FluctuationIT
Please find here all the powershell CmdLET used in this WorkSHOP
Try first to type the cmd
Avoid to copy paste the cmd
If you have comment or if you want to share your way to do, please fill free to do it
You will find the same file in the following google docs url :
[Link]
U5mk0/edit?usp=sharing
Please copy the code in this folder
[Link]
ng
And please create a folder with your name and copy your code in a google doc
Every month I will see and share with others fluctuationIT readers
MANAGE RESOURCE DISCOVERY AD
import-module "C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\bin\ConfigurationManager.psd1"
cd s01:
Get-CMDiscoveryMethod -name ActiveDirectoryForestDiscovery | fl *
$d=Get-CMDiscoveryMethod -name ActiveDirectorySystemDiscovery
$d.EmbeddedProperties."Enable Filtering Expired Logon"
(Get-CMDiscoveryMethod -name ActiveDirectoryForestDiscovery).EmbeddedProperties."Enable AD Site Boundary Creation"
Convert-CMSchedule -ScheduleString "0001200000100038"
# Modifying Discovery Methods
Set-CMDiscoveryMethod -PollingSchedule
$14days=New-CMSchedule -RecurCount 14 -RecurInterval Days
Set-CMDiscoveryMethod -ActiveDirectoryForestDiscovery -Enabled $true `
-EnableActiveDirectorySiteBoundaryCreation $true -PollingSchedule $14days `
-SiteCode s01
(Get-CMDiscoveryMethod -name ActiveDirectoryForestDiscovery).Properties.Props |
where PropertyName -eq "Startup Schedule"
Invoke-CMForestDiscovery
Set-CMDiscoveryMethod -ActiveDirectorySystemDiscovery -Enabled $true `
-ActiveDirectoryContainer "ldap://OU=London Clients,DC=Adatum,DC=com","ldap://OU=London servers,DC=Adatum,DC=com" `
-SiteCode s01 -EnableDeltaDiscovery $true -DeltaDiscoveryMins 15 -PollingSchedule $14days `
-AddAdditionalAttribute Department
Invoke-CMSystemDiscovery -Sitecode s01
Set-CMDiscoveryMethod -ActiveDirectoryUserDiscovery -Enabled $true `
-ActiveDirectoryContainer "ldap://OU=Marketing,DC=Adatum,DC=com","ldap://OU=Managers,DC=Adatum,DC=com" `
-SiteCode s01 -EnableDeltaDiscovery $true -DeltaDiscoveryMins 10 -PollingSchedule $user `
-AddAdditionalAttribute Department,DisplayName,Title
$user=New-CMSchedule -RecurCount 7 -RecurInterval Days
(Get-CMDiscoveryMethod -name ActiveDirectoryUserDiscovery).Properties.Props |
where PropertyName -eq "Startup Schedule"
Invoke-CMUserDiscovery -SiteCode S01
Get-CMUser | select -Property Name
Get-CMDevice | select -Property name
COLLECTIONS DEVICE COLLECTIONS
#app,task sequence, collections AD group DEvice
get-help devicecollection
# 7 default collections
New-CMDeviceCollection
New-CMUserCollection
New-CMDeviceCollection -RefreshType
<#Server_coll AllSystemens 30 days NO
london_clients All Clients 21 days yes
all_clients AllSystems 21 days YES
#>
$21days=New-CMSchedule -RecurInterval Days -RecurCount 21
$30days=New-CMSchedule -RecurInterval Days -RecurCount 30
New-CMDeviceCollection -LimitingCollectionName "All Systems" -name "All clients" `
-RefreshSchedule $21days -RefreshType Both
New-CMDeviceCollection -LimitingCollectionName "All Clients" -name "Adatum_clients" `
-RefreshSchedule $21days -RefreshType Both
New-CMDeviceCollection -LimitingCollectionName "All Systems" -name "Adatum_servers" `
-RefreshSchedule $30days -RefreshType Periodic
Add-CMDeviceCollectionQueryMembershipRule -CollectionName "Adatum_clients" `
-QueryExpression "select * from SMS_R_System where SMS_R_System.SystemOUName ='[Link]/London Clients'" `
-RuleName "london clients"
