Install Fonts with Powershell

$ssfFonts = 0x14

$fontSourceFolder = ""

$Shell = New-Object -ComObject Shell.Application

$SystemFontsFolder = $Shell.Namespace($ssfFonts)

$FontFiles = Get-ChildItem $fontSourceFolder

$SystemFontsPath = $SystemFontsFolder.Self.Path

$rebootFlag = $false

 

foreach($FontFile in $FontFiles) {

    # $FontFile will be copied to this path:

    $targetPath = Join-Path $SystemFontsPath $FontFile.Name

    # So, see if target exists...

    if(Test-Path $targetPath){

        # font file with the same name already there.

        # delete and replace.

        $rebootFlag = $true

        Remove-Item $targetPath -Force

        Copy-Item $FontFile.FullName $targetPath -Force

    }else{

        #install the font.

        $SystemFontsFolder.CopyHere($FontFile.fullname)

    }

}

 

#Follow-up message

if($rebootFlag){

    Write-Host "At least one existing font overwritten. A reboot may be necessary."

}

Disable-Enable automapping Echange 2016

Because automapping is not always working correct, just created this script to re-enable automapping with the correct settings. This script you need to run on the Exchange server.

# Created by Daag van der Meer
# blog.van-daag.nl
# This script gives the user full access to the mailbox. This will update also the folders below the inbox with the rights.

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn;


# Enter the mailbox name here
$mailbox= "<mailboxname>"

# Add here the usernames like "<USERNAME>", "<ÜSERNAME>"
$users= "<USERNAME>", "<ÜSERNAME>"


####### Start of the Script. Do not edit below

foreach ($user in $users){ 
# First disable AutoMapping
Add-MailboxPermission -Identity $mailbox -User $user -AccessRights FullAccess -InheritanceType All -Automapping $false


# Now enable Automapping
Add-MailboxPermission -Identity $mailbox -User $user -AccessRights FullAccess -InheritanceType All -Automapping $true
} 

 

AD Send mail on password reset

This is based on Security Event ID 4724. When this is logged on the domain controller, Task Scheduler kicks this script. And send a mail to Admin and user. And also creates a local log file who reset the password.

# Created by Daag van der Meer on 12-10-2018
# Blog.van-daag.nl
# Powershell Send mail When account password reset is done To user and admin.
# Save this also in a Log file
 
##################
## Temp location for creating HTML email
##################
$Report= "c:\Temp\reset.html" 

##################
## Log location
##################
$log= "C:\Logs\Accountreset.csv"
 
$HTML=@" 
<title>Account locked out Report</title> 
<!--mce:0--> 
"@ 

##################
## Retrieve eventlog with all value
##################

$event = Get-EventLog -LogName Security -InstanceId 4724 -Newest 1 |
 Select TimeGenerated, ReplacementStrings |
  % { 
     New-Object PSObject -Property @{ 
      "Account name" = $_.ReplacementStrings[0] 
      "Account Domain" = $_.ReplacementStrings[1] 
      "Reset by" = $_.ReplacementStrings[4] 
      Date = $_.TimeGenerated 
    } 
   } 

##################
## Retrieve eventlog For filter username
##################

$userevent= Get-EventLog -LogName Security -InstanceId 4724 -Newest 1 | Select-Object @{n='UserName';e={$_.ReplacementStrings[0]}}
$user= $userevent -replace ".*=" -replace "}"

##################
## send mail to admin
##################


$event | ConvertTo-Html -Property "Account name","Account Domain","Reset By",Date -head $HTML -body  "<H2> User account password is reset</H2>"| 
     Out-File $Report -Append 

##################
## Mail config admin
##################

$MailBody= Get-Content $Report 
$MailSubject= "User password reset" 
$SmtpClient = New-Object system.net.mail.smtpClient 
$SmtpClient.host = "<MAIL SERVER>" 
$MailMessage = New-Object system.net.mail.mailmessage 
$MailMessage.from = "<FROM MAILADRESS>" 
$MailMessage.To.add("<MAILADRESS>") 
$MailMessage.Subject = $MailSubject 
$MailMessage.IsBodyHtml = 1 
$MailMessage.Body = $MailBody 
$SmtpClient.Send($MailMessage) 

del c:\Temp\reset.html
$event | Export-Csv $log -NoTypeInformation -Append


#############################
### Send mail to user #######
#############################

