Configuration on Much Ado About IT

DSC vs. GPO vs. SCCM vs. MDM (Intune)

Julian Knight — Sat, 18 Jun 2016 17:42:13 +0000

Microsoft Windows administrators now have a number of ways for managing their estates.

Group Policy (GPO)

Allows very fine-grained control over every aspect of Windows. Primarily aimed at Windows desktops. Requires Active Directory (AD) and very careful configuration. Requires well trained specialist staff to get it right.
System Center Configuration Manager (SCCM)

Allows central control over software delivery. Also requires AD. Configuration of delivery packages can be complex and very careful change control is required. Software delivery via SCCM can also be intrusive to users. Requires well trained specialist staff to get it right.
Desired State Configuration (DSC)

Though extended by Microsoft this is actually part of a wider open standard “Open Management Infrastructure” and so applies to other platforms as well including Linux. Mainly aimed at server configurations. Falls into the DevOps camp as it defines server configurations in purely text format and so can be put under source control easily. DSC is typically dynamic and enforces the correct configuration (normally every 15 minutes) which greatly helps ensure secure configurations.
Mobile Device Management (MDM)

Primarily aimed at mobile devices, this style of configuration is increasingly applicable to Windows Desktops with the advent of Windows 10. Microsoft InTune is leading the way with other MDM vendors following on. Not everything on the desktop can yet be controlled this way, even with W10 but many key settings and controls are already available. A much simpler method for enforcing desktop settings than the other methods, it allows fewer administrators and much less specialist knowledge.

The article from FoxDeploy covers the first three of those and lays out the purpose of each. Well worth a read.

What is missing is the 4th method which uses Mobile Device Management tooling. The leading contender for this is Microsoft InTune. However, InTune is really only focussed on Windows 10 (desktop and mobile), it has limited control in other Operating Systems.

Servers only ever exist in a given state. If they deviate or we make changes, we refactor and redeploy. DSC drives it all and the machine will be up and running on a new OS, with data migrated in a matter of minutes.

For all practical purposes, the first true large scale management tool we had for Windows systems in the modern era was Group Policy, or GPO as it is commonly truncated.

Comparatively, SCCM and MDT allow us to we import an image from a Windows install disk and then run dozens of individual steps which are customized based on the target machines platform, model, office location and other factors. The sky is the limit.

Curated from DSC vs. GPO vs. SCCM, the case for each. – FoxDeploy.com

Update 2018-05-04 - Intune and Autopilot

It should be noted that Intune is now much more capable than when this was originally written.

Intune now has mobile device management that easily rivals any of the other MDM tools across all platforms. It is also well able to manage Apple OS X as far as Apple actually allow remote management of this type (they provide only a restricted set of API’s unlike Windows).

It should now be possible to manage and configure Windows desktops (at least Windows 10) just using Intune via the Cloud without any input from the other tools.

Intune coupled with Microsoft Autopilot provides a massively powerful and attractive set of tools for the deployment and configuration of Windows 10 based devices.

Autopilot lets you ship devices straight from the manufacturer to the end user with no build needed. The user only requires a broadband Internet connection. Devices are unboxed by the user and connected to the Internet. The user logs in with their cloud identity. Intune “knows” which organisation the device belongs to and begins configuration. The whole process takes about 10 minutes to give a device that can browse the Internet and 1 to 2 hours at most before all local client applications are installed and configured (in the background) depending on the complexity of your configuration.

Site updated – Faster and better!

Julian Knight — Fri, 15 Jun 2012 22:56:54 +0000

The upgrade of this blog from WordPress 3.3 to 3.4 on Dreamhost didn’t go as smoothly as planned. In fact it failed fairly spectacularly – unable to complete the required database upgrade.

However, many clouds have silver linings. In this case it meant that I brought forward my plans to ditch the horribly slow hosting provided by Dreamhost in the USA and switch over to the new VPS provided by BHost in the UK.

