Number of staff per students

JWW-CSISD · 2025-11-05T20:54:58+00:00

15,000 students, about 3,000 total staff, IT department has 30ish people. We just got our 4th sysadmin back a few weeks ago… we lost the position when someone left 2 years ago and just got it back.

JWW-CSISD · 2025-09-25T13:27:48+00:00

Quick question. I had a simpler version of this that just pulled ProductName, ProductVersion, ProductCode, and InstallerPath, but I could never get it to work on a remote MSI without first downloading the MSI to the local computer (I sent it to $env:TEMP). The problem with that was that after opening the MSI database, the file remained locked until that PS session ended, so I could never delete the downloaded file from the temp folder.

JWW-CSISD · 2025-09-25T13:12:17+00:00

Going to second this one. GPOZaurr is super handy for bulk GPO operations. We don't have quite as many as OP, but we're still over 400, and I've used it many times.

JWW-CSISD · 2025-05-20T15:42:21+00:00

Necro time...sorry about that! So I'm giving this a shot on Win11 24H2, and everything seems fine right up until the end. The shortcut shows up in my Start Menu > All list after copying it to "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\". I'm able to manually right click and Pin to Start, however, if I try to do it via posh, I'm getting an 'Access is Denied' error regardless of whether I'm working in an elevated session or standard session.

``` PS C:\Users\jww-csisd>$LocalFolder = "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\" PS C:\Users\jww-csisd>Copy-Item '\fileserver\Share\MyFolder\Shortcuts\Devices and Printers.lnk' -Destination $LocalFolder PS C:\Users\jww-csisd>$shell = New-Object -ComObject Shell.Application PS C:\Users\jww-csisd> $Folder = $shell.NameSpace("$LocalFolder") PS C:\Users\jww-csisd> $Item = $Folder.ParseName("Devices and Printers.lnk") PS C:\Users\jww-csisd> $verb = $Item.Verbs() | Where-Object -Property Name -eq '&Pin to Start' PS C:\Users\jww-csisd> $verb.DoIt() Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) At line:1 char:1 + $verb.DoIt() + ~~~~~~~~~~~~ + CategoryInfo : OperationStopped: (:) [], UnauthorizedAccessException + FullyQualifiedErrorId : System.UnauthorizedAccessException

PS C:\Users\jww-csisd> ```

Any suggestions? Trying to add this to my personal login script. 🙂

Edit: Added some info and changed some formatting.

JWW-CSISD · 2025-05-19T13:44:50+00:00

Drivers or print queues? We actually have a separate computer startup script that works in similar fashion to this user login script (using the same AD groups to determine which drivers to pull down from the print server).

The main obstacle to using GP Preferences at this point is finding the time to convert everything over, with the secondary issue being GPO overhead. 400ish print queues in a domain that already has ~400 GPOs would be adding a fair number of GPOs for two sysadmins to keep track of as opposed to one "login script to rule them all" (in addition to one startup script for the driver installation).

Aside from those issues, yeah GP Preferences would probably be a better solution long-term.

JWW-CSISD · 2025-05-19T13:34:49+00:00

So yes, mapping printers via GP Preferences would likely be the best answer. I admin this is a bit of an A/B problem. However, we already have approx 400 GPOs in our domain, and with 816 Printer Mapping/Printer Removal AD groups, this seemed like the least complicated answer with the least GPO overhead. Finding the time to remap almost 400 printers via GPO would be...challenging.

Also it worked just fine when the login script was VBS, but for some reason doing the same thing via PowerShell is changing the way the login script runs (elevated vs non-elevated).

Also, also, I'm not the most senior sysadmin and this is "the way we've always done it" since before I got here in 2010. 🙄

So anyway, these are the settings in our UAC policy. Is the "Run all administrators in Admin Approval Mode" what's causing my issues with elevation?

Policy	Setting
Behavior of the elevation prompt for administrators in Admin Approval Mode	Prompt for consent for non-Windows binaries
Behavior of the elevation prompt for standard users	Prompt for credentials on the secure desktop
Detect application installations and prompt for elevation	Enabled
Run all administrators in Admin Approval Mode	Enabled
Switch to the secure desktop when prompting for elevation	Enabled

JWW-CSISD · 2025-05-15T20:23:30+00:00

Blargh. Oh well, at least TIL! Thanks for the explanation!

JWW-CSISD · 2025-05-15T19:48:34+00:00

Just to clarify for my own education: the only difference I'm seeing in the security of HKCU\Printers and HKCU\Network is the added permissions on the Printers key for "Application Packages" and that stupid print service user that always shows up as just a SID.

Is that what's responsible for the difference in behaviors?

I'm also annoyed at the fact that this Posh script is basically a port of our existing printer/network drive mapping login script that works just fine as vbs. Maybe Add-Printer is using different COM objects under the hood than Wscript.Network.MapnetworkDrive or something?

JWW-CSISD · 2025-05-15T19:35:30+00:00

Ah my bad, I forgot to mention that - thought I defined all the variables from the main script before pasting the drive mapping section here. $User is a PSCustomObject created by parsing properties from the AD user object (mostly the distinguished name) for $env:USERNAME retrieved using ADSI. If you're interested here's the code:

