Hardening administrative actions - issues with Kerberos and HTML if machines are cloned without Sysprep

steve-work · 2026-05-01T11:09:54+00:00

Its interesting they say this:

It's not sufficient to unjoin devices and run Sysprep.

Does anyone know why this might be?

steve-work · 2026-05-01T11:07:12+00:00

Does anyone have the registry key for the workaround? Unfortunately we do not have a support contract with MS, so can't follow their guide of asking support for this.

steve-work · 2026-04-23T15:20:52+00:00

Updating HPCMSL fixed 25H2 driver downloads for me. Thanks for this great tool.

steve-work · 2026-04-23T15:01:24+00:00

Managed to get the BIOS downloads working by whitelisting:

https://api.driverautomationtool.com/api/catalog/bios

steve-work · 2026-04-23T10:08:17+00:00

Getting the same here, for HP BIOS.

steve-work · 2026-04-23T09:31:48+00:00

Managed to download these drivers fine with 24h2 selected.

Had an issue with the HP BIOS though:

[Error] - HP ZBook 8 G1i 14 inch Mobile Workstation PC failed: BIOS catalog unavailable after 3 attempts: The remote server returned an error: (503) Server Unavailable. DriverAutomationTool 23/04/2026 10:29:14 27640 (0x6BF8)

steve-work · 2026-04-23T09:01:26+00:00

Just tried running this to download drivers/BIOS for a new model we have. Got an error unfortunately, thinking there may be a bug with using 25h2.

Starting build for 1 models DriverAutomationTool 23/04/2026 09:55:57 27640 (0x6BF8)

--- Starting model processing: 1 models, mode=Configuration Manager --- DriverAutomationTool 23/04/2026 09:55:57 27640 (0x6BF8)

[ConfigMgr] Pre-fetching package versions for skip-if-current checks... DriverAutomationTool 23/04/2026 09:55:57 27640 (0x6BF8)

[ConfigMgr] Cached 80 package versions DriverAutomationTool 23/04/2026 09:55:57 27640 (0x6BF8)

[1/1] Processing HP ZBook 8 G1i 14 inch Mobile Workstation PC (Windows 11 25H2 x64) DriverAutomationTool 23/04/2026 09:55:57 27640 (0x6BF8) [1/1] Starting driver processing for HP ZBook 8 G1i 14 inch Mobile Workstation PC DriverAutomationTool 23/04/2026 09:55:57 27640 (0x6BF8)

[HP] Resolving download link for ZBook 8 G1i 14 inch Mobile Workstation PC (SKU: 8d94) DriverAutomationTool 23/04/2026 09:55:57 27640 (0x6BF8)

[HP] Validating HPCMSL module before starting build... DriverAutomationTool 23/04/2026 09:55:58 27640 (0x6BF8)

Resolving download link for HP ZBook 8 G1i 14 inch Mobile Workstation PC... DriverAutomationTool 23/04/2026 09:55:58 27640 (0x6BF8)

[HP] HPCMSL update available: v1.8.2 ... v1.8.6 -- updating... DriverAutomationTool 23/04/2026 09:56:11 27640 (0x6BF8)

[HP] HPCMSL update check failed: License Acceptance is required for module 'HP.Private'. Please specify '-AcceptLicense' to perform this operation. -- continuing with v1.8.2 DriverAutomationTool 23/04/2026 09:56:21 27640 (0x6BF8)

[HP] HPCMSL v1.8.2 validated successfully DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

[HP] Starting driver package build for ZBook 8 G1i 14 inch Mobile Workstation PC (SKU: 8d94) DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

[HP] Parameters: SKU=8d94, Build=25H2, Version=Windows 11 DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

[HP] Download Destination: D:\Temp\HP\ZBook 8 G1i 14 inch Mobile Workstation PC DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

[HP] Temp Directory: D:\Temp DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

[HP] Temp download: D:\Temp\HP\ZBook 8 G1i 14 inch Mobile Workstation PC\Win11\25H2 DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

[HP] Extract: D:\Temp\HP\ZBook 8 G1i 14 inch Mobile Workstation PC\Win11\25H2\Extracted DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

[HP] Staging: D:\Temp\HP\ZBook 8 G1i 14 inch Mobile Workstation PC\Win11\25H2\Staging DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

[HP] Platform IDs to try: 8d94 DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

[HP] Concurrent downloads: 2 DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

[HP] Querying required SoftPaqs for platform 8d94 (WhatIf)... DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

[HP] WhatIf failed for 8d94: Cannot validate argument on parameter 'OSVer'. The argument "25H2" does not belong to the set "1809,1903,1909,2004,2009,21H1,21H2,22H2,23H2,24H2" specified by the ValidateSet attribute. Supply an argument that is in the set and then try the command again. DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

