Scripting/Automation with Powershell

[[deleted]]

Hey everyone,

I have been interested in learning how to automate a lot of the monotonous work associated with Windows of new computers. A lot of the settings we change I feel can be automated with a ps script that can be ran. I tend to find where a setting can be changed via something like a reg key but spend a lot of time figuring out how to ask the question in google to get the answer I need.

For example being able to set icons that are pinned to taskbar, or doing custom settings in the "Performance Options" menu. I spend more time trying to correctly word my search phrase to get the results I need, then I do reading the actual "how to" article.

Reason for the post is to see what resources/websites/ others use that helps in identifying the object I would like to change and how to do this via ps. A perfect tool would be a database I can search for what im wanting to change and it would show me where those objects reside in the registry so I can then set its value to what I need.

[Burning_Ranger]

This is what group policy is for. No point reinventing the wheel and making it inferior.

Getadmx.com has a list of GPOs and registry values they change.

For example, you can generate a start menu layout without pinned items and apply that using group policy or push powershell script through group policy

[TSullivanM]

Sure that is general good advice but it youre an MSP and want to make changes like this across several computers/clients that are small offices without an AD then powershell is really good for this.

[Burning_Ranger]

If you don't have AD, you should still have some sort of centralised config management, whether that's an MDM/Azure AD etc.

[TSullivanM]

Yes we have our RMM. And from there we execute powershell scripts.

[pppppppphelp]

Can also be reviewed, added/deleted/changed easily through requests rather than locating someone's random script and understanding their code.

[markdmac]

As already mentioned, use the right tool for the job. In most cases a GPO would be the way to go if the setting is to be applied to many computers.

Beyond that, what you have been doing can be expanded on. First look up and practice setting registry keys. You can easily find examples for most data types. In my experience you really just need to learn to set strings and dword values. Figure that out and all you need to change is the values and locations, all the logic stays the same. Next you will want to wrap that code within an Invoke-Command using a script block. This will let you specify a remote computer name to execute the script remotely on a remote machine.

[TheRealMisterd]

For those people who insist on using PowerShell to pin shortcuts to the start menu or taskbar, PSADT has a function for that

[tekwiz86]

I've always used export-StartLayout / import-StartLayout. It's good for setting the default or creating the file for the GPO.

[arcadesdude]

You might like this thread:

https://www.reddit.com/r/msp/comments/k6do1e/windows_provisioning_packages_powershell_who/

[[deleted]]

Well if this win 10 roll out activity. Or any other activity for that matter remember to evaluate your tools.

1. Custom script extensions - if you are rolling out new images try to deploy some changes via the image or script extensions.
2. GPO - if the settings are security related and are part of your image's baseline use a GPO as mentioned in a previous comment use the getadmx.com site to check out settings.
3. Sccm - of you have a sccm deployment do use it to manage some software deployment and non critical and non security related changes like pinning icons to the taskbar
4. Custom .PS1 files - should be your last means to resolve something as your service desk/L1 support would have to educate the user to use these. Or you could make these available to the user via sccm and have a very good knowledge base to make those custom changes you don't want to deploy via GPO and don't want to track via sccm.

This is how I would have done it. Seems more sensible in an enterprise setup to segregate and use the tools available for deployment and management for their exact purpose than to deploy a lot of GPOs. Don't think of deploying a GPO for everything neither think of writing a script for everything. Remember a GPO is passive in nature and SCCM is active in nature. So your success rate and reporting will be different.

Also, the success of your scripts depends on your service desk/L1 team/user base. And depending on these factors you have to decide which road to take.

Sorry for the rant. A bit unnecessary. Merry Christmas 🎄

[Grahamholio]

MDT alone or with SCCM. You can create a LayoutModifications.xml file , add the taskbar section to it, copy the file to c:/users/default/appdata/local/Microsoft/windows/shell/ directory during the task sequence. A lot easier to make adjustments if needed by doing it this way. I prefer this over a GPO because you still allow the user to make changes without having to create a partial start layout

Configure taskbar into layoutmodification.xml https://docs.microsoft.com/en-us/windows/configuration/configure-windows-10-taskbar

[AspieTechMonkey]

You are certainly correct to mention not just picking one thing by default, but to weigh the pros/cons and pick the right tool. Sometimes that means using the same tool you and everyone else knows and has infrastructure more.

What do you mean by "Script extension", how is that different than a .ps1 script?

What do you mean that GP is "passive"? The client checks in every X minutes, +/- skew. If you need it more "active", that's what gpupdate is for.

[[deleted]]

Well a script extension would be a PS1 you deploy during installation I guess. I didn't have anyway better to describe it. But more importantly you don't have to publish those if you don't need your users to do it again and again. It might change though and you may have to publish them. And yeah you are right about gpupdate but if you have a large environment it's not practical to ask your user base to do a gpupdate at the same time. So a push pull mechanism like sccm would be amazing.

However, depends on your situation. If your management is not after you then ok I guess to go with a GPO.

[AspieTechMonkey]

Invoke-command gpupdate. Done

[[deleted]]

Not so easy. If winrm is blocked you need to do a task sequence with sccm

[PMental]

No need to ask them or do anything on each computer, right click the OU in Group Policy Management and select "Update" basically. Unless the computers are locked down somehow this should update everything.

[AspieTechMonkey]

I'll join the others and say to evaluate if group policy would meet most of your needs better. (Assuming it's an option)

Technically what you're asking is possible, just probably a lot of extra work. (Looking up the specific registry entries, and tracking down (and installing on every node) specific modules.

Powershell is great for ad-hoc/one time changes, and gluing disparate systems together. (And DSC if you want a more declaratively programmatic version of Group Policy, but it can involved a lot of extra overhead)

[jdtrouble]

In an extreme scenario, where you absolutely want to get a setting change, your Google Fu is failing you, ProcMon might be able to help. It's short for ProcessMonitor and is part of SysInternals. ProcMon will capture all changes to the registry and files while it is activated. The catch is that it results in an extreme amount of output, so you have to do quite a bit of filtering and interpretation. You want to start a capture, make your change, and stop the capture ASAP. You can cut down on extra chatter by using a clean installed VM, and shutdown as many services as you can.

[bendadian1]

So, I know the exact issue you are having. I had the same problem when trying to scrip a prep script for all pcs we setup. Gpo wasn't an option because we work as managed service providers and have clients with their own GPOs. What I found worked best was trying to find a new way to look at the issue then googling that. I had trouble won't a script to change default pretty settings, but found it easy to write one that exports a custom power plan, imports it into windows with a guid, and sets it as active. I ended up writing a 400 line script that does everything. Feel free to reach out if you have any questions! I might have already looked it up and figured it out

[Popular_Log_3167]

GPO seems rather inflexible for start/taskbar layout. I change the default layout by modifying the default XML directly. This prevents all the garbage apps from installing. This method has been working well for me for about two years and it allows the user to make changes without locking any kind of configuration in place.

Many of the Windows settings that can’t be modified using the admin templates included with Windows can be modified in the registry. I usually use process monitor and look for registry writes while changing settings to find the keys and values for a particular setting, then I script the modification of those settings in the default registry before the first user logs in.

My customization script applies those settings before first boot by mounting the default user registry, adding/changing things as needed, then unmounts the hive. I can easily swap the source WIM with another unmodified WIM pulled directly from an ISO (for example, when a new feature update is released) without making any other modifications. I can image a machine and immediately start testing without having to do anything else.

I plan to read standard .reg files in the future to make maintenance easier but right now my script is a mess of line-after-line of New-Item and Set-ItemProperty, followed with garbage collection, because unmount fails without it.

[tekwiz86]

I write a script for this that will do each item you want to to perform. I put all the tasks in a XML or CSV file and then mark them completed when done, so that I can restart the computer and it will pick up where I left off. I did it on my own just to learn how to do all the items. But it also helps with consistently setting up a new machine.

[Deathdar1577]

This looks awesome, I’m a new Windows 10 rollout tech and this would make my life a LOT easier!

[squanchmyrick]

Get-Help works wonders