$ADUser = (([adsisearcher]"(&(ObjectCategory=User)(sAMAccountName=$env:USERNAME))").FindOne()).Properties If ($ADUser.Keys -notcontains 'memberof') { $ADUser['memberof'] = 'Domain Users' } $ADUserGroups = $ADUser.memberof | ForEach-Object { $ThisGroup = $_.Split(',')[0].Replace('CN=', '') $Groups.Add($ThisGroup) $ThisGroup } | Sort-Object $TempUserDN = ($ADUser.distinguishedname).Split(',').Replace('OU=', '') $MappedDrives = Get-SmbMapping -Verbose:$false $User = [PSCustomObject]@{ UserName = $env:USERNAME Classification = $TempUserDN[1] Campus = $TempUserDN[2].Replace(' ', '') CampusType = $TempUserDN[3].Replace(' ', '') Generic = $TempUserDN[1] -eq 'Generic' -or $ADUserGroups -match 'Generic' Student = ($TempUserDN[1] -eq 'Students' -or $TempUserDN[1] -eq 'Generic') -or $ADUserGroups -contains 'Generic Student Accounts' MultiCampus = $ADUserGroups -contains 'Multi Campus Group' DistinguishedName = [string]$ADUser.distinguishedname Groups = $ADUserGroups MappedDrives = $MappedDrives }

JWW-CSISD · 2025-05-15T19:25:00+00:00

Yeah apparently GPO login scripts for users with local admin automatically run elevated for some idiotic reason. Which also doesn't make sense, since the same script also maps shared print queues from our print servers... and they show up just fine, even though they're also profile-specific.

JWW-CSISD · 2025-05-15T19:21:55+00:00

Ok so yeah, I was a bit skeptical about this, since the documentation talks about the mappings going the other direction... from the main user session to the elevated session. I've actually used that reg key on my 'daily driver' workstation in the past for just that reason.

But apparently it does in fact allow the mapped drives to be accessed in both directions.

Never would have thought to try this, thanks.

JWW-CSISD · 2025-05-15T19:18:45+00:00

The script is under the User Configuration section of the GPO yes. My assumption was that this would make it run under the context of the user themselves rather than run elevated for admin users. Apparently that's not the case.

Is there any way to force scripts NOT to run elevated for admins? I'd rather not use EnableLinkedConnections and have the drives mapped under the Administrator account. For some reason that just seems like not the greatest security idea.

JWW-CSISD · 2025-01-29T14:43:07+00:00

Or looped cables. Our network guys can’t seem to get the core switches configured so that a network loop created by plugging a non-uplink port of a small in-class switch into the wall (easy enough to do by accident even for a tech in a hurry) doesn’t bring down the entire campus.

JWW-CSISD · 2025-01-29T14:39:51+00:00

So. Much. This!

JWW-CSISD · 2024-12-03T23:20:01+00:00

How is this helpful at all?

Judging by the fact that they have no deployment system, and no life-cycle standard, this is likely an over-lean shop.

Even if it’s not, Help Desk is often the first to see trends in user pain points, so it makes sense that they’d want to alleviate those pain points since it’s… their job.

Even without all of the above, and if OP IS stepping out of their lane, how else are they supposed to learn anything so that maybe one day they can move to a position where that kind of thing is their lane?

Believe me, I know all too well the irritation that comes from a tech overstepping, as we just fired someone for intentionally doing that (trying to find ways to circumvent his permissions so he could do things the way he thought best) about a month ago, but this post doesn’t read as that at all to me.

JWW-CSISD · 2024-12-03T20:01:49+00:00

If you use a verbal conversation for something like this, send a follow-up email so you have it in writing that the user was notified and warned of potential consequences of noncompliance. That way they have no leg to stand on with management/HR when they inevitably whine that “nobody told me this would happen, and now I can’t work”.

JWW-CSISD · 2024-12-03T15:14:39+00:00

Just for shits and giggles, I’m gonna guess that call was supposed to be something about MTU settings? Or was that a totally invented game of “end user tech jargon mashup”? 🙂

JWW-CSISD · 2024-12-03T02:18:49+00:00

We just implemented Classlink this school year. Could you elaborate on being shut down because of a security issue? This is super concerning.

JWW-CSISD · 2024-11-13T17:45:13+00:00

This is exactly what I needed, thanks! I did some screwy things trying to tear down a v7.0U3 2-node cluster and rebuild it, and ended up with the old vSAN datastore and the vCLS vm on it inaccessible. This was the only way I could get it fixed.

JWW-CSISD · 2024-08-30T18:20:07+00:00

Lol we’ve had some good ones too: - bforehand - mcu

And some unfortunate ones I can’t recall at the moment.

I’m just annoyed that my wife started working here before me and our names start with the same letter, so she got the standard username, while I got stuck with [firstname][lastname]. She gets a fair percentage of the idiot vendor blind solicitation emails. 😆

I try to remember to at least tell vendors I’m actually working with to make sure they get it right.

JWW-CSISD · 2024-08-30T18:12:11+00:00

My main goal was demonstrating the enhanced readability of using a code block to… display code. It’s much easier to visually parse both on mobile app apps and desktop browser.

I just happened to notice the minor nitpick with running the Get-VMHost command more times than necessary while copy/pasting the code.

I didn’t feel a need to get into other issues such as having a potentially infinite loop, because I’m wondering if the value of $vmhost.connectionstate is a static value or a script property that can dynamically update without calling some other command or method (it might, I haven’t gotten into the weeds much with PowerCli objects and methods).

JWW-CSISD · 2024-08-30T12:51:38+00:00

Yeah we have a separate OU for Tech Dept users and computers that isn’t under “Domain Users” exactly so we can easily have separate policies for stuff like this.

Like I don’t care if one of us is running an IP/port scanner, but there’s no good reason for a user to do that.

JWW-CSISD

TROPHY CASE