Add-CMDeviceCollectionQueryMembershipRule -CollectionName "All_clients" `
-QueryExpression "select * from SMS_R_System where SMS_R_System.OperatingSystemNameandVersion like "Microsoft
Windows NT WorkStation %"" `
-RuleName "all clients"
Add-CMDeviceCollectionQueryMembershipRule -CollectionName “All Clients” `
-QueryExpression "select * from SMS_R_System where SMS_R_System.OperatingSystemNameandVersion like 'Microsoft
Windows NT Workstation %'" -RuleName “All Clients”
+33663561093 SMS
BOUNDARIES
#One more task prior client installation boundaries and boundary groups
#Site assignment and content locations
#IP Subnet
#AD SITE
#IP address rang
#IPV6 Prefix
Set-CMDiscoveryMethod -ActiveDirectoryForestDiscovery -EnableActiveDirectorySiteBoundaryCreation $true `
-EnableSubnetBoundaryCreation $true -SiteCode s01
get-help cmboundary | Measure-Object
New-CMBoundary
Get-CMBoundary
Set-CMBoundary
Remove-CMBoundary
#Boundary Groups
# members are boundaries
#site content ref
New-CMBoundaryGroup
New-CMBoundary -Name "Malta Subnet" -Type IPSubnet -value "[Link]"
New-CMBoundaryGroup -Name "Malta Boundary group"
Add-CMBoundaryToGroup -BoundaryGroupName "Malta Boundary group" -BoundaryName "Malta Subnet"
CLIENT SCCM INSTALLATION
# push
get-CMClientPushInstallation
Install-CMClient
# configure the push client
New-ADOrganizationalUnit -name "sccm accounts"
# create the user used for client installation
New-ADUser -name CMPush -path "ou=sccm accounts,dc=adatum,dc=com" `
-AccountPassword (read-host -AsSecureString -Prompt "password please") -Enabled $true
Add-ADGroupMember -Identity "Domain admins" -Members CMPush
Get-ADGroupMember -Identity "domain admins" | select name
# FSP FallBack Status point
# create a new account in CM
New-CMAccount -name "adatum\cmpush" -SiteCode s01 -Password (read-host -AsSecureString -Prompt "password please")
Get-CMClientPushInstallation
#set the parameters for [Link]
Set-CMClientPushInstallation -SiteCode s01 -ChosenAccount "adatum\cmpush" `
-EnableAutomaticClientPushInstallation $false `
-InstallationProperty "SMSSITECODE=S01 CCMEVALHOUR=12 SMSCACHESIZE=10000 SMSCACHEDIR=c:\CMCACHE
FSP=lon-cfg"
# install the client gogogogo
get-cmdevice -CollectionName "adatum_servers" | select name,DeviceOS,isClient
get-cmdevice -Name "web-server" | select isclient
# install
Install-CMClient -DeviceName web-server -AlwaysInstallClient $true -ForceReinstall $true
CLIENTS OPERATIONS
# make regulits calls to the MP : download the policy : dictate what the client must do
# 60 Mn 400 mn THE refresh every 60 mn
Get-CMClientOperation
Invoke-CMClientNotification
Clear-CMClientOperation
Invoke-CMClientOperationSummarization
Get-CMDevice | select name
Invoke-CMClientNotification -DeviceName win10-device -NotificationType RequestMachinePolicyNow
Clear-CMClientOperation -Id
# client status
# client activity
Get-CMClientStatusSetting
Get-CMClientStatusUpdateSchedule
Update-CMClientStatus -Force
CLIENTS SETTINGS
# client make a call to the MP
get-help cmclientsetting
Get-CMClientSetting
New-CMClientSetting
Set-CMClientSetting
Remove-CMClientSetting
New-CMClientSetting -name windows10mkt -Type Device
Get-CMClientSetting -Setting ComputerAgent
New-CMClientSetting -name "Desktop settings" -type Device
Set-CMClientSetting -name "Desktop settings" -ComputerAgentSettings -BrandingTitle "Fluctuationit Inc"
Start-CMClientSettingDeployment -ClientSettingName "Desktop settings" `
