Windows

Export a Certificate with MMC

Export a Certificate with MMC

If you work with wild card certificates, it’s common to need to deploy them to more than one server. You will need to export the certificate to install it on other systems.

In this post, I will show you step-by-step how to export a certificate using MMC (Microsoft Management Console).

The Process

  • Connect to the system that has the certificate you want to export.
  • Open MMC.
  • Add the Certificates Snap-in.
  • Select Computer account and click Next.
  • Select Local computer and click Finish.
  • Click OK to close the Add or Remove Snap-ins window.
  • Right-click on the Certificate you want to export and click Export.
…

Read More Read More

Complete a CSR

Complete a CSR

When you create a CSR and provide it to your certificate vendor or CA (Certificate Authority), you must complete the CSR (Certificate Signing Request).

In this post, I will show you step-by-step how to complete a CSR.

Prerequisites

  • CSR generated on a system that you want to complete the CSR on. If you don’t know how my post Generate CSR with MMC details all the steps.

You can check which system has the pending certificate by checking the Certificate Enrollment Requests in MMC (Microsoft Management Console).

Certificate Pending completion of CSR

The Process

  • Connect to the system you used to generate the CSR.
  • Download the certificate files from your certificate vendor or CA.
  • Right-click on the certificate file and select Install Certificate.
…

Read More Read More

Intune Deploy Windows 10 Default Start Menu

Intune Deploy Windows 10 Default Start Menu

I recently discovered that I caused an unintended side effect on Windows 10 when deploying a default taskbar for all users.

In my post Intune Deploy Default Taskbar I inadvertently introduced a bug to the Windows 10 Start Menu making it so users can’t customize anything.

The bug is that users can pin programs to the taskbar but they can’t pin anything to the Start Menu and they also can’t change anything in the Start Menu.

Can’t pin Microsoft Access to the Start Menu on Windows 10

The issue does not impact Windows 11 as the way the Windows 11 Start Menu layout uses JSON and the Windows 10 Start Menu layout uses XML, the same XML file that is used for the default taskbar.

I am happy to allow users to customize their Start Menu as much as they want but I do want a consistent user experience for all. Most users likely won’t change anything, but the ones that do want to customize their Start Menu would be blocked.

In this post, I will show you step-by-step how to fix the bug and how to deploy a partial custom Start Menu for Windows 10 using Microsoft Intune.

The Process

  • On a source system configure an application group in your start menu and pin the applications in the order you want.

The application group name will also be deployed. I named my application group Company Name for this example but you can make it whatever you want.

I don’t want the custom Start Menu application group to be very intrusive so I will use 1×1 icons for all the common Microsoft applications and I will use 2×2 icon for Company Portal as Company Portal is still new for a lot of people.

Source Windows 10 Start Menu application group
  • Export the Start Menu layout by running the following PowerShell command Export-StartLayout -UseDesktopApplicationID -path C:\temp\start-menu.xml
  • Open the Start Menu XML file as we will need to make changes to it.
…

Read More Read More

Registry Check Setter

Registry Check Setter

In the past, I’ve made a few one-off PowerShell scripts to set various registry settings. I find myself needing to do this more and more. I’ve always just forced my registry settings with no regard to whether the settings were already correct.

A perfect example of this is my PowerShell script to Disable Auto Windows Updates

While this method works I felt like it could be better. I decided to make a brand new script that would be less forceful and more modular and use functions and parameters.

This resulted in the creation of the PowerShell script that I call the Registry Check Setter.

The PowerShell script enables you to set multiple registry settings very easily while checking if the settings are already correct or not.

You can find the script on my GitHub https://github.com/thedxt/Registry-Check-Setter

How It Works

The script starts by checking if the registry key path exists, if the key path doesn’t exist the script considers it safe to just set the settings and sets them. If the key path does exist the script then moves on to checking if the registry value name exists.

If the registry value name is not found in the registry key path the script then creates the value with the needed setting and exists. If the registry value name exists the script then checks if the registry value name setting is correct.

If the registry value name setting is not correct the script then changes the setting to make it correct and then exits.

An example of this would be if I was trying to prevent a Windows 10 system from upgrading to Windows 11 and I wanted to turn off auto updates.

To lock the system to Windows 10 the registry path HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate needs a registry value named ProductVersion that is a String with a setting of Windows 10.

To lock the system to a specific feature update of Windows 10 the registry path HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate needs a registry value named TargetReleaseVersionInfo that is a String with a setting of 22H2.

To enable locking the system to Windows 10 22H2 the registry path HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate needs a registry value named TargetReleaseVersion that is a DWord with a setting of 1.

To turn off auto updates the registry path HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU needs a registry value named NoAutoUpdate that is a DWord with a setting of 1.