$useremail = Get-ADUser $user -Properties mail | Select-Object -ExpandProperty mail
$userfirstname1 = Get-ADUser $user -Properties GivenName | Select-Object GivenName
$userfirstname = $userfirstname1 -replace ".*=" -replace "}"
$userlastsname1 = Get-ADUser $user -Properties Surname | Select-Object Surname
$userlastsname = $userlastsname1 -replace ".*=" -replace "}"

$Pic = '<ADD LOCATION FOR PICTURE IN MAIL>'

$att1 = new-object Net.Mail.Attachment($Pic)
$att1.ContentType.MediaType = “image/png”
$att1.ContentId = “Attachment”

##################
## HTML mail setup to user
##################

$userBody = @"
<html>
    <body>
    <span lang=NL style='font-size:10.0pt;line-height:106%;color:black'>
Dear $userfirstname $userlastsname,<br>
<br>
The password for your <b>DOMAIN\$user</b> account has been reset.<br>
If you did not request this, please inform:<br>
<br>
This is an automated email.<br>
<br>
</span>
<img src="cid:Attachment">
"@

##################
## Mail config user
##################

$userSubject = "Your password is changed"
$userMessage = New-Object system.net.mail.mailmessage 
$userMessage.from = "<FROM MAILADRESS>"
$userMessage.To.add("$useremail")  
$userMessage.Subject = $userSubject  
$userMessage.IsBodyHtml = 1
$userMessage.Body = $userBody 


$userMessage.Attachments.Add($att1)


$SmtpClient.Send($userMessage)

 

AD Send mail on Account Lock

At a company where I worked, there was no logging with account lock and the had plans to change the GPO that accounts will not be auto unlocked.
So I also added mailing to the admin of that specific OU (Country)

I found a script from Maxzor1908 on Technet
That was the basic. I Added a lot of extra.

# Powershell User Account locked out Maxzor1908 *16/4/2013* 
# Checked and edit by Daag van der Meer - 03-10-2018
# blog.van-daag.nl
#              Email adress needs to be filled in at the admin account.
 
##################
## Temp location for creating HTML email
##################
$Report= "c:\Temp\Lockedhtml.html" 

##################
## Log location
##################
$log= "C:\Logs\AccountLocked.csv"
 
$HTML=@" 
<title>Account locked out Report</title> 
<!--mce:0--> 
"@ 
 
$Account_Name = @{n='Account name';e={$_.ReplacementStrings[-1]}} 
$Account_domain = @{n='Account Domain';e={$_.ReplacementStrings[-2]}} 
$Caller_Computer_Name = @{n='Caller Computer Name';e={$_.ReplacementStrings[-1]}} 
 
##################
## Retrieve eventlog with all value
##################

             
$event= Get-EventLog -LogName Security -InstanceId 4740 -Newest 1 | 
   Select TimeGenerated,ReplacementStrings,"Account name","Account Domain","Caller Computer Name" | 
   % { 
     New-Object PSObject -Property @{ 
      "Account name" = $_.ReplacementStrings[-7] 
      "Account Domain" = $_.ReplacementStrings[5] 
      "Caller Computer Name" = $_.ReplacementStrings[1] 
      Date = $_.TimeGenerated 
    } 
   } 
    
  $event | ConvertTo-Html -Property "Account name","Account Domain","Caller Computer Name",Date -head $HTML -body  "<H2> User is locked in the Active Directory</H2>"| 
     Out-File $Report -Append 
 

##################
## Retrieve eventlog For filter username
##################


 $user= Get-EventLog -LogName Security -InstanceId 4740 -Newest 1 | 
   Select ReplacementStrings | 
   % { 
     New-Object PSObject -Property @{ 
      "Account name" = $_.ReplacementStrings[-7] 
      } 
   } 

