient
strLDAPPath = "dc=MyDomain,dc=local"
'------------- SPECIAL SETTINGS -------------
'Those are the fields / attributes from AD that the script will obey and try to replace
'Additionally there is another special settings section further below that will do the acutal replacement
strFelder = "streetAddress,l,info,postalCode,telephoneNumber,facsimileTelephoneNumber,mail,sn,givenName,department,mobile"
'------------- END OF SETTINGS -------------

'the script assumes it is started from the logonserver respective from the \\mydomain\netlogon directory
Dim oShell
Set oShell = CreateObject("WScript.Shell")
strLogonServer = oShell.expandEnvironmentStrings("%LogonServer%")
strLogonServer = Replace(strLogonServer, "\\", "")
Set oShell = Nothing

'read parameters
strInputFilePrefix = WScript.Arguments.Item(0)
bolUseAsDefaultNewMail = CBool(WScript.Arguments.Item(1))
bolUseAsDefaultReplyMail = CBool(WScript.Arguments.Item(2))

'read files and adjust them
strEX = ".htm"
Convert
strEX = ".rtf"
Convert
strEX = ".txt"
Convert

Sub Convert()

Dim objNetwork
Dim strDestinationPath
Dim strInputFile
Dim strOutputFile
Dim strUser
Dim strUserProfile
Dim i
Dim j
Dim cn
Dim rs
Dim strSignaturNameHex
Dim cmdParam
Dim strUserstrDomain
Dim strAppData
Dim strSignaturePath
Dim fso
Dim strCurrentLine

Set objNetwork = CreateObject("WScript.Network")
Set WSHShell = WScript.CreateObject("WScript.Shell")

On Error Resume Next

'find current Windows user and profile path
strUserDomain = WSHShell.Environment("PROCESS").Item("userdomain")
If LCase(strUserDomain) = LCase(strDomain) Then
strUser = objNetwork.UserName
Else
strUser = WSHShell.Environment("PROCESS").Item("userdomain")
End If

strUserProfile = WSHShell.Environment("PROCESS").Item("userprofile")
strAppData = WSHShell.Environment("PROCESS").Item("appdata")

'LDAP connection
Set objConnection = CreateObject("ADODB.Connection")
objConnection.Open "Provider=ADsDSOObject;"

Set objCommand = CreateObject("ADODB.Command")
objCommand.ActiveConnection = objConnection

objCommand.CommandText = _
"<LDAP://" & strLDAPPath & ">;(&(objectCategory=User)" & _
"(samAccountName=" & strUser & "));" & strFelder & ";subtree"

Set objRecordset = objCommand.Execute
If Not objRecordset.RecordCount = 0 Then
strSignaturName = strInputFilePrefix

'if you pull the signatures from a different path then \\mydomain\netlogon adjust the following line accordingly
strInputFile = "\\" & strLogonServer & "\NetLogon\Signatures\" & strSignaturName & strEX 

'this will write the signature to the user profile - should not need adjustment
strSignaturePath = strAppData & "\Microsoft\Signatures\"
strOutputFile = strSignaturePath & strSignaturName & strEX

Set fso = CreateObject("Scripting.FileSystemObject")
If Not fso.FileExists(strInputFile) Then
MsgBox "Outlook-Signatures input file '" & strInputFile & "' not found or access denied - contact the helpdesk please!"
Exit Sub
End If

If Not fso.FolderExists(strSignaturePath) Then
fso.CreateFolder (strSignaturePath)
End If

'let's see if there is a special sub-folder that comes with the signatures
'note that this might depend on your language - it might be "-Dateien" (german) or "_files" in english - in the end it
'is the signature name plus an Windows language specific extension as a sub-folder 
'both languages are already obeyed - adjust if you have additional versions
'the script will copy the folder to the destination
If strEX = ".htm" Then
If fso.FolderExists("\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "-Dateien") Then
fso.CopyFolder "\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "-Dateien", strAppData & "\Microsoft\Signatures\", True
End If 
If fso.FolderExists("\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "_files") Then
fso.CopyFolder "\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "_files", strAppData & "\Microsoft\Signatures\", True
End If
End If

Set TS = fso.OpenTextFile(strInputFile, 1, False, -2) 'Change 0 to -1 or -2 for unicode files.
Set MyFile = fso.CreateTextFile(strOutputFile, True, False)

While Not TS.AtendOfStream
linesource = Trim(TS.ReadLine)
strCurrentLine = linesource
If InStr(strCurrentLine, "@@") > 0 Then
'------------- SPECIAL SETTINGS -------------
'the code in this section will replace variables in the source files with fields from Active Directory/LDAP. In some cases you might want special 
'replacements or e.g. write extra information - like if mobile number exists write "Cell: " + mobile - if not - do nothing - this might also depend on the current 
'file extension strEX - see examples below

'regular replacements
strCurrentLine = Replace(strCurrentLine, "@@GivenName@@", NZ(objrecordset.Fields("givenName"), ""))
strCurrentLine = Replace(strCurrentLine, "@@LastName@@", NZ(objrecordset.Fields("sn"), ""))
strCurrentLine = Replace(strCurrentLine, "@@Department@@", NZ(objrecordset.Fields("department"), ""))

'file specific and value specific replacement exmaples
If strEX = ".htm" then
'this will ad a line break after in HTML code
strCurrentLine = Replace(Replace(strCurrentLine, "@@Title@@", NZ(objrecordset.Fields("title"), "")),chr(13),"<br>")
Else
'non html files don't need this line-break in this example - you could add a VBNewLine or CHR(10) & CHR(13) etc..
strCurrentLine = Replace(strCurrentLine, "@@Title@@", NZ(objrecordset.Fields("title"), "")) 
End If

strCurrentLine = Replace(strCurrentLine, "@@eMail@@", NZ(objrecordset.Fields("mail"), ""))
strCurrentLine = Replace(strCurrentLine, "@@Phone@@", NZ(objrecordset.Fields("telephoneNumber"), ""))
strCurrentLine = Replace(strCurrentLine, "@@Fax@@", NZ(objrecordset.Fields("facsimileTelephoneNumber"), ""))
strCurrentLine = Replace(strCurrentLine, "@@Street@@", NZ(objrecordset.Fields("streetAddress"), ""))
strCurrentLine = Replace(strCurrentLine, "@@ZIPandCity@@", NZ(objrecordset.Fields("postalCode"), "") & " " & NZ(objrecordset.Fields("l"), ""))

'file specific and value specific replacement exmaples for mobile / cell number or not - the line will only appear if there is a cell phone number in LDAP
If Len(Trim(NZ(objrecordset.Fields("mobile"), ""))) > 0 Then
If strEX = ".htm" Then
strCurrentLine = Replace(strCurrentLine, "@@Mobile@@", "<br>Cell: " & NZ(objrecordset.Fields("mobile"), ""))
Else
strCurrentLine = Replace(strCurrentLine, "@@Mobile@@", "Cell: " & NZ(objrecordset.Fields("mobile"), ""))
End If
Else
strCurrentLine = Replace(strCurrentLine, "@@Mobile@@", "")
End If

'------------- END OF SPECIAL SETTINGS -------------
End If
MyFile.WriteLine strCurrentLine
Wend
Else
MsgBox ("Outlook-Signatures: User object not found in LDAP - please contact the helpdesk!")
End If

objConnection.Close

If strSignaturName <> "" Then
'Registry settings - version specific
'Outlook 2000/2002/XP
If bolUseAsDefaultNewMail Then
WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\NewSignature", strSignaturName
Else
WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\NewSignature", ""
End If
If bolUseAsDefaultReplyMail Then
WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\ReplySignature", strSignaturName
Else
WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\ReplySignature", ""
End If

'Outlook 2003 (sorry - might be I lost the correct RegKey - but I doubgt anyone is still using 2003 - might be the same os the 2007 
'we need some special calculations here - convert the regular strings to a reg-key formar / binary for Outlook 2007 and newer
ReDim arr((Len(strSignaturName) * 2) + 1)
For i = 1 To Len(strSignaturName)
arr((i - 1) * 2) = Asc(Mid(strSignaturName, i, 1))
arr(((i - 1) * 2) + 1) = 0
Next
arr((i - 1) * 2) = 0
arr(((i - 1) * 2) + 1) = 0

ReDim arrClean((Len("") * 2) + 1)
For i = 1 To Len("") 
arrClean((i - 1) * 2) = Asc(Mid("", i, 1))
arrClean(((i - 1) * 2) + 1) = 0
Next
arrClean((i - 1) * 2) = 0
arrClean(((i - 1) * 2) + 1) = 0

'Outlook 2007
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")
RegKeyName = "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002"
RegName = "New Signature"
If bolUseAsDefaultNewMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
RegName = "Reply-Forward Signature"
If bolUseAsDefaultReplyMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

'Outlook 2010
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")
RegKeyName = "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003" 
RegName = "New Signature"
If bolUseAsDefaultNewMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
RegName = "Reply-Forward Signature"
If bolUseAsDefaultReplyMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

'Outlook 2013
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")
RegKeyName = "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002" 
RegName = "New Signature"
If bolUseAsDefaultNewMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
RegName = "Reply-Forward Signature"
If bolUseAsDefaultReplyMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

'Outlook 2016
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")
RegKeyName = "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002" 
RegName = "New Signature"
If bolUseAsDefaultNewMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
RegName = "Reply-Forward Signature"
If bolUseAsDefaultReplyMail Then
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)
Else
BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)
End If
Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv") 
End If

MyFile.Close
TS.Close

Set fso = Nothing
Set TS = Nothing
Set MyFile = Nothing

End Sub

Function NZ(ValueIfNotNull, ValueIfNull)
NZ = ValueIfNotNull
If (IsNull(NZ)) Then NZ = ValueIfNull
End Function

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

'Parameters to execute the script:

'OutlookSignatures.VBS strInputFilePrefix bolUseAsDefaultNewMail bolUseAsDefaultReplyMail

' parameters are separated by spaces - use "" for input-file-names with spaces

' strInputFilePrefix: file name of the signature file - do not add any extensions (.txt / .htm / .rtf)

' bolUseAsDefaultNewMail: TRUE = 1 or -1 / FALSE = 0 - use numeric values

' bolUseAsDefaultReplyMail: TRUE = 1 or -1 / FALSE = 0 - use numeric values

'Example

'SIGNATUR.VBS MySignature 1 1

'generic variables - do not adjust

'Const HKEY_CLASSES_ROOT=&H80000000

'Const HKEY_LOCAL_MACHINE=&H80000002

'Const HKEY_USERS=&H80000003

'Const HKEY_CURRENT_CONFIG=&H80000005

Const HKEY_CURRENT_USER = &H80000001

Dim strLogonServer

Dim strDomain

Dim strEX

Dim strSignaturName

Dim strLDAPPath

Dim strFelder

Dim bolUseAsDefaultNewMail

Dim bolUseAsDefaultReplyMail

'Settings you need to adjust

'------------- BEGIN OF SETTINGS -------------

strDomain = "MyDomain" 'short NetBIOS domain name should be sufficient

strLDAPPath = "dc=MyDomain,dc=local"

'------------- SPECIAL SETTINGS -------------

'Those are the fields / attributes from AD that the script will obey and try to replace

'Additionally there is another special settings section further below that will do the acutal replacement

strFelder = "streetAddress,l,info,postalCode,telephoneNumber,facsimileTelephoneNumber,mail,sn,givenName,department,mobile"

'------------- END OF SETTINGS -------------

'the script assumes it is started from the logonserver respective from the \\mydomain\netlogon directory

Dim oShell

Set oShell = CreateObject("WScript.Shell")

strLogonServer = oShell.expandEnvironmentStrings("%LogonServer%")

strLogonServer = Replace(strLogonServer, "\\", "")

Set oShell = Nothing

'read parameters

strInputFilePrefix = WScript.Arguments.Item(0)

bolUseAsDefaultNewMail = CBool(WScript.Arguments.Item(1))

bolUseAsDefaultReplyMail = CBool(WScript.Arguments.Item(2))

'read files and adjust them

strEX = ".htm"

Convert

strEX = ".rtf"

Convert

strEX = ".txt"

Convert

Sub Convert()

Dim objNetwork

Dim strDestinationPath

Dim strInputFile

Dim strOutputFile

Dim strUser

Dim strUserProfile

Dim i

Dim j

Dim cn

Dim rs

Dim strSignaturNameHex

Dim cmdParam

Dim strUserstrDomain

Dim strAppData

Dim strSignaturePath

Dim fso

Dim strCurrentLine

Set objNetwork = CreateObject("WScript.Network")

Set WSHShell = WScript.CreateObject("WScript.Shell")

On Error Resume Next

'find current Windows user and profile path

strUserDomain = WSHShell.Environment("PROCESS").Item("userdomain")

If LCase(strUserDomain) = LCase(strDomain) Then

strUser = objNetwork.UserName

Else

strUser = WSHShell.Environment("PROCESS").Item("userdomain")

End If

strUserProfile = WSHShell.Environment("PROCESS").Item("userprofile")

strAppData = WSHShell.Environment("PROCESS").Item("appdata")

'LDAP connection

Set objConnection = CreateObject("ADODB.Connection")

objConnection.Open "Provider=ADsDSOObject;"

Set objCommand = CreateObject("ADODB.Command")

objCommand.ActiveConnection = objConnection

objCommand.CommandText = _

"<LDAP://" & strLDAPPath & ">;(&(objectCategory=User)" & _

"(samAccountName=" & strUser & "));" & strFelder & ";subtree"

Set objRecordset = objCommand.Execute

If Not objRecordset.RecordCount = 0 Then

strSignaturName = strInputFilePrefix

'if you pull the signatures from a different path then \\mydomain\netlogon adjust the following line accordingly

strInputFile = "\\" & strLogonServer & "\NetLogon\Signatures\" & strSignaturName & strEX

'this will write the signature to the user profile - should not need adjustment

strSignaturePath = strAppData & "\Microsoft\Signatures\"

strOutputFile = strSignaturePath & strSignaturName & strEX

Set fso = CreateObject("Scripting.FileSystemObject")

If Not fso.FileExists(strInputFile) Then

MsgBox "Outlook-Signatures input file '" & strInputFile & "' not found or access denied - contact the helpdesk please!"

Exit Sub

End If

If Not fso.FolderExists(strSignaturePath) Then

fso.CreateFolder (strSignaturePath)

End If

'let's see if there is a special sub-folder that comes with the signatures

'note that this might depend on your language - it might be "-Dateien" (german) or "_files" in english - in the end it

'is the signature name plus an Windows language specific extension as a sub-folder

'both languages are already obeyed - adjust if you have additional versions

'the script will copy the folder to the destination

If strEX = ".htm" Then

If fso.FolderExists("\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "-Dateien") Then

fso.CopyFolder "\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "-Dateien", strAppData & "\Microsoft\Signatures\", True

End If

If fso.FolderExists("\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "_files") Then

fso.CopyFolder "\\" & strLogonServer & "\NetLogon\signaturen\" & strSignaturName & "_files", strAppData & "\Microsoft\Signatures\", True

End If

Set TS = fso.OpenTextFile(strInputFile, 1, False, -2) 'Change 0 to -1 or -2 for unicode files.

Set MyFile = fso.CreateTextFile(strOutputFile, True, False)

While Not TS.AtendOfStream

linesource = Trim(TS.ReadLine)

strCurrentLine = linesource

If InStr(strCurrentLine, "@@") > 0 Then

'------------- SPECIAL SETTINGS -------------

'the code in this section will replace variables in the source files with fields from Active Directory/LDAP. In some cases you might want special

'replacements or e.g. write extra information - like if mobile number exists write "Cell: " + mobile - if not - do nothing - this might also depend on the current

'file extension strEX - see examples below

'regular replacements

strCurrentLine = Replace(strCurrentLine, "@@GivenName@@", NZ(objrecordset.Fields("givenName"), ""))

strCurrentLine = Replace(strCurrentLine, "@@LastName@@", NZ(objrecordset.Fields("sn"), ""))

strCurrentLine = Replace(strCurrentLine, "@@Department@@", NZ(objrecordset.Fields("department"), ""))

'file specific and value specific replacement exmaples

If strEX = ".htm" then

'this will ad a line break after in HTML code

strCurrentLine = Replace(Replace(strCurrentLine, "@@Title@@", NZ(objrecordset.Fields("title"), "")),chr(13),"<br>")

Else

'non html files don't need this line-break in this example - you could add a VBNewLine or CHR(10) & CHR(13) etc..

strCurrentLine = Replace(strCurrentLine, "@@Title@@", NZ(objrecordset.Fields("title"), ""))

End If

strCurrentLine = Replace(strCurrentLine, "@@eMail@@", NZ(objrecordset.Fields("mail"), ""))

strCurrentLine = Replace(strCurrentLine, "@@Phone@@", NZ(objrecordset.Fields("telephoneNumber"), ""))

strCurrentLine = Replace(strCurrentLine, "@@Fax@@", NZ(objrecordset.Fields("facsimileTelephoneNumber"), ""))

strCurrentLine = Replace(strCurrentLine, "@@Street@@", NZ(objrecordset.Fields("streetAddress"), ""))

strCurrentLine = Replace(strCurrentLine, "@@ZIPandCity@@", NZ(objrecordset.Fields("postalCode"), "") & " " & NZ(objrecordset.Fields("l"), ""))

'file specific and value specific replacement exmaples for mobile / cell number or not - the line will only appear if there is a cell phone number in LDAP

If Len(Trim(NZ(objrecordset.Fields("mobile"), ""))) > 0 Then

If strEX = ".htm" Then

strCurrentLine = Replace(strCurrentLine, "@@Mobile@@", "<br>Cell: " & NZ(objrecordset.Fields("mobile"), ""))

Else

strCurrentLine = Replace(strCurrentLine, "@@Mobile@@", "Cell: " & NZ(objrecordset.Fields("mobile"), ""))

End If

Else

strCurrentLine = Replace(strCurrentLine, "@@Mobile@@", "")

End If

'------------- END OF SPECIAL SETTINGS -------------

End If

MyFile.WriteLine strCurrentLine

Wend

Else

MsgBox ("Outlook-Signatures: User object not found in LDAP - please contact the helpdesk!")

End If

objConnection.Close

If strSignaturName <> "" Then

'Registry settings - version specific

'Outlook 2000/2002/XP

If bolUseAsDefaultNewMail Then

WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\NewSignature", strSignaturName

Else

WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\NewSignature", ""

End If

If bolUseAsDefaultReplyMail Then

WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\ReplySignature", strSignaturName

Else

WSHShell.RegWrite "HKCU\Software\Microsoft\Office\10.0\Common\MailSettings\ReplySignature", ""

End If

'Outlook 2003 (sorry - might be I lost the correct RegKey - but I doubgt anyone is still using 2003 - might be the same os the 2007

'we need some special calculations here - convert the regular strings to a reg-key formar / binary for Outlook 2007 and newer

ReDim arr((Len(strSignaturName) * 2) + 1)

For i = 1 To Len(strSignaturName)

arr((i - 1) * 2) = Asc(Mid(strSignaturName, i, 1))

arr(((i - 1) * 2) + 1) = 0

arr((i - 1) * 2) = 0

arr(((i - 1) * 2) + 1) = 0

ReDim arrClean((Len("") * 2) + 1)

For i = 1 To Len("")

arrClean((i - 1) * 2) = Asc(Mid("", i, 1))

arrClean(((i - 1) * 2) + 1) = 0

arrClean((i - 1) * 2) = 0

arrClean(((i - 1) * 2) + 1) = 0

'Outlook 2007

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

RegKeyName = "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002"

RegName = "New Signature"

If bolUseAsDefaultNewMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

RegName = "Reply-Forward Signature"

If bolUseAsDefaultReplyMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

'Outlook 2010

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

RegKeyName = "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003"

RegName = "New Signature"

If bolUseAsDefaultNewMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

RegName = "Reply-Forward Signature"

If bolUseAsDefaultReplyMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

'Outlook 2013

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

RegKeyName = "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002"

RegName = "New Signature"

If bolUseAsDefaultNewMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

RegName = "Reply-Forward Signature"

If bolUseAsDefaultReplyMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

'Outlook 2016

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

RegKeyName = "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002"

RegName = "New Signature"

If bolUseAsDefaultNewMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

RegName = "Reply-Forward Signature"

If bolUseAsDefaultReplyMail Then

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arr)

Else

BinaryReturn = objRegistry.SetBinaryValue(HKEY_CURRENT_USER, RegKeyName, RegName, arrClean)

End If

Set objRegistry = GetObject("winmgmts:\\.\root\default:StdRegProv")

End If

MyFile.Close

TS.Close

Set fso = Nothing

Set TS = Nothing

Set MyFile = Nothing

End Sub

Function NZ(ValueIfNotNull, ValueIfNull)

NZ = ValueIfNotNull

If (IsNull(NZ)) Then NZ = ValueIfNull

End Function

June 28, 2018 by Florian Rossmark recommendations scripts solutions

Print Server backup script

Print servers need to backed up. This is because of two main reasons. One is that users heavily depend on printers and a not properly working print server will cause imediate helpdesk tickets and unhappy users. The other one is that installing a new driver, might it be a new version, a new model or even an additional manufacturer, can cause other print drivers to act up or even stop working – many administrators know and fear that.

