CreateShortcut.vbs - now with icons!

Per the last post, I expanded the CreateShortcut VBScript to include icon specification, in case you don't like the default icon (to make it look 'prettier' if needed). This adds a parameter for the icon location as well as icon index. Here is the code:

Set oWS = WScript.CreateObject("WScript.Shell")
sLinkFile = WScript.Arguments(0)
Set oLink = oWS.CreateShortcut(sLinkFile)
oLink.TargetPath = WScript.Arguments(1)
if WScript.Arguments.count = 3 then
oLink.IconLocation = WScript.Arguments(2)
end if
oLink.Save

And the usage:

CreateShortcut.vbs "C:\Users\JoeSmith\Desktop\Excel.lnk" "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE" "C:\Program Files (x86)\Microsoft Office\Office16\protocolhandler.exe,0"

This example creates an icon on JoeSmith's desktop for Excel, but replaces the icon with the default 'Office' icon instead of the Excel icon.  

The icon specification parameter is completely optional - you can still use the default icon by not specifying the 3rd parameter for icon location in the script usage and it will work fine.

I've found this particularly useful for batch files or internet shorcuts to replace those ugly default icons with prettier ones.

Tackling the HP Audio Driver Keylogger issue with SCCM

Here's a rundown of how I tackled the HP Audio Driver Keylogger issue.

1. Created a Config Item called "Conexant Log File Check", and used the below settings.

2. Created a Config Baseline, added the Config Item to it, then deployed to the Clients collection.
3. Created a collection off of the resultant collection based on the Non-compliance count, then deployed the Conexant Audio Driver application as Required to this collection.
4. The Conexant Audio Driver application was based on two Detection Method rules:

Since both of these driver versions were documented as being keyloggers, the driver could be used to automatically upgrade both versions.

Create a desktop shortcut the VBScript way

Here is how to create a shortcut (on the Desktop or anywhere else) using VBScript.  This method allows creation from just one .VBS file and saves space by not having to worry about copying multiple shortcuts to the user's Desktop or elsewhere.  I used this VBScript extensively when I realized I wanted to create desktop shortcuts to commonly used applications but did not want to create multiple shortcut.lnk files to copy to the user's Desktop folder (or other folders) manually.

The contents of the CreateShortcut.vbs file:

Set oWS = WScript.CreateObject("WScript.Shell")
sLinkFile = WScript.Arguments(0)
Set oLink = oWS.CreateShortcut(sLinkFile)
oLink.TargetPath = WScript.Arguments(1)
oLink.Save

Usage:

CreateShortcut.vbs <path to shortcut with .lnk extension> <path/filename of file/folder>

For example - to create a shortcut to MS Excel on the user's desktop:

CreateShortcut.vbs "C:\Users\JoeUser\Desktop\Microsoft Excel.lnk" "C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE"

The icon for the shortcut uses the default icon of the file/folder (e.g. it will use Excel's default icon in the above example).

Powershellist - My backup script

Not really SCCM related, but still useful.  :)

This Powershell script is what I wrote awhile back to backup the entire C: drive to a specified network share.  It prompts to perform a disk check (reboot required) before backing up to ensure there are no bad sectors.  It creates folders based on make, model, and hostname of the computer and outputs the general backup information (hostname, backup date, network location, make, model) to a CSV file on the network share.

Clear-Host
Write-Host "This performs a full system backup using Windows Backup.  Please verify you are logged in as an account that has write access to \\server\share before continuing."
$diskchfile = "C:\windows\temp\disk_check.tag"
if (-not (Test-Path $diskchfile)) { 
$diskch = read-host "Disk check has not been run yet.  Do you want to run a Disk Check now? [y/n] "
IF($diskch -eq "y") {
$text = 'y'
$text | Out-File 'C:\windows\temp\disk_check.tag'
Write-Host "NOTE: Please run this script again to continue backup after the Disk Check."
$text | chkdsk C: /r
Write-Host "Rebooting to run Disk check..."
shutdown /r /t 5
cmd /c pause | out-null
exit
} else {
write-host "Disk check aborted."
}
} else {
Write-Host "Disk check has been performed."
}
$machine = (Get-WmiObject -Class:Win32_ComputerSystem).Model
$make,$model = $machine -Split(" "),2

write-host "Make: $make"
write-host "Model: $model"

$backuppath = "\\server\share\$make\$model\$env:computername"
if ((Test-Path $backuppath)) { 
write-host "WARNING: This machine may have previously been backed up.  Please check the open Explorer window to verify VHD file exists."
Start-Process -filepath explorer.exe -argumentlist "\\server\share\$make\$model\$env:computername"
cmd /c pause | out-null
}

$modelpath = "\\server\share\$make\$model"
if (-not (Test-Path $modelpath)) { 
New-Item -ItemType directory -Path "\\server\share\$make\$model"
}

write-host "Running DontSleep to keep machine awake during backup operation..."
Start-Process -filepath DontSleep.exe

New-Item -ItemType directory -Path "\\server\share\$make\$model\$env:computername"
$date = Get-Date
"$env:computername,$date,\\server\share\$make\$model\$env:computername" | Out-File -Append "\\server\share\Recent backups.csv"
wbadmin start backup "-backupTarget:\\server\share\$make\$model\$env:computername" -include:c: -vssFull
cmd /c pause | out-null
exit

Using certificates as applications in SCCM

This is more for my own benefit, although some may find this useful.

Here is how to import certificates using the Application model in SCCM.  This also includes some basic errorlevel handling.

First, create an Application as a Script Installer, then use the following batch script as the installation command (e.g. save as InstallCertificate.cmd).


@echo off
setlocal
if exist "\\server\share\%COMPUTERNAME%.pfx" (
echo Cert exists for this endpoint. >> C:\logs\cert_install.log
certutil.exe -f –p CertPassword1 –importpfx "%~dp0\%COMPUTERNAME%.pfx" NoExport >> C:\logs\cert_install.log | findstr "ERROR_INVALID_PASSWORD"
if '%ERRORLEVEL%'=='0' goto password2
exit /b
:password2
echo First password invalid - trying second password. >> C:\logs\cert_install.log
certutil -f –p CertPassword2 –importpfx "%~dp0\%COMPUTERNAME%.pfx" NoExport >> C:\logs\cert_install.log
)

(In this example, there were two passwords defined depending on who made the certificate in our environment, hence the errorlevel checking to verify passwords)

The detection method of the Application is then defined as a Powershell script:

Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*$env:computername*"}

This will check to ensure the hostname of the computer exists in the Cert store (which is how this particular certificate is installed).  Another variant would be this install script (InstallCertificate.cmd example):

@echo off

if exist "\\server\share\CertName.cer" (

echo Certificate found >> C:\logs\cert_install.log

certutil -addstore root "%~dp0\CertName.cer" >> C:\logs\cert_install.log

)

The detection method for this example would be this Powershell script:

Get-ChildItem -Path Cert:\LocalMachine\Root | Where-Object {$_.Subject -like "*CertName*"}

The "CertName" in this example would be the exact name of the certificate listed in the store.

I have yet to make an uninstall script for this Application since in our environment it wasn't necessarily needed (and I didn't want users to have the power to remove the cert in the first place).  However, the script would most likely need a minor change in InstallCertificate.cmd from "-addstore" to "-delstore" in the second example.

Silent install of Installshield applications in SCCM

I have had Installshield applications come up time and again, and not much documentation (or few and far between) based on how to silently install them.  Therefore here is my tutorial on how to silently install them properly with ConfigMgr.

1. Identify if the application is InstallShield-based or not.  You can do this usually by running the setup or installation exe file manually.  If the setup wizard says InstallShield, you're golden.

2. Copy the Installshield application source file(s) to your SCCM file share.  Most of the time, they will have a setup.exe and no MSI file, although there are sometimes MSI files alongside the setup executable - it's usually better to follow this tutorial than add the MSI file due to extra requirements needed by the application's setup.
3. Install the application in "Record" mode.  This is done to generate a setup.iss file.  Open a command prompt in the folder of the application's source files.  To do this, open an Explorer window, navigate to your SCCM server's file/application share, then to the folder of the application source files.  Hold Shift, then right-click a blank area of the folder, then click Open command window here.   Type the following at the cmd prompt:
setup.exe -r
4. Install the application as you would normally for every user in Record mode.  When the application setup finishes, the setup.iss file is generated and placed in the C:\Windows folder of the computer it installed on.  Copy this file to your application's source files folder on the SCCM share.
5. Create an installation bat file with the following (general) contents:
setup.exe -s -f1".\setup.iss" -f2"%TEMP%\Appinstall.log"
Save the file as install.cmd (or install.bat) into your SCCM's application share folder.  This install.bat can be run normally to perform a silent (unattended) install of the application.
6. Add the application using the SCCM Console.  Be sure to specify it as a Script installer when adding the application.  For the command line, enter install.cmd (or install.bat).
7. Determine the Detection Method.  This can be based on MSI (if there was an optional MSI with the application), or on Registry key.  I have had to do a few Registry detection methods loosely based on the following:

8. Finish the Add Application wizard, then deploy to a Collection.  I usually deploy to a test collection to install from Software Center before deploying to any others.

If there are any install errors in Software Center, check the log file on the endpoint by opening the %TEMP%\Appinstall.log file generated from the installation (specified in Step 5).

Remove all old versions of Java with PS AppDeploy Toolkit

Here's the script to uninstall all old versions of Java (while installing the newest version) using the Powershell AppDeploy Toolkit:

Remove-MSIApplications -Name "J2SE Runtime Environment 5.0"
Remove-MSIApplications -Name "Java(TM) 6 Update"
Remove-MSIApplications -Name "Java 7 Update"
Remove-MSIApplications -Name "Java 8 Update"