Yes, I could just force the settings to be correct but if I run the script multiple times it constantly changes the settings and doesn’t take into account if the Windows Update service is running. If the Windows Update service is already running these settings won’t properly take effect until the Windows Update service is restarted or the whole system is rebooted.

My thought process is you could combine the results of the Registry Check Setter to have another script take action.

…

Read More Read More

Intune Device Filters

Intune Device Filters

As the end of Windows 10 starts creeping up we have to adapt some of our methods to support mixed environments with Windows 10 and Windows 11.

Most settings in Microsoft Intune aren’t specific to Windows 10 or Windows 11 some settings are specific to the version. For example, one of them is the Windows Start Menu. Windows 10 uses an XML file and Windows 11 uses a JSON file. Technically there’s no impact if you deploy those settings to either version of Windows but that might not always be the case. It’s a better idea to only target the intended version of Windows.

A way that I like to handle this is with Intune Device Filters. In this post, I’ll show you step-by-step how to create Device Filters for Windows 10 and Windows 11 in Microsoft Intune.

The Process

  • Login to Microsoft Intune admin center
  • Click on Devices
  • Click on Filters
  • Click on Create > Managed devices
  • Give your Filter a name. Like Windows 10 or Windows 11.
  • Set the Platform as Windows 10 and later
…

Read More Read More

geoSCOUT 9.0 Launcher Upgrade

geoSCOUT 9.0 Launcher Upgrade

With the release of geoSCOUT version 9.0 geoLOGIC has upgraded the geoSCOUT launcher. As part of the upgrade process to version 9.0, you should be upgrading the geoSCOUT launcher as geoSCOUT users will get a warning message stating that they need the new launcher. They can still use geoSCOUT even if the launcher isn’t upgraded but they will keep seeing the warning message every time they open geoSCOUT.

Warning message about the old geoSCOUT launcher

The geoSCOUT launcher upgrade can be a challenging task in a large environment when users don’t have local admin. In this post, I’ll detail what I’ve discovered about how the geoSCOUT launcher works and include a PowerShell script to upgrade the launcher.

Discovery

The geoSCOUT launcher seems to work by looking for a user’s GMAP.ini file saved in the user’s %AppData%, if that file isn’t present then the launcher will throw an error.

When you install geoSCOUT using the Desktop_Build_NonAdmin installer or the Desktop_Build installer both of them use the context of the path that executed the install to populate the user’s GMAP.ini file saved in %AppData%.

My theory on how part of the geoSCOUT launcher works is that it uses the user’s GMAP.ini file to find the geoSCOUT server and for version 8 it loads gsmainV8.exe from the Programs directory in the geoSCOUT network location.

The geoSCOUT version 9.0 launcher seems to work the same way as the version 8 launcher did except that instead of launching gsmainV8.exe it launches gsmap.exe. Technically speaking you could run geoSCOUT by just launching gsmap.exe but that isn’t the recommended way.

After the geoSCOUT upgrade to version 9.0 if a user is using a shortcut to gsmainV8.exe they will get the warning that their launcher is out of date and needs to be upgraded even if their geoSCOUT launcher has been upgraded on their system.

The way the geoSCOUT launcher works is important because it shows us that unlike the normal geoSCOUT user install the path you use to install the launcher doesn’t matter.

…

Read More Read More

Windows Verbose Status

Windows Verbose Status

By default, Windows servers display lots of details when you logon to them and rarely leave you wondering what it’s doing. A while back I ran into an issue that was causing 15 minute login times when a user would log in to the computer for the first time. This was particularly a problem with shared systems like meeting room computers as many users may have never logged into that computer before. The problem scales with the more meeting rooms you have and the more users you have, and typically people are rushing for meetings and don’t have time to wait for a long Windows login process.

From the user’s perspective, it looks like the computer would just sit at Welcome for 15 minutes. Yes, you can go dig into the event logs and see what’s causing that or you could make it so the computer can output what it’s doing, making it so the users can provide you with more useful information.

To do this you need to enable verbose statuses. This is enabled by default on Windows servers but not regular Windows devices. When a regular Windows device logins in and sits at the Welcome message it is doing stuff but not telling you what it’s doing.

In this post, I will detail step-by-step how to enable the Windows verbose login status with a GPO or Intune.

The Process

GPO

  • Make a new GPO
  • Go to Computer Configuration > Policies > Administrative Templates > System
  • Set Display highly detailed status messages to Enabled.
  • Link the GPO to the OU of the devices you want to enable Verbose Status on.

Intune

  • Login to Microsoft Intune admin center.
  • Click on Devices
  • Click on Configuration profiles
…

Read More Read More

Windows Search Box Company Branding

Windows Search Box Company Branding

A while back I saw someone’s computer that had a company logo in the Windows taskbar; it looked super slick. I wanted to duplicate the same thing in my setup.