Windows server actually allows you to backup the current print drivers, installed printers and their configuration. You can use this to migrate your printers or to back them up. Of course, you can simply depend on e.g. VMware snapshots, storage level snapshots or other backups of your server. But you also could just export the whole print server configuration while using the scripts below. Those will actually call the Windows API to back up the printers and store it all in a file that you can keep centrally. You don’t just rely on snapshots or a full server backup for e.g. your SQL databases as well, do you?

The script uses a .CMD file that will execute the actual backup and send a email report, while using the SMTPSEND program from Michael Kocum (https://www.dataenter.com/download.asp) for this since I already ad it flying around – you could replace the mail send option with another prepared SMTPSEND client, a VBS script or just remove it completely. Additionally there is a .VBS script that will do a clean up of the target backup files depending on the age of the files in the specified directory.

All the parameters are explained and set in the top part of the .CMD file – I therefor will not explain them here again – you should not need to modify the scripts by default – but feel free to do so. Of course, you should create a scheduled task and execute the .CMD periodically. This can save you time and headache in case you have a malfunctioning print server system. The restore can be easily done through the Print Management MMC that Windows provides you, cause the actual backup files are createed using the same Windows APIs. Your end users will be happy that their printers got back to work in no time, hopefully.

@ECHO OFF
SETLOCAL
REM Printer Backup Script
REM This script creates a Printer Backup on a Windows 2008 or newer Server System
REM (might work as well on Windows Vista or newer)
REM The Script uses Standard Windows Procedures to create a Standard Windows Printer Backup File
REM The Backup will include Printer Settings and Drivers
REM Use "Print Management" to restore the backup 
REM 
REM WARNING
REM -------
REM The Script will automatically search and delete all Files older than intAge in the destination Folder!
REM Always set a destination Folder just for the System you are going to Backup.
REM SubFolders will be ignored.
REM 
REM CONFIG Values
REM -------------
REM strPrintServer = string value / PrintServer to backup - localhost or hostname
REM intAge = integer value / max Age in Days for the Backup Files, the script will automatically delete older Backup Files
REM strPath = string value / SMB or UNC Path to the Backup-Folder, the executing User needs Read/Write access to this path
REM strMailServer = string value / SMTP Server
REM intMailServerPort = integer value / SMTP Server Port
REM strMailFrom = string value / from address, must be able to send Mail over the SMTP
REM strMailTo = string value / mail recipient
REM strMailSuject = string value / mail subject line


REM CONFIG Values
REM =============================================================================================
SET strPrintServer=server.domain.local
SET intAge=3
SET strPath=\\server.domain.local\backup$\Printer\SERVER
SET strMailServer=smtp.domain.com
SET intMailServerPort=25
SET strMailFrom=admin@domain.local
SET strMailTo=admin@domain.local
SET strMailSubject=Printer Backup - SERVERNAME
REM =============================================================================================
REM End CONFIG Values

REM Script-System-Variables, do not change from here on!
SET ScriptLog=%~dp0\Printer_Backup_Log.txt

DEL %ScriptLog% 
ECHO Script-Log Start Date/Time: %Date% / Time: %Time% >> %ScriptLog%
ECHO Script-Parameter: >> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%
ECHO strPrintServer: %strPrintServer% >> %ScriptLog%
ECHO intAge: %intAge% >> %ScriptLog%
ECHO strPath: %strPath% >> %ScriptLog%
ECHO strMailServer: %strMailServer% >> %ScriptLog%
ECHO intMailServerPort: %intMailServerPort% >> %ScriptLog%
ECHO strMailFrom: %strMailFrom% >> %ScriptLog%
ECHO strMailTo: %strMailTo% >> %ScriptLog%
ECHO strMailSubject: %strMailSubject% >> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%

ECHO Get date in format YYYY-MM-DD (assumes the locale is the United States) >> %ScriptLog%
FOR /F "tokens=1,2,3,4 delims=/ " %%A IN ('Date /T') DO SET NowDate=%%D%%C%%B>> %ScriptLog%
FOR /F "tokens=1,2 delims=: " %%A IN ('Time /T') DO SET NowDate=%NowDate%_%%A%%B>> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%

ECHO Starting Printer Backup: >> %ScriptLog% 
%windir%\System32\Spool\Tools\PrintBRM.EXE -B -S %strPrintServer% -F %strPath%\%NowDate%_%strPrintServer%.bak >>"%ScriptLog%"
ECHO =========================================================================== >> %ScriptLog%

ECHO Backup CleanUp >> %ScriptLog%
CSCRIPT %~dp0\Printer_Backup_CleanUp.vbs %intAge% "%strPath%" >> %ScriptLog%
ECHO Backup CleanUp finished >>%ScriptLog%
ECHO =========================================================================== >> %ScriptLog%
ECHO Current Files in Backup Path: >>%ScriptLog%
DIR %strPath% >>%ScriptLog%
ECHO =========================================================================== >> %ScriptLog%

ECHO Script-Log End Date/Time: %Date% / Time: %Time% >> %ScriptLog%
ECHO Sending Info Mail >> %ScriptLog%
%~dp0\SMTPSEND.EXE -f%strMailFrom% -t%strMailTo% -h%strMailServer% -p%intMailServerPort% -s%strMailSubject% -i%ScriptLog% >> %ScriptLog%
ECHO =========================================================================== >> %ScriptLog%

ENDLOCAL

@ECHO OFF

SETLOCAL

REM Printer Backup Script

REM This script creates a Printer Backup on a Windows 2008 or newer Server System

REM (might work as well on Windows Vista or newer)

REM The Script uses Standard Windows Procedures to create a Standard Windows Printer Backup File

REM The Backup will include Printer Settings and Drivers

REM Use "Print Management" to restore the backup

REM

REM WARNING

REM -------

REM The Script will automatically search and delete all Files older than intAge in the destination Folder!

REM Always set a destination Folder just for the System you are going to Backup.

REM SubFolders will be ignored.

REM

REM CONFIG Values

REM -------------

REM strPrintServer = string value / PrintServer to backup - localhost or hostname

REM intAge = integer value / max Age in Days for the Backup Files, the script will automatically delete older Backup Files

REM strPath = string value / SMB or UNC Path to the Backup-Folder, the executing User needs Read/Write access to this path

REM strMailServer = string value / SMTP Server

REM intMailServerPort = integer value / SMTP Server Port

REM strMailFrom = string value / from address, must be able to send Mail over the SMTP

REM strMailTo = string value / mail recipient

REM strMailSuject = string value / mail subject line

REM CONFIG Values

REM =============================================================================================

SET strPrintServer=server.domain.local

SET intAge=3

SET strPath=\\server.domain.local\backup$\Printer\SERVER

SET strMailServer=smtp.domain.com

SET intMailServerPort=25

SET strMailFrom=admin@domain.local

SET strMailTo=admin@domain.local

SET strMailSubject=Printer Backup - SERVERNAME

REM =============================================================================================

REM End CONFIG Values

REM Script-System-Variables, do not change from here on!

SET ScriptLog=%~dp0\Printer_Backup_Log.txt

DEL %ScriptLog%

ECHO Script-Log Start Date/Time: %Date% / Time: %Time% >> %ScriptLog%

ECHO Script-Parameter: >> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO strPrintServer: %strPrintServer% >> %ScriptLog%

ECHO intAge: %intAge% >> %ScriptLog%

ECHO strPath: %strPath% >> %ScriptLog%

ECHO strMailServer: %strMailServer% >> %ScriptLog%

ECHO intMailServerPort: %intMailServerPort% >> %ScriptLog%

ECHO strMailFrom: %strMailFrom% >> %ScriptLog%

ECHO strMailTo: %strMailTo% >> %ScriptLog%

ECHO strMailSubject: %strMailSubject% >> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO Get date in format YYYY-MM-DD (assumes the locale is the United States) >> %ScriptLog%

FOR /F "tokens=1,2,3,4 delims=/ " %%A IN ('Date /T') DO SET NowDate=%%D%%C%%B>> %ScriptLog%

FOR /F "tokens=1,2 delims=: " %%A IN ('Time /T') DO SET NowDate=%NowDate%_%%A%%B>> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO Starting Printer Backup: >> %ScriptLog%

%windir%\System32\Spool\Tools\PrintBRM.EXE -B -S %strPrintServer% -F %strPath%\%NowDate%_%strPrintServer%.bak >>"%ScriptLog%"

ECHO =========================================================================== >> %ScriptLog%

ECHO Backup CleanUp >> %ScriptLog%

CSCRIPT %~dp0\Printer_Backup_CleanUp.vbs %intAge% "%strPath%" >> %ScriptLog%

ECHO Backup CleanUp finished >>%ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO Current Files in Backup Path: >>%ScriptLog%

DIR %strPath% >>%ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ECHO Script-Log End Date/Time: %Date% / Time: %Time% >> %ScriptLog%

ECHO Sending Info Mail >> %ScriptLog%

%~dp0\SMTPSEND.EXE -f%strMailFrom% -t%strMailTo% -h%strMailServer% -p%intMailServerPort% -s%strMailSubject% -i%ScriptLog% >> %ScriptLog%

ECHO =========================================================================== >> %ScriptLog%

ENDLOCAL

Set objArgs = WScript.Arguments

If objArgs.Count > 0 Then

Dim strPath
Dim intAge

intAge = objArgs(0)
strPath = objArgs(1)

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFolder = objFSO.GetFolder(strPath)

For Each objFile in objFolder.Files
If DateDiff("d", objFile.DateLastModified, Now()) > Cint(intAge) Then
On Error Resume Next
objFile.Delete
On Error Goto 0
End If
Next

End If

Set objArgs = WScript.Arguments

If objArgs.Count > 0 Then

Dim strPath

Dim intAge

intAge = objArgs(0)

strPath = objArgs(1)

Set objFSO = CreateObject("Scripting.FileSystemObject")

Set objFolder = objFSO.GetFolder(strPath)

For Each objFile in objFolder.Files

If DateDiff("d", objFile.DateLastModified, Now()) > Cint(intAge) Then

On Error Resume Next

objFile.Delete

On Error Goto 0

End If

June 27, 2018 by Florian Rossmark recommendations scripts server solutions

Automate your SUS clean up

Many companies rely on WSUS respective SUS services from Microsoft – aka. Windows Server Update Services as internal source and control of their update deployment to clients and servers within their network.

One of the big challenges for IT is to keep them clean and performant. The Cleanup-Assistant in the SUS management console tends to run forever and in any case means manual labor over and over again.

Below are two scripts – a CMD script that needs to be adjusted with parameters and a powershell script that will be called with those parameters. The scripts acutally will call the same API as the MMC Assistant does, just that this can be automatically performed via a scheduled task in Windows.

It helps you to keep your SUS slim and more performant.

In any way – I highly recommend to not blindly just enable all categories rather then limiting it to the once you have in place as well as once you reached a certain patch-level even actively denying updates you never will need again (keep in mind, new rolled out systems might still need older updates – but you could possibly refresh your base images or rely on Microsoft update services / online updates for those cases).

The combination of making updates obsolete and actually running a cleanup periodically will improve your SUS server performance.

As for the parameters, those are explained in the CMD script header – therefor I will not explain them here again.

@echo off 
REM SUS - CleanUp Script
REM Script start a Windows PowerShell Script that will acces the WSUS API and start a cleanup.
REM All parameters are set in this file, there is no need to change the PS script.
REM An email with results will be generated as well.

REM ScriptPath: Path where this and the PS1 script resides
REM Log: name of the logfile / shouldn't need to be adjusted
REM PSLog: name of PS script logfile, shouldn't need to be adjusted
REM CleanupScript: name of the PS1 script - you shouldn't need to adjust this

REM SUSServerFQDN: FQDN/full DNS name of the SUS Server (hostname.dns.tld)
REM SUSServerPort: Port-Number (80 / 443 / 8530 / 8531 - depending on your installation, check IIS if necessary)
REM SUSContentDrive: Drive-Letter of the partition that holds the WSUS-Content ( C or D or E - without the : )

REM supersededUpdates: 1 or 0 => Decline updates that have not been approved for 30 days or more, are not currently needed by any clients, and are superseded by an aproved update.
REM expiredUpdates: 1 or 0 => Decline updates that aren't approved and have been expired my Microsoft.
REM obsoleteUpdates: 1 or 0 => Delete updates that are expired and have not been approved for 30 days or more.
REM compressUpdates: 1 or 0 => Delete older update revisions that have not been approved for 30 days or more.
REM obsoleteComputers: 1 or 0 => Delete computers that have not contacted the server in 30 days or more.
REM unneededContentFiles: 1 or 0 => Delete update files that aren't needed by updates or downstream servers.

REM SMTPServer: DNS-Name of the Mail-Server (hostname.dns.tld)
REM MailFrom: Mail-Sender address
REM MailTo: Mail-Recipient address


REM ****** BEGIN Parameter Configuration ****** 
Set ScriptPath=C:\Batch\SUSCleanUp
Set Log=%ScriptPath%\Logs\wsus-cleanup.log 
Set PSLog=%ScriptPath%\Logs\ps-cleanup.log 
Set CleanupScript=%ScriptPath%\SUSCleanUp.ps1

Set SUSServerFQDN=our-sus-server.domain.local
Set SUSServerPort=8530
Set SUSContentDrive=D

Set supersededUpdates=1
Set expiredUpdates=1
Set obsoleteUpdates=1
Set compressUpdates=1
Set obsoleteComputers=1
Set unneededContentFiles=1

Set SMTPServer=relay.domain.com
Set MailFrom=administrator@domain.com
Set MailTo=suslogfiles@domain.com
REM ****** END Paremeter Configuration ******


REM CleanUp and PreRequirements
MD %ScriptPath%\Logs 1>NUL 2>NUL
REM DEL %Log% 1>NUL 2>NUL
DEL %PSLog% 1>NUL 2>NUL

REM Script Execution
echo. >> "%log%" 
echo ############################################################ >> "%log%" 
echo. >> "%log%"
echo Begin Cleanup Report %wsus-server-01% on %date% %time%: >> "%log%" 
echo ------------------------------------------------------------ >> "%log%" 
"%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe" "%cleanupscript% '%susserverfqdn%' '%pslog%' '%smtpserver%' '%mailfrom%' '%mailto%'" %supersededUpdates% %expiredUpdates% %obsoleteUpdates% %compressUpdates% %obsoleteComputers% %unneededContentFiles% %SUSContentDrive% %SUSServerPort% >> "%log%"
echo ------------------------------------------------------------ >> "%log%"
echo End Cleanup Report %wsus-server-01% on %date% %time%: >> "%log%"

@echo off

REM SUS - CleanUp Script

REM Script start a Windows PowerShell Script that will acces the WSUS API and start a cleanup.

REM All parameters are set in this file, there is no need to change the PS script.

REM An email with results will be generated as well.

REM ScriptPath: Path where this and the PS1 script resides

REM Log: name of the logfile / shouldn't need to be adjusted

REM PSLog: name of PS script logfile, shouldn't need to be adjusted

REM CleanupScript: name of the PS1 script - you shouldn't need to adjust this

REM SUSServerFQDN: FQDN/full DNS name of the SUS Server (hostname.dns.tld)

REM SUSServerPort: Port-Number (80 / 443 / 8530 / 8531 - depending on your installation, check IIS if necessary)

REM SUSContentDrive: Drive-Letter of the partition that holds the WSUS-Content ( C or D or E - without the : )

REM supersededUpdates: 1 or 0 => Decline updates that have not been approved for 30 days or more, are not currently needed by any clients, and are superseded by an aproved update.

REM expiredUpdates: 1 or 0 => Decline updates that aren't approved and have been expired my Microsoft.

REM obsoleteUpdates: 1 or 0 => Delete updates that are expired and have not been approved for 30 days or more.

REM compressUpdates: 1 or 0 => Delete older update revisions that have not been approved for 30 days or more.

REM obsoleteComputers: 1 or 0 => Delete computers that have not contacted the server in 30 days or more.

REM unneededContentFiles: 1 or 0 => Delete update files that aren't needed by updates or downstream servers.

REM SMTPServer: DNS-Name of the Mail-Server (hostname.dns.tld)

REM MailFrom: Mail-Sender address

REM MailTo: Mail-Recipient address

REM ****** BEGIN Parameter Configuration ******

Set ScriptPath=C:\Batch\SUSCleanUp

Set Log=%ScriptPath%\Logs\wsus-cleanup.log

Set PSLog=%ScriptPath%\Logs\ps-cleanup.log

Set CleanupScript=%ScriptPath%\SUSCleanUp.ps1

Set SUSServerFQDN=our-sus-server.domain.local

Set SUSServerPort=8530

Set SUSContentDrive=D

Set supersededUpdates=1

Set expiredUpdates=1

Set obsoleteUpdates=1

Set compressUpdates=1

Set obsoleteComputers=1

Set unneededContentFiles=1

Set SMTPServer=relay.domain.com

Set MailFrom=administrator@domain.com

Set MailTo=suslogfiles@domain.com

REM ****** END Paremeter Configuration ******

REM CleanUp and PreRequirements

MD %ScriptPath%\Logs 1>NUL 2>NUL

REM DEL %Log% 1>NUL 2>NUL

DEL %PSLog% 1>NUL 2>NUL

REM Script Execution

echo. >> "%log%"

echo ############################################################ >> "%log%"

echo. >> "%log%"

echo Begin Cleanup Report %wsus-server-01% on %date% %time%: >> "%log%"

echo ------------------------------------------------------------ >> "%log%"

"%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe" "%cleanupscript% '%susserverfqdn%' '%pslog%' '%smtpserver%' '%mailfrom%' '%mailto%'" %supersededUpdates% %expiredUpdates% %obsoleteUpdates% %compressUpdates% %obsoleteComputers% %unneededContentFiles% %SUSContentDrive% %SUSServerPort% >> "%log%"

echo ------------------------------------------------------------ >> "%log%"

echo End Cleanup Report %wsus-server-01% on %date% %time%: >> "%log%"

# WSUS Connection Parameters:
[String]$WSUSServer = $args[0] 
[Boolean]$useSecureConnection = $False
[Int32]$portNumber = $args[12]
[String]$LogFile = $args[1] 
[String]$SMTPServer = $args[2] 
[String]$MailFrom = $args[3]
[String]$MailTO = $args[4]
[String]$SUSDrive = $args[11]
[String]$WMIDiskSpaceRequest = "\\" + $WSUSServer + "\root\cimv2:Win32_logicalDisk.DeviceID='" + $SUSDrive + ":'"

# Windows PowerShell example to check 'If File Exists'
#$FileExists = Test-Path $LogFile
#If ($FileExists -eq $True) {
#Delete old LogFiles
# Remove-Item $LogFile
#}

# Cleanup Parameters:
# Decline updates that have not been approved for 30 days or more, are not currently needed by any clients, and are superseded by an aproved update.
[Boolean]$supersededUpdates = $True
If ($args[5] = 0) {
$supersededUpdates = $False
}
# Decline updates that aren't approved and have been expired my Microsoft.
[Boolean]$expiredUpdates = $True
If ($args[6] = 0) {
$expiredUpdates = $False
}
# Delete updates that are expired and have not been approved for 30 days or more.
[Boolean]$obsoleteUpdates = $True
If ($args[7] = 0) {
$obsoleteUpdates = $False
}
# Delete older update revisions that have not been approved for 30 days or more.
[Boolean]$compressUpdates = $True
If ($args[8] = 0) {
$compressUpdates = $False
}
# Delete computers that have not contacted the server in 30 days or more.
[Boolean]$obsoleteComputers = $True
If ($args[9] = 0) {
$obsoleteComputers = $False
}
# Delete update files that aren't needed by updates or downstream servers.
[Boolean]$unneededContentFiles = $True
If ($args[10] = 0) {
$unneededContentFiles = $False
}
#EndRegion VARIABLES

#Region SCRIPT
# Load .NET assembly
[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration");

# Connect to WSUS Server
$wsusParent = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer($WSUSServer,$useSecureConnection,$portNumber);

# Log the date first
"Microsoft SUS Server CleanUp" | out-file -filepath $LogFile -append -noClobber;
$date = date
$info = "Start Date / Time: " + $date
$info | out-file -filepath $LogFile -append -noClobber;

# Log the SUS Server Name
$info = "Microsoft SUS Server Name: " + $WSUSServer
$info | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

# Log Current Free DiskSpace
$diskbefore = ([wmi]$WMIDiskSpaceRequest)
"Free disk space before cleanup:" | out-file -filepath $LogFile -append -noClobber;
"Drive " + $SUSDrive + ": has {0:#.0} GB free of {1:#.0} GB Total" -f ($diskbefore.FreeSpace/1GB),($diskbefore.Size/1GB) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

# Perform Cleanup
"Microsoft SUS Server CleanUp Results" | out-file -filepath $LogFile -append -noClobber;
"====================================" | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

$CleanupManager = $wsusParent.GetCleanupManager();

