Tim D'Annecy

#Windows #Powershell

I found this post on Reddit and wanted to save the command for my notes.

Running this command in Powershell will give you the PC's currently connected SSID. This is handy for troubleshooting network issues when connected remotely through a PSSession.

netsh wlan show interfaces | select-string SSID

#powershell #Exchange

If you're using Microsoft Exchange Online, there's no way to currently see when a Mail Contact was created on the web dashboard.

I wanted to know when an address was added as a Mail Contact in one of our tenants, but I also wasn't able to get an audit trail using the Microsoft Compliance center.

As a workaround, this Powershell command will give the basic info for “WhenCreated”.

Get-Recipient -RecipientTypeDetails MailContact -ResultSize Unlimited | sort WhenCreated | select Name,Alias,WhenCreated

#bash #linux

QNAP recently enabled a maintenance prompt that appears when you connect over SSH. In the current version of the QNAP OS, I'm not able to turn off the prompt via GUI and needed to run a bash command to get it to go away.

I found this command somewhere and it's been working for me:

sed -r -i.bak 's/^(.*admin.*qts-console-mgmt.*)$/#\1/' /etc/profile

#Windows

• Open Local Group Policy Editor (gpedit.msc)

• Change entry at Computer Configuration > Administrative Templates > System > Specify settings for optional component installation and component repair to “Enabled” and check the box for “Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS)”

• Run gpupdate in Command Prompt.

• Open Settings > Apps > Apps & features > Optional features and click “Add a feature”. Search for and install “RSAT: Active Directory Domain Services and Lightweight Directory Services Tools”

Alternatively, you can add it through Powershell:

Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

• Verify the installation was complete by running Import-Module activedirectory in Powershell.

#Windows #Intune

On Windows, to allow Quick Assist to display UAC prompts to a remote user, you need to make a few quick changes.

Microsoft Endpoint (Intune)

Older instructions are here: https://www.cloud-boy.be/portfolio/run-as-admin-gives-black-screen-in-quick-assist-teamviewer-intune-fix/ [A]

New instructions are:

1. Open the Endpoint management dashboard

2. Click on “Devices” and select “Configuration profiles”. Click on “Create profile”. Change Platform to “Windows 10 and later” and the Profile type field to “Settings catalog (preview)”. Click the “Create” button.

3. Give it a basic name and navigate to the “Configuration settings” page.

4. Click the “Add settings” button. Double click on the “Local Policies Security Options” entry in the Settings picker pane on the right. Check the box for the option “User Account Control Switch To The Secure Desktop When Prompting For Elevation”. Back on the main settings area to the left, change the dropdown to “Disabled” and click the “Next” button.

5. Enable the policy to all devices (as needed) and then test.

Discuss...

#Windows

%appdata%\Microsoft\Windows\Themes\CachedFiles

or just...

%appdata%\Microsoft\Windows\Themes\TranscodedWallpaper

I'm just writing this down for my notes.

#Windows #Powershell

# Uninstall-UmbrellaRoamingClient
# Tim D'Annecy 2021-06-04
# Removes Cisco Umbrella Roaming Client.

function Uninstall-UmbrellaRoamingClient {
    [CmdletBinding()]
    param ()
 
    $UmbrellaStatus = (Get-Service -Name 'Umbrella_RC').Status

    If ( $UmbrellaStatus = 'Running' ) {
        Write-Host 'Roaming Client was running. Stopping now.'
        Stop-Service -Name 'Umbrella_RC' -Force
        try {
            #wmic Product where "name='Umbrella Roaming Client'" call uninstall
            (Get-WmiObject -Class win32_product -Filter "Name='Umbrella Roaming Client'").Uninstall()
            Write-Host 'Umbrella successfully uninstalled using wmic call.'
            Start-Sleep -Seconds 5
            Clear-DnsClientCache
        }
        catch {
            Write-Host 'Umbrella could not be uninstalled.'
        }
    }
    else {
        Write-Host 'Roaming Client was not running. Exiting.'
    }
}

Uninstall-UmbrellaRoamingClient

#Windows #Powershell

While most organizations are moving files to cloud-based solutions, I'm working for a client who wants to keep everything in-house. In this environment, some users had a private folder under a previous drive letter mapping, others didn't have anything at all.

I created this quick and dirty Powershell script to automate the cleanup process for existing users.

This script gets all users from AD, sets their HomeDirectory attribute in AD to a fileshare and mounts it on the U: drive, and creates private folders with the correct ACL permissions.

# Assign-PrivateDrive
# Tim D'Annecy 2021-07-09
# Creates shared drive folder with correct permissions and sets AD property.

function Assign-PrivateDrive {
    param()

    Import-Module ActiveDirectory
    $driveLetter = 'U:'
    $PrimaryDC = 'sample.dc'
    $activeOUDN = 'OU=Users,DC=sample,DC=local'

    $users = Get-ADUser -Filter { Enabled -eq $true }  -SearchBase $activeOUDN -Properties * 
    foreach ($user in $users) {
        $UserSAM = $user.SamAccountName
        $fullPath = "\\samplefs\share\Private\{0}" -f $UserSAM
        Set-ADUser -Server $PrimaryDC -Identity $UserSAM -HomeDrive $driveLetter -HomeDirectory $fullPath 
        
        if (!(Test-Path -Path $fullPath )) {
            Write-Host "Creating directory at $fullPath"
            New-Item -path $fullPath -ItemType Directory
            $acl = Get-Acl $fullPath

            $FileSystemRights = [System.Security.AccessControl.FileSystemRights]"Modify"
            $AccessControlType = [System.Security.AccessControl.AccessControlType]::Allow
            $InheritanceFlags = [System.Security.AccessControl.InheritanceFlags]"ContainerInherit, ObjectInherit"
            $PropagationFlags = [System.Security.AccessControl.PropagationFlags]"InheritOnly"
    
            $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule ("sample\$UserSAM", $FileSystemRights, $InheritanceFlags, $PropagationFlags, $AccessControlType)
            $acl.AddAccessRule($AccessRule)
            
            Write-Host 'Setting permissions on folder.'
            Set-Acl -Path $fullPath -AclObject $acl 
        }
        else {
            Write-Host "Skipping $($user.Name) . Directory found at $fullPath"
        }
    } 
}

Assign-PrivateDrive

#Windows #AutoHotkey

I wrote an AutoHotkey script that inserts commonly used text when a keystroke is pressed.

I had issues using the script with Active Directory Users and Computers. I would press the hotkey, but nothing would happen. This has something to do with how Windows handles UAC. Luckily, AHK has a workaround.

Found out from the AHK FAQ that I needed to rerun the AHK installer, select “Modify” in the installer, and check the box for “Add 'Run with UI Access' to context menus”.

Now, I can run my script and interact with ADUC windows without issues.

Making this note for myself for future reference.

#Windows #Powershell

I found a great way to have something similar to the GNU program top on Windows in Powershell in this Stack Exchange post.

While(1) {ps | sort -des cpu | select -f 15 | ft -a; sleep 1; cls}

It's not the exact same app, but it gives you the top 15 running processes sorted by CPU load.