The documentation on what causes a company logo to show up in the search box in the Windows taskbar and the Windows start menu is kind of lacking however, after playing around I figured it out. It’s the custom default theme in Microsoft 365 that will cause the organization logo to show up on Windows devices connected to a Microsoft 365 tenant be it joined or just registered devices.

Before and after adding the company logo branding

In this post, I will show step-by-step how to add a custom default theme to your Microsoft 365 tenant that will also apply to the search box in the taskbar of Windows devices. This works on Windows 10 and Windows 11.

The Process

  • Login to the Microsoft 365 admin center
  • Click on Settings > Org settings
  • Click Organization profile
…

Read More Read More

Intune Deploy Default Taskbar

Intune Deploy Default Taskbar

Update

The process detailed below works perfectly on Windows 11 however, on Windows 10 the process below will lock the Start Menu layout preventing users from being able to pin anything to the Windows 10 Start Menu or change anything in the Start Menu. The process to fix this is to also deploy a default Windows 10 Start Menu the process for the fix is detailed in my post Intune Deploy Windows 10 Default Start Menu.

Deploying the same taskbar to all users is a very nice quality of life improvement, as it can help eliminate the problems of users using Windows Mail instead of the already installed Microsoft Outlook.

I opted to deploy a standard default taskbar using Microsoft Intune as Microsoft Office is a required application on all Intune systems in my setup so I didn’t need to worry about a system trying to pin Microsoft Outlook when it wasn’t installed.

In this post, I’ll show you step-by-step how to create the taskbar XML file and how to deploy it to Windows 10 and Windows 11 using Microsoft Intune.

Create the XML

<?xml version="1.0" encoding="utf-8"?>
<LayoutModificationTemplate
    xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"
    xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout"
    xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout"
    xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout"
    Version="1">
  <CustomTaskbarLayoutCollection>
    <defaultlayout:TaskbarLayout>
      <taskbar:TaskbarPinList>
        <taskbar:UWA AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
        <taskbar:DesktopApp DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk" />
      </taskbar:TaskbarPinList>
    </defaultlayout:TaskbarLayout>
 </CustomTaskbarLayoutCollection>
</LayoutModificationTemplate>
Code language: HTML, XML (xml)

We will need to make some changes as it isn’t perfect. We will start by telling Windows to unpin all the default pinned apps.

  • To remove all the default pinned apps we need to change <CustomTaskbarLayoutCollection> to be   <CustomTaskbarLayoutCollection PinListPlacement="Replace">

Even though we configure the taskbar XML to replace the default pinned apps this has no impact on the apps the user has pinned, it may move the items to the start of the taskbar if they have them pinned further down but that’s it.

Now we can start adding the pinned apps we want. I like to have Edge, File Explorer, and Outlook pinned.

…

Read More Read More

Deploying Windows LAPS

Deploying Windows LAPS

I’ve been a fan of LAPS for a while and in 2023 Microsoft made LAPS even better by introducing a new version called Windows LAPS. Windows LAPS (Local Administrator Password Solution) is a great tool for managing your local admin passwords.

You might be thinking it’s ok I use one complicated password for my local admin accounts, it does not matter in fact it’s worse because if that local admin password hash is obtained then techniques such as pass-the-hash could be used or the password could be cracked and then all systems are compromised, it also sticks out on a penetration test.

Let’s be real, how often are you really changing those passwords even if they are all unique? Well, it doesn’t matter now because Microsoft has made managing all of it much simpler.

LAPS is not new, it has been around for years. In the past to use LAPS you needed to install a small client on the systems you wanted to manage with LAPS. You also needed to install the LAPS UI to retrieve the password or go digging in the AD attributes for the password.

After April 2023 all of that has changed as with the April 2023 security update systems running Windows 10 or newer and servers running Windows Server 2019 or newer now support Windows LAPS natively. No more extra programs are needed. There’s really no excuse for not using Windows LAPS.

The old way of doing Microsoft LAPS with the small client and LAPS UI is now called Legacy LAPS.

Here is step-by-step how to deploy Windows LAPS after the April 2023 update in on-premises Active Directory setup.

Prerequisites

  • All domain controllers and systems managed by LAPS must have the April 2023 update or newer.
  • An AD group for the users who can view LAPS passwords.
  • An AD group for the users who can reset the current LAPS password. (You can use the same group for both if you want.)
  • An Admin account that is a member of Schema Admins and Domain Admins.
  • Domain Functional Level of Windows Server 2016 or higher.

Initial Configuration

  • Login to a domain controller with an account that is a member of schema admins and domain admins
  • Open PowerShell as admin
  • Confirm you have the LAPS PowerShell module by running the following command get-command -module LAPS
…

Read More Read More