IT Related

Monday, June 27, 2022

send CTRL ALT DEL from command line

(new-object -ComObject shell.application).WindowsSecurity()

Friday, May 27, 2022

Assiging proper permissions to service account to join to domain with Powershell

1. Service account creation:

New-ADUser -Name "svc-YLEU-domain" -Accountpassword (ConvertTo-SecureString -String `
"Passsword" -Force -AsPlainText) -Enabled $true -PasswordNeverExpires:$true `
-Path "OU=Service Accounts,OU=Users,DC=contoso,DC=local" `
-Description `
"Service Account for automatic join of new machines to domain using terraform or other automation languages" `
-UserPrincipalName "svc-YLEU-domain@contoso.local" `
-Manager "vagrant" -CannotChangePassword:$true

2. Assign proper permissions to OU:

$guidComputerObject      = new-object Guid bf967a86-0de6-11d0-a285-00aa003049e2
$RawGuid = ([guid]'bf967a86-0de6-11d0-a285-00aa003049e2').toByteArray();
$Path = [ADSI]"LDAP://CN=Computers,DC=contoso,DC=local"
$ntaccount = New-Object System.Security.Principal.NTAccount("contoso\svc-YLEU-domain")
$IdentityReference = $ntaccount.Translate([System.Security.Principal.SecurityIdentifier])

$Perms = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($IdentityReference,"CreateChild","Allow",$RawGuid,"All",$([GUID]::Empty))
$Path.psbase.ObjectSecurity.AddAccessRule($Perms)


$Perms = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($IdentityReference,"DeleteChild","Allow",$RawGuid,"All",$([GUID]::Empty))
$Path.psbase.ObjectSecurity.AddAccessRule($Perms)


$ObjectType = ([guid]'4c164200-20c0-11d0-a768-00aa006e0529').toByteArray();
$InheritedObjectType = ([guid]'bf967a86-0de6-11d0-a285-00aa003049e2').toByteArray();
$PropagationFlags = [System.Security.AccessControl.PropagationFlags] "InheritOnly"
$Perms = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($IdentityReference,"ReadProperty","Allow",$ObjectType,"Descendents",$InheritedObjectType)

$Path.psbase.ObjectSecurity.AddAccessRule($Perms)
$Perms = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($IdentityReference,"WriteProperty","Allow",$ObjectType,"Descendents",$InheritedObjectType)
$Path.psbase.ObjectSecurity.AddAccessRule($Perms)



$ObjectType = ([guid]'f3a64788-5306-11d1-a9c5-0000f80367c1').toByteArray();
$InheritedObjectType = ([guid]'bf967a86-0de6-11d0-a285-00aa003049e2').toByteArray();
$Perms = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($IdentityReference,"Self","Allow",$ObjectType,"Descendents",$InheritedObjectType)
$Path.psbase.ObjectSecurity.AddAccessRule($Perms)

$ObjectType = ([guid]'72e39547-7b18-11d1-adef-00c04fd8d5cd').toByteArray();
$InheritedObjectType = ([guid]'bf967a86-0de6-11d0-a285-00aa003049e2').toByteArray();
$Perms = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($IdentityReference,"Self","Allow",$ObjectType,"Descendents",$InheritedObjectType)
$Path.psbase.ObjectSecurity.AddAccessRule($Perms)


$ObjectType = ([guid]'00299570-246d-11d0-a768-00aa006e0529').toByteArray();
$InheritedObjectType = ([guid]'bf967a86-0de6-11d0-a285-00aa003049e2').toByteArray();
$Perms = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($IdentityReference,"ExtendedRight","Allow",$ObjectType,"Descendents",$InheritedObjectType)
$Path.psbase.ObjectSecurity.AddAccessRule($Perms)

$Path.psbase.commitchanges()

#/* Check the results */

(Get-Acl "ad:\CN=Computers,DC=contoso,DC=local").Access | where-object { $_.IdentityReference -eq 'contoso\svc-YLEU-domain' }

#/* Check the returned ObjectType GUID is Computer */

#$RawGuid = ([guid]'bf967a86-0de6-11d0-a285-00aa003049e2').toByteArray();
##Get-ADObject -Filter {schemaIDGUID -eq $rawGuid} -SearchBase (Get-ADRootDSE).schemaNamingContext -prop schemaIDGUID | Select-Object Name,@{Name='schemaIDGUID';Expression={[guid]$_.schemaIDGUID}}

Sunday, February 13, 2022

Restore DB from URL

 RESTORE DATABASE kk_NO FROM URL = 'https://blobbbb.blob.core.windows.net/sqlbackup1/db/20191129/full_20191129_120001.bak'  
with
NORECOVERY 
,REPLACE 
, MAXTRANSFERSIZE = 4194304, BLOCKSIZE = 65536, BUFFERCOUNT = 2000
,STATS = 10;
 
GO
 
RESTORE DATABASE kk_NO FROM URL = 'https://blobbb.blob.core.windows.net/sqlbackup1/db/20191204/diff_20191204_91502.bak'
 
--With MOVE 'kk_SE' to 'F:\Data\kk_SE_clone.mdf',
--MOVE 'kk_log_SE' to 'h:\Log\kk_log_SE_clone.ldf',
with
RECOVERY 
,REPLACE 
, MAXTRANSFERSIZE = 4194304, BLOCKSIZE = 65536, BUFFERCOUNT = 2000
,STATS = 10;
 
GO

KMS setup

 function Select-Proxy ()
{
$h=hostname
$ret=""
$prx1 = "10.81.10.66"
$prx2 = "10.81.18.66"
$out1 = Test-NetConnection $prx1
$out2 = Test-NetConnection $prx2
$st1=($out1).PingReplyDetails.Status
$st2=($out2).PingReplyDetails.Status
$rtt1=($out1).PingReplyDetails.RoundtripTime   
$rtt2=($out2).PingReplyDetails.RoundtripTime   
 
if ($st1 -eq "Success" -and $st2 -eq "Success")
{
    #Write-Host "both Success"
    if ($rtt1 -le $rtt2)
    {
       $ret=$prx1
    }
    else
    {
       $ret=$prx2
    }
 
}
elseif ($st1 -eq "Success" -and $st2 -ne "Success")
{
    Write-Host "$prx1 is success."
    $ret=$prx1
}
elseif ($st1 -ne "Success" -and $st2 -eq "Success")
{
    Write-Host "$prx2 is success."
    $ret=$prx2
}
Write-Host "Proxy on $h : $ret"
$ret
}
 
 
[object] $objCred = $null
[string] $strUser = 'Administrator'
[System.Security.SecureString] $strPass = ''
 
$strPass = ConvertTo-SecureString -String "Welcome1" -AsPlainText -Force
$objCred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ($strUser, $strPass)
 
 
$CompIP="10.81.16.48"
$CompName="ccskms001p"
 
invoke-command -ComputerName $CompIP -Credential $objCred -ScriptBlock {Rename-Computer -NewName $($suing:CompName)}
invoke-command -ComputerName $CompIP -Credential $objCred -ScriptBlock {shutdown /r /t 0}
 
 
 
$remote_proxy=Invoke-Command -ComputerName $CompIP -Credential $objCred -ScriptBlock ${Function:Select-Proxy}
 
Invoke-Command -ComputerName $CompIP -Credential $objCred -ScriptBlock {C:\windows\System32\bitsadmin.exe /Util /SetIEProxy NETWORKSERVICE Manual_proxy http://$($using:remote_proxy):3128 "*.statoilfuelretail.com;10.*"}
Invoke-Command -ComputerName $CompIP -Credential $objCred -ScriptBlock {C:\windows\System32\bitsadmin.exe /Util /SetIEProxy LOCALSYSTEM Manual_proxy http://$($using:remote_proxy):3128 "*.statoilfuelretail.com;10.*"}
                 
 
invoke-command -ComputerName $CompIP -Credential $objCred -ScriptBlock {
Install-PackageProvider -Name NuGet -Force -Proxy http://$($using:remote_proxy):3128
Install-Module PSWindowsUpdate -Force -Proxy http://$($using:remote_proxy):3128
 
}
 
Invoke-Command -ComputerName $CompIP -Credential $objCred -ScriptBlock  {New-Item -Path C:\temp -ItemType Directory}
 
Invoke-Command -ComputerName $CompIP -Credential $objCred -ScriptBlock {Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/poorleno1/scep_config/master/EPAMPolicy.xml' -OutFile "c:\\temp\\EPAMPolicy.xml" -Proxy "http:\\$($using:remote_proxy):3128"}
Invoke-Command -ComputerName $CompIP -Credential $objCred -ScriptBlock {Invoke-WebRequest -Uri 'http://wsus.ds.download.windowsupdate.com/c/msdownload/update/software/crup/2017/01/scepinstall_2c54f8168cc9d05422cde174e771147d527c92ba.exe' -OutFile "c:\\temp\\scepinstall.exe" -Proxy "http:\\$($using:remote_proxy):3128"}
Invoke-Command -ComputerName $CompIP -Credential $objCred -ScriptBlock  {
                                                            & {
                                                                $proc = Start-Process "c:\temp\scepinstall.exe" -ArgumentList "/s /q /NoSigsUpdateAtInitialExp /policy c:\temp\EPAMPolicy.xml" -PassThru
                                                                $handle = $proc.Handle # cache proc.Handle http://stackoverflow.com/a/23797762/1479211
                                                                $proc.WaitForExit();
                                                            }
                                                        }
 
$adgroup="cg_s_"+$CompName+"_prod_adm"
New-ADGroup -Path "ou=Groups,dc=contoso,dc=local" -GroupScope 1 -server dc1 -Name $adgroup
 
 
Invoke-Command -ComputerName $CompIP -Credential $objCred -ScriptBlock  {Add-Computer -DomainName statoilfuelretail.com -Credential sfr\a-sfr-jarekole -OUPath "ou=Computers,ou=OCloud,dc=statoilfuelretail,dc=com";shutdown /r /t 0}
#Wait until computer registers in DNS
 
invoke-command -ComputerName $CompName -ScriptBlock {hostname}
 
Invoke-Command -ComputerName $CompName -ScriptBlock  {Add-LocalGroupMember -Group Administrators -Member ocloud_server_adm}
Invoke-Command -ComputerName $CompName -ScriptBlock  {Add-LocalGroupMember -Group Administrators -Member $($using:adgroup)}
 
 
Invoke-Command -ComputerName $CompName -ScriptBlock  {Install-WindowsFeature -Name VolumeActivation -IncludeAllSubFeature -IncludeManagementTools}
 
Invoke-Command -ComputerName $CompName -ScriptBlock  {}
 
 
Invoke-Command -ComputerName $CompName -ScriptBlock  {Get-NetFirewallRule -DisplayName *key*| select enabled}
Invoke-Command -ComputerName $CompName -ScriptBlock  {Enable-NetFirewallRule -Name SPPSVC-In-TCP}



cscript.exe %windir%\system32\slmgr.vbs /ipk licenseKey
Cscript.exe %windir%\system32\slmgr.vbs /ato



VERIFICATION:

nslookup -q=SRV _VLMCS._TCP.contoso.local

verify statistics:

slmgr.vbs /dli
#list what product keys are installed
slmgr.vbs /dlv all

# add 6 more months to your trial version
slmgr.vbs /rearm



How to verify KMS clients (workstations):

Run following command on affected machine:

(Get-WinEvent -FilterHashtable @{logname="application";id=12288} -MaxEvents 1).message

Verify output:

The client has sent an activation request to the key management service machine.
Info:
0x00000000, 0x00000000, KMSSERVER:1688, 90af96d5-88ee-440c-b78f-990246b52969, 2019/12/16 12:05, 0, 1, 259146, 81671aaf-79d1-4eb1-b004-8cbbe173afea, 25

Red value should be all zeros and orange is value in minutes where reactivation should occur (259146 – 6 months). Green 1 means it’s licensed.
Reference:
https://blogs.technet.microsoft.com/askpfeplat/2015/11/09/kms-migration-from-2008-r2-to-windows-server-2012-r2-and-kms-activation-known-issues/
https://support.citrix.com/article/CTX219672