-CollectionName "all clients"
Invoke-CMClientNotification -DeviceCollectionName "all clients" -NotificationType RequestMachinePolicyNow
Set-CMPackage
Package and Software
# DP and Content
#Software distribution component
# DP ROLE placed close to the devices
# Client settings :
#Software distribution component
# the number of concurrent PKG ->DPS
# the number of threads to transfer PKG to the DP
# Retry count and retry delay for sending PKGS to DP
# MultiCast retry
# Network access AD USER clients to access the DP
(Get-CMSoftwareDistributionComponent | ? ComponentName -EQ "SMS_DISTRIBUTION_MANAGER").Props |
ft -Property PropertyName,value
Set-CMSoftwareDistributionComponent -SiteCode s01 -NetworkAccessAccountName `
-MaximumPackageCount -MaximumThreadCountPerPackage -RetryCount
# Distribution Points
# performance, dp located as close as possible
# dedicated server for DP
# Azure or on premise
# at least 2 DP -> DP Groups
# certificate
# add a new DP
New-CMSiteSystemServer -SiteCode s01 -SiteSystemServerName "new-server" -UseSiteServerAccount
# web-server administrators local add the lon-cfg
Add-CMDistributionPoint -SiteCode -SiteSystemServerName -CertificateExpirationTimeUtc `
-MinimumFreeSpaceMB 100000 -ClientConnectionType Intranet -InstallInternetServer `
-PrimaryContentLibraryLocation E -PrimaryPackageShareLocation E
New-CMDistributionPointGroup -name DPSMalta -Description "dps"
Add-CMDistributionPointToGroup -DistributionPointGroupName "dpsmalta" -DistributionPointName
# on the google drive labs ps code
# Folder your turn
# create a doc insind ps code to add a new dp add the dp groups
SOFTWARE
# pKG and applications
# collections of files that the device needs
#msinstaller
# Content library
-DistributionPriority -ForcedDisconnectDelay -share
# 7zip
New-CMPackage -Name 7ZIP -Description "Archiving Software" -Language English `
-Path "\\lon-cfg\Software\7zip"
New-CMProgram -PackageName 7ZIP -StandardProgramName 7ZIP `
-DiskSpaceRequirement 4 -DiskSpaceUnit MB -DriveMode RenameWithUnc -Duration 20 `
-ProgramRunType WhetherOrNotUserIsLoggedOn -RunMode RunWithAdministrativeRights `
-RunType Hidden -CommandLine "[Link] /S /D=C:\Program Files (x86)\7zip"
Start-CMContentDistribution -PackageName 7zip -DistributionPointGroupName DP
Start-CMPackageDeployment -CollectionName "adatum_clients" -StandardProgram `
-ProgramName 7ZIP -PackageName 7zip -DeployPurpose Required -ScheduleEvent AsSoonAsPossible `
-FastNetworkOption DownloadContentFromDistributionPointAndRunLocally -SlowNetworkOption DoNotRunProgram
Invoke-CMClientNotification -DeviceName win10-device -NotificationType RequestMachinePolicyNow
Invoke-CMDeploymentSummarization -CollectionName "adatum_clients"
Get-CMDeploymentStatus | where programName -eq "7zip"
# applications
# application catalog web site
New-CMApplication -name "Chrome" -Description "gooel chrome" -Publisher "google" `
-SoftwareVersion "13.0.0"
Add-CMDeploymentType -MsiInstaller -EnableContentLocationFallback $false -ApplicationName "chrome" `
-Language English -ForceForUnknownPublisher $true -InstallationFileLocation
"\\LON-CFG\Software\chrome\[Link]"
Start-CMApplicationDeployment -CollectionName "adatum_clients" -DeadlineDate (get-date).AddMinutes(5) `
-DeployPurpose Required -DeployAction Install -UserNotification DisplayAll -name "chrome"
Invoke-CMClientNotification -DeviceName win10-device -NotificationType RequestMachinePolicyNow
Set-CMApplication
WSUS
COMPLIANCE
# device well configured
# items and baseLines.
# RDP IS On
# ITEMS Mac, mobile and WIndows
New-CMConfigurationItem
Set-CMConfigurationItem
New-CMConfigurationItem -name "client check" -CreationType WindowsOS
New-CMConfigurationItem -name "client check interval" -CreationType WindowsOS
#baseLine
New-CMBaseline -name "check client [Link]"
Get-CMConfigurationItem | select LocalizedDisplayName,CI_ID
Set-CMBaseline -name "check client [Link]" -AddOSConfigurationItem 16778479,16778480
Start-CMBaselineDeployment -name "check client [Link]" -CollectionName "adatum_clients" `
-EnableEnforcement $true -OverrideServiceWindow $true
Invoke-CMClientNotification -DeviceCollectionName "adatum_clients" -NotificationType RequestMachinePolicyNow
# view result
Get-CMBaseline -name "check client [Link]" | select LocalizedDisplayName,ComplianceCount,NonComplianceCount
Invoke-CMBaselineSummarization
OSD
#TS STEPS Capturing or deploying
get-help tasksequence
# Boot images
# Driver pKG : during windows 10 installation
# OS Images
New-CMTaskSequence -OperatingSystemImagePackageId -BootImagePackageId
Get-CMPackage | select -Property name,packageid
#S0100003
Get-CMOperatingSystemImage | select -Property name,packageid
# S010000D
Get-CMBootImage | select -Property name,packageid
# S0100002
New-CMTaskSequence -name "Win10 Deploy v1" -InstallOperatingSystemImage `
-OperatingSystemImagePackageId S010000D -PartitionAndFormatTarget $true `
-LocalAdminPassword (read-host -AsSecureString -Prompt "password ?-----") `
-JoinDomain DomainType -DomainName "[Link]" -DomainAccount "adatum\administrator" `
-DomainPassword (read-host -AsSecureString -Prompt "passwordfor admin domain ?-----") `
-ClientPackagePackageId S0100003 -SoftwareUpdateStyle NoInstall -BootImagePackageId S0100002
-OperatingSystemImageIndex 1
Get-CMTaskSequence
# DEPLOY to collections
Get-CMTaskSequence | select -Property name,packageid
Start-CMTaskSequenceDeployment -TaskSequencePackageId S010000E -CollectionName "All Unknown Computers" `
-DeployPurpose Available -Availability MediaAndPxe -ShowTaskSequenceProgress $true `
-DeploymentOption DownloadContentLocallyWhenNeededByRunningTaskSequence
Install-WindowsFeature -Name UpdateServices-Ui
OSD PART 2
#3 goals SCCM
# Asset inventory of all devices software licenses
# deploy app
# OSD
# SCCM enable PXE on your DP WDS ZTI
# MDT
# prepare the OSD
# manage boot images
# import drives WINPE
# device boot PXE contact the WDS bootstrap
# winpe downlaod it to the device
# hard disk and network mandatory
# WINPE BOOT Images most toshiba dell
# not lucky boot images network will have to modify
# boot images include the driver network
# drivers driver package
# Master installer images
# TS Tasl sequence
# Boot images WIM file WINPE to the client to start OSD deployment process
# Drivers include in the boot images
# Drivers for the device DELL latitude e6510
# OS start to be installed, drivers
# OS Image capture WIN file
# VM Install OS, Drivers, patch, software,Anti virus
# SYSPREP
# OS Installer : OOBE win10 build 1803
# boot Images
# SCCM ADK
# PS CMdlet
get-help cmbootimage
##?? module sccm is not loaded
import-module "C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\bin\ConfigurationManager.psd1"
cd s01:
get-help cmbootimage
Set-CMDriverBootImage
Get-CMBootImage | select -Property Name,PackageID,Imagepath | ft -AutoSize
# boot image
Set-CMBootImage -name "Boot image (x64)" -AddOptionalComponent
# DRIVER
get-help cmdriver
import-cmdriver -UncFileLocation "\\LON-CFG\Software\Drivers\HyperVx64\[Link]" -EnableAndAllowInstall $true
get-cmdriver | select -Property LocalizedDisplayName
New-CMDriverPackage -name "hv network" -path "\\LON-CFG\Software\Drivers\pkg"
Add-CMDriverToDriverPackage -DriverName "Microsoft Hyper-V Network Adapter" -DriverPackageName "hv network"
Set-CMDriverBootImage -BootImageName "Boot image (x64)" -SetDriveBootImageAction AddDriverToBootImage `
-DriverName "Microsoft Hyper-V Network Adapter"
# os iMAGES
# Master WIN FILE
get-help cmOperatingSystemImage
# NO WIM
New-CMOperatingSystemImage -name "Windows 10 ent x64" -path "\\lon-cfg\e$\Capture\[Link]"
Start-CMContentDistribution -BootImageName "Boot image (x64)" -DistributionPointGroupName dp
Start-CMContentDistribution -OperatingSystemImageName "Windows 10 ent x64" -DistributionPointGroupName dp
SITE SETTINGS AND MAINTENANCE
# site settings
Get-CMSite
set-cmsite -SiteCode s01 -FreeSpaceThresholdCriticalGB 20 -GenerateAlertWhenFreeDiskSpaceOnSiteDatabaseIsLow $true `
-WarningAlertWhenFreeDiskSpaceFallBelowFollowingValueGB 30
# site maintenance
Get-CMSiteMaintenanceTask -SiteCode s01 | select itemName
Set-CMSiteMaintenanceTask -SiteCode s01 -MaintenanceTask DeleteAgedSoftwareMeteringSummaryData -DaysOfWeek Sunday
#email
Set-CMEmailNotificationComponent -EnableEmailNotification -SmtpServerFqdn -TypeOfAuthentication Anonymous -SendFrom
SITE ROLES
# MP
# Primary contact for your clients
# all the datas from your clients are send to the MP
# 25000 clients
Add-CMManagementPoint
# State Migration Point OSD
# profile of your computers (UMST)
$s=New-CMStorageFolder -StorageFolderName "c:\usmt" -MaximumClientNumber 100 `
-MinimumFreeSpace 20 -SpaceUnit Gigabyte
Add-CMStateMigrationPoint -StorageFolder $s -AllowFallbackSourceLocationForContent $true `
-SiteCode s01 -SiteSystemServerName "[Link]" -TimeDeleteAfter 2 -TimeUnit Days -EnableRestoreOnlyMode
$false
# reporting Services Point
# SSRS
Add-CMReportingServicePoint -ReportServerInstance MSSQLSERVER -SiteCode s01 -UserName -SiteSystemServerName
Add-CMAssetIntelligenceSynchronizationPoint
SECONDARY SITE
# why ?
PS
|S
# bandwitch beetween your ps and your ss
# MP and DP
New-CMSqlServerSetting -CopySqlServerExpressOnSecondarySite
Remove-CMSecondarySite
#1
New-CMSecondarySite
#2
New-CMInstallationSourceFile
#3
New-CMSqlServerSetting
fluctuationit@[Link]
ANTIMALWARE
# Malware protection remidation computers
# FW settings
# endpoint protection client on your device
# role
Add-CMEndpointProtectionPoint -SiteSystemServerName "[Link]" `
-SiteCode s01 -LicenseAgreed $true -ProtectionService DoNotJoinMaps
# to install the endpoint protection on device
get-help malware
# create a new policy
New-CMAntimalwarePolicy -name "Client_policy" -Policy ScanSettings,ScheduledScans,RealTimeProtection
Set-CMAntimalwarePolicy -name "Client_policy" -EnableScheduledScan $true -ScheduledScanType QuickScan `
-ScheduledScanWeekday Friday -ScheduledScanTime "11:00" -LimitCpuUsage 50
Set-CMAntimalwarePolicy -name "Client_policy" -ScanRemovableStorage $true -ScanEmail $true
Set-CMAntimalwarePolicy -name "Client_policy" -RealTimeProtectionOn $true `
-RealTimeScanOption ScanIncomingAndOutgoingFiles
Invoke-CMClientNotification -DeviceName "win10-device" -NotificationType RequestMachinePolicyNow
# deploy
Start-CMAntimalwarePolicyDeployment -AntimalwarePolicyName "Client_policy" -CollectionName "adatum_clients"
MONITORING
# Status message clients and sites sql
# gaz factory
Get-CMStatusSummarizer -StatusSummarizerType ComponentStatusSummarizer
# 502 ID
New-CMStatusFilterRule -name "Discovery agent stopped" -SiteCode s01 `
-ComponentName SMS_WINNT_SERVER_DISCOVERY_AGENT -MessageType Milestone -MessageId 502 `
-SeverityType Error -ForwardToStatusSummarizer $false
# rule powerfull contrat flow
# manage status message
Get-CMComponentStatusMessage
Get-CMSiteStatusMessage
Get-CMComponentStatusMessage -Severity Information -SiteCode s01 -ComponentName
"SMS_AD_USER_DISCOVERY_AGENT" `
-ViewingPeriod "8/13/2018" | select -Property component,MessageID,MessageType,Time | ft |
out-file c:\SMS_AD_USER_DISCOVERY_AGENT.txt
#Alerts
get-help alert
Get-CMAlert | select -Property Name,AlertState,ID,Severity | ft
$alert=Get-CMAlert | ? {$_.name -like "*DatabaseFreeSpaceWarning*"} | Select-Object -ExpandProperty ID
New-CMAlertSubscription -name "db issue space" -AlertId $alert -EmailAddress "sccm@[Link]" -LocaleId 1033
Suspend-CMAlert
# tks you very much
SECURITY ROLE
# roles
# Role based administration
# security roles scopes admins users
# Roles
# 15 roles
Get-CMSecurityRole | select -Property RoleName,IsBuiltIn,NumberOfAdmins,RoleID | ft -AutoSize
Copy-CMSecurityRole -name "my_admin_role " -SourceRoleName "full administrator"
# scopes
# which objects can be managed ny admin users
# users admin must be assigned one security scope
# All scope and Default scope
Get-CMSecurityScope
New-CMSecurityScope -name "Scope_demo1"
New-CMAdministrativeUser -name "adatum\it" -RoleName "my_admin_role " `
-SecurityScopeName "Scope_demo1"
Get-CMAdministrativeUser | select -Property Rolenames,LogonName,CaterogyNames,CollectionNames