Lorky

Add Domain Group to Local Admin Group - PowerShell

December 20, 2022, 4:54 pm technology

Hi everyone !

Today I will share a quick tip if you want to add a group to the locla admin group easily.

Sometime you need to use restricted group's policy, but when the environement is already setup some time it's easier to just do a batch.

The batch is nice as it target the OU you want, and it add the Domain Group you want to the local admin group. Please adjust the script for the Administrators groups name depending on the Windows language.

\$DomainName = "CONTOSO"
\$UserName = "Gestionnaire"
\$User = [ADSI]"WinNT://\$DomainName/\$UserName,group"

\$OUpath = 'OU=Ordinateurs,DC=CONTOSO,DC=HQ,DC=qc,DC=ca'
\$Computers = Get-ADComputer -Filter * -SearchBase \$OUpath | Select-object

\$Computers | ForEach {
\$computerName = \$_.Name
Write-Host \$computerName
\$AdminGroup = [ADSI]"WinNT://\$computerName/Administrateurs,group"
\$AdminGroup.Add(\$User.Path)
}

Thanks everyone :)

List Installed Update WMI

December 6, 2022, 3:58 pm technology

Hi everyone

Today I wanted to share a small but handy tip to list all updates.

It come handy when you want to compare all updates on some machines for problems.

wmic qfe get hotfixid,installedon

The output look like that;

image.png?w=438

As you can see it's easy after to compare server, or to know which update got installed when.

Remove Teams Auto Signin with Domain Account

December 2, 2022, 3:51 pm technology

Hi everyone !

Today I wanted to share a small tip if you want to disable team from using the domain upn when the session open for the first time.

The tip is nice as when the user open Team for the first time if you are hybrid / on-prem the users can have difficulty to open team as they need to select "use another email" in the windows footer. If the user don't use the correct login then a loop happen, the sign-off seem impossible from Teams when it try to load an unexisting account. (Removing team and reisntalling it is the easiest workaround if it happen)

The tip can be easilly done by Group Policy.

The magic registry key to use in our case is SkipUpnPrefill (HCU\Software\Microsoft\Office\Teams)

image-6.png?w=826

You can create the settings are in GPP;

image-7.png?w=681

As you can see it's a easy tip to do :) (more read on the settings here; https://learn.microsoft.com/en-us/microsoftteams/troubleshoot/authentication/teams-defaults-to-domain-joined-account)

Thanks everyone

Windows Server 2019 - Clean WSUS WID Database

November 22, 2022, 8:28 pm technology

Hi everyone

Today I wanted to share a tip to clean up your WSUS WID database.

The tip allow you to not remove and reinstall to achieve the same goal. You save 2 reboot in the least.

The first step is to close the services;

Stop-Service WSUSService, W3SVC

Make sure the service is stopped;

Get-Service WSUSService, W3SVC

Erase the database file;

C:\windows\WID\Data\susdb.*

After that we need to connect to the database service, as for it the data is still there yet;

We need to restart the service;

Start-Service WSUSService, W3SVC

Use HeidiSQL portable edition, (https://www.heidisql.com/download.php)

Use named pipe and that to connect;

\.\pipe\MICROSOFT##WID\tsql\query

image-3.png?w=576

The connection might give you such error; just click OK and ignore it

image-4.png?w=308

From there use that command to reset the database;

**ALTER DATABASE SUSDB** **SET OFFLINE WITH ROLLBACK IMMEDIATE;** **DROP DATABASE SUSDB;**

Click to Run

image-5.png?w=789

Now technically speaking the WSUS is empty, but the console will fail to open at that point. We need to redo the WSUS wizard, which can be run that way;

Program Files\Update Services\Tools\Wsusutil.exe postinstall CONTENT_DIR="e:\WSUS"

Make sure the folder you write in CONTENT_DIR is empty.

image-2.png?w=946

After the command, the WSUS's console should open correctly, and it should ask you about what product and language you want :)

Force GPUpdate for all computers

November 21, 2022, 10:28 pm technology

Hi everyone !

Today I wanted to talk about a small tip if you need to refresh a computer gpo for some computer OU.

I will talk the powershell command let; Invoke-GPUpdate

The commad let is powerfull, as you can target a computer, and to update only user settings; that way;

Invoke-GPUpdate -Computer "DOMAIN\WORKSTATION-001" -Target "User"

The last command let I wanted to talk is a more complex's one, like this one;

Get-ADComputer –filter * -Searchbase "ou=Site-A, dc=Domain,dc=com" | foreach{ Invoke-GPUpdate –computer \$_.name -force}

That one will search a complete OU for all computer account, and invoke a gpupdate /force on them.

Before running it I suggest to try the Get-ADComputer command let to be sure it target computer you want;

Get-ADComputer –filter * -Searchbase "ou=Site-A, dc=Domain,dc=com" | fl

Make sure you know that the remote user will see a gpupdate's windows, to have it hidden make sure you use -AsJob in your command let.

Thansk everyone for listening

Lorky`s Blog - Techno ressources and general informations for everyone !

Add Domain Group to Local Admin Group - PowerShell

List Installed Update WMI

Remove Teams Auto Signin with Domain Account

Windows Server 2019 - Clean WSUS WID Database

Force GPUpdate for all computers

Popular Tags

Archives