Author Archives: Thomas.Marcussen

About Thomas.Marcussen

Technology Architect & Evangelist, Microsoft Trainer and Everything System Center Professional with a passion for Technology

Intel NUC adding the missing SMBIOS information

Posted on by
1

Today I encountered the Intel NUC (NUC5i3RYH).

The task was simple, Add Drivers to WinPE & Create Driver Package for Windows 8.1

Unfortunately, the Intel NUC (NUC5i3RYH) was missing vital SMBIOS information ;(

The System Management BIOS (SMBIOS) defines access methods and data structures for BIOS that stores information on specific computers.

Example SMBIOS categories include:

  • Manufacturer
  • Product Name
  • Version
  • Serial Number
  • System SKU Number
  • System family
  • Chassis Asset Tag

I ran the following commandline: wmic csproduct get *

The result concluded that all information (except the SMBIOS GUID) was missing.

In my case, I needed the Product Name to match the actual model number – The info is needed to apply a specific driver package for the model using Configuration Manager or MDT

The Product Name can be verified using commandline: wmic csproduct get name

When assigning drivers from the task sequence in Configuration Manager or MDT I usually use:

SELECT * FROM Win32_ComputerSystem WHERE Model LIKE “%TYPE%”

or for Lenovo

SELECT * FROM Win32_ComputerSystemProduct WHERE Version LIKE ‘%TYPE%’

So what to do?

Intel has released a tool to modify the bios: Intel® Integrator Toolkit (download: https://downloadcenter.intel.com/download/22856)

Using the tool is pretty simple:

  1. Download and Install Intel® Integrator Toolkit
  2. Start the tool
  3. Select download and customize bios in the wizard
  4. Choose your model from the list
  5. Select your BIOS
  6. Click Download and customize
  7. In the SMBIOS tab add the info you need
  8. Click Save
  9. In File Menu, click Create BIOS Install Package
  10. Save your EXE file
  11. Now run the file on the model you need to update with the information – it works from within Windows or from Windows PE.

After the reboot you will need to confirm the BIOS upgrade.

The added information is now available for use

Windows 10 – Windows Updates troubleshooting

Posted on by
Reply

If you experience problems with Windows Updates and need to debug on the actual process, WindowsUpdates.log has always been a good place to start……… but not on Windows 10

According to Microsoft these steps are relevant only for the January Tech Preview of Windows 10.

Windows Update uses Event Tracing for Windows (ETW) to generate diagnostic logs. This method improves performance and reduces disk space usage. However, the logs are not immediately readable as written. To decode the resulting ETL files and create a log that you can read, follow these steps.

  1. Download the public symbols by following the directions here. Install these symbols to a directory such as C:\symbols.
  2. Download the Tracefmt.exe tool by following the instructions here.
  3. Open a command prompt with administrative rights.
  4. Create a temporary folder, such as %systemdrive%\WULogs.
  5. Locate the directory that contains Tracefmt.exe, as downloaded and installed in step 2. Then, copy Tracefmt.exe to %systemdrive%\WULogs.
  6. Run the following commands at a command prompt, in the order presented:
    • cd /d %systemdrive%\WULogs
    • copy %windir%\Logs\WindowsUpdate\* %systemdrive%\WULogs\
    • tracefmt.exe -o windowsupate.log <each windows update log delimited by space> -r c:\Symbols

For example, the last line might resemble the following:

tracefmt.exe -o windowsupate.log Windowsupdate.103937.1.etl Windowsupdate.103937.10.etl -r c:\Symbols

Lucky for us, we don’t always need to dig deep – there is a deprecated logfile we can use for now (January Tech Preview) WindowsUpdate_AU_deprecated.log

Allowing non-Administrators to control Hyper-V

Posted on by
Reply

By default Hyper-V is configured such that only members of the administrators group can create and control virtual machines.  I am going to show you how to allow a non-administrative user to create and control virtual machines.

Hyper-V uses the new authorization management framework in Windows to allow you to configure what users can and cannot do with virtual machines.

Hyper-V can be configured to store it’s authorization configuration in Active Directory or in a local XML file.  After initial installation it will always be configured to use a local XML file located at \programdata\Microsoft\Windows\Hyper-V\InitialStore.xml on the system partition.  To edit this file you will need to:

Open the Run dialog (launch it from the Start menu or press Windows Key + R).
Start mmc.exe
Open the File menu and select Add/Remove Snap-in…
From the Available snap-ins list select Authorization Manager.
Click Add > and then click OK.
Click on the new Authorization Manager node in the left panel.
Open the Action menu and select Open Authorization Store…
Choose XML file for the Select the authorization store type: option and then use the Browse… to open \programdata\Microsoft\Windows\Hyper-V\InitialStore.xml on the system partition (programdata is a hidden directory so you will need to type it in first).
Click OK.
Expand InitialStore.xml then Microsoft Hyper-V services then Role Assignments and finally select Administrator.
Open the Action menu and select Assign Users and Groups then From Windows and Active Directory…
Enter the name of the user that you want to be able to control Hyper-V and click OK.
Close the MMC window (you can save or discard your changes to Console 1 – this does not affect the authorization manager changes that you just made).

The user that you added will be able to completely control Hyper-V even if they are not an administrator on the physical computer.

How To: Debug missing Drivers in MDT

Posted on by
Reply

Came across this great post by Keith Garner (http://ow.ly/JeHHD) on Microsoft Social forum

Its the most thorough debugging guide I’ve seen on drivers in MDT

How to debug Network Driver Problems

One of the earliest hurdles an MDT administrator will come across is the management of device drivers, specifically networking drivers. With most other drivers, like Audio, printer, and video drivers, a quick call to Windows Update or install over the network will resolve the Installation. However unless the Network (and storage) Drivers are installed into Windows from the start, it will be much more difficult to install the rest of the system.

This post should help you get started if you find a machine that did not install a device driver properly, and you want to know how to find and import the correct drivers.

Installing network drivers in the full OS

  • Step 1 – Try network connection again
    It’s possible that you might get a DHCP error from MDT, but when you try again later to connect the Deployment Share it works! This may be caused by a slow or malfunctioning DHCP server in your network. Re-check your DHCP servers, ensure that PortFast is enabled on your routers. If all else fails get your network administrators to document the DHCP delay. A long delay in modern networks is unnecessary.
  • Step 2 – Verify connectivity
    You may not have a driver problem but a network problem. Check the physical connection on the computer (Network installs on MDT *REQUIRE* a wired network connection, no Wi-Fi). Open a web browser. Check the IP Address (ipconfig.exe /all). Ping the Deployment Server, manually connect to the Deployment Share. IF you can’t connect to the Deployment Share, neither can MDT.
  • Step 3 – Find the Correct Driver Package
    Before you load the driver into MDT, first verify that you have the correct driver. There are scenarios where you may *think* you have the correct driver, but the driver will never run because the package is designed for a different OS/SKU/Platform/whatever. Install the driver package by:
    ○ Open the Device Manager (devmgmt.msc).
    ○ Find the network device in the list (ensure this is the wired device, not the wireless device)
    ○ Right click on “Properties” and click on the “Details” tab.
    ○ From the “Details” tab, select the property “Hardware Ids” select all the values, and copy to the clipboard, it would be a good idea to save for later. Should look something like:
    PCI\VEN_8086&DEV_1502&SUBSYS_21F317AA&REV_04
    PCI\VEN_8086&DEV_1502&SUBSYS_21F317AA
    PCI\VEN_8086&DEV_1502&CC_020000
    PCI\VEN_8086&DEV_1502&CC_0200
    ○ From the “Driver” tab, click on “Update Driver…”, click on “Browse my computer for driver software” locate the driver package on the local machine or USB Drive, and install the package.
    ○ You should get a confirmation that the driver package was installed.
    ○ IF you do not get confirmation, MDT driver installation may not work.

Windows will install the driver starting with the *.inf install package, and will typically include a *.sys (binary) and a *.cat (digital Signature). If the driver package has been re-packaged into a *.cab, *.zip, or other compressed *.exe file, the package must be extracted first. This is a hard requirement for any driver used by MDT and/or SCCM. All driver packages that are signed by Microsoft (WHQL) will be installed from the *.inf file, and you should only use devices that have the Microsoft WHQL Logo as a sign of quality.

If you need a help on where to find driver packages for your devices, the 3 largest Computer OEM manufacturers supply drivers grouped by Make and Model that are easily imported into MDT and SCCM. See: http://deploymentbunny.com/2014/07/08/back-to-basicwhere-to-find-drivers-for-servers-and-clients/

  • Step 4 – Load driver into MDT
    If you have more than 20 driver packages, or if you anticipate you will have more than 20 drivers, you should start grouping your drivers in sub-folders for organization. One popular method is to group by Computer Make and Model. Ensure that you are using the correct Driver Selection Profile in your task sequence. If you are unsure, disable any selection profile(s) to ensure the driver is installed correctly.
  • Step 5 – Run the full MDT installation
    During installation MDT will perform the following:
    ○ Run the PNPEnum.exe utility and capture output to PnPEnum.xml. The VEN_Xxxx and DEV_Yyyy from the “HardwareIDs” property above must be present in this list. Otherwise we won’t have a match.
    ○ Search through the %DeployRoot%\control\drivers.xml file looking for a match for the HardwareID. MDT may filter the search based on the folder search type.
    ○ MDT will copy each matching driver to the local c:\drivers directory using the xcopy.exe command. You can search (grep) for the string “xcopy” in the ZTIDrivers.log file, that will get you list of all driver packages matched by MDT.
    ○ MDT will allow the machine to boot into the NEW OS, and Driver Installation will begin in the OS. IF there are multiple drivers found and copied locally, the Windows (not MDT) will determine the best one. The c:\windows\inf\SetupAPI.*.log files will detail which drivers copied locally were installed (or *not* installed).

Installing Network Drivers in WinPE

  • Step 6 – Try the network connection again
    (See above
  • Step 7 – Verify Connectivity from within WinPE
    Verifying network connectivity will be a bit more difficult in WinPE, since we have a limited User Interface, so all investigation must be done in the debugging mode (Press F8) cmd.exe
    ○ Try connecting to the Deployment Share:
    c:\> net use * \\MDT\DeploymentShare$ /u:UserDomain\UserName *
    ○ Try pinging the Deployment Server:
    c:\> Ping.exe MDT.Corp.contoso.com
    ○ Verify that you have an IP address ( ipconfig /all ) If you have an AutoConfiguration address – Driver OK – WinPE can’t reach the DHCP server. If you have “Media Disconnected” – Driver OK – Physical adapter not plugged to network. If no devices are listed – Driver bad – Driver not installed.
    ○ Check the x:\windows\system32\WpeInit.log – This log will show the network driver (if found) being installed.
  • Step 8 – Verify driver packages are getting included into WinPE
    Firstly, verify the correct driver package from within the full OS above. By default MDT will import *all* Storage and Networking drivers into your WinPE image. However it is possible to change the subset of files copied via “Selection Profile” or other method. Cross check your WinPE Driver Settings.
    ○ From within the MDT console, right click on the root of your Deployment Share and select properties.
    ○ Click on the “Windows PE” tab, and the “Drivers and Patches” sub tab for both x86 and x64.
    ○ Your Network Drivers package must be in the “Selection Profile” if enabled.Finally verify that the correct Network Driver package is being copied to WinPE. If necessary this may include setting up a debugger to watch the MDT Provider build the WinPE Image from scratch. My preference is to use the SysInternals  http://live.sysinternals.com/Dbgview.exe tool.
    ○ Open up the MDT console.
    ○ Download and run the DbgView.exe tool.
    ○ Update the deployment share in question.
    ○ The DbgView tool should show what drivers were copied to each WinPE Image.

Other

  • Whenever you add a driver into the MDT console, you must update the deployment share for that drivers to be added to your WinPE Image. If you are unsure, select “Completely regenerate the boot images.” to ensure the drivers is imported. Additionally, you must copy the updated LitetouchPE_x??.wim and *.iso files to the other consumers of the WinPE image like WDS/PXE and or any USB offline media.
  • Note that some Broadcom NetXtreme class of drivers have a multi-function driver architecture that may have difficulty loading in WinPE. Ensure that you load the “RIS” class of drivers from Broadcom in your MDT environment.
  • Note that by default MDT does *NOT* support the installation of Windows over Wireless network devices (Wi-Fi). The MDT installation sources must either be available through wired networking, or offline (USB Flash) media.
  • This post does not discuss origination of drivers within MDT ( Chaos vs. Total Control ), that is a different topic. http://www.deploymentresearch.com/Research/tabid/62/EntryId/112/MDT-2013-Lite-Touch-Driver-Management.aspx

Further Help

If you are still having problems with drivers in via MDT, ask the experts in the MDT Technet Forum:

  • Include a short description of the problem. Including the Make/Mode if necessary.
  • Include the HardwareIDs from the Device Manager (Devmgmt.msc) into the post (from above).
  • Copy your known good driver package (step 3 above) to OneDrive.
  • Copy the following log files to a public site like OneDrive and include the link:
    ○ PnpEnum.xml (from Client)
    ○ Bdd.log (From Client) – or at least the ZTIDrivers.log file.
    ○ c:\windows\inf\SetupAPI.*.log (from client)
    ○ %DeployRoot%\control\Driver*.xml
    ○ %DeployRoot%\control\SelectionProfile*.xml
    ○ %DeployRoot%\control\settings.xml (if problems in WinPE)
    ○ x:\windows\System32\WpeInit.log (if problems in WinPE)
    ○ If the MDT server is not including your driver package in WinPE include the DBGView log.