If you have had the chance to compare the two sites, you’ll know that it now runs a lot faster. It will improve again when I do some tweaking. I can now use a proper opcode cache for PHP, something that Dreamhost wasn’t able to provide.

I’ll be doing further optimisations now that I have full control, I should be able to do away with a whole load of WordPress plugins.

Speeding up Cygwin

Julian Knight — Wed, 15 Jul 2009 14:54:00 +0000

Yesterday I mentioned my success with Cygwin. One issue I did have though was with the speed of startup. It was taking 15-20 seconds to start a BASH shell. It turns out that this was a PATH issue. I went through my Windows PATH and cleared out the clutter. Now it takes just around 3-4 seconds for a full BASH login and less still for just running a script. I now find myself using the BASH shell for all sorts of things and I’ve set up a number of alias’s to switch to folders I’m using a lot and to open common documents. One handy function I’ve added to .bashrc (so it is always available) works out the current working version of a document. It assumes that you keep copies that have a version number or date in the file name that will sort correctly. You can find the code on my development blog. Here are a few more alias’s I use:

How-to show a Message of the Day (MOTD) at the Windows Command Prompt

Julian Knight — Tue, 12 May 2009 22:33:00 +0000

One of the features available under UNIX is the Message of the Day (MOTD). This is run every time you start a command prompt and displays the content of a file. In addition, the UNIX shells allow all sorts of stuff to be run and configured every time you start a new prompt using the .profile and .bashrc command files.

Windows users don’t generally expect that kind of flexibility from their command prompts. However, Windows does indeed support the use of an autorun into which you can shoe-horn any command you like.

So for my standard setup, I make the shell autorun run a .profile.cmd file that sits in the %USERPROFILE% folder. From that file, I can run anything I like.

To set up a shell autorun, you have to edit the registry so the usual warnings to be careful and back things up apply.

There are two locations you can set, one for the machine as a whole and one for the logged-in user.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Command Processor

If you want to set an autorun for another user, you need to go down HKEY_USERS and find the appropriate one. It is really easier just to log in!

In one or both of those locations, add a new “String Value” (REG_SZ) called AutoRun with the value:

%USERPROFILE%\.profile.cmd

Now create that file and put in a message such as:

@echo "Hello and welcome to my command prompt"

Save the file and open a new shell and you should see the message just after the Microsoft copyright.

This should work on all versions of Windows at least from XP onwards.

If you want to add this to a batch file to set up new machines, here is the command you need:

reg.exe ADD "HKLM\SOFTWARE\Microsoft\Command Processor" /v AutoRun /t REG_SZ /d ^%USERPROFILE^%\.profile.cmd /f

(Note that the above needs to go on a single line)

Updates

2018-04-22 - Tidy formatting, reformat for Hugo output.

Technorati : Batch, Configuration, Scripting, Vista, Win7, Windows Diigo Tag Search : Batch, Configuration, Scripting, Vista, Win7, Windows

Keeping Control: File and Folder Links for Windows Users

Julian Knight — Mon, 27 Apr 2009 21:12:00 +0000

A good backup strategy for any computer involves keeping control of where stuff is stored. The fewer locations that contain files that change, the fewer locations have to be maintained. UNIX users have always had the ability to keep things wherever they wanted and then to LINK that information into the required location. Basically, links create a link or tunnel between one file or folder and another. Most of the time, you will not notice that you’ve entered a tunnel and you are not interested really. Windows users, however, have always been the poor cousins here. Stuck as we were in FATland, we had no access to fancy features such as links. So Microsoft in their inimitable fashion created a poor-man’s link – the Windows Shell Shortcut – so that the Windows GUI had some minimal capability (really only for menu’s and Windows Explorer). Windows 2000 improved on this by introducing “Reparse Points” one form of which is the “Junction“. This is an extension to NTFS that allows folders to be joined (linked) to another location in