"CleanUp: supersededUpdates = " + $supersededUpdates | out-file -filepath $LogFile -append -noClobber;
"----------------------------------" | out-file -filepath $LogFile -append -noClobber;
date | out-file -filepath $LogFile -append -noClobber;
$CleanupScope_supersededUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($supersededUpdates,$False,$False,$False,$False,$False);
$CleanupManager.PerformCleanup($CleanupScope_supersededUpdates) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: expiredUpdates = " + $expiredUpdates | out-file -filepath $LogFile -append -noClobber;
"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;
date | out-file -filepath $LogFile -append -noClobber;
$CleanupScope_expiredUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$expiredUpdates,$False,$False,$False,$False);
$CleanupManager.PerformCleanup($CleanupScope_expiredUpdates) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: obsoleteUpdates = " + $obsoleteUpdates | out-file -filepath $LogFile -append -noClobber;
"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;
date | out-file -filepath $LogFile -append -noClobber;
$CleanupScope_obsoleteUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$obsoleteUpdates,$False,$False,$False);
$CleanupManager.PerformCleanup($CleanupScope_obsoleteUpdates) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: compressUpdates = " + $compressUpdates | out-file -filepath $LogFile -append -noClobber;
"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;
date | out-file -filepath $LogFile -append -noClobber;
$CleanupScope_compressUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$False,$compressUpdates,$False,$False);
$CleanupManager.PerformCleanup($CleanupScope_compressUpdates) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: obsoleteComputers = " + $obsoleteComputers | out-file -filepath $LogFile -append -noClobber;
"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;
date | out-file -filepath $LogFile -append -noClobber;
$CleanupScope_obsoleteComputers = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$False,$False,$obsoleteComputers,$False);
$CleanupManager.PerformCleanup($CleanupScope_obsoleteComputers) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: unneededContentFiles = " + $unneededContentFiles | out-file -filepath $LogFile -append -noClobber;
"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;
date | out-file -filepath $LogFile -append -noClobber;
$CleanupScope_unneededContentFiles = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$False,$False,$False,$unneededContentFiles);
$CleanupManager.PerformCleanup($CleanupScope_unneededContentFiles) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

# Log Current Free DiskSpace
$diskafter = ([wmi]$WMIDiskSpaceRequest)
"Free disk space after cleanup:" | out-file -filepath $LogFile -append -noClobber;
"Drive " + $SUSDrive + ": has {0:#.0} GB free of {1:#.0} GB Total" -f ($diskafter.FreeSpace/1GB),($diskafter.Size/1GB) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

# Log the date after
$date = date
$info = "End Date / Time: " + $date
$info | out-file -filepath $LogFile -append -noClobber;
#EndRegion SCRIPT

# Source: http://gallery.technet.microsoft.com/scriptcenter/90ca6976-d441-4a10-89b0-30a7103d55db#content
# Mail the report...
$message = new-object Net.Mail.MailMessage
$mailer = new-object Net.Mail.SmtpClient($SMTPServer)
$message.From = $MailFrom #"Sender <Sender@Domain.TLD>"
$message.To.Add($MailTo) #("Recipient <Recipient@Domain.TLD>")
$MeinText = "WSUS - Server CleanUp Report " + $WSUSServer
$message.Subject = $MeinText
$message.Body = [string]::join([environment]::NewLine, (get-content $logfile))
$mailer.Send($message)

#Delete Log => will happen at the next run
#Remove-Item $LogFile

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

# WSUS Connection Parameters:

[String]$WSUSServer = $args[0]

[Boolean]$useSecureConnection = $False

[Int32]$portNumber = $args[12]

[String]$LogFile = $args[1]

[String]$SMTPServer = $args[2]

[String]$MailFrom = $args[3]

[String]$MailTO = $args[4]

[String]$SUSDrive = $args[11]

[String]$WMIDiskSpaceRequest = "\\" + $WSUSServer + "\root\cimv2:Win32_logicalDisk.DeviceID='" + $SUSDrive + ":'"

# Windows PowerShell example to check 'If File Exists'

#$FileExists = Test-Path $LogFile

#If ($FileExists -eq $True) {

#Delete old LogFiles

# Remove-Item $LogFile

# Cleanup Parameters:

# Decline updates that have not been approved for 30 days or more, are not currently needed by any clients, and are superseded by an aproved update.

[Boolean]$supersededUpdates = $True

If ($args[5] = 0) {

$supersededUpdates = $False

}

# Decline updates that aren't approved and have been expired my Microsoft.

[Boolean]$expiredUpdates = $True

If ($args[6] = 0) {

$expiredUpdates = $False

}

# Delete updates that are expired and have not been approved for 30 days or more.

[Boolean]$obsoleteUpdates = $True

If ($args[7] = 0) {

$obsoleteUpdates = $False

}

# Delete older update revisions that have not been approved for 30 days or more.

[Boolean]$compressUpdates = $True

If ($args[8] = 0) {

$compressUpdates = $False

}

# Delete computers that have not contacted the server in 30 days or more.

[Boolean]$obsoleteComputers = $True

If ($args[9] = 0) {

$obsoleteComputers = $False

}

# Delete update files that aren't needed by updates or downstream servers.

[Boolean]$unneededContentFiles = $True

If ($args[10] = 0) {

$unneededContentFiles = $False

}

#EndRegion VARIABLES

#Region SCRIPT

# Load .NET assembly

[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration");

# Connect to WSUS Server

$wsusParent = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer($WSUSServer,$useSecureConnection,$portNumber);

# Log the date first

"Microsoft SUS Server CleanUp" | out-file -filepath $LogFile -append -noClobber;

$date = date

$info = "Start Date / Time: " + $date

$info | out-file -filepath $LogFile -append -noClobber;

# Log the SUS Server Name

$info = "Microsoft SUS Server Name: " + $WSUSServer

$info | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

# Log Current Free DiskSpace

$diskbefore = ([wmi]$WMIDiskSpaceRequest)

"Free disk space before cleanup:" | out-file -filepath $LogFile -append -noClobber;

"Drive " + $SUSDrive + ": has {0:#.0} GB free of {1:#.0} GB Total" -f ($diskbefore.FreeSpace/1GB),($diskbefore.Size/1GB) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

# Perform Cleanup

"Microsoft SUS Server CleanUp Results" | out-file -filepath $LogFile -append -noClobber;

"====================================" | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

$CleanupManager = $wsusParent.GetCleanupManager();

"CleanUp: supersededUpdates = " + $supersededUpdates | out-file -filepath $LogFile -append -noClobber;

"----------------------------------" | out-file -filepath $LogFile -append -noClobber;

date | out-file -filepath $LogFile -append -noClobber;

$CleanupScope_supersededUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($supersededUpdates,$False,$False,$False,$False,$False);

$CleanupManager.PerformCleanup($CleanupScope_supersededUpdates) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: expiredUpdates = " + $expiredUpdates | out-file -filepath $LogFile -append -noClobber;

"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;

date | out-file -filepath $LogFile -append -noClobber;

$CleanupScope_expiredUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$expiredUpdates,$False,$False,$False,$False);

$CleanupManager.PerformCleanup($CleanupScope_expiredUpdates) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: obsoleteUpdates = " + $obsoleteUpdates | out-file -filepath $LogFile -append -noClobber;

"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;

date | out-file -filepath $LogFile -append -noClobber;

$CleanupScope_obsoleteUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$obsoleteUpdates,$False,$False,$False);

$CleanupManager.PerformCleanup($CleanupScope_obsoleteUpdates) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: compressUpdates = " + $compressUpdates | out-file -filepath $LogFile -append -noClobber;

"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;

date | out-file -filepath $LogFile -append -noClobber;

$CleanupScope_compressUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$False,$compressUpdates,$False,$False);

$CleanupManager.PerformCleanup($CleanupScope_compressUpdates) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: obsoleteComputers = " + $obsoleteComputers | out-file -filepath $LogFile -append -noClobber;

"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;

date | out-file -filepath $LogFile -append -noClobber;

$CleanupScope_obsoleteComputers = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$False,$False,$obsoleteComputers,$False);

$CleanupManager.PerformCleanup($CleanupScope_obsoleteComputers) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: unneededContentFiles = " + $unneededContentFiles | out-file -filepath $LogFile -append -noClobber;

"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;

date | out-file -filepath $LogFile -append -noClobber;

$CleanupScope_unneededContentFiles = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$False,$False,$False,$unneededContentFiles);

$CleanupManager.PerformCleanup($CleanupScope_unneededContentFiles) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

# Log Current Free DiskSpace

$diskafter = ([wmi]$WMIDiskSpaceRequest)

"Free disk space after cleanup:" | out-file -filepath $LogFile -append -noClobber;

"Drive " + $SUSDrive + ": has {0:#.0} GB free of {1:#.0} GB Total" -f ($diskafter.FreeSpace/1GB),($diskafter.Size/1GB) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

# Log the date after

$date = date

$info = "End Date / Time: " + $date

$info | out-file -filepath $LogFile -append -noClobber;

#EndRegion SCRIPT

# Source: http://gallery.technet.microsoft.com/scriptcenter/90ca6976-d441-4a10-89b0-30a7103d55db#content

# Mail the report...

$message = new-object Net.Mail.MailMessage

$mailer = new-object Net.Mail.SmtpClient($SMTPServer)

$message.From = $MailFrom #"Sender <Sender@Domain.TLD>"

$message.To.Add($MailTo) #("Recipient <Recipient@Domain.TLD>")

$MeinText = "WSUS - Server CleanUp Report " + $WSUSServer

$message.Subject = $MeinText

$message.Body = [string]::join([environment]::NewLine, (get-content $logfile))

$mailer.Send($message)

#Delete Log => will happen at the next run

#Remove-Item $LogFile

June 26, 2018 by Florian Rossmark scripts server solutions

Solution for VSS exceptions with VMware guests / VM tools

Today’s blog is about “Solution for VSS exceptions with VMware guests / VM tools” and was initially posted by myself here: https://vox.veritas.com/t5/Backup-Exec/Solution-for-VSS-exceptions-with-VMware-guests-VM-tools/td-p/829072 – it actually became a KB entry for an as of today older version of Veritas Backup Exec – but I did not want to leave it out of my blog.. Here is the link to the KB article: https://www.veritas.com/docs/000009506

Here is the article I wrote – starting with a description of the actual issue:

We have been experiencing VSS issues with VMware guests in regards to the installed Backup Exec Agent and a previously installed VMware Tools VSS option.

Uninstalling the VMware Tools VSS option in various ways including restarts did not fix our issues. If you search the internet for solutions, you find many attempts but no real solution or explanation.

One of our admins spend several hours with the Veritas support without a solution, he was about to escalate the issue with them, when we found the root cause and could actually fix our issues.

First the steps to solve this:

Uninstall the VMware Tools VSS option (no restart will be requiered)
Make sure VMware VSS service was deleted
1. If this is not the case, you might need to do so manually and remove additional DLL’s etc. as well as restart the system, but this is independent from this solution
You might have already done steps 1 and 2 but you still get VSS exceptions from the backup that says you have more than one VSS agent installed:
1. V-79-8192-38331 – The backup has detected that both the VMware VSS Provider and the Symantec VSS Provider have been installed on the virtual machine ‘hostname’. However, only one VSS Provider can be used on a virutal machine. You must uninstall the VMware VSS Provider.
2. Now you wonder what causes this and you get stuck
3. You could uninstall the Veritas/Symantec Backup Exec Agent and only back the system up per VMDK
4. You would lose the GRT / granular backup / restore capabilities
Check your registry for the following reg key
1. HKLM\System\CurrentControlSet\Services\BeVssProviderConflict
2. If this key exists, but your VMware VSS provider is uninstalled, you need to follow up with step 5
Open a notepad as administrator
Open this file in the notepad
1. C:\ProgramData\VMware\VMware Tools\manifest.txt
Search for the following two entries:
1. Vcbprovider_2003.installed
2. vcbprovider.installed
Make sure both of them are set to FALSE, most likely one of them is TRUE
Run a test backup
1. This test backup now should not show the exception anymore
2. The registry key should vanish (refresh/press F5) without you taking action

So what happened?

You uninstalled the VMware Tools VSS provider, but this manifest file did not get updated. We actually could see that it sometimes does get updated and sometimes does not. This seems to be some kind of issue with the VMware Tools uninstalled/installer.

But why this manifest.txt file?

As we found out, there scripts that get executed by Symantec/Veritas Backup Exec before the backup. You might find them in two locations, and it seems to depend a bit on the Windows version which script is executed (at which location). You could edit them both and just undo the checks in the scripts, but this wouldn’t be correct. It is more correct to update the manifest.txt file. If you want to, you can check the date/time of the manifest.txt file before you change it – you might see it was not updated while you uninstalled the VMware Tools VSS provider (assuming you did only do this and not do additional installs/uninstalls within the VMware Tools / please note as well that this only is true when you still experienced those issues).

Now, back to those scripts, you find them here:

C:\Windows
C:\Program Files\Symantec\Backup Exec\RAWS\VSS Provider

The name of the script that matters:

pre-freeze-script.bat

This script checks several DLLs, registry entries, paths and on Windows 2008 and newer the ProgramData-Path for this specific manifest.txt file and the two entries mentioned.

Once you uninstall the VMware VSS provider, and the file did not get updated, you might see this issue and wonder how to solve it. The solution is to simply update it to mirror the uninstallation of the VMware VSS provider (vcbprovider). We double checked this with several installations and could see if the file actually gets updated, those two values are set to FALSE, if it doesn’t, at least one of the values remains true, what causes the pre-freeze-script.bat to write the registry key mentioned earlier and therefor causing the issue in the backup – exceptions.

If you still have the same issues after updating the manifest.txt, simply check all the DLL’s that are mentioned in the script and make sure they don’t exist. You might also consider to manually delete the registry-key (it seems to be just a dumy-key) to make sure there is no issue that prevents the script from deleting it. Make sure it does not re-appear after a backup! Otherwise you might still have some DLLs left on your system that cause the script to re-create the registry key.

Hope this helps a few of you out there. This was an ongoing issue for a while and I came accross those issues many times ever since Windows 2008. This applies to Windows 2008 R2, Windows 2012, Windows 2012 R2 and pretty sure to Windows 2016 as well.

It helped us getting rid of those issues completely and actually not even needing a single restart of the guest VM to solve the issues (removing the VMware VSS provide did not need a restart).

June 25, 2018 by Florian Rossmark configuration scripts server solutions

Password expiration notifications for end users

Today I wanted to share a script with you that allows you to inform your users per email that their password will expire or even is expired and reminds them about your password policies like complex passwords and how to chose a password. This is a simple VBScript and can easily be adjusted. The email will be generated from a file, in this case a HTML file that you provide. You can adjust the content of this HTML file as you need it. There are sure many commercial solutions out there that can do more then this script, but if you want to save the money and are satisfied with the provided options, this sure can be a good alternative.

Let me mention one thing about passwords first – most of us live with the usual policy that passwords should be changed periodically and need to be of a certain length and complexity. We all live with the daily calls of the help-desk about forgotten passwords, not changed passwords (pretty much why I wrote the script) and so on – what changed was a new recommendation in late 2017 or early 2018 that actually is based on statistics and data and now says – yes – complex passwords and certain lengths – but do not enforce periodic changes of those passwords due to this actually resulting in to less secure passwords while users might only change a number or even write those passwords more likely down and therefor compromising the whole attempt to secure the system.

Anyways – the next few lines will explain the parameters you can adjust in the top section of the VBS script – further below I will post the script and an example HTML file so you can start right away.

The options are between the lines 7 and 61 – don’t be scared – most of them are pretty simple to understand and are actually explained in the script itself. You should not need to modify anything outside those two lines.

About the parameter naming convention and possible values:

starting with str as strings – those expect text-markers and alphanumeric values “text”
starting with int as integer values – those are direct numeric values – e.g. 123
starting with bol are boolean values – those can be either TRUE or FALSE – meaning on or off

Here are the options you can set:

strSMTPServer: SMTP mail server DNS name or IP address
intSMTPServerPort: SMTP mail server port – normally 25
strFrom: SMTP mail from address
strToAdmin: SMTP mail to address for administrator emails
strAdminMailSubject: subject for mail to administrators
strUserMailSubjectExpired: subject for mails to user when password is expired
strUserMailSubjectWillExpire: subject for mail to user when password will expire – the exact word REPLACEWITHDAYS will be replaced by the days left value so mention it in the subject line if you want to see the value there
strBodyURL: URL or full file-path (HTML file path e.g. file://) to import for body, the entire content of this URL/FILE will be imported to the body of the email and should explain ways how to change the password
strAttachment: full file-path to an attachment for the email to the users / leave empty if no attachment
strLDAPSortColumn: per default: pwdLastSet / sort column for LDAP query
intStartWithPWexpiresInDays: If the passwords expires in days N or less, the script will inform the user – keep in mind – if you run the script daily, those users will get an email every day once their password will expire in less then the indicated days. 5 is sure a good start.
bolIgnoreDisabledAccounts: Disabled accounts should always be ignored
bolInformAdminAboutPWexpires: this will inform the admin about expiring passwords
bolInformAdminAboutPWisExpired: this will inform the admin about accounts with expired passwords
bolInformAdminAboutPWneverExpires: this will inform the admin about accounts with password set to never expire
bolInformAdminAboutUserCantChangePW: this will inform the admin about users who are not allowed to change their password
bolInformAdminAboutAccountDisabled: this will inform the admin about disabled accounts found – this would have been done in ADS by an administrator
bolInformAdminAboutExpiredUserAccount: this will inform the admin if the user account has an expiration date and the account is expired
bolInformAdminAboutAccountWithoutEMail: this will inform the admin about accounts without a set email address
bolInformAdminAboutStillGoodPasswords: this will inform the admin about users/passwords that are still valid
bolInformAdminAboutIgnoredUsersExcludedByGroup: this will inform the admin about users that have been ignored by the strGroupsExclude filter
Please Note: the status account locked will not be checked, this should be corrected automatically by the default security GPO instead (will be in most cases by default)
strSearchOUs: Filter Priority 1 – only users in those OU paths will be processed. Use LDAP DN like: “OU=Folder,OU=Folder,DC=Domain,DC=local”, you do not need to include the DC=Domain,DC=local – the script will add this information if necessary. Use | (pipe) if you want to add more then one LDAP DN path. Leave empty (“”) to disable this filter
strGroupsExclude : Filter Priority 2 – if the user object is still not excluded, this group exclude filter will be applied. If the user is member of one of those groups (if multiple groups are defined), he will be ignored. Use | (pipe) if you want to add more then one GroupName. Leave empty (“”) to disable this filter. Example: “Group Number1|GroupNumber2”
strGroupsInclude: Filter Priority 3 – if the user object is still not excluded, this group Include filter will be applied. The user has to be a member of one of those groups (if multiple groups are defined). Use | (pipe) if you want to add more then one GroupName. Leave empty (“”) to disable this filter. Example: “Group Number1|GroupNumber2”
bolDebug: set TRUE for script-output, highly recommended to execute the Script in CMD with CSCRIPT <ScriptName> so you see it in a command window instead of dialog boxes.
bolAttachDebugToAdminMail: the debug output will be attached to the admin-mail (independent from bolDebug)
bolTestDebugOutputToConsoleOnly: this will disable the mail.send – only output to the CMD will be generated, please enable bolDebug
bolRedirectMailToAdmin: this will redirect all mails to the admin, instead of sending them to the user – the subject line will include the user-mail address in this case – this allows you to do a real test and actually see what would be send out to whom – without actually sending the emails to the end user
bolAdminMailOnly: this will send the admin-mail only, no user mail will be generated

'This VBScript will run aggainst the ActiveDirectory Domain the executing User is a Member of. 
'The executing User does not need to be an Domain-Administrator of any kind, a simply User is able to read the necessary information from ActiveDirectory
'
'Please configure the following Options - the Script does not accept or expect any Start-Parameter
'
'Version 2.2 - 04/12/2017: Florian Rossmark
'---------------------------------- START OPTIONS ----------------------------------

Const strSMTPServer = "relay.domain.com" 'SMTP Mail-Server to use
Const intSMTPServerPort = 25 'SMTP Mail-Server connection Port Number
Const strFrom = "pwdscript@domain.com" 'SMTP Mail From Address
Const strToAdmin = "helpdesk@domain.com" 'SMTP Mail To Address for Administrator 
Const strAdminMailSubject = "Company Name - User Password Script Results to Admin" 'Subject for Mail to Admin
Const strUserMailSubjectExpired = "Your password has expired!" 'Subject for Mail to User when Password is expired
Const strUserMailSubjectWillExpire = "Your password will expire in REPLACEWITHDAYS days" 'Subject for Mail to User when Password will expire - the exact word REPLACEWITHDAYS will be replaced by the days left value
Const strBodyURL = "file://C:/scripts/PWD/PWDExpire.html" 'URL or full file-path (HTML) to import for Body, the entire content of this URL/FILE will be imported to the Body of the email and should explain ways how to change the password
Const strAttachment = "" 'full File-Path to an attachment for the email to the users / leave empty if no attachment

Const strLDAPSortColumn = "pwdLastSet" 'per default: pwdLastSet / sort column for LDAP query

Const intStartWithPWexpiresInDays = 5 'If the Passwords expires in days N or less, the script will inform the user

Const bolIgnoreDisabledAccounts = True 'Disabled accounts should always be ignored

Const bolInformAdminAboutPWexpires = True 'This will inform the Admin about expiring passwords
Const bolInformAdminAboutPWisExpired = True 'This will inform the Admin about accounts with expired Passwords
Const bolInformAdminAboutPWneverExpires = True 'This will inform the Admin about accounts with password set to never expire
Const bolInformAdminAboutUserCantChangePW = True 'This will inform the Admin about users who are not allowed to change their password
Const bolInformAdminAboutAccountDisabled = True 'This will inform the Admin about disabled accounts found - this would have been done in ADS by an administrator
Const bolInformAdminAboutExpiredUserAccount = True 'This will inform the admin if the User Account has an expiration date and the account is expired
Const bolInformAdminAboutAccountWithoutEMail = True 'This will inform the Admin about accounts without a set email address
Const bolInformAdminAboutStillGoodPasswords = True 'This will inform the Admin about Users/Passwords that are still valid
Const bolInformAdminAboutIgnoredUsersExcludedByGroup = True 'This will inform the Admin about Users that have been ignored by the strGroupsExclude filter
'Please Note: Status Account Locked will not be checked, this should be corrected automatically by the Default Security GPO instead (will be in most cases by default)

'Filter Priority 1 - only Users in those OU Paths will be processed
'Use LDAP DN like: "OU=Folder,OU=Folder,DC=Domain,DC=local", you do not need to include the DC=Domain,DC=local - the Script will add this information if necessary
'Use | (pipe) if you want to add more then one LDAP DN Path
'Leave empty ("") to disable this filter
Const strSearchOUs = "" '"OU=Users,OU=Site,DC=domain,DC=local"

'Filter Priority 2 - if the User Object is still not excluded, this Group Exclude filter will be applied
'If the user is member of one of those groups (if multiple groups are defined), he will be ignored
'Use | (pipe) if you want to add more then one GroupName
'Leave empty ("") to disable this filter
'Example: "Group Number1|GroupNumber2"
Const strGroupsExclude = "No Password notification emails"

'Filter Priority 3 - if the User Object is still not excluded, this Group Include filter will be applied
'The user has to be a member of one of those groups (if multiple groups are defined)
'Use | (pipe) if you want to add more then one GroupName
'Leave empty ("") to disable this filter
'Example: "Group Number1|GroupNumber2"
Const strGroupsInclude = ""

Const bolDebug = True 'Set TRUE for Script-Output, highly recommended to execute the Script in CMD with CSCRIPT <ScriptName>
Const bolAttachDebugToAdminMail = False 'The Debug Output will be attached to the Admin-Mail (independent from bolDebug)
Const bolTestDebugOutputToConsoleOnly = False 'This will disable the Mail.Send - only output to the CMD will be generated, please enable bolDebug 
Const bolRedirectMailToAdmin = True 'This will redirect all Mails to the Admin, instead of sending them to the User - the Subject line will include the User-Mail Address in this case
Const bolAdminMailOnly = False 'This will send the Admin-Mail only, no User Mail will be generated
'---------------------------------- END OPTIONS ----------------------------------

'---------------------------------- Script starts here ----------------------------------
'---------------------------------- please do not modify after this line ----------------------------------

'Reference: https://msdn.microsoft.com/en-us/library/aa772300(v=vs.85).aspx
Const ADS_UF_DONT_EXPIRE_PASSWD = 65536
Const ADS_UF_PASSWD_CANT_CHANGE = 64
Const ADS_UF_PASSWORD_EXPIRED = 8388608
Const ADS_ACETYPE_ACCESS_DENIED_OBJECT = 6
Const CHANGE_PASSWORD_GUID = "{ab721a53-1e2f-11d0-9819-00aa0040529b}"

'A few Global Variables for the Admin-Mail
Dim strAdminPWexpires, strAdminPWisExpired, strAdminPWneverExpires, strAdminUserCantChangePW, strAdminAccountDisabled, strAdminExpiredUserAccount, strAdminAccountWithoutEMail, strAdminPWstillGood, strAdminIgnoredUsersExcludedByGroup
Dim strAdminErrorUsers
Dim strAdminDebug

SearchADS() 'Let's Start the actual process

'starts the actual search procedure - in a sub so it is easier to keep overview of the script
Sub SearchADS()

Dim objADSRoot, objADSDomain, objADSConnection, objADSCommand, objMaxPWDage, objUser
Dim intMaxPWDage, intDaysLeft
Dim bolProcessUser
Dim cntArray
Dim arrSearchOUs, arrGroupsExclude, arrGroupsInclude
Dim iADSCommand
Dim strFirstFoundGroupMembership

arrGroupsExclude = Split(strGroupsExclude, "|")
arrGroupsInclude = Split(strGroupsInclude, "|")

'Connect to ADS and get Users
Set objADSRoot = GetObject("LDAP://rootDSE") 
Set objADSDomain = GetObject("LDAP://" & objADSRoot.Get("defaultNamingContext"))
Set objMaxPWDage = objADSDomain.Get("maxPwdAge") 'please note, this script can't obey the latest ADS multible password GPO rules, it will only follow the standard with only one password rule
intMaxPWDage = CCur((objMaxPWDage.HighPart * 2 ^ 32) + objMaxPWDage.LowPart) / CCur(-864000000000) 
If Not intMaxPWDage > 0 Then 'Passwords won't expire at all
ScriptDebug("intMaxPWDage is set to: " & intMaxPWDage & " - Script stopped")
SendEmailNotification True, "", True, 0, "intMaxPWDage is incorrect, please check ADS configuration. Script aborded" 'Inform that there is no expiration configuration in Active Directory
Exit Sub 'Stop the Sub / End the Search
End If
Set objADSConnection = CreateObject("ADODB.Connection")
objADSConnection.Open "Provider=ADsDSOObject;"
Set objADSCommand = CreateObject("ADODB.Command")
objADSCommand.ActiveConnection = objADSConnection
If Not Len(strSearchOUs) > 0 Then
ReDim arrSearchOUs(0) 'we still need an array to run the For Next 
arrSearchOUs(0) = ""
Else
arrSearchOUs = Split(strSearchOUs, "|")
End If
For iADSCommand = 0 To UBound(arrSearchOUs) 'we already filter OUs if necessary - filter priority 1
If Len(strSearchOUs) > 0 Then 'we need everytime a new objADSDomain to set the Filter based on the OU
If Not Right(arrSearchOUs(iADSCommand),Len(objADSRoot.Get("defaultNamingContext"))) = objADSRoot.Get("defaultNamingContext") Then
If Not Right(arrSearchOUs(iADSCommand),1) = "'" Then
arrSearchOUs(iADSCommand) = arrSearchOUs(iADSCommand) & ","
End If
arrSearchOUs(iADSCommand) = arrSearchOUs(iADSCommand) & objADSRoot.Get("defaultNamingContext")
End If
ScriptDebug("Searching LDAP Path: " & arrSearchOUs(iADSCommand))
Set objADSDomain = GetObject("LDAP://" & arrSearchOUs(iADSCommand))
End If
'samAccountType=805306368 / this is the correct value for USERS only - a search for the ObjectClass USER will also list Contacts
objADSCommand.CommandText = "<" & objADSDomain.ADsPath & ">;(&(samAccountType=805306368));userAccountControl,sAMAccountName,givenName,sn,mail,distinguishedName,lockoutTime;subtree"
objADSCommand.Properties("Sort on") = strLDAPSortColumn
Set rs = objADSCommand.Execute
If Not rs.EOF Then
Do While Not rs.EOF
ScriptDebug("") 'Empty Line before each run for easier to read output
ScriptDebug("PROCESSING USER: " & NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")")
intDaysLeft = 0
bolProcessUser = True

'Priority 2 - Exclude the following groups
If Len(strGroupsExclude) > 0 Then 
strFirstFoundGroupMembership = "" 'just to make sure, lets clean the variable
If IsUserInGroup(rs("distinguishedName"), arrGroupsExclude, strFirstFoundGroupMembership) Then 'User is Member of the Group, we ignore him
ScriptDebug("..USER IS MEMBER OF EXCLUDED GROUP: " & strFirstFoundGroupMembership & " - IGNORING USER")
bolProcessUser = False
'old info - 'We don't inform the Admin in this case, would be done over the Debug Info
If bolInformAdminAboutIgnoredUsersExcludedByGroup Then
strAdminIgnoredUsersExcludedByGroup = AddAdminInfoTo(strAdminIgnoredUsersExcludedByGroup, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info
End If
End If
End If

'Priority 3 - Include the following groups
If bolProcessUser Then 'do we still go on with this User?
If Len(strGroupsInclude) > 0 Then
strFirstFoundGroupMembership = "" 'just to make sure, lets clean the variable
If Not IsUserInGroup(rs("distinguishedName"), arrGroupsInclude, strFirstFoundGroupMembership) Then 'User is Member of the Group, we ignore him
ScriptDebug("..USER IS NOT A MEMBER OF ANY OF THE INCLUDED GROUPS - IGNORING USER")
bolProcessUser = False
'old info - 'We don't inform the Admin in this case, would be done over the Debug Info
If bolInformAdminAboutIgnoredUsersExcludedByGroup Then
strAdminIgnoredUsersExcludedByGroup = AddAdminInfoTo(strAdminIgnoredUsersExcludedByGroup, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info
End If 
Else 'User will be noramlly proccessed, we still inform about it in the Script-Debug
ScriptDebug("..USER IS MEMBER OF INCLUDED GROUP: " & strFirstFoundGroupMembership & " - PROCESSING USER")
End If 
End If
End If

'Priority 4 - disabled account? this would have been done by an administrator
If bolProcessUser Then 'do we still go on with this User?
If IsAccountDisabled(rs("distinguishedName")) Then 'Account is disabled
ScriptDebug("..DISABLED USER ACCOUNT FOUND")
If bolIgnoreDisabledAccounts Then 'do we ignore this Account?
bolProcessUser = False
End If
If bolInformAdminAboutAccountDisabled Then
'strAdminAccountDisabled = AddAdminInfoTo(strAdminAccountDisabled, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info
strAdminAccountDisabled = AddAdminInfoTo(strAdminAccountDisabled, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), ""), True) 'Add to Admin Info
End If
End If
End If

'Priority 5 - Will User Account expire? (we only check if it is expired, if yes we take action)
If bolProcessUser Then 'do we still go on with this User?
If IsUserAccountExpired(rs("distinguishedName"), dtmExpiration) Then
bolProcessUser = False
ScriptDebug("..USER ACCOUNT IS EXPIRED SINCE: " & dtmExpiration)
If bolInformAdminAboutExpiredUserAccount Then
'strAdminExpiredUserAccount = AddAdminInfoTo(strAdminExpiredUserAccount, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - User expired since: " & dtmExpiration) 'Add to Admin Info
strAdminExpiredUserAccount = AddAdminInfoTo(strAdminExpiredUserAccount, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat(dtmExpiration), True) 'Add to Admin Info
End If
End If
End If

'Priority 6 - password never expires? this would have been done by an administrator
If bolProcessUser Then 'do we still go on with this User?
If PasswordDoesExpire(rs("userAccountControl")) Then 'Password does not expire
ScriptDebug("..USER WITH PASSWORD WILL NOT EXPIRE FOUND")
bolProcessUser = False
If bolInformAdminAboutPWneverExpires Then
'strAdminPWneverExpires = AddAdminInfoTo(strAdminPWneverExpires, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info
strAdminPWneverExpires = AddAdminInfoTo(strAdminPWneverExpires, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), ""), True) 'Add to Admin Info
End If
End If 
End If

'Priority 7 - User can't even change the password? this would have been done by an administrator
If bolProcessUser Then 'do we still go on with this User?
If UserCantChangePassword(rs("distinguishedName")) Then 'User can't change Password
ScriptDebug("..USER WITH CAN'T CHANGE PASSWORD FOUND")
bolProcessUser = False
If bolInformAdminAboutUserCantChangePW Then
'strAdminUserCantChangePW = AddAdminInfoTo(strAdminUserCantChangePW, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info
strAdminUserCantChangePW = AddAdminInfoTo(strAdminUserCantChangePW, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), ""), True) 'Add to Admin Info
End If
End If
End If

'Priority 8 - User does not have an EMail Address? can't inform User if PW is about to expire what shall we do?
If bolProcessUser Then 'do we still go on with this User?
If Not Len(NZ(rs("mail"), "")) > 0 Then 'User is missing email address
ScriptDebug("..USER WITHOUT EMAIL ADDRESS FOUND")
bolProcessUser = False
If bolInformAdminAboutAccountWithoutEMail Then
'strAdminAccountWithoutEMail = AddAdminInfoTo(strAdminAccountWithoutEMail, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days Left: " & (GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)) 'Add to Admin Info
strAdminAccountWithoutEMail = AddAdminInfoTo(strAdminAccountWithoutEMail, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info
End If
End If 
End If

'Priority 9 - now we check the Password Age and take action
If bolProcessUser Then 'do we still go on with this User?
If PasswordIsExpired(rs("userAccountControl")) Then 'The Password is already expired? We need to take action / this will be double checked later on with a calculation
ScriptDebug("..PASSWORD IS EXPIRED")
SendEmailNotification False, NZ(rs("mail"), ""), True, 0, "" 'Inform the USER about the expired Password 
If bolInformAdminAboutPWisExpired Then
'strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info
strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info
End If
Else 'Password is not expired yet, how many days does the User have left?
Set objUser = GetObject("LDAP://" & rs("distinguishedName"))

intDaysLeft = GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage)

If intDaysLeft <= 0 Then 'we have a number of days left
If intStartWithPWexpiresInDays >= (intDaysLeft * -1) Then 'User is to be informed, his days left are less then defined
ScriptDebug("..PASSWORD FOR USER WILL EXPIRE IN: " & (intDaysLeft * -1) & " DAYS")
SendEmailNotification False, NZ(rs("mail"), ""), False, (intDaysLeft * -1), "" 'Inform the USER that the Password will expire
If bolInformAdminAboutPWexpires Then
'strAdminPWexpires = AddAdminInfoTo(strAdminPWexpires, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days Left: " & (intDaysLeft * -1)) 'Add to Admin Info
strAdminPWexpires = AddAdminInfoTo(strAdminPWexpires, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((intDaysLeft * -1)), True) 'Add to Admin Info
End If
Else 'User has more days left then needed by Script Configuration
'we do not need to take action - we do not even send Mail to the Admin
ScriptDebug("..USER PASSWORD IS STILL GOOD - DAYS LEFT: " & (intDaysLeft * -1))
If bolInformAdminAboutStillGoodPasswords Then
'strAdminPWstillGood = AddAdminInfoTo(strAdminPWstillGood, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days Left: " & (intDaysLeft * -1)) 'Add to Admin Info
strAdminPWstillGood = AddAdminInfoTo(strAdminPWstillGood, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((intDaysLeft * -1)), True) 'Add to Admin Info
End If
End If
Else 'Password is already expired and needs to be changed now / second check, first one might not give the needed information
ScriptDebug("..PASSWORD IS EXPIRED FOR: " & (intDaysLeft * -1) & " DAYS")
SendEmailNotification False, NZ(rs("mail"), ""), True, 0, "" 'Inform the USER about the expired Password 
If bolInformAdminAboutPWisExpired Then
'strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days expired: " & (intDaysLeft * -1)) 'Add to Admin Info
strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((intDaysLeft * -1)), True) 'Add to Admin Info
End If
End If

Set objUser = Nothing 'to make sure the Object is release
End If
End If 

rs.MoveNext
Loop
End If
Set rs = Nothing
Next 'Next from arrSearchOUs
Set objADSCommand = Nothing
Set objADSConnection = Nothing
Set objADSDomain = Nothing
Set objADSRoot = Nothing

ScriptDebug("")
ScriptDebug("SCRIPT ENDED SUCCESSFULLY => Sending Admin Mail")
SendEmailNotification True, "", True, 0, GenerateAdminMailBody 'Send the final admin notification with the requested information

End Sub

'Function returns days left for Password of User-Object (uses default Value intDaysLeft)
Function GetPWDaysLeft(strDistinguishedName, strGivenName, strSN, strsAMAccountName, intDaysLeft, intMaxPWDage)

Dim objUser

Set objUser = GetObject("LDAP://" & strDistinguishedName)

On Error Resume Next
'intDaysLeft will be negative, like a countdown, T minus DAYS
intDaysLeft = DateDiff("d", objUser.PasswordLastChanged, Now) - intMaxPWDage
If Err Then
If Err.Number = &h8000500d Then 'PWD was just changed
intDaysLeft = intMaxPWDage
ScriptDebug("..USER PASSWORD WAS JUST CHANGED")
'we don't send any Mails about this
Else 'unexpexted Error occured - this shouldn't happen at all!
ScriptDebug("..UNEXPECTED ERROR (UserPasswordLastChanged)")
'strAdminErrorUsers = AddAdminInfoTo(strAdminErrorUsers, strGivenName & " " & strSN & " (" & strsAMAccountName & ")") 'Add to Admin Info
strAdminErrorUsers = AddAdminInfoTo(strAdminErrorUsers, strGivenName & "</td><td>" & strSN & "</td><td>" & strsAMAccountName, True) 'Add to Admin Info
End If
End If
Err.Clear
On Error Goto 0

Set objUser = Nothing

GetPWDaysLeft = Round(intDaysLeft, 0)

End Function

Function IsUserAccountExpired(distinguishedName, dtmExpirationDate)

Dim bolReturn
Dim objUser
Dim dtmAccountExpiration

bolReturn = False

If NZ(distinguishedName, "") <> "" Then
Set objUser = GetObject("LDAP://" & distinguishedName)
On Error Resume Next
dtmAccountExpiration = objUser.AccountExpirationDate
If Err.Number = -2147467259 Or dtmAccountExpiration = "1/1/1970" Then 'Account has no expiration date specified
'we do nothing - not even a debug message
Else 'Account has expireation date
If DateDiff("d", dtmAccountExpiration, Now) > 0 Then
bolReturn = True
dtmExpirationDate = dtmAccountExpiration
End If 
End If
On Error Goto 0
Set objUser = Nothing
End If

IsUserAccountExpired = bolReturn

End Function

'Is the User Member of one of the Groups in the Array? Give back first GroupName found if possible
Function IsUserInGroup(distinguishedName, arrGroups, FirstFoundGroupMembership)

Dim objUser, objGroup
Dim i
Dim strGroupName
Dim bolFound

bolFound = False
If NZ(distinguishedName, "") <> "" Then
Set objUser = GetObject("LDAP://" & distinguishedName)
On Error Resume Next
For Each objGroup In objUser.GetEx("memberOf")
strGroupName = Split(objGroup,",")(0)
strGroupName = Right(strGroupName, (Len(strGroupName)-3))
For i = 0 To UBound(arrGroups)
If LCase(strGroupName) = LCase(arrGroups(i)) Then
bolFound = True
FirstFoundGroupMembership = strGroupName
IsUserInGroup = True
Exit For
End If
Next
If bolFound Then
Exit For
End If
Next
On Error Goto 0
Set objUser = Nothing
Else
IsUserInGroup = False 'couldn't find User distinguishedName - not really possible
End If

End Function

'Is the Password Expired?
Function PasswordIsExpired(userAccountControl)
If NZ(userAccountControl, "") <> "" Then
If ADS_UF_PASSWORD_EXPIRED And userAccountControl Then
PasswordIsExpired = True
Else
PasswordIsExpired = False
End If
Else
PasswordIsExpired = False
End If
End Function

'Is the User able to change to Password?
Function UserCantChangePassword(distinguishedName)

Dim bolReturn
Dim objUser, objSD, objDACL, objACE

bolReturn = False
If NZ(distinguishedName, "") <> "" Then
On Error Resume Next
Set objUser = GetObject("LDAP://" & distinguishedName)
Set objSD = objUser.Get("nTSecurityDescriptor")
Set objDACL = objSD.DiscretionaryAcl
For Each objACE in objDACL
If objACE.AceType = ADS_ACETYPE_ACCESS_DENIED_OBJECT And LCase(objACE.ObjectType) = CHANGE_PASSWORD_GUID Then
bolReturn = True
Exit For
End If
Next
Set objDACL = Nothing
Set objSD = Nothing
Set objUser = Nothing
On Error Goto 0
End If
UserCantChangePassword = bolReturn

End Function

'Does the Account PW expire or not?
Function PasswordDoesExpire(userAccountControl)
If NZ(userAccountControl, "") <> "" Then
If ADS_UF_DONT_EXPIRE_PASSWD And userAccountControl Then
PasswordDoesExpire = True
Else
PasswordDoesExpire = False
End If
Else
PasswordDoesExpire = False
End If
End Function

'Account Disabled or not
Function IsAccountDisabled(distinguishedName)

Dim bolReturn
Dim objUser

bolReturn = False
If NZ(distinguishedName, "") <> "" Then
On Error Resume Next
Set objUser = GetObject("LDAP://" & distinguishedName)
bolReturn = objUser.AccountDisabled 
Set objUser = Nothing
On Error Goto 0
End If
IsAccountDisabled = bolReturn

End Function

'NZ equivalent to VBA
Function NZ(Value,alternativeValue)
If IsNull(Value) Then
NZ = alternativeValue
Else
NZ = Value
End If
End Function

'Adds the Information as needed to the specified Variable as a new Line and returns the complete new string
Function AddAdminInfoTo(CurrentString, NewTextLine, IsTable)
If Not Len(NZ(CurrentString, "")) > 0 Then
'AddAdminInfoTo = NewTextLine
If Not IsTable Then
AddAdminInfoTo = NewTextLine
Else
AddAdminInfoTo = CurrentString & "<tr><td>" & Replace(NewTextLine, vbNewLine, "") & "</td></tr>"
End If 
Else
'AddAdminInfoTo = CurrentString & vbNewLine & NewTextLine
If Not IsTable Then
AddAdminInfoTo = CurrentString & vbNewLine & NewTextLine
Else
AddAdminInfoTo = CurrentString & "<tr><td>" & Replace(NewTextLine, vbNewLine, "") & "</td></tr>"
End If
End If
End Function