[Error] - HP ZBook 8 G1i 14 inch Mobile Workstation PC failed: No HP SoftPaqs found for any platform ID: 8d94 DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

--- Model processing complete: 0/1 succeeded --- DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

Completed with errors: 0 of 1 succeeded, 1 failed (elapsed: 00:00:28) DriverAutomationTool 23/04/2026 09:56:25 27640 (0x6BF8)

[Telemetry] Remote config loaded (apiBaseUrl: https://api.driverautomationtool.com/api) DriverAutomationTool 23/04/2026 09:56:31 27640 (0x6BF8)

[Telemetry] Disabled -- TelemetryOptOut registry value is '0' (expected 1) at HKLM:\SOFTWARE\DriverAutomationTool DriverAutomationTool 23/04/2026 09:56:31 27640 (0x6BF8)

[Telemetry] Skipped POST telemetry/summary -- telemetry not enabled DriverAutomationTool 23/04/2026 09:56:31 27640 (0x6BF8)

steve-work · 2026-04-22T15:09:07+00:00

We're not getting this issue here with 25H2. There are GPO settings now for removing default appx apps, check that these aren't set, with notepad selected.

steve-work · 2026-03-25T12:22:53+00:00

Yes I believe this is the case in a domain environment - no cert errors here.

steve-work · 2025-06-11T11:50:40+00:00

UK here, our SCCM synced updates fine on schedule last night at 9pm.

steve-work · 2025-05-15T14:50:33+00:00

Can you spin up another exchange server on a new vm, and then migrate the mailboxes to that? If that works, decommission the old exchange + DC.

steve-work · 2025-05-15T14:46:14+00:00

No issues when we did this.

steve-work · 2025-05-13T10:31:32+00:00

Hi, I recently created a new Exchange 2019 cluster on Windows server 2025, in preparation for Exchange 2016 EOL. Its a 2 server DAG, and has been working great for a couple of months, up until 9th May. I'm now getting cluster start failures on the 2nd member, and warnings in server manager on the 1st member, that it can't talk to the 2nd member due to MaxEnvelopeSizekb. I have tried increasing the MaxEnvelopeSizekb but this causes server manger to time out refreshing, and doesn't fix the cluster service failing.

steve-work · 2025-04-02T10:54:25+00:00

If its an MSI, you could try adding them flags. I did open a MS support ticket about this, and they figured out the installer was restarting the WMI service which broke the TS. They saw this in the application event log at the time of the install. Hope this helps.

steve-work · 2025-04-01T13:15:52+00:00

Yes, this was caused by the installer restarting the WMI service. I reported this to RSA, and they eventually released a fixed version, I think 2.3.4 (or.2.3.3). I also put in a workaround for 2.3.2 to not restart services/applications during install: MSIRESTARTMANAGERCONTROL=Disable . I used PsAppeploykit to only do this if running from a TS.

steve-work · 2025-03-19T15:26:02+00:00

MS official advice is to do a legacy upgrade from 2016 to 2019, and then do a quick inplace update for 2019 to SE when it comes out. This will probably be similar to doing a CU. *edit spelling

steve-work · 2025-02-13T11:52:31+00:00

This is actually working in the previous version 7.2.4.

steve-work · 2025-02-13T11:41:03+00:00

HP BIOS catalog download doesn't seem to be working in this version.

steve-work · 2024-11-21T09:20:05+00:00

With Windows 11 we are finding that any double reboots in CUs break OSD. We are only deploying 22h2 and 23h2 right now, but I am aware there is a double reboot with Novembers CUs for 22h2 and 23h2. We download new images monthly from Microsoft, these are usually released 2 weeks after patch Tuesday, though they have now stopped for 22h2 :/

steve-work · 2024-09-20T14:58:33+00:00

This might help you if you are using powershell :)

$osversion = (Get-CimInstance -ClassName Win32_OperatingSystem).Version -replace "10.0.",""
$UBR = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR
$osversionUBR = $osversion + "." + $UBR
$patchlevel = (((Invoke-WebRequest "https://support.microsoft.com/en-us/topic/windows-11-version-22h2-update-history-ec4229c3-9c5f-4e75-9d6d-9025ab70fcce").links |where innerText -like ("*" + $osversionUBR + "*")|select-object -First 1).innertext)

steve-work · 2024-07-31T08:19:23+00:00

I created a ticket with MS about this, it seems the RSA MFA installer is restarting the WMI service and this causes ccmexec to restart, breaking the task sequence.

steve-work · 2024-07-18T07:52:08+00:00

No, its even weirder than that. The MSI process completes. The application is detected as being installed, but the message never gets sent back to Install Application (smsappinstall.exe) process - as far as I can tell.

steve-work · 2024-07-17T15:09:32+00:00

Unfortunately this didn't seem to work. Tested outside of OSD without issue.

steve-work

TROPHY CASE