Poweshell under the security context of another user (RunAs)

Posted on by
Reply

Recently i needed to run some powershell scripts under multiple security context’s – the main reason for this was my client’s strict delegation model.

We ended up with multiple service account with rights only to the needed systems (Its not such a bad thing!)

The result was this powershell script to change security context

$SPAccountName = “<username>”;
$AccountPassword = “<password>”;
$AccountPasswordAsSecureString = $AccountPassword | ConvertTo-SecureString -Force -AsPlainText
$credential = New-Object System.Management.Automation.PsCredential(“$env:userdomain\$SPAccountName”,$AccountPasswordAsSecureString)
$SvcAccSession = New-PSSession -Credential $credential;
Invoke-Command -Session $SvcAccSession -Script { Import-Module ActiveDirectory }
Invoke-Command -Session $SvcAccSession -Script { Get-AdGroupMember “Some-group”}

In the above example we just get the member of some application group – but really, you can do whatever you like.

If you need it to query a specific server you can use -Computername <servername> right after New-PSSession.

This method also came in rather handy when running service-side powershell execution invoked by a webservice.. but more on that later

 

Unable to use Power Shell AD cmdlets on Remote Server

Posted on by
1

I came across this error when building a web service executing powershell cmdlets

When executing the commands directly on the server worked without problems

but when using New-PSSession to invoke the scripts I ended up with the following error:

WARNING: Error initializing default drive: ‘Unable to contact the server. This
may be because this server does not exist, it is currently down, or it does not
have the Active Directory Web Services running.’.
Unable to contact the server. This may be because this server does not exist,
it is currently down, or it does not have the Active Directory Web Services
running.
+ CategoryInfo : ResourceUnavailable: (:) [Get-ADObject], ADServe
rDownException
+ FullyQualifiedErrorId : ActiveDirectoryServer:0,Microsoft.ActiveDirector
y.Management.Commands.GetADObject
+ PSComputerName : localhost

Note that PSComputerName was not defined in my script – default is localhost.

To resolve the problem i did the following:

  1. Added “-Computername <Server1>” to my script file (Server1 is a domain controller, that had Active Directory Web Services running (default on Domain controllers running Windows Server 2012 R2) (Check Link for running on Windows Server 2003 and Windows Server 2008)
  2. Executed “Winrm QuickConfig” on Server1

I was searching for groups with a specific like description with the following command: get-adobject -Filter {description -like “ps1*”}

and the result with the problem solved:

PSComputerName : Server1
RunspaceId : b83f4390-36b7-4cfa-8539-279b12fce09f
DistinguishedName : CN=Application Group
1,OU=Applications,DC=ThomasMarcussen,DC=com
Name : Application Group 1
ObjectClass : group
ObjectGUID : 4c57f3b5-726b-4de7-882b-2c80b3f0fdb8

PSComputerName : Server1
RunspaceId : b83f4390-36b7-4cfa-8539-279b12fce09f
DistinguishedName : CN=Application Group
2,OU=Applications,DC=ThomasMarcussen,DC=com
Name : Application Group 2
ObjectClass : group
ObjectGUID : 70289cdd-0277-457e-bc2d-162703342f74

 

 

Access Director 2.4.0.2 released!

Posted on by
Reply

It’s been some time since our last update, but here we go again

Access Director has been updated and released

This is a major upgrade, all previous versions should be uninstalled prior to installing the new versions

Short list of changes

  • Its now possbile to use localized balloon notification (or your own)
  • Language default is en-us
    • valid values are auto, or specific lananuge files e.g. de-de.lng (must reside in existing languages folder)
  • Localized menu options (remember du save lng files as unicode)
  • Registry modifications now resides in HKLMSoftwareNoLightPeopleAccess Director
  • as per request the MSI, and application itself is now signed
  • Removed the need for any registry keys needed for the service to start (will run with default values if no other is present
  • Updated Policy Prefences template included in zip file

Direct Download Link: http://tinyurl.com/mtc4pzo

let me know of bugs and feature requests 🙂 @MarcussenThomas

 

 

Advanced Installer

Posted on by
Reply

For many years I’ve been working with Wise Package Studio, the best tool ever for application repackaging projects. Since Wise Package Studio is End of life – announced in December 2011. Now seemed like a good time to find a new tool, Flexera Admin Studio seemed like the obvious choice, but is rather expensive (still a great tool)

In some cases Orca (http://www.technipages.com/download-orca-msi-editor) would get the job done, but still would take a long time

I remembered coming across Advanced Installer at TechEd NA, so decide to have a look at the tool

There is a free trial from the website and also a free version: http://www.advancedinstaller.com/download.html

Advanced Installer comes in multiple versions, I choose to test the Architect version, mainly because it had the following features highlighted

  • Repacker
  • App-V
  • SCCM
  • MSI Quick-Edit

My test of the product was a great success !

Today I will recommend this product to my customers looking to repackage or edit MSI’s, it has a nice and intuitive interface, much like Wise Package Studio had 😉

Have a look at some of the videos from Advanced Installer on YouTube: https://www.youtube.com/channel/UCIPx2SPC1K7_DoPdVeFHoNg

 

 

Change the size of a virtual machine by using a Azure PowerShell script

Posted on by
Reply

Finally i got around to moving my demo environment to Azure

I don’t need my environment to perform 100% while not using it, so came a cross this nice way to scale my environment on-demand.

This is possbile with a simple powershell script:

Function HowTo-SetAzureVMSize{
[CmdletBinding()]
param(
[parameter(Mandatory=$true)]
[string]$ServiceName,
[parameter(Mandatory=$false)]
[ValidateNotNullOrEmpty()]
[string]$Name=$ServiceName,
[parameter(Mandatory=$true)]
[string]$VMSize
)
PROCESS{
Get-AzureVM –ServiceName $ServiceName –Name $Name |
Set-AzureVMSize $VMSize |
Update-AzureVM
}
}
HowTo-SetAzureVMSize -ServiceName {your-cloud-service-name} -Name {your-vm} –VMSize “{your-desired-vm-size}”

Example:

Function HowTo-SetAzureVMSize{
[CmdletBinding()]
param(
[parameter(Mandatory=$true)]
[string]$ServiceName,
[parameter(Mandatory=$false)]
[ValidateNotNullOrEmpty()]
[string]$Name=$ServiceName,
[parameter(Mandatory=$true)]
[string]$VMSize
)
PROCESS{
Get-AzureVM –ServiceName $ServiceName –Name $Name |
Set-AzureVMSize $VMSize |
Update-AzureVM
}
}
HowTo-SetAzureVMSize -ServiceName ThomasMarcussen -Name TMSRV001 –VMSize “Standard_D2”

Currently not all hardware configurations are available in all locations – I tested in Western Europe.

Virtual Machine Sizes:

A0 (Shared core, 768 MB Memory)
A1 (1 core, 1.75 GB Memory)
A2 (2 cores, 3.5 GB Memory)
A3 (4 cores, 7 GB Memory)
A4 (8 cores, 14 GB Memory)
A5 (2 cores, 14 GB Memory
A6 (4 cores, 28 GB Memory)
A7 (8 cores, 56 GB Memory)

D1 (1 core, 1.75 GB Memory)
D2 (2 cores, 7 GB Memory)
D3 (4 cores, 14 GB Memory)
D4 (8 cores, 28 GB Memory)
D11 (2 cores, 14 GB Memory)
D12 (4 cores, 28 GB Memory)
D13 (8 cores, 56 GB Memory)
D13 (16 cores, 112 GB Memory)

Allowed values are:

ExtraSmall
Small
Medium
Large
ExtraLarge
A5
A6
A7
A8
A9

Basic_A0
Basic_A1
Basic_A2
Basic_A3
Basic_A4

Standard_D1
Standard_D2
Standard_D3
Standard_D4
Standard_D11
Standard_D12
Standard_D13
Standard_D14

Admin Rights: The Root Of Many Vulnerabilities

Posted on by
Reply

A recent survey conducted by BeyondTrust (www.beyondtrust.com), a developer and marketer of least privilege management software, reveals that 92% of critical vulnerabilities reported by Microsoft could have been prevented simply by removing administrator rights from Windows users. Also, the survey points out, removing administrator rights helps companies protect themselves and their computers against 94% of Microsoft Office, 89% of Microsoft Internet Explorer, and 53% of Windows vulnerabilities. Given the prevalence of Microsoft software in today’s corporate environment, these numbers should give any administrator pause.

Get a head start removing Admin Rights – by using Access Director from Basic Bytes