'Reformatts the Days-Left into a special div tag if it is negative/positive
Function AdminInfoDaysLeftHTMLFormat(DaysLeft)
If DaysLeft > 0 Then
AdminInfoDaysLeftHTMLFormat = "<div class=""dayspositive"">" & DaysLeft & "</div>"
Else
AdminInfoDaysLeftHTMLFormat = "<div class=""daysnegative"">" & DaysLeft & "</div>"
End If
End Function

'Generates the Mail-Body for the Admin Mail
Function GenerateAdminMailBody()

Dim strReturn
strReturn = ""

strReturn = strReturn & "<style>" & vbNewLine
strReturn = strReturn & "table { font-family: Calibri; font-size: 11pt; }" & vbNewLine
strReturn = strReturn & "th { font: bold; background-color: light-blue; }" & vbNewLine
strReturn = strReturn & "th, td { border-bottom: 1px solid black; text-align: left; }" & vbNewLine
strReturn = strReturn & "tr:nth-child(even) { background-color: #f2f2f2; }" & vbNewLine
strReturn = strReturn & "tr:hover { background-color: #f5f5f5 }" & vbNewLine
strReturn = strReturn & "td.right { text-align: right; }" & vbNewLine
strReturn = strReturn & "div.dayspositive { }" & vbNewLine
strReturn = strReturn & "div.daysnegative { color: #FF0000; font: bold; }" & vbNewLine
strReturn = strReturn & "h1 { font: bold; font-size: 12pt; text-decoration: underline; }" & vbNewLine
strReturn = strReturn & "</style>" & vbNewLine

If Len(NZ(strAdminErrorUsers, "")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING USERS GENERATED SCRIPT ERRORS:</u>" & vbNewLine
strReturn = strReturn & "<h1>USERS THAT GENERATED SCRIPT ERRORS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminErrorUsers & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminErrorUsers & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolInformAdminAboutPWexpires And Len(NZ(strAdminPWexpires,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING PASSWORDS WILL EXPIRE:</u>" & vbNewLine
strReturn = strReturn & "<h1>NOTIFIED USERS WITH EXPIRING PASSWORDS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminPWexpires & vbNewLine
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminPWexpires & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolInformAdminAboutPWisExpired And Len(NZ(strAdminPWisExpired,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING PASSWORDS ARE EXPIRED ALREADY:</u>" & vbNewLine
strReturn = strReturn & "<h1>NOTIFIED USERS WITH EXPIRED PASSWORDS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminPWisExpired & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminPWisExpired & "</table><br><br>" 
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolInformAdminAboutAccountWithoutEMail And Len(NZ(strAdminAccountWithoutEMail,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS DON'T HAVE A VALID EMAIL ADDRESS:</u>" & vbNewLine
strReturn = strReturn & "<h1>USER ACCOUNTS WITH NO VALID EMAIL ADDRESS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminAccountWithoutEMail & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminAccountWithoutEMail & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If 

If bolInformAdminAboutPWneverExpires And Len(NZ(strAdminPWneverExpires,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING PASSWORDS NEVER EXPIRE:</u>" & vbNewLine
strReturn = strReturn & "<h1>PASSWORD NEVER EXPIRES USERS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminPWneverExpires & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminPWneverExpires & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If 

If bolInformAdminAboutUserCantChangePW And Len(NZ(strAdminUserCantChangePW,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING USERS CAN'T CHANGE THEIR PASSWORDS:</u>" & vbNewLine
strReturn = strReturn & "<h1>THE FOLLOWING USERS CAN'T CHANGE THEIR PASSWORDS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminUserCantChangePW & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminUserCantChangePW & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolInformAdminAboutAccountDisabled And Len(NZ(strAdminAccountDisabled,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS ARE DISABLED:</u>" & vbNewLine
strReturn = strReturn & "<h1>DISABLED USER ACCOUNTS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminAccountDisabled & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminAccountDisabled & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolInformAdminAboutExpiredUserAccount And Len(NZ(strAdminExpiredUserAccount,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS ARE EXPIRED:</u>" & vbNewLine
strReturn = strReturn & "<h1>EXPIRED USER ACCOUNTS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminExpiredUserAccount & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminExpiredUserAccount & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If 

If bolInformAdminAboutIgnoredUsersExcludedByGroup And Len(NZ(strAdminIgnoredUsersExcludedByGroup,"")) > 0 Then
strReturn = strReturn & "<h1>EXCLUDED USER ACCOUNTS (GROUP-FILTER):</h1>" & vbNewLine
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminIgnoredUsersExcludedByGroup & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolInformAdminAboutStillGoodPasswords And Len(NZ(strAdminPWstillGood,"")) > 0 Then
'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS HAVE VALID PASSWORDS:</u>" & vbNewLine
strReturn = strReturn & "<h1>THE FOLLOWING USER ACCOUNTS HAVE VALID PASSWORDS:</h1>" & vbNewLine
'strReturn = strReturn & strAdminPWstillGood & vbNewLine 
strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminPWstillGood & "</table><br><br>"
strReturn = strReturn & vbNewLine & vbNewLine
End If

If bolAttachDebugToAdminMail Then
'strReturn = strReturn & "<u>DEBUG OUTPUT:</u>" & vbNewLine
strReturn = strReturn & "<h1>DEBUG OUTPUT:</h1>" & vbNewLine
'strReturn = strReturn & strAdminDebug & vbNewLine
strReturn = strReturn & Replace(strAdminDebug, vbNewLine, "<br>") & vbNewLine
End If

GenerateAdminMailBody = "<div style=""font-family: calibri; font-size: 11pt;"">" & strReturn & "</div>"

End Function

'Sends out EMails, to the User (False, UserMailAddress, True or False, DaysLeft for Password, "") or the Admin (TRUE, "", True or False, 0, AdminTextBody)
Sub SendEmailNotification(AdminMail, UserMailAddress, IsExpired, DaysLeft, AdminTextBody)

Dim objMail

Set objMail = CreateObject("CDO.Message")

objMail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2 
objMail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = strSMTPServer
objMail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = intSMTPServerPort 
objMail.Configuration.Fields.Update 

objMail.From = strFrom

If AdminMail Then 'is Admin Mail
objMail.Subject = strAdminMailSubject 
objMail.To = strToAdmin
'objMail.TextBody = AdminTextBody
'objMail.HTMLBody = Replace(AdminTextBody, vbNewLine, "<br>")
objMail.HTMLBody = AdminTextBody
Else 'is User Mail
If Not bolAdminMailOnly Then 'only the Admin Mail will be send
If IsExpired Then 
objMail.Subject = strUserMailSubjectExpired
Else
objMail.Subject = Replace(strUserMailSubjectWillExpire, "REPLACEWITHDAYS", DaysLeft)
End If
If bolRedirectMailToAdmin Then 'redirect Mails to Admin - add User Mail Address to Subject
objMail.To = strToAdmin
objMail.Subject = objMail.Subject & " - REDIRECTED TO ADMIN INSTEAD OF: " & UserMailAddress
Else
objMail.To = UserMailAddress
End If
objMail.CreateMHTMLBody strBodyURL
End If
End If

If Not bolTestDebugOutputToConsoleOnly Then
If Len(strAttachment) > 0 Then 'we do have an attachment to add?
objMail.AddAttachment strAttachment
End If
If bolAdminMailOnly Then 'only Admin Mail?
If AdminMail Then 'Then only if it is the Admin Mail
objMail.Send
End If
Else 'User Mail as well as Admin Mail
objMail.Send
End If
Else
ScriptDebug("=>DEBUG ONLY MODE - A EMAIL WOULD HAVE BEEN SEND TO: " & objMail.To & " - Subject: " & objMail.Subject)
End If

Set objMail = Nothing

End Sub

'Any Debug-Information will be proccessed here, easier to do it central and being able to change it to a LogFile or what ever...
Sub ScriptDebug(strDebugMessage)
If bolDebug Then
WScript.Echo strDebugMessage
End If
If bolAttachDebugToAdminMail Then
strAdminDebug = AddAdminInfoTo(strAdminDebug, strDebugMessage, False)
End If 
End Sub

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

596

597

598

599

600

601

602

603

604

605

606

607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

628

629

630

631

632

633

634

635

636

637

638

639

640

641

642

643

644

645

646

647

648

649

650

651

652

653

654

655

656

657

658

659

'This VBScript will run aggainst the ActiveDirectory Domain the executing User is a Member of.

'The executing User does not need to be an Domain-Administrator of any kind, a simply User is able to read the necessary information from ActiveDirectory

'Please configure the following Options - the Script does not accept or expect any Start-Parameter

'Version 2.2 - 04/12/2017: Florian Rossmark

'---------------------------------- START OPTIONS ----------------------------------

Const strSMTPServer = "relay.domain.com" 'SMTP Mail-Server to use

Const intSMTPServerPort = 25 'SMTP Mail-Server connection Port Number

Const strFrom = "pwdscript@domain.com" 'SMTP Mail From Address

Const strToAdmin = "helpdesk@domain.com" 'SMTP Mail To Address for Administrator

Const strAdminMailSubject = "Company Name - User Password Script Results to Admin" 'Subject for Mail to Admin

Const strUserMailSubjectExpired = "Your password has expired!" 'Subject for Mail to User when Password is expired

Const strUserMailSubjectWillExpire = "Your password will expire in REPLACEWITHDAYS days" 'Subject for Mail to User when Password will expire - the exact word REPLACEWITHDAYS will be replaced by the days left value

Const strBodyURL = "file://C:/scripts/PWD/PWDExpire.html" 'URL or full file-path (HTML) to import for Body, the entire content of this URL/FILE will be imported to the Body of the email and should explain ways how to change the password

Const strAttachment = "" 'full File-Path to an attachment for the email to the users / leave empty if no attachment

Const strLDAPSortColumn = "pwdLastSet" 'per default: pwdLastSet / sort column for LDAP query

Const intStartWithPWexpiresInDays = 5 'If the Passwords expires in days N or less, the script will inform the user

Const bolIgnoreDisabledAccounts = True 'Disabled accounts should always be ignored

Const bolInformAdminAboutPWexpires = True 'This will inform the Admin about expiring passwords

Const bolInformAdminAboutPWisExpired = True 'This will inform the Admin about accounts with expired Passwords

Const bolInformAdminAboutPWneverExpires = True 'This will inform the Admin about accounts with password set to never expire

Const bolInformAdminAboutUserCantChangePW = True 'This will inform the Admin about users who are not allowed to change their password

Const bolInformAdminAboutAccountDisabled = True 'This will inform the Admin about disabled accounts found - this would have been done in ADS by an administrator

Const bolInformAdminAboutExpiredUserAccount = True 'This will inform the admin if the User Account has an expiration date and the account is expired

Const bolInformAdminAboutAccountWithoutEMail = True 'This will inform the Admin about accounts without a set email address

Const bolInformAdminAboutStillGoodPasswords = True 'This will inform the Admin about Users/Passwords that are still valid

Const bolInformAdminAboutIgnoredUsersExcludedByGroup = True 'This will inform the Admin about Users that have been ignored by the strGroupsExclude filter

'Please Note: Status Account Locked will not be checked, this should be corrected automatically by the Default Security GPO instead (will be in most cases by default)

'Filter Priority 1 - only Users in those OU Paths will be processed

'Use LDAP DN like: "OU=Folder,OU=Folder,DC=Domain,DC=local", you do not need to include the DC=Domain,DC=local - the Script will add this information if necessary

'Use | (pipe) if you want to add more then one LDAP DN Path

'Leave empty ("") to disable this filter

Const strSearchOUs = "" '"OU=Users,OU=Site,DC=domain,DC=local"

'Filter Priority 2 - if the User Object is still not excluded, this Group Exclude filter will be applied

'If the user is member of one of those groups (if multiple groups are defined), he will be ignored

'Use | (pipe) if you want to add more then one GroupName

'Leave empty ("") to disable this filter

'Example: "Group Number1|GroupNumber2"

Const strGroupsExclude = "No Password notification emails"

'Filter Priority 3 - if the User Object is still not excluded, this Group Include filter will be applied

'The user has to be a member of one of those groups (if multiple groups are defined)

'Use | (pipe) if you want to add more then one GroupName

'Leave empty ("") to disable this filter

'Example: "Group Number1|GroupNumber2"

Const strGroupsInclude = ""

Const bolDebug = True 'Set TRUE for Script-Output, highly recommended to execute the Script in CMD with CSCRIPT <ScriptName>

Const bolAttachDebugToAdminMail = False 'The Debug Output will be attached to the Admin-Mail (independent from bolDebug)

Const bolTestDebugOutputToConsoleOnly = False 'This will disable the Mail.Send - only output to the CMD will be generated, please enable bolDebug

Const bolRedirectMailToAdmin = True 'This will redirect all Mails to the Admin, instead of sending them to the User - the Subject line will include the User-Mail Address in this case

Const bolAdminMailOnly = False 'This will send the Admin-Mail only, no User Mail will be generated

'---------------------------------- END OPTIONS ----------------------------------

'---------------------------------- Script starts here ----------------------------------

'---------------------------------- please do not modify after this line ----------------------------------

'Reference: https://msdn.microsoft.com/en-us/library/aa772300(v=vs.85).aspx

Const ADS_UF_DONT_EXPIRE_PASSWD = 65536

Const ADS_UF_PASSWD_CANT_CHANGE = 64

Const ADS_UF_PASSWORD_EXPIRED = 8388608

Const ADS_ACETYPE_ACCESS_DENIED_OBJECT = 6

Const CHANGE_PASSWORD_GUID = "{ab721a53-1e2f-11d0-9819-00aa0040529b}"

'A few Global Variables for the Admin-Mail

Dim strAdminPWexpires, strAdminPWisExpired, strAdminPWneverExpires, strAdminUserCantChangePW, strAdminAccountDisabled, strAdminExpiredUserAccount, strAdminAccountWithoutEMail, strAdminPWstillGood, strAdminIgnoredUsersExcludedByGroup

Dim strAdminErrorUsers

Dim strAdminDebug

SearchADS() 'Let's Start the actual process

'starts the actual search procedure - in a sub so it is easier to keep overview of the script

Sub SearchADS()

Dim objADSRoot, objADSDomain, objADSConnection, objADSCommand, objMaxPWDage, objUser

Dim intMaxPWDage, intDaysLeft

Dim bolProcessUser

Dim cntArray

Dim arrSearchOUs, arrGroupsExclude, arrGroupsInclude

Dim iADSCommand

Dim strFirstFoundGroupMembership

arrGroupsExclude = Split(strGroupsExclude, "|")

arrGroupsInclude = Split(strGroupsInclude, "|")

'Connect to ADS and get Users

Set objADSRoot = GetObject("LDAP://rootDSE")

Set objADSDomain = GetObject("LDAP://" & objADSRoot.Get("defaultNamingContext"))

Set objMaxPWDage = objADSDomain.Get("maxPwdAge") 'please note, this script can't obey the latest ADS multible password GPO rules, it will only follow the standard with only one password rule

intMaxPWDage = CCur((objMaxPWDage.HighPart * 2 ^ 32) + objMaxPWDage.LowPart) / CCur(-864000000000)

If Not intMaxPWDage > 0 Then 'Passwords won't expire at all

ScriptDebug("intMaxPWDage is set to: " & intMaxPWDage & " - Script stopped")

SendEmailNotification True, "", True, 0, "intMaxPWDage is incorrect, please check ADS configuration. Script aborded" 'Inform that there is no expiration configuration in Active Directory

Exit Sub 'Stop the Sub / End the Search

End If

Set objADSConnection = CreateObject("ADODB.Connection")

objADSConnection.Open "Provider=ADsDSOObject;"

Set objADSCommand = CreateObject("ADODB.Command")

objADSCommand.ActiveConnection = objADSConnection

If Not Len(strSearchOUs) > 0 Then

ReDim arrSearchOUs(0) 'we still need an array to run the For Next

arrSearchOUs(0) = ""

Else

arrSearchOUs = Split(strSearchOUs, "|")

End If

For iADSCommand = 0 To UBound(arrSearchOUs) 'we already filter OUs if necessary - filter priority 1

If Len(strSearchOUs) > 0 Then 'we need everytime a new objADSDomain to set the Filter based on the OU

If Not Right(arrSearchOUs(iADSCommand),Len(objADSRoot.Get("defaultNamingContext"))) = objADSRoot.Get("defaultNamingContext") Then

If Not Right(arrSearchOUs(iADSCommand),1) = "'" Then

arrSearchOUs(iADSCommand) = arrSearchOUs(iADSCommand) & ","

End If

arrSearchOUs(iADSCommand) = arrSearchOUs(iADSCommand) & objADSRoot.Get("defaultNamingContext")

End If

ScriptDebug("Searching LDAP Path: " & arrSearchOUs(iADSCommand))

Set objADSDomain = GetObject("LDAP://" & arrSearchOUs(iADSCommand))

End If

'samAccountType=805306368 / this is the correct value for USERS only - a search for the ObjectClass USER will also list Contacts

objADSCommand.CommandText = "<" & objADSDomain.ADsPath & ">;(&(samAccountType=805306368));userAccountControl,sAMAccountName,givenName,sn,mail,distinguishedName,lockoutTime;subtree"

objADSCommand.Properties("Sort on") = strLDAPSortColumn

Set rs = objADSCommand.Execute

If Not rs.EOF Then

Do While Not rs.EOF

ScriptDebug("") 'Empty Line before each run for easier to read output

ScriptDebug("PROCESSING USER: " & NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")")

intDaysLeft = 0

bolProcessUser = True

'Priority 2 - Exclude the following groups

If Len(strGroupsExclude) > 0 Then

strFirstFoundGroupMembership = "" 'just to make sure, lets clean the variable

If IsUserInGroup(rs("distinguishedName"), arrGroupsExclude, strFirstFoundGroupMembership) Then 'User is Member of the Group, we ignore him

ScriptDebug("..USER IS MEMBER OF EXCLUDED GROUP: " & strFirstFoundGroupMembership & " - IGNORING USER")

bolProcessUser = False

'old info - 'We don't inform the Admin in this case, would be done over the Debug Info

If bolInformAdminAboutIgnoredUsersExcludedByGroup Then

strAdminIgnoredUsersExcludedByGroup = AddAdminInfoTo(strAdminIgnoredUsersExcludedByGroup, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info

End If

'Priority 3 - Include the following groups

If bolProcessUser Then 'do we still go on with this User?

If Len(strGroupsInclude) > 0 Then

strFirstFoundGroupMembership = "" 'just to make sure, lets clean the variable

If Not IsUserInGroup(rs("distinguishedName"), arrGroupsInclude, strFirstFoundGroupMembership) Then 'User is Member of the Group, we ignore him

ScriptDebug("..USER IS NOT A MEMBER OF ANY OF THE INCLUDED GROUPS - IGNORING USER")

bolProcessUser = False

'old info - 'We don't inform the Admin in this case, would be done over the Debug Info

If bolInformAdminAboutIgnoredUsersExcludedByGroup Then

End If

Else 'User will be noramlly proccessed, we still inform about it in the Script-Debug

ScriptDebug("..USER IS MEMBER OF INCLUDED GROUP: " & strFirstFoundGroupMembership & " - PROCESSING USER")

End If

'Priority 4 - disabled account? this would have been done by an administrator

If bolProcessUser Then 'do we still go on with this User?

If IsAccountDisabled(rs("distinguishedName")) Then 'Account is disabled

ScriptDebug("..DISABLED USER ACCOUNT FOUND")

If bolIgnoreDisabledAccounts Then 'do we ignore this Account?

bolProcessUser = False

End If

If bolInformAdminAboutAccountDisabled Then

'strAdminAccountDisabled = AddAdminInfoTo(strAdminAccountDisabled, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info

strAdminAccountDisabled = AddAdminInfoTo(strAdminAccountDisabled, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), ""), True) 'Add to Admin Info

End If

'Priority 5 - Will User Account expire? (we only check if it is expired, if yes we take action)

If bolProcessUser Then 'do we still go on with this User?

If IsUserAccountExpired(rs("distinguishedName"), dtmExpiration) Then

bolProcessUser = False

ScriptDebug("..USER ACCOUNT IS EXPIRED SINCE: " & dtmExpiration)

If bolInformAdminAboutExpiredUserAccount Then

'strAdminExpiredUserAccount = AddAdminInfoTo(strAdminExpiredUserAccount, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - User expired since: " & dtmExpiration) 'Add to Admin Info

strAdminExpiredUserAccount = AddAdminInfoTo(strAdminExpiredUserAccount, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat(dtmExpiration), True) 'Add to Admin Info

End If

'Priority 6 - password never expires? this would have been done by an administrator

If bolProcessUser Then 'do we still go on with this User?

If PasswordDoesExpire(rs("userAccountControl")) Then 'Password does not expire

ScriptDebug("..USER WITH PASSWORD WILL NOT EXPIRE FOUND")

bolProcessUser = False

If bolInformAdminAboutPWneverExpires Then

'strAdminPWneverExpires = AddAdminInfoTo(strAdminPWneverExpires, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info

strAdminPWneverExpires = AddAdminInfoTo(strAdminPWneverExpires, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), ""), True) 'Add to Admin Info

End If

'Priority 7 - User can't even change the password? this would have been done by an administrator

If bolProcessUser Then 'do we still go on with this User?

If UserCantChangePassword(rs("distinguishedName")) Then 'User can't change Password

ScriptDebug("..USER WITH CAN'T CHANGE PASSWORD FOUND")

bolProcessUser = False

If bolInformAdminAboutUserCantChangePW Then

'strAdminUserCantChangePW = AddAdminInfoTo(strAdminUserCantChangePW, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info

strAdminUserCantChangePW = AddAdminInfoTo(strAdminUserCantChangePW, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), ""), True) 'Add to Admin Info

End If

'Priority 8 - User does not have an EMail Address? can't inform User if PW is about to expire what shall we do?

If bolProcessUser Then 'do we still go on with this User?

If Not Len(NZ(rs("mail"), "")) > 0 Then 'User is missing email address

ScriptDebug("..USER WITHOUT EMAIL ADDRESS FOUND")

bolProcessUser = False

If bolInformAdminAboutAccountWithoutEMail Then

'strAdminAccountWithoutEMail = AddAdminInfoTo(strAdminAccountWithoutEMail, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days Left: " & (GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)) 'Add to Admin Info

strAdminAccountWithoutEMail = AddAdminInfoTo(strAdminAccountWithoutEMail, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info

End If

'Priority 9 - now we check the Password Age and take action

If bolProcessUser Then 'do we still go on with this User?

If PasswordIsExpired(rs("userAccountControl")) Then 'The Password is already expired? We need to take action / this will be double checked later on with a calculation

ScriptDebug("..PASSWORD IS EXPIRED")

SendEmailNotification False, NZ(rs("mail"), ""), True, 0, "" 'Inform the USER about the expired Password

If bolInformAdminAboutPWisExpired Then

'strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ")") 'Add to Admin Info

strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage) * -1)), True) 'Add to Admin Info

End If

Else 'Password is not expired yet, how many days does the User have left?

Set objUser = GetObject("LDAP://" & rs("distinguishedName"))

intDaysLeft = GetPWDaysLeft(rs("distinguishedName"), NZ(rs("givenName"), ""), NZ(rs("sn"), ""), NZ(rs("sAMAccountName"), ""), intDaysLeft, intMaxPWDage)

If intDaysLeft <= 0 Then 'we have a number of days left

If intStartWithPWexpiresInDays >= (intDaysLeft * -1) Then 'User is to be informed, his days left are less then defined

ScriptDebug("..PASSWORD FOR USER WILL EXPIRE IN: " & (intDaysLeft * -1) & " DAYS")

SendEmailNotification False, NZ(rs("mail"), ""), False, (intDaysLeft * -1), "" 'Inform the USER that the Password will expire

If bolInformAdminAboutPWexpires Then

'strAdminPWexpires = AddAdminInfoTo(strAdminPWexpires, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days Left: " & (intDaysLeft * -1)) 'Add to Admin Info

strAdminPWexpires = AddAdminInfoTo(strAdminPWexpires, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((intDaysLeft * -1)), True) 'Add to Admin Info

End If

Else 'User has more days left then needed by Script Configuration

'we do not need to take action - we do not even send Mail to the Admin

ScriptDebug("..USER PASSWORD IS STILL GOOD - DAYS LEFT: " & (intDaysLeft * -1))

If bolInformAdminAboutStillGoodPasswords Then

'strAdminPWstillGood = AddAdminInfoTo(strAdminPWstillGood, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days Left: " & (intDaysLeft * -1)) 'Add to Admin Info

strAdminPWstillGood = AddAdminInfoTo(strAdminPWstillGood, NZ(rs("givenName"), "") & "</td><td>" & NZ(rs("sn"), "") & "</td><td>" & NZ(rs("sAMAccountName"), "") & "</td><td class=""right"">" & AdminInfoDaysLeftHTMLFormat((intDaysLeft * -1)), True) 'Add to Admin Info

End If

Else 'Password is already expired and needs to be changed now / second check, first one might not give the needed information

ScriptDebug("..PASSWORD IS EXPIRED FOR: " & (intDaysLeft * -1) & " DAYS")

SendEmailNotification False, NZ(rs("mail"), ""), True, 0, "" 'Inform the USER about the expired Password

If bolInformAdminAboutPWisExpired Then

'strAdminPWisExpired = AddAdminInfoTo(strAdminPWisExpired, NZ(rs("givenName"), "") & " " & NZ(rs("sn"), "") & " (" & NZ(rs("sAMAccountName"), "") & ") - Days expired: " & (intDaysLeft * -1)) 'Add to Admin Info

End If

Set objUser = Nothing 'to make sure the Object is release

End If

rs.MoveNext

Loop

End If

Set rs = Nothing

Next 'Next from arrSearchOUs

Set objADSCommand = Nothing

Set objADSConnection = Nothing

Set objADSDomain = Nothing

Set objADSRoot = Nothing

ScriptDebug("")

ScriptDebug("SCRIPT ENDED SUCCESSFULLY => Sending Admin Mail")

SendEmailNotification True, "", True, 0, GenerateAdminMailBody 'Send the final admin notification with the requested information

End Sub

'Function returns days left for Password of User-Object (uses default Value intDaysLeft)

Function GetPWDaysLeft(strDistinguishedName, strGivenName, strSN, strsAMAccountName, intDaysLeft, intMaxPWDage)

Dim objUser

Set objUser = GetObject("LDAP://" & strDistinguishedName)

On Error Resume Next

'intDaysLeft will be negative, like a countdown, T minus DAYS

intDaysLeft = DateDiff("d", objUser.PasswordLastChanged, Now) - intMaxPWDage

If Err Then

If Err.Number = &h8000500d Then 'PWD was just changed

intDaysLeft = intMaxPWDage

ScriptDebug("..USER PASSWORD WAS JUST CHANGED")

'we don't send any Mails about this

Else 'unexpexted Error occured - this shouldn't happen at all!

ScriptDebug("..UNEXPECTED ERROR (UserPasswordLastChanged)")

'strAdminErrorUsers = AddAdminInfoTo(strAdminErrorUsers, strGivenName & " " & strSN & " (" & strsAMAccountName & ")") 'Add to Admin Info

strAdminErrorUsers = AddAdminInfoTo(strAdminErrorUsers, strGivenName & "</td><td>" & strSN & "</td><td>" & strsAMAccountName, True) 'Add to Admin Info

End If

Err.Clear

On Error Goto 0

Set objUser = Nothing

GetPWDaysLeft = Round(intDaysLeft, 0)

End Function

Function IsUserAccountExpired(distinguishedName, dtmExpirationDate)

Dim bolReturn

Dim objUser

Dim dtmAccountExpiration

bolReturn = False

If NZ(distinguishedName, "") <> "" Then

Set objUser = GetObject("LDAP://" & distinguishedName)

On Error Resume Next

dtmAccountExpiration = objUser.AccountExpirationDate

If Err.Number = -2147467259 Or dtmAccountExpiration = "1/1/1970" Then 'Account has no expiration date specified

'we do nothing - not even a debug message

Else 'Account has expireation date

If DateDiff("d", dtmAccountExpiration, Now) > 0 Then

bolReturn = True

dtmExpirationDate = dtmAccountExpiration

End If

On Error Goto 0

Set objUser = Nothing

End If

IsUserAccountExpired = bolReturn

End Function

'Is the User Member of one of the Groups in the Array? Give back first GroupName found if possible

Function IsUserInGroup(distinguishedName, arrGroups, FirstFoundGroupMembership)

Dim objUser, objGroup

Dim i

Dim strGroupName

Dim bolFound

bolFound = False

If NZ(distinguishedName, "") <> "" Then

Set objUser = GetObject("LDAP://" & distinguishedName)

On Error Resume Next

For Each objGroup In objUser.GetEx("memberOf")

strGroupName = Split(objGroup,",")(0)

strGroupName = Right(strGroupName, (Len(strGroupName)-3))

For i = 0 To UBound(arrGroups)

If LCase(strGroupName) = LCase(arrGroups(i)) Then

bolFound = True

FirstFoundGroupMembership = strGroupName

IsUserInGroup = True

Exit For

End If

If bolFound Then

Exit For

End If

On Error Goto 0

Set objUser = Nothing

Else

IsUserInGroup = False 'couldn't find User distinguishedName - not really possible

End If

End Function

'Is the Password Expired?

Function PasswordIsExpired(userAccountControl)

If NZ(userAccountControl, "") <> "" Then

If ADS_UF_PASSWORD_EXPIRED And userAccountControl Then

PasswordIsExpired = True

Else

PasswordIsExpired = False

End If

Else

PasswordIsExpired = False

End If

End Function

'Is the User able to change to Password?

Function UserCantChangePassword(distinguishedName)

Dim bolReturn

Dim objUser, objSD, objDACL, objACE

bolReturn = False

If NZ(distinguishedName, "") <> "" Then

On Error Resume Next

Set objUser = GetObject("LDAP://" & distinguishedName)

Set objSD = objUser.Get("nTSecurityDescriptor")

Set objDACL = objSD.DiscretionaryAcl

For Each objACE in objDACL

If objACE.AceType = ADS_ACETYPE_ACCESS_DENIED_OBJECT And LCase(objACE.ObjectType) = CHANGE_PASSWORD_GUID Then

bolReturn = True

Exit For

End If

Set objDACL = Nothing

Set objSD = Nothing

Set objUser = Nothing

On Error Goto 0

End If

UserCantChangePassword = bolReturn

End Function

'Does the Account PW expire or not?

Function PasswordDoesExpire(userAccountControl)

If NZ(userAccountControl, "") <> "" Then

If ADS_UF_DONT_EXPIRE_PASSWD And userAccountControl Then

PasswordDoesExpire = True

Else

PasswordDoesExpire = False

End If

Else

PasswordDoesExpire = False

End If

End Function

'Account Disabled or not

Function IsAccountDisabled(distinguishedName)

Dim bolReturn

Dim objUser

bolReturn = False

If NZ(distinguishedName, "") <> "" Then

On Error Resume Next

Set objUser = GetObject("LDAP://" & distinguishedName)

bolReturn = objUser.AccountDisabled

Set objUser = Nothing

On Error Goto 0

End If

IsAccountDisabled = bolReturn

End Function

'NZ equivalent to VBA

Function NZ(Value,alternativeValue)

If IsNull(Value) Then

NZ = alternativeValue

Else

NZ = Value

End If

End Function

'Adds the Information as needed to the specified Variable as a new Line and returns the complete new string

Function AddAdminInfoTo(CurrentString, NewTextLine, IsTable)

If Not Len(NZ(CurrentString, "")) > 0 Then

'AddAdminInfoTo = NewTextLine

If Not IsTable Then

AddAdminInfoTo = NewTextLine

Else

AddAdminInfoTo = CurrentString & "<tr><td>" & Replace(NewTextLine, vbNewLine, "") & "</td></tr>"

End If

Else

'AddAdminInfoTo = CurrentString & vbNewLine & NewTextLine

If Not IsTable Then

AddAdminInfoTo = CurrentString & vbNewLine & NewTextLine

Else

AddAdminInfoTo = CurrentString & "<tr><td>" & Replace(NewTextLine, vbNewLine, "") & "</td></tr>"

End If

End Function

'Reformatts the Days-Left into a special div tag if it is negative/positive

Function AdminInfoDaysLeftHTMLFormat(DaysLeft)

If DaysLeft > 0 Then

AdminInfoDaysLeftHTMLFormat = "<div class=""dayspositive"">" & DaysLeft & "</div>"

Else

AdminInfoDaysLeftHTMLFormat = "<div class=""daysnegative"">" & DaysLeft & "</div>"

End If

End Function

'Generates the Mail-Body for the Admin Mail

Function GenerateAdminMailBody()

Dim strReturn

strReturn = ""

strReturn = strReturn & "<style>" & vbNewLine

strReturn = strReturn & "table { font-family: Calibri; font-size: 11pt; }" & vbNewLine

strReturn = strReturn & "th { font: bold; background-color: light-blue; }" & vbNewLine

strReturn = strReturn & "th, td { border-bottom: 1px solid black; text-align: left; }" & vbNewLine

strReturn = strReturn & "tr:nth-child(even) { background-color: #f2f2f2; }" & vbNewLine

strReturn = strReturn & "tr:hover { background-color: #f5f5f5 }" & vbNewLine

strReturn = strReturn & "td.right { text-align: right; }" & vbNewLine

strReturn = strReturn & "div.dayspositive { }" & vbNewLine

strReturn = strReturn & "div.daysnegative { color: #FF0000; font: bold; }" & vbNewLine

strReturn = strReturn & "h1 { font: bold; font-size: 12pt; text-decoration: underline; }" & vbNewLine

strReturn = strReturn & "</style>" & vbNewLine

If Len(NZ(strAdminErrorUsers, "")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING USERS GENERATED SCRIPT ERRORS:</u>" & vbNewLine

strReturn = strReturn & "<h1>USERS THAT GENERATED SCRIPT ERRORS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminErrorUsers & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminErrorUsers & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutPWexpires And Len(NZ(strAdminPWexpires,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING PASSWORDS WILL EXPIRE:</u>" & vbNewLine

strReturn = strReturn & "<h1>NOTIFIED USERS WITH EXPIRING PASSWORDS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminPWexpires & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminPWexpires & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutPWisExpired And Len(NZ(strAdminPWisExpired,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING PASSWORDS ARE EXPIRED ALREADY:</u>" & vbNewLine

strReturn = strReturn & "<h1>NOTIFIED USERS WITH EXPIRED PASSWORDS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminPWisExpired & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminPWisExpired & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutAccountWithoutEMail And Len(NZ(strAdminAccountWithoutEMail,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS DON'T HAVE A VALID EMAIL ADDRESS:</u>" & vbNewLine

strReturn = strReturn & "<h1>USER ACCOUNTS WITH NO VALID EMAIL ADDRESS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminAccountWithoutEMail & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminAccountWithoutEMail & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutPWneverExpires And Len(NZ(strAdminPWneverExpires,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING PASSWORDS NEVER EXPIRE:</u>" & vbNewLine

strReturn = strReturn & "<h1>PASSWORD NEVER EXPIRES USERS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminPWneverExpires & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminPWneverExpires & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutUserCantChangePW And Len(NZ(strAdminUserCantChangePW,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING USERS CAN'T CHANGE THEIR PASSWORDS:</u>" & vbNewLine

strReturn = strReturn & "<h1>THE FOLLOWING USERS CAN'T CHANGE THEIR PASSWORDS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminUserCantChangePW & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminUserCantChangePW & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutAccountDisabled And Len(NZ(strAdminAccountDisabled,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS ARE DISABLED:</u>" & vbNewLine

strReturn = strReturn & "<h1>DISABLED USER ACCOUNTS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminAccountDisabled & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th></tr>" & strAdminAccountDisabled & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutExpiredUserAccount And Len(NZ(strAdminExpiredUserAccount,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS ARE EXPIRED:</u>" & vbNewLine

strReturn = strReturn & "<h1>EXPIRED USER ACCOUNTS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminExpiredUserAccount & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminExpiredUserAccount & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutIgnoredUsersExcludedByGroup And Len(NZ(strAdminIgnoredUsersExcludedByGroup,"")) > 0 Then

strReturn = strReturn & "<h1>EXCLUDED USER ACCOUNTS (GROUP-FILTER):</h1>" & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminIgnoredUsersExcludedByGroup & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolInformAdminAboutStillGoodPasswords And Len(NZ(strAdminPWstillGood,"")) > 0 Then

'strReturn = strReturn & "<u>THE FOLLOWING USER ACCOUNTS HAVE VALID PASSWORDS:</u>" & vbNewLine

strReturn = strReturn & "<h1>THE FOLLOWING USER ACCOUNTS HAVE VALID PASSWORDS:</h1>" & vbNewLine

'strReturn = strReturn & strAdminPWstillGood & vbNewLine

strReturn = strReturn & "<table><tr><th>Firstname</th><th>LastName</th><th>Username</th><th>Expires in days</th></tr>" & strAdminPWstillGood & "</table><br><br>"

strReturn = strReturn & vbNewLine & vbNewLine

End If

If bolAttachDebugToAdminMail Then

'strReturn = strReturn & "<u>DEBUG OUTPUT:</u>" & vbNewLine

strReturn = strReturn & "<h1>DEBUG OUTPUT:</h1>" & vbNewLine

'strReturn = strReturn & strAdminDebug & vbNewLine

strReturn = strReturn & Replace(strAdminDebug, vbNewLine, "<br>") & vbNewLine

End If

GenerateAdminMailBody = "<div style=""font-family: calibri; font-size: 11pt;"">" & strReturn & "</div>"

End Function

'Sends out EMails, to the User (False, UserMailAddress, True or False, DaysLeft for Password, "") or the Admin (TRUE, "", True or False, 0, AdminTextBody)

Sub SendEmailNotification(AdminMail, UserMailAddress, IsExpired, DaysLeft, AdminTextBody)

Dim objMail

Set objMail = CreateObject("CDO.Message")

objMail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2

objMail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = strSMTPServer

objMail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = intSMTPServerPort

objMail.Configuration.Fields.Update

objMail.From = strFrom

If AdminMail Then 'is Admin Mail

objMail.Subject = strAdminMailSubject

objMail.To = strToAdmin

'objMail.TextBody = AdminTextBody

'objMail.HTMLBody = Replace(AdminTextBody, vbNewLine, "<br>")

objMail.HTMLBody = AdminTextBody

Else 'is User Mail

If Not bolAdminMailOnly Then 'only the Admin Mail will be send

If IsExpired Then

objMail.Subject = strUserMailSubjectExpired

Else

objMail.Subject = Replace(strUserMailSubjectWillExpire, "REPLACEWITHDAYS", DaysLeft)

End If

If bolRedirectMailToAdmin Then 'redirect Mails to Admin - add User Mail Address to Subject

objMail.To = strToAdmin

objMail.Subject = objMail.Subject & " - REDIRECTED TO ADMIN INSTEAD OF: " & UserMailAddress

Else

objMail.To = UserMailAddress

End If

objMail.CreateMHTMLBody strBodyURL

End If

If Not bolTestDebugOutputToConsoleOnly Then

If Len(strAttachment) > 0 Then 'we do have an attachment to add?

objMail.AddAttachment strAttachment

End If

If bolAdminMailOnly Then 'only Admin Mail?

If AdminMail Then 'Then only if it is the Admin Mail

objMail.Send

End If

Else 'User Mail as well as Admin Mail

objMail.Send

End If

Else

ScriptDebug("=>DEBUG ONLY MODE - A EMAIL WOULD HAVE BEEN SEND TO: " & objMail.To & " - Subject: " & objMail.Subject)

End If

Set objMail = Nothing

End Sub

'Any Debug-Information will be proccessed here, easier to do it central and being able to change it to a LogFile or what ever...

Sub ScriptDebug(strDebugMessage)

If bolDebug Then

WScript.Echo strDebugMessage

End If

If bolAttachDebugToAdminMail Then

strAdminDebug = AddAdminInfoTo(strAdminDebug, strDebugMessage, False)

End If

End Sub

<html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Your password will expire in “X” days</title>
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p.sectiontitle, li.sectiontitle, div.sectiontitle
{margin-top:12.0pt;
margin-right:0in;
margin-bottom:12.0pt;
margin-left:0in;
font-size:12.0pt;
font-family:Verdana;
font-variant:small-caps;
font-weight:bold;}
p.sectioncontent, li.sectioncontent, div.sectioncontent
{margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:9.0pt;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:Verdana;}
span.sectiontitlechar
{font-family:Verdana;
font-variant:small-caps;
font-weight:bold;}
@page Section1
{size:8.5in 11.0in;
margin:81.35pt 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
/* List Definitions */
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>

</head>

<body lang="EN-US" link="blue" vlink="purple">

<div class="Section1">
<table width="100%"><tr><td>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana;
color:blue">This is an automated password expiration notification. </span></b></p>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana;
color:blue">Please change your password as soon as possible.</span></b></p>
</td><td>
<div text-align=right>
<img src="logo.jpg" width="150px">
</div>
</td></tr></table>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></b></p>

<p class="MsoNormal"><b><u><span style="font-size:10.0pt;font-family:Verdana">Password
Policy</span></u></b></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="sectioncontent"><b>Password Rules</b></p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">1.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

</span>Your password must be changed every 90 days</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">2.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>The system will remember the last 8 passwords used and will not allow
them again</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">3.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Minimum password age is 1 day. A password cannot be changed until it is
1 day old.</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">4.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Account lockout duration is 15 minutes</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">5.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Account lockout threshold is 6 invalid login attempts</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">6.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Reset account lockout counter after 15 minutes</p>

<p class="sectioncontent">&nbsp;</p>

<p class="sectioncontent"><b>Complexity Rules</b></p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">1.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

</span>It must be at least 8 characters in length</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">2.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>It cannot contain a significant portion of the username or the person’s
full name</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">3.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>It cannot contain a complete dictionary word</p>

<p class="sectioncontent" style="margin-left:45.0pt;text-indent:-.25in">4.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>It must contain at least one character from 3 of the 4 following groups:</p>

<p class="sectioncontent" style="margin-left:63.0pt;text-indent:-.25in">a.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Lower-case alpha character (a-z)</p>

<p class="sectioncontent" style="margin-left:63.0pt;text-indent:-.25in">b.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Upper-case alpha character (A-Z)</p>

<p class="sectioncontent" style="margin-left:63.0pt;text-indent:-.25in">c.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</span>Numeric digit (0-9)</p>

<p class="sectioncontent" style="margin-left:63.0pt;text-indent:-.25in">d.<span style="font-size:7.0pt;font-family:&quot;Times New Roman&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

</span>Special character ( { } [ ] , . &lt; &gt; ; : ' " ? / | \ ` ~ ! @ #
$ <br>
% ^ &amp; * ( ) _ - + = )</p>

<p class="sectioncontent">&nbsp;</p>

<p class="sectioncontent"><b>Suggestions</b></p>

<p class="sectioncontent">Use a password that you can remember. One common
practice is to model your password after a sentence or a phrase. It can also be
useful to replace letter with numbers. </p>

<p class="sectioncontent">&nbsp;</p>

<p class="sectioncontent">Steve might use the well-known statement, “I can eat
sushi for lunch every day” to come up with the following password:</p>

<p class="sectioncontent" style="text-indent:27.0pt">Ic3s4led!</p>

<p class="sectioncontent">&nbsp;</p>

<p class="sectioncontent">Ray might use “My motorcycle is way too fast for you!”</p>

<p class="sectioncontent" style="text-indent:27.0pt">MmiW2f4u!</p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="MsoNormal"><b><u><span style="font-size:10.0pt;font-family:Verdana">How
to Change Your Password</span></u></b></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Method
1 – Directly From Windows</span></b></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">If you
have a computer with direct connectivity to corporate network, changing
your password is very easy. </span></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<ol style="margin-top:0in" start="1" type="1">
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">After
you are logged into your computer, enter the keyboard combination “Ctrl +
ALT + Del” (this is the same combination used&nbsp; when logging onto your
computer)</span></li>
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">In the
Windows Security popup window click “Change Password”</span></li>
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">The 1<sup>st</sup>
two fields will be auto-filled. Please enter your current “OLD” password
followed by your “NEW” password in the last two fields.</span></li>

</ol>

<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt;
font-family:Verdana">&nbsp;</span></p>

<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="289" style="width:216.6pt;margin-left:41.4pt;border-collapse:collapse">
<tbody><tr>
<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Description</span></b></p>
</td>
<td width="153" valign="top" style="width:114.6pt;border:solid windowtext 1.0pt;
border-left:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Your
Answer</span></b></p>

</td>
</tr>
<tr>
<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Username</span></p>
</td>
<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your
userID e.g. jsmith</span></p>

</td>
</tr>
<tr>
<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Log on
to</span></p>
</td>
<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Company Name</span></p>

</td>
</tr>
<tr>
<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Old
password</span></p>
</td>
<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your
OLD password</span></p>

</td>
</tr>
<tr>
<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">New
password</span></p>
</td>
<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your
NEW password</span></p>

</td>
</tr>
<tr>
<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;
border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Confirm
new password</span></p>
</td>
<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:
none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;
padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your
New Password</span></p>

</td>
</tr>
</tbody></table>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<ol style="margin-top:0in" start="4" type="1">
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Click
OK </span></li>
</ol>

<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt;
font-family:Verdana">Your new password is now set and will be valid for 90 days</span></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Method
2 – Contact the Helpdesk</span></b></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">If you
require assistance in changing your password, please submit a help desk request
and we will be more than happy to help you out. </span></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">&nbsp;</span></p>

<ol style="margin-top:0in" start="1" type="1">
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Create
a helpdesk ticket </span></li>

<ol style="margin-top:0in" start="1" type="a">
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Open
your web browser and type <a href="http://helpdesk.domain.com/">http://helpdesk.domain.com</a></span></li>
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Create
a new ticket and label it “I Need Help”</span></li>
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">In the
Notes field, please provide a phone number and the best time to reach you</span></li>
</ol>
<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">An IT associate will contact you to assist in changing your password</span></li>

</ol>

<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt;
font-family:Verdana">NOTE: If you are unable to access helpdesk website,
please call 888-888-8888 or x8888</span></p>

</div>


</body></html>

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

<title>Your password will expire in “X” days</title>

<style>

<!--

/* Font Definitions */

@font-face

{font-family:Verdana;

panose-1:2 11 6 4 3 5 4 4 2 4;}

/* Style Definitions */

p.MsoNormal, li.MsoNormal, div.MsoNormal

{margin:0in;

margin-bottom:.0001pt;

font-size:12.0pt;

font-family:"Times New Roman";}

a:link, span.MsoHyperlink

{color:blue;

text-decoration:underline;}

a:visited, span.MsoHyperlinkFollowed

{color:purple;

text-decoration:underline;}

p.sectiontitle, li.sectiontitle, div.sectiontitle

{margin-top:12.0pt;

margin-right:0in;

margin-bottom:12.0pt;

margin-left:0in;

font-size:12.0pt;

font-family:Verdana;

font-variant:small-caps;

font-weight:bold;}

p.sectioncontent, li.sectioncontent, div.sectioncontent

{margin-top:0in;

margin-right:0in;

margin-bottom:0in;

margin-left:9.0pt;

margin-bottom:.0001pt;

font-size:10.0pt;

font-family:Verdana;}

span.sectiontitlechar

{font-family:Verdana;

font-variant:small-caps;

font-weight:bold;}

@page Section1

{size:8.5in 11.0in;

margin:81.35pt 1.0in 1.0in 1.0in;}

div.Section1

{page:Section1;}

/* List Definitions */

{margin-bottom:0in;}

-->

</style>

</head>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana;

color:blue">This is an automated password expiration notification. </span></b></p>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana;

color:blue">Please change your password as soon as possible.</span></b></p>

</td><td>

</div>

</td></tr></table>

<p class="MsoNormal"><b><u><span style="font-size:10.0pt;font-family:Verdana">Password

Policy</span></u></b></p>

<p class="sectioncontent"><b>Password Rules</b></p>

</span>Your password must be changed every 90 days</p>

</span>The system will remember the last 8 passwords used and will not allow

them again</p>

</span>Minimum password age is 1 day. A password cannot be changed until it is

1 day old.</p>

</span>Account lockout duration is 15 minutes</p>

</span>Account lockout threshold is 6 invalid login attempts</p>

</span>Reset account lockout counter after 15 minutes</p>

<p class="sectioncontent"><b>Complexity Rules</b></p>

</span>It must be at least 8 characters in length</p>

</span>It cannot contain a significant portion of the username or the person’s

full name</p>

</span>It cannot contain a complete dictionary word</p>

</span>It must contain at least one character from 3 of the 4 following groups:</p>

</span>Lower-case alpha character (a-z)</p>

</span>Upper-case alpha character (A-Z)</p>

</span>Numeric digit (0-9)</p>

</span>Special character ( { } [ ] , . < > ; : ' " ? / | \ ` ~ ! @ #

$ <br>

% ^ & * ( ) _ - + = )</p>

<p class="sectioncontent"><b>Suggestions</b></p>

<p class="sectioncontent">Use a password that you can remember. One common

practice is to model your password after a sentence or a phrase. It can also be

useful to replace letter with numbers. </p>

<p class="sectioncontent">Steve might use the well-known statement, “I can eat

sushi for lunch every day” to come up with the following password:</p>

<p class="sectioncontent">Ray might use “My motorcycle is way too fast for you!”</p>

<p class="MsoNormal"><b><u><span style="font-size:10.0pt;font-family:Verdana">How

to Change Your Password</span></u></b></p>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Method

1 – Directly From Windows</span></b></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">If you

have a computer with direct connectivity to corporate network, changing

your password is very easy. </span></p>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">After

you are logged into your computer, enter the keyboard combination “Ctrl +

ALT + Del” (this is the same combination used  when logging onto your

computer)</span></li>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">In the

Windows Security popup window click “Change Password”</span></li>

two fields will be auto-filled. Please enter your current “OLD” password

followed by your “NEW” password in the last two fields.</span></li>

</ol>

<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt;

font-family:Verdana"> </span></p>

<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;

padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Description</span></b></p>

</td>

<td width="153" valign="top" style="width:114.6pt;border:solid windowtext 1.0pt;

border-left:none;padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Your

Answer</span></b></p>

</td>

</tr>

<tr>

<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;

border-top:none;padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Username</span></p>

</td>

<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:

none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;

padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your

userID e.g. jsmith</span></p>

</td>

</tr>

<tr>

<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;

border-top:none;padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Log on

to</span></p>

</td>

<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:

none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;

padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Company Name</span></p>

</td>

</tr>

<tr>

<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;

border-top:none;padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Old

password</span></p>

</td>

<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:

none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;

padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your

OLD password</span></p>

</td>

</tr>

<tr>

<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;

border-top:none;padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">New

password</span></p>

</td>

<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:

none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;

padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your

NEW password</span></p>

</td>

</tr>

<tr>

<td width="136" valign="top" style="width:102.0pt;border:solid windowtext 1.0pt;

border-top:none;padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Confirm

new password</span></p>

</td>

<td width="153" valign="top" style="width:114.6pt;border-top:none;border-left:

none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;

padding:0in 5.4pt 0in 5.4pt">

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Your

New Password</span></p>

</td>

</tr>

</tbody></table>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Click

OK </span></li>

</ol>

<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt;

font-family:Verdana">Your new password is now set and will be valid for 90 days</span></p>

<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:Verdana">Method

2 – Contact the Helpdesk</span></b></p>

<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">If you

require assistance in changing your password, please submit a help desk request

and we will be more than happy to help you out. </span></p>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Create

a helpdesk ticket </span></li>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Open

your web browser and type <a href="http://helpdesk.domain.com/">http://helpdesk.domain.com</a></span></li>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">Create

a new ticket and label it “I Need Help”</span></li>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">In the

Notes field, please provide a phone number and the best time to reach you</span></li>

</ol>

<li class="MsoNormal"><span style="font-size:10.0pt;font-family:Verdana">An IT associate will contact you to assist in changing your password</span></li>

</ol>

<p class="MsoNormal" style="margin-left:.25in"><span style="font-size:10.0pt;

font-family:Verdana">NOTE: If you are unable to access helpdesk website,

please call 888-888-8888 or x8888</span></p>

</div>

</body></html>

As always – feel free to reach out to me if you have any questions or comments.

June 22, 2018 by Florian Rossmark recommendations scripts security server solutions

Script to remove RemoteApp and Desktop Connections

RADC or RemoteApp and Desktop Connections are very powerful in combination with Windows 7 or newer. You actually can have Terminalserver or RDS / Remote Desktop Server applications in the users start menu and connect to them in seamless window applications.

Windows 7 made it challenging to even implement those applications in a large scale, for this sole purpose you had to use a PowerShell script that actually imported a WCX file. Windows 8 and especially Windows 10 can do this via GPO nowadays.

The GPO settings allow one RDS farm to be added and they of course will remove the RDS farm if the GPO is changed/removed.

But what about those Windows 7 clients that are still out there and those cases where you actually have other RDS / RADC connections that you want to delete, e.g. manually created ones. I just came across this scenario and wanted to share the script I just wrote. I created two files in order to executed it simply via GPO as a Cscsript in order to avoid any dialog boxes coming up.

CSCRIPT "%~dp0\RADC_Delete.vbs"

1	CSCRIPT "%~dp0\RADC_Delete.vbs"

'Define the RDSDNSName - Look up in Registry Key: 
'HKCU\Software\Microsoft\Workspaces\Feeds\{unique number - different on each profile/system}
'Key: WorkspaceId 
'Put the WorkspaceId in to the RDSDNSName variable
Const RDSDNSName = "rds.yourdomain.com"

Dim oReg,fso
Dim strResult,strWorkspaceFolder,strStartMenuRoot
Dim strComputer 
Dim hDefKey

Const HKEY_CURRENT_USER = &H80000001

hDefKey = HKEY_CURRENT_USER 
strComputer = "." 
strKeyPath = "Software\Microsoft\Workspaces\Feeds"
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
oReg.EnumKey hDefKey, strKeyPath, arrSubKeys
For Each strSubkey In arrSubKeys
strSubKeyPath = strKeyPath & "\" & strSubkey
oReg.EnumValues hDefKey, strSubKeyPath, arrValueNames, arrTypes

On Error Resume Next
oReg.GetStringValue hDefKey, strSubKeyPath, "WorkspaceId", strValue
strResult=cstr(strValue)
oReg.GetStringValue hDefKey, strSubKeyPath, "WorkspaceFolder", strValue
strWorkspaceFolder=cstr(strValue)
oReg.GetStringValue hDefKey, strSubKeyPath, "StartMenuRoot", strValue
strStartMenuRoot=cstr(strValue)
On Error Goto 0

If Len(strResult)>0 Then
If LCase(strResult) = LCase(RDSDNSName) Then
Set fso = CreateObject("Scripting.FileSystemObject")
On Error Resume Next
If fso.FolderExists(strWorkspaceFolder) Then
fso.DeleteFolder strWorkspaceFolder, True
End If
If fso.FolderExists(strStartMenuRoot) Then
fso.DeleteFolder strStartMenuRoot, True
End If
DeleteSubkeys HKEY_CURRENT_USER, strSubKeyPath 
On Error Goto 0 
Set fso = Nothing
End If
End If
Next
Set oReg = Nothing

Sub DeleteSubkeys(HKEY_CURRENT_USER, strKeyPath) 
oReg.EnumKey HKEY_CURRENT_USER, strKeyPath, arrSubkeys

If IsArray(arrSubkeys) Then 
For Each strSubkey In arrSubkeys 
DeleteSubkeys HKEY_CURRENT_USER, strKeyPath & "\" & strSubkey 
Next 
End If

oReg.DeleteKey HKEY_CURRENT_USER, strKeyPath 
End Sub

'Define the RDSDNSName - Look up in Registry Key:

'HKCU\Software\Microsoft\Workspaces\Feeds\{unique number - different on each profile/system}

'Key: WorkspaceId

'Put the WorkspaceId in to the RDSDNSName variable

Const RDSDNSName = "rds.yourdomain.com"

Dim oReg,fso

Dim strResult,strWorkspaceFolder,strStartMenuRoot

Dim strComputer

Dim hDefKey

Const HKEY_CURRENT_USER = &H80000001

hDefKey = HKEY_CURRENT_USER

strComputer = "."

strKeyPath = "Software\Microsoft\Workspaces\Feeds"

Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

oReg.EnumKey hDefKey, strKeyPath, arrSubKeys

For Each strSubkey In arrSubKeys

strSubKeyPath = strKeyPath & "\" & strSubkey

oReg.EnumValues hDefKey, strSubKeyPath, arrValueNames, arrTypes

On Error Resume Next

oReg.GetStringValue hDefKey, strSubKeyPath, "WorkspaceId", strValue

strResult=cstr(strValue)

oReg.GetStringValue hDefKey, strSubKeyPath, "WorkspaceFolder", strValue

strWorkspaceFolder=cstr(strValue)

oReg.GetStringValue hDefKey, strSubKeyPath, "StartMenuRoot", strValue

strStartMenuRoot=cstr(strValue)

On Error Goto 0

If Len(strResult)>0 Then

If LCase(strResult) = LCase(RDSDNSName) Then

Set fso = CreateObject("Scripting.FileSystemObject")

On Error Resume Next

If fso.FolderExists(strWorkspaceFolder) Then

fso.DeleteFolder strWorkspaceFolder, True

End If

If fso.FolderExists(strStartMenuRoot) Then

fso.DeleteFolder strStartMenuRoot, True

End If

DeleteSubkeys HKEY_CURRENT_USER, strSubKeyPath

On Error Goto 0

Set fso = Nothing

End If

Set oReg = Nothing

Sub DeleteSubkeys(HKEY_CURRENT_USER, strKeyPath)

oReg.EnumKey HKEY_CURRENT_USER, strKeyPath, arrSubkeys

If IsArray(arrSubkeys) Then

For Each strSubkey In arrSubkeys

DeleteSubkeys HKEY_CURRENT_USER, strKeyPath & "\" & strSubkey

End If

oReg.DeleteKey HKEY_CURRENT_USER, strKeyPath

End Sub

The .CMD executes the .VBS an expects it in the same directory of course. In the .VBS you will need to change the 5th line – as inidicated. Everything else you can leave as is. Of course this script will only delete the specified connection. You could define the line 5 parameter and change line 33 from

If LCase(strResult) = LCase(RDSDNSName) Then

1	If LCase(strResult) = LCase(RDSDNSName) Then

to the following line

If LCase(strResult) = LCase(RDSDNSName) Then

1	If LCase(strResult) = LCase(RDSDNSName) Then

This would result in to deleted everything but the defined connection and therefor do a cleanup. In theory you could then put a empty string in line 5 and just clean up everything.

As always, I hope some of you find this helpful.

June 20, 2018 by Florian Rossmark configuration scripts solutions windows

Join systems to a domain and create KeePass server entries for local admin’s

Please note – this script was updated – you find the updated post here.

One of the challenges in most daily IT operations is onboarding of workstations and servers (respective domain join). Over the years I came across and tried many ways to accomplish this. Today I wanted to share a script and solution others might find helpful, but first lets get down to some theory and background.

The goals and challenges:

simple domain join after a system was imaged
- this is in theory possible in a fully automated process via various imaging solutions – I found that WDS (Microsoft Windows Deployment Services are in most cases the easiest way to accomplish this while having the possibility to use this in consulting for various clients, in enterprise for various departments etc. Since Windows 10 came in to the equation some of the automation with WDS became more challenging – so keeping it simple with some additional manual labor is often the easiest way to accomplish this – to simplify the process a PowerShell script became a perfect solution).
systems should have a local admin account (not administrator / SID 500 / who should remain disabled) with an individual password
- typing this manual you always risk that the password is misspelled either in your password database or on the actual operating system
- if you think it is a good idea to have the same password on all your clients I actually suggest you do some security related research!

The PowerShell script below will do the following for you:

Ask for the name of the system (this will change the hostname/computername)
Ask for credentials for KeePass / Pleasant Password Server
Ask for credentials to join the system to the domain
Create a local admin user account on the system
Generate a password for this account
Check if there is an existing KeePass / Pleasant Password Server entry for this system
If not – it will proceed and create a entry with the machine name, username, password and various additional information like
1. manufacturer
2. model
3. serial number / service tag
4. UEFI BIOS Windows license key
5. MAC addresses of all network cards Windows knows about
And finally it will join the domain and put the system right away in to the defined OU

The whole script is only an example – you don’t have to use KeePass / Pleasant Password Server nor is the script perfect for any situation – you can take it and modify it as you need it – point it to various IT Asset databases or let you chose from predefined OUs etc. – adjust it as you needed – in general it is a very useful baseline and I wanted to share it.

One of the challenges is to execute the script as administrator (elevated rights) and as well bypass the script execution restrictions without compromising them in a default image, like disabling this important security feature on the image itself. To accomplish this, a simple CMD-Script actually will execute the PowerShell script. CMD-Script can right-clicked and executed as administrator and gain elevated rights. This is as of today not possible by default with PowerShell scripts (.ps1).

Create the following two files “Execute-DomainJoin.cmd” and “Execute-DomainJoin.ps1” and save them in the same directory or e.g. a portable flash drive. Adjust the PowerShell script so it connects to your domain and local systems.

powershell.exe -executionpolicy unrestricted -file "%~dp0\Execute-DomainJoin.ps1"
pause

1 2	powershell.exe -executionpolicy unrestricted -file "%~dp0\Execute-DomainJoin.ps1" pause

Please note – this script was updated – you find the updated post here.

$ScriptVersion = "1.0 - 6/15/2018 - Florian Rossmark
Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Welcome to the Execute Domain-Join script"
Write-Host "========================================="
Write-Host ""
Write-Host ""
Write-Host "This script will do the following Steps:"
Write-Host "----------------------------------------"
Write-Host "- You enter the Computer Name / Host Name"
Write-Host "- You enter Domain Admin credentials for a Domain-Join"
Write-Host "- You enter credentials to access KeyPass Password server"
Write-Host ""
Write-Host ""
Write-Host "Note: always type credentials without any domain-information (MYDOMAIN\) - the script will fail otherwise."
Write-Host ""
Write-Host ""
Write-Host ""
Write-Host "- The script will automatically create a KeyPass entry with all information"
Write-Host "- The script will automatically create a specific local admin account for this machine"
Write-Host "- The script will automatically rename the system to the given name"
Write-Host "- The script will automatically join the system to the domain"
Write-Host ""
Write-Host ""
Write-Host "Script Version: $ScriptVersion"
Write-Host ""
Write-Host ""
pause

#Upper area holds functions..
Function MakeUp-String([Int]$Size = 8, [Char[]]$CharSets = "ULNS", [Char[]]$Exclude) {
$Chars = @(); $TokenSet = @()
If (!$TokenSets) {$Global:TokenSets = @{
U = [Char[]]'ABCDEFGHJKLMNPQRSTUVWXYZ' #Upper case
L = [Char[]]'abcdefghijkmnpqrstuvwxyz' #Lower case
N = [Char[]]'23456789' #Numerals
S = [Char[]]'!@$!@$!@$!@$' #Symbols
}}
$CharSets | ForEach {
$Tokens = $TokenSets."$_" | ForEach {If ($Exclude -cNotContains $_) {$_}}
If ($Tokens) {
$TokensSet += $Tokens
If ($_ -cle [Char]"Z") {$Chars += $Tokens | Get-Random} #Character sets defined in upper case are mandatory
}
}
While ($Chars.Count -lt $Size) {$Chars += $TokensSet | Get-Random}
($Chars | Sort-Object {Get-Random}) -Join "" #Mix the (mandatory) characters and output string
};

#bypass/avoid certificate issues
Add-Type @"
using System;
using System.Net;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;
public class ServerCertificateValidationCallback
{
public static void Ignore()
{
ServicePointManager.ServerCertificateValidationCallback +=
delegate
(
Object obj,
X509Certificate certificate,
X509Chain chain,
SslPolicyErrors errors
)
{
return true;
};
}
}
"@
[ServerCertificateValidationCallback]::Ignore();

#Script starts here...
Clear-Host
Write-Host ""
Write-Host ""
Write-Host "This script must be executed in a PowerShell with elevated rights!"
Write-Host ""
Write-Host ""
Write-Host "Stop the script with: CTRL + C any time..."
Write-Host ""
Write-Host ""
pause
Clear-Host

$ComputerName = Read-Host "Please enter the new Computer Name"
$DomainJoinCredentials = Get-Credential -Message "Enter your credentials for the domain join"
$KeePassCredentials = Get-Credential -Message “Enter your credentials to access Keepass Server”
$localAdminUser = $("$ComputerName" + "_Admin")
$PW = MakeUp-String(12)
$PWencrypted = ConvertTo-SecureString $PW -AsPlainText -Force

Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Checking KeePass to see if those credentials already exist"
Write-Host ""
Write-Host ""

#Collecting MACs
$colMACItems = get-wmiobject Win32_NetworkAdapter | Where-Object {$_.MACAddress -like "*:*"}
foreach ($objMACItem in $colMACItems) {
$MACobj = $objMACItem |select Description,MACAddress
$MACs += $MACobj.MACAddress + " - " + $MACobj.Description + "
"
}
#Collecting SN/ServiceTag and HW information
$SN = "ServiceTag / SN: "+(Get-WmiObject win32_bios | select SerialNumber).SerialNumber
$Model = "Model: "+(Get-WmiObject win32_computersystem | select Model).Model
$Manufacturer = "Manufacturer: "+(Get-WmiObject win32_computersystem | select Manufacturer).Manufacturer
$UEFIKey = wmic path softwarelicensingservice get OA3xOriginalProductKey
$KeepassURL = "https://passwordserver.mydomain.local:10001"
$PWFolder = "Local Admin Accounts"
$PWName = "Individual Admin Account on $ComputerName"
$PWUser = $localAdminUser
$PWPassword = $PW
$PWDescription = "Hardware information:
=====================
$Manufacturer
$Model
$SN

UEFI BIOS Windows Key:
======================
$UEFIKey

Known MAC Addresses:
====================
$MACs
(MACs might be subject to change with Docking-Stations)"

$tokenParams = @{
grant_type='password';
username=$KeePassCredentials.UserName;
password=$KeePassCredentials.GetNetworkCredential().password;}

$JSON = Invoke-WebRequest -Uri "$KeepassURL/OAuth2/Token" -Method POST -Body $tokenParams -ContentType "application/x-www-form-urlencoded"
$Token = (ConvertFrom-Json $JSON.Content).access_token

$headers = @{
"Accept" = "application/json"
"Authorization" = "$Token"}

$GroupSearch = @{“search” = $PWFolder}
$Group = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $GroupSearch) -Headers $headers -ContentType 'application/json'
$GroupID = $Group.Groups.Id

$SearchPhrase = $PWUser
$searchbody = @{“search” = $SearchPhrase}
$Search = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $searchbody) -Headers $headers -ContentType 'application/json'
$SearchID = $Search.Credentials.Id

$KeePassResultscnt = 0
ForEach($Result in $Search.credentials)
{
$CredentialID = $Result.id
If ($Result.GroupId -eq $GroupID)
{
$KeePassResultscnt += 1
}
}
If ($KeePassResultscnt -ge 1)
{
Write-Host "Total number of results found: $cnt"
Write-Host ""
Write-Host ""
Write-Host "ALERT - KeePass already has credentials for this system - can not proceed."
Write-Host "=========================================================================="
Write-Host ""
Write-Host "Search-Phrase: $SearchPhrase"
Write-Host "Search-Folder: $PWFolder"
Write-Host "Amount of results found: $KeePassResultscnt"
Write-Host ""
Write-Host ""
Write-Host ""
Write-Host "Next Steps:"
Write-Host "==========="
Write-Host "- This script will exit now!"
Write-Host "- No changes to the system of KeePass have been applied"
Write-Host "- Go to KeePass and check if this is an old entry and can be renamed/moved"
Write-Host "- Execute the script again"
Write-Host ""
Write-Host ""
pause
EXIT
} Else {
Write-Host ""
Write-Host ""
Write-Host "Writing new credentials to the KeePass server/database"
Write-Host ""
Write-Host ""
$PWEntryDT = Get-Date -Format "O"
$CredEntry = @{
Id = "00000000-0000-0000-0000-000000000000"
Name = "$PWName"
Username = "$PWUser"
Password = "$PWPassword"
Created = "$PWEntryDT"
Modified = "$PWEntryDT"
GroupId = "$GroupID"
Notes = "$PWDescription"
Url = "$ComputerName"
}
Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/credential/00000000-0000-0000-0000-000000000000"-body @(ConvertTo-Json $CredEntry) -Headers $headers -ContentType 'application/json'
Write-Host ""
Write-Host ""
Write-Host "Finished writing to KeePass server/database"
Write-Host ""
Write-Host ""
}
pause

Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Please check the following information:"
Write-Host "======================================="
Write-Host ""
Write-Host "Computer Name: $ComputerName"
Write-Host "local Admin: $localAdminUser"
Write-Host "Admin-PW: $PW"
Write-Host ""
Write-Host ""
Write-Host "Make sure the information above are correct!"
Write-Host ""
Write-Host ""
Write-Host "Verify the local Admin and Admin-PW in KeePass!"
Write-Host ""
Write-Host ""
pause
Write-Host ""
Write-Host ""
Write-Host "All information are verified?"
Write-Host ""
Write-Host ""
pause

Clear-Host
Write-Host "Checking and removing (if exists) old local user: $localAdminUser"
Get-LocalUser -Name $localAdminUser | Remove-LocalUser
Clear-Host
Write-Host "Adding new local administrator account: $localAdminUser"
New-LocalUser -Name $localAdminUser -Password $PWencrypted -AccountNeverExpires -PasswordNeverExpires -Description "System specific local administrator account"
$NewUser = Get-LocalUser -Name $localAdminUser
$AdminGroup = Get-LocalGroup -Name "Administrators"
Add-LocalGroupMember -Name $AdminGroup -Member $NewUser

Write-Host ""
Write-Host ""
Write-Host "Finished."
Write-Host ""
Write-Host ""
pause

Write-Host ""
Write-Host ""
Write-Host "Joining this system to the domain and reboot automatically - stay put"
Write-Host ""
Write-Host ""
Write-Host "Note: The system will not reboot if an error occurs. Check the error message in case you see a error."
Write-Host ""
Write-Host ""

Add-Computer -Domain "mydomain.local" -Credential $DomainJoinCredentials -NewName $ComputerName -Restart -Force -OUPath "OU=Computers,OU=San Diego,OU=USA,DC=mydomain,DC=local"

Write-Host ""
Write-Host ""
Write-Host "Computer exists already:"
Write-Host " Check Domain - remove Computer if needed"
Write-Host " Reboot this system"
Write-Host " Rename this system manually after the reboot"
Write-Host ""
Write-Host "Credentials for Domain are wrong:"
Write-Host " Start the script over"
Write-Host ""
Write-Host ""
pause

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

$ScriptVersion = "1.0 - 6/15/2018 - Florian Rossmark

Clear-Host

Write-Host ""

Write-Host "Welcome to the Execute Domain-Join script"

Write-Host "========================================="

Write-Host ""

Write-Host "This script will do the following Steps:"

Write-Host "----------------------------------------"

Write-Host "- You enter the Computer Name / Host Name"

Write-Host "- You enter Domain Admin credentials for a Domain-Join"

Write-Host "- You enter credentials to access KeyPass Password server"

Write-Host ""

Write-Host "Note: always type credentials without any domain-information (MYDOMAIN\) - the script will fail otherwise."

Write-Host ""

Write-Host "- The script will automatically create a KeyPass entry with all information"

Write-Host "- The script will automatically create a specific local admin account for this machine"

Write-Host "- The script will automatically rename the system to the given name"

Write-Host "- The script will automatically join the system to the domain"

Write-Host ""

Write-Host "Script Version: $ScriptVersion"

Write-Host ""

pause

#Upper area holds functions..

Function MakeUp-String([Int]$Size = 8, [Char[]]$CharSets = "ULNS", [Char[]]$Exclude) {

$Chars = @(); $TokenSet = @()

If (!$TokenSets) {$Global:TokenSets = @{

U = [Char[]]'ABCDEFGHJKLMNPQRSTUVWXYZ' #Upper case

L = [Char[]]'abcdefghijkmnpqrstuvwxyz' #Lower case

N = [Char[]]'23456789' #Numerals

S = [Char[]]'!@$!@$!@$!@$' #Symbols

}}

$CharSets | ForEach {

$Tokens = $TokenSets."$_" | ForEach {If ($Exclude -cNotContains $_) {$_}}

If ($Tokens) {

$TokensSet += $Tokens

If ($_ -cle [Char]"Z") {$Chars += $Tokens | Get-Random} #Character sets defined in upper case are mandatory

}

While ($Chars.Count -lt $Size) {$Chars += $TokensSet | Get-Random}

($Chars | Sort-Object {Get-Random}) -Join "" #Mix the (mandatory) characters and output string

};

#bypass/avoid certificate issues

Add-Type @"

using System;

using System.Net;

using System.Net.Security;

using System.Security.Cryptography.X509Certificates;

public class ServerCertificateValidationCallback

{

public static void Ignore()

{

ServicePointManager.ServerCertificateValidationCallback +=

delegate

(

Object obj,

X509Certificate certificate,

X509Chain chain,

SslPolicyErrors errors

)

{

return true;

};

}

[ServerCertificateValidationCallback]::Ignore();

#Script starts here...

Clear-Host

Write-Host ""

Write-Host "This script must be executed in a PowerShell with elevated rights!"

Write-Host ""

Write-Host "Stop the script with: CTRL + C any time..."

Write-Host ""

pause

Clear-Host

$ComputerName = Read-Host "Please enter the new Computer Name"

$DomainJoinCredentials = Get-Credential -Message "Enter your credentials for the domain join"

$KeePassCredentials = Get-Credential -Message “Enter your credentials to access Keepass Server”

$localAdminUser = $("$ComputerName" + "_Admin")

$PW = MakeUp-String(12)

$PWencrypted = ConvertTo-SecureString $PW -AsPlainText -Force

Clear-Host

Write-Host ""

Write-Host "Checking KeePass to see if those credentials already exist"

Write-Host ""

#Collecting MACs

$colMACItems = get-wmiobject Win32_NetworkAdapter | Where-Object {$_.MACAddress -like "*:*"}

foreach ($objMACItem in $colMACItems) {

$MACobj = $objMACItem |select Description,MACAddress

$MACs += $MACobj.MACAddress + " - " + $MACobj.Description + "

}

#Collecting SN/ServiceTag and HW information

$SN = "ServiceTag / SN: "+(Get-WmiObject win32_bios | select SerialNumber).SerialNumber

$Model = "Model: "+(Get-WmiObject win32_computersystem | select Model).Model

$Manufacturer = "Manufacturer: "+(Get-WmiObject win32_computersystem | select Manufacturer).Manufacturer

$UEFIKey = wmic path softwarelicensingservice get OA3xOriginalProductKey

$KeepassURL = "https://passwordserver.mydomain.local:10001"

$PWFolder = "Local Admin Accounts"

$PWName = "Individual Admin Account on $ComputerName"

$PWUser = $localAdminUser

$PWPassword = $PW

$PWDescription = "Hardware information:

=====================

$Manufacturer

$Model

$SN

UEFI BIOS Windows Key:

======================

$UEFIKey

Known MAC Addresses:

====================

$MACs

(MACs might be subject to change with Docking-Stations)"

$tokenParams = @{

grant_type='password';

username=$KeePassCredentials.UserName;

password=$KeePassCredentials.GetNetworkCredential().password;}

$JSON = Invoke-WebRequest -Uri "$KeepassURL/OAuth2/Token" -Method POST -Body $tokenParams -ContentType "application/x-www-form-urlencoded"

$Token = (ConvertFrom-Json $JSON.Content).access_token

$headers = @{

"Accept" = "application/json"

"Authorization" = "$Token"}

$GroupSearch = @{“search” = $PWFolder}

$Group = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $GroupSearch) -Headers $headers -ContentType 'application/json'

$GroupID = $Group.Groups.Id

$SearchPhrase = $PWUser

$searchbody = @{“search” = $SearchPhrase}

$Search = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $searchbody) -Headers $headers -ContentType 'application/json'

$SearchID = $Search.Credentials.Id

$KeePassResultscnt = 0

ForEach($Result in $Search.credentials)

{

$CredentialID = $Result.id

If ($Result.GroupId -eq $GroupID)

{

$KeePassResultscnt += 1

}

If ($KeePassResultscnt -ge 1)

{

Write-Host "Total number of results found: $cnt"

Write-Host ""

Write-Host "ALERT - KeePass already has credentials for this system - can not proceed."

Write-Host "=========================================================================="

Write-Host ""

Write-Host "Search-Phrase: $SearchPhrase"

Write-Host "Search-Folder: $PWFolder"

Write-Host "Amount of results found: $KeePassResultscnt"

Write-Host ""

Write-Host "Next Steps:"

Write-Host "==========="

Write-Host "- This script will exit now!"

Write-Host "- No changes to the system of KeePass have been applied"

Write-Host "- Go to KeePass and check if this is an old entry and can be renamed/moved"

Write-Host "- Execute the script again"

Write-Host ""

pause

EXIT

} Else {

Write-Host ""

Write-Host "Writing new credentials to the KeePass server/database"

Write-Host ""

$PWEntryDT = Get-Date -Format "O"

$CredEntry = @{

Id = "00000000-0000-0000-0000-000000000000"

Name = "$PWName"

Username = "$PWUser"

Password = "$PWPassword"

Created = "$PWEntryDT"

Modified = "$PWEntryDT"

GroupId = "$GroupID"

Notes = "$PWDescription"

Url = "$ComputerName"

}

Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/credential/00000000-0000-0000-0000-000000000000"-body @(ConvertTo-Json $CredEntry) -Headers $headers -ContentType 'application/json'

Write-Host ""

Write-Host "Finished writing to KeePass server/database"

Write-Host ""

}

pause

Clear-Host

Write-Host ""

Write-Host "Please check the following information:"

Write-Host "======================================="

Write-Host ""

Write-Host "Computer Name: $ComputerName"

Write-Host "local Admin: $localAdminUser"

Write-Host "Admin-PW: $PW"

Write-Host ""

Write-Host "Make sure the information above are correct!"

Write-Host ""

Write-Host "Verify the local Admin and Admin-PW in KeePass!"

Write-Host ""

pause

Write-Host ""

Write-Host "All information are verified?"

Write-Host ""

pause

Clear-Host

Write-Host "Checking and removing (if exists) old local user: $localAdminUser"

Get-LocalUser -Name $localAdminUser | Remove-LocalUser

Clear-Host

Write-Host "Adding new local administrator account: $localAdminUser"

New-LocalUser -Name $localAdminUser -Password $PWencrypted -AccountNeverExpires -PasswordNeverExpires -Description "System specific local administrator account"

$NewUser = Get-LocalUser -Name $localAdminUser

$AdminGroup = Get-LocalGroup -Name "Administrators"

Add-LocalGroupMember -Name $AdminGroup -Member $NewUser

Write-Host ""

Write-Host "Finished."

Write-Host ""

pause

Write-Host ""

Write-Host "Joining this system to the domain and reboot automatically - stay put"

Write-Host ""

Write-Host "Note: The system will not reboot if an error occurs. Check the error message in case you see a error."

Write-Host ""

Add-Computer -Domain "mydomain.local" -Credential $DomainJoinCredentials -NewName $ComputerName -Restart -Force -OUPath "OU=Computers,OU=San Diego,OU=USA,DC=mydomain,DC=local"

Write-Host ""

Write-Host "Computer exists already:"

Write-Host " Check Domain - remove Computer if needed"

Write-Host " Reboot this system"

Write-Host " Rename this system manually after the reboot"

Write-Host ""

Write-Host "Credentials for Domain are wrong:"

Write-Host " Start the script over"

Write-Host ""

pause

Explaining, adjusting and guiding your through the PowerShell script

It is important that you understand the script so you can make adjustments to it. I will try to explain everything that is important and reference some line-numbers while doing so.

Lines 1-30 are just a general introduction and show some generic information
Lines 31-76 hold some functions to generate a password, to bypass some certificate issues etc
1. Lines 35-38 are worth taking a look at, here are all the characters of the four categories that will be used to generate a password. Excluded are already usually hard to read characters in some fonts and other characters that might cause issues – of course, adjust especially line 38 to your preferences and add more symbols or remove what you don’t want to use
Lines 77-89 are just informational
Lines 90-96 expect some user-input
1. new computername
2. get credentials for the domain join (admin)
  1. the script will not validate the credentials, in theory this could be done but I never found it that important
3. get credentials to read/write on the password database server (often not the actual admin-credentials, therefor I separated those two)
  1. the script will not validate the credentials, in theory this could be done but I never found it that important
4. the local admin username that will be created
  1. $localAdminUser = $(“$ComputerName” + “_Admin”)
  2. the above line will create a hostname_admin account – you can adjust this to your preferences
5. 94-95 will generate a password and encrypt it so it can be used to create the local account
Lines 97-103 are just informational
Lines 104-216 – this is actually the whole password server communication and entry check and generation
1. 104-115 those lines gather various information from your current system like serial number, UEFI Windows keys, etc. – you can keep em as is
2. 116 – please enter the URL to your password server here
3. 117 – here your need to enter the folder where the generated credentials are going to be put in on your password server
4. 118 – this is the subject of the entry that will be generated – adjust this to your preferences
5. 119-120 – those are username/password for the entry – you should leave this as is
6. 121-134 – those lines are the details in your password server entry – adjust them to your likes
7. 135-165 – this actually will execute the following on the REST API on your password server
  1. connect to it
  2. check if a entry with the same username already exists
8. 166-189 – this will raise an alert that this user already exists on your password server – 189 will actually exit the whole script
9. 190-216 – this block will write to the password server – cause it did not find an entry with the new username
Lines 217-241 this shows the new created username and password – it actually suggests you compare the entries on your password server to the information shown to make sure everything is correct
Lines 242-251 will create the new local admin account on the system and set the password
Lines 252-267 are informational
Line 268 will execute the actual domain join
1. please adjust the -Domain and the -OUPath parameter to your specific needs
2. note that the command will automatically restart the system
Lines 269-282 Those lines are informational – actually – if anything would go wrong those lines would be shown and help to take further steps after the failed domain join – in most cases those suggestions will help – in the end the error output shown by the command for the domain join (line 268) would indicate what went wrong. The restart of the system actually would bypass this message in the end (more or less)

If you have any questions, feel free to reach out to me. The script could be cleaned up more – but I wanted to provide a working version of it – so I just did a quick clean up or some special stuff and posted it here. Personally I like things a bit more structured, but as said – this is just a general example.

Please note – this script was updated – you find the updated post here.

This script is also mentioned on the API Examples page on the Pleasant Solutions web site here.

June 15, 2018 by Florian Rossmark configuration recommendations scripts security server solutions windows

solutions

SQL Express SQLState 08001 and Error 17

Microsoft RADIUS / NPS SQL logging

Updated domain join script including KeePass / Pleasant Password server entries for local admins

How to create an independent backup network

WDS respective PXE boot and VMware

Gathering profile information from computer

The advantage of DFS and how to set up a working structure

The structure example:

Example target file system structure:

The file servers and their preparation:

DFS Root-Server

DFS Department Server

DFS Archive Server

DFS Other Server

The DFS namespace set up and configuration

Note – information about the above example

What are the real benefits of this

Full text search and DFS drive mappings

Enable SMBv1 on Windows 10 per GPO

Build your own lab environment with VMware

Windows 2016 DHCP load balancer and it’s quirks

Inserting tables as pictures

Monitor DFS replication backlog between servers in PRTG

Prevent ScreenSaver coming up with a PowerShell script

Automate Outlook signature roll outs while pulling the information from Active Directory / LDAP

Print Server backup script

Automate your SUS clean up

Solution for VSS exceptions with VMware guests / VM tools

Password expiration notifications for end users

Script to remove RemoteApp and Desktop Connections

Join systems to a domain and create KeePass server entries for local admin’s

Recent blog posts

Blog Archives

solutions

The structure example:

Example target file system structure:

The file servers and their preparation:

DFS Root-Server

DFS Department Server

DFS Archive Server

DFS Other Server

The DFS namespace set up and configuration

Note – information about the above example

What are the real benefits of this

Full text search and DFS drive mappings

Recent blog posts

Blog Archives

Tags