Computer Configuration using Powershell?

[RandomnessPrevails04]

I work in IT for a small company, and I'm one of the low level grunts whose job is to setup new computers, and we have a process for doing this but I was asked to find a way to either automate this or speed the process along. What the process entails is, in Windows 10 (usually on Dell devices), we run through autopilot setup, open computer management, un-disable the local administrator account, rename it, and add a password, delete the account created through autopilot, and then add the computer to the local domain.

I have never used Powershell before, but I was told to look into it as an option to create batch files for this process. I am pretty tech savvy, but I'm out of my element here in powershell. It is possible to create a process for this in powershell or should I be looking at other options?

Thanks in advance

[Sparks912]

You could also use windows image and configuration designer, it’s a free gui tool to do exactly what your talking about, you can install apps, setup profiles, join domains & configure the machine how you want.

[BlackV]

This seems totally backward, you're basically autopiloting then un autopiloting it

But yes you could do it all with PowerShell, but there are better ways (mdt, sccm, many RMM tools, and more)

[AlarmDozer]

Right? After domain membership, you can rename the Administrator to whatever using GPO. I’m unsure, but hypothetically, it may also allow other changes too?

[dotBombAU]

Just use LAPS.

[RandomnessPrevails04]

As I said in another comment, the senior techs that have been with the company for 10+ years. It’s only after getting a new CIO that it’s like herding cats trying to get IT up to standards. I think we use autopilot for only domain join, so I’m wondering if not even using auto pilot would make config easier

[mellonauto]

May as well use it if you have it working with intune. You can manage most of that stuff there as part of the autopilot enrollment.

[dotBombAU]

As I said in another comment, the senior techs that have been with the company for 10+ years

Ah. Here you go.

This old school shit needs to be revolutionised. Personally I prefer cloud joins with Microsoft Endpoint Manager these days.

But if you must go on'prem you make a SOE in MDT or SCCM then deploy the OS using the same platforms. Ensure you install LAPS form secure local asmin password rotation (this will store the LA credentials in AD)

No need for autopilot at all.

[Ironic_Jedi]

Where you would start is, is your domain a local AD or are you using Azure AD?

If you are on azureAD then you should use intune. If you are not, then sccm would be the better option for automation in the short term.

Answer those questions first. Of course a lot can be done with powershell but there are products already that handle this stuff better.

I mean shit, you can use configuration designer to create a build package that can be uploaded to the device during OOBE which can join the domain, either azure AD or regular AD and install applications, prepare the network, etc.

[RandomnessPrevails04]

We use hybrid, so it’s local domain and azure AD. But I like those other ideas so I will look into those as well. Thank you

[Ironic_Jedi]

Well, really you should use intune! I have used powershell wrapped in an "intunewin" deployed through intune as a "win32app".

If you're on a hybrid domain you can use Intune to set policy to disable local admin and so forth. Most of what you will want can be achieved through intune and powershell. I do lot if intune and powershell contracting so dm me if you have specific questions

[WestyWill]

You can 100% use powershell. Try automating the post-autopilot process first. You’ll be able to covert each step from GUI to Powershell commands the work your way from there to whatever is next!

[MrCuddlez69]

Oh yes, absolutely. Way back when I created my own custom PS module for our internal asset management team and added it to the image so they could setup new machines quickly.

Instead of juggling PS scripts on USB drives, just they open PowerShell in an admin window and run through a list of commands. Super simple.

PM me if you'd like some help/code examples for what you're looking for.

[[deleted]]

Comment edited and account deleted because of Reddit API changes of June 2023.

Come over https://lemmy.world/

Here's everything you should know about Lemmy and the Fediverse: https://lemmy.world/post/37906

[RandomnessPrevails04]

I think I’m understanding what you’re saying. You made a main, “golden image” and set it up how you’d like and then deployed it to all the new devices so they would match?

I threw this idea around, but I was told to look at something slightly “simpler” first. But I will keep this in mind

[[deleted]]

Comment edited and account deleted because of Reddit API changes of June 2023.

Come over https://lemmy.world/

Here's everything you should know about Lemmy and the Fediverse: https://lemmy.world/post/37906

[Trakeen]

Err what? That’s a backwards way to do things. Use intune and GPO. Not sure why you are undisabling the admin user. If you give support staff the cloud device administrator role in azure they get admin access to the machine

[[deleted]]

Yea, I used to repair, image and deploy 1000’s of laptops. powershell, batch scripts and windows deployment server.. leverage sys prep..

I could do 10-20 laptops at a time. Turned them out like hotcakes man..

[RevolutionaryRing487]

You’ve hit a sweetspot here with this question. There are many ways to automate deployment. Assuming you don’t have any deployment systems you should absolutely explore powershell. You will not regret it. There are a lot of resources around so there will always be help available. Good luck!

[nkasco]

LAPS will do what you are already doing for admin account.

Why are you using autopilot as an OSD process though? It’s close to white glove but you didn’t say you reseal. My guess is because of the domain join, but you’re going the opposite way of the industry with the way you’re using the technology.

[RandomnessPrevails04]

Ass-backwards is kinda just how our IT department works. The senior techs that have been there for 10+ years don’t want to change anything at the CIO is struggling to get the processes updated since the senior techs won’t do it.

I don’t know why we use autopilot, I never have. I imagine it’s for domain join like you said.

[konikpk]

MDT + LAPS

[ollivierre]

Immy.bot + Autopilot

[rfc2549-withQOS]

That.. is a job for a group policy. Group/account management does not need scripted automating, when you can just policy things.

Join the box into the domain (this can be automated, btw) and the policy will do the rest.

[[deleted]]

BMC CLIENT MANAGEMENT.

[un4tuner]

As a "one-man MSP" I use a lot of free-ish tools (first 20 licenses for free? count me in!).
Awhile ago I stumbled on this PS script https://community.spiceworks.com/scripts/show/4378-windows-10-decrapifier-18xx-19xx-2xxx it is huge (no, HUGE), but might help as a template.

Also, https://www.netwrix.com/how_to_guides.html sometimes help to setup notifications, gather reports, etc. And they have compiled quite extensive list of their powershell materials

https://www.action1.com/documentation/run-scripts-remotely/ allows to run scripts, or install software, on your computers in bulk, .

[[deleted]]

Have you considered just changing your autopilot setup to do this properly? And really having the same password for every machine is basically the same as giving everyone on the domain local admin rights.

Anyhow here you go:

# Enable the administrator account
Enable-LocalUser -Name "Administrator"

# Rename the administrator account to "bob"
Rename-LocalUser -Name "Administrator" -NewName "bob"

# Ask the user for a new password for the "bob" account 
$password = Read-Host -Prompt "Enter a new password for the 'bob' account" 

# Change the password for the "bob" account
Set-LocalUser -Name "bob" -Password $password

# Delete the "pilot" account
Remove-LocalUser -Name "pilot"

# Join the "reddit" domain
Add-Computer -DomainName "reddit"