$userrename = $user -replace ".*=" -replace "}"
$userou = Get-ADUser $userrename -Properties DistinguishedName | Select-Object -ExpandPropert DistinguishedName

##############################
## Here is the ad Groups configured who can unlock accounts
#############################
 

if ($userou.Contains('OU=<OU>')) {$mail = "<AD GROUP>"}

elseif ($userou.Contains('OU=<OU>')) {$mail = "<AD GROUP>"}

else {$mail = "<AD GROUP>" }

$adminmail = Get-ADGroupMember $mail | select samaccountname | %{Get-ADUser $_.samaccountname -Properties mail} | %{write-output "$($_.mail)"}
$mailadmin =  $adminmail -join "," -replace ",,"

##################
## Mail config admin
##################


$MailBody= Get-Content $Report 
$MailSubject= "User Account locked out" 
$SmtpClient = New-Object system.net.mail.smtpClient 
$SmtpClient.host = "<MAIL SERVER>" 
$MailMessage = New-Object system.net.mail.mailmessage 
$MailMessage.from = "<FROM MAIL ADRESS>" 
$MailMessage.To.add("<TO MAIL ADRESS>,$mailadmin") 
$MailMessage.Subject = $MailSubject 
$MailMessage.IsBodyHtml = 1 
$MailMessage.Body = $MailBody 
$SmtpClient.Send($MailMessage) 


##################
## Remove the temp document
##################
del c:\Temp\Lockedhtml.html

##################
## Write to log about the account lock
##################

$event | Export-Csv $log -NoTypeInformation -Append

AD Change Display name

At the company were I worked we had a name change. They also use the display name in outlook to send mail. Example: Daag van der Meer [Company] So everyone see direct what the company is.

The script below built the display name with firstname lastname [Company]

# Script created by Daag van der Meer
# Blog.van-daag.nl

Import-Module ActiveDirectory

#creates a list of all users (change all between <>
$allUsers = Get-ADUser -Filter * -SearchBase 'ou=Users,ou=<OU>,DC=<DC>,DC=<DC' -Properties cn,displayName

 
# Add your company name or something else after username 
$hi = "<company>"

 

foreach ( $u in $allUsers | Where-Object { ($_.givenName) -and ($_.surName) } ) {

    $fn = $u.givenName.Trim()

    $ln = $u.surName.Trim()

   

    Write-Host $fn $ln

    Set-ADUser -Identity $u -DisplayName "$fn $ln $hi" -GivenName "$fn" -SurName "$ln"-PassThru |

        Rename-ADObject -NewName "$fn $ln $hi"

}

 

AD Change Roaming profile Path Terminal server

I created this script because of moving the profiles to a server in the data center were also the terminal server is located.

Powershell needs to be runned as Administrator

########
## created by Daag van der Meer
## blog.van-daag.nl
## 26-04-2018
########
#
# Script is used to set Homedrive, RDP Homedrive, Profilepath, RDP profile path.
#
# Script needs to be runned as Admin!!!


Import-Module ActiveDirectory
     # On the Domain Controller There is on C:\Temp\Users.txt with the usernames to change the path

foreach ($user in (get-content c:\temp\Users.txt)) {
    ## Homedrive and profile location
    $homeDirectory = '\\<NewServer>\home$\<Country>\' + $user; 
    $ProfilePath = '\\<NewServer>\Profile$\<Country>\' + $user; 

    ## Set homedrive (DISABLE THIS IF YOU DON'T WANT TO CHANGE THIS)
    # Finally set their home directory and home drive letter in Active Directory
    Set-ADUser -Identity $user -HomeDirectory $homeDirectory -HomeDrive H
	
	## Set Profile (DISABLE THIS IF YOU DON'T WANT TO CHANGE THIS)
		Set-ADUser -Identity $user -ProfilePath $ProfilePath
        
        ## Set RDP Profile and Homedrive
        Get-ADUser -Filter "SAMAccountName -like '$user*'"| ForEach-Object {
        $ADSI = [ADSI]('LDAP://{0}' -f $_.DistinguishedName)
        try {
            $ADSI.InvokeSet('TerminalServicesProfilePath',$ProfilePath)
            $ADSI.InvokeSet("TerminalServicesHomeDrive","H:")
            $ADSI.InvokeSet("TerminalServicesHomeDirectory",$homeDirectory)
            $ADSI.SetInfo()
        }
        catch {
            Write-Error $Error[0]
        }
}
	
}

 

Finding WWN’s on Windows Server 2012 Using PowerShell

With a single command you can retrieve WWN’s on Windows Server 2012 R2 using PowerShell.

Open the PowerShell command and type:

Get-WmiObject -class MSFC_FCAdapterHBAAttributes -namespace “root\WMI” | ForEach-Object {(($_.NodeWWN) | ForEach-Object {“{0:x}” -f $_}) -join “:”}

And that is all there is to it. Simple and fast using PowerShell.

Update: I have been been made aware of another way to get the WWN on Windows 2012 R2 with a cmdlet called get-initiatorport which was added to Windows Server 2012 R2. This is a much cleaner way of retrieving the WWN information instead of the WMI call.

 

PS C:\> Get-InitiatorPort

InstanceName NodeAddress PortAddress ConnectionType
------------ ----------- ----------- --------------
PCI\VEN_10DF&DEV_F100&SUBS... 20000090fa56b930 10000090fa56b930 Fibre Channel
PCI\VEN_10DF&DEV_F100&SUBS... 20000090fa56b931 10000090fa56b931 Fibre Channel

You can also filter the display and just get the PortAddress

PS C:\> Get-InitiatorPort | Select-Object -Property PortAddress | Format-Table -AutoSize

PortAddress
-----------
10000090fa56b930
10000090fa56b931

More information on get-initiatorport and many other storage related cmdlets can be found here!

 

Site

Remove Windows 10 1703 default apps

I Use this script in MDT to remove all Windows 10 Apps.
Add more in $Appslist if you need to remove more.

$AppsList = "Microsoft.3DBuilder","Microsoft.Microsoft3DViewer","Microsoft.BingWeather","Microsoft.Getstarted","Microsoft.Messaging","Microsoft.MicrosoftOfficeHub","Microsoft.MicrosoftSolitaireCollection","Microsoft.OneConnect","Microsoft.People","Microsoft.SkypeApp","microsoft.windowscommunicationsapps","Microsoft.FeedbackHub","Microsoft.WindowsMaps","Microsoft.XboxApp","Microsoft.XboxIdendityProvider","Microsoft.ZuneMusic","Microsoft.ZuneVideo","AdobeSystemsIncorporated.AdobePhotoshopExpress","Microsoft.Advertising.Xaml","Microsoft.Office.OneNote","Microsoft.WindowsFeedbackHub","Microsoft.XboxGameOverlay","Microsoft.XboxIdentityProvider","Microsoft.XboxSpeechToTextOverlay","Microsoft.Office.Sway","Microsoft.BingNews","D5EA27B7.Duolingo-LearnLanguagesforFree","46928bounde.EclipseManager"
 
    ForEach ($App in $AppsList) 
    { 
        $PackageFullName = (Get-AppxPackage $App).PackageFullName
        $ProPackageFullName = (Get-AppxProvisionedPackage -online | where {$_.Displayname -eq $App}).PackageName
         
        If ($PackageFullName) 
        { 
            Write-Verbose "Removing Package: $App"
            remove-AppxPackage -package $PackageFullName
        } 
        Else
        { 
            Write-Host "Unable to find package: $App"
        } 
  
        If ($ProPackageFullName) 
        { 
            Write-Verbose "Removing Provisioned Package: $ProPackageFullName"
            Remove-AppxProvisionedPackage -online -packagename $ProPackageFullName
        } 
        Else
        { 
            Write-Verbose "Unable to find provisioned package: $App"
        }
    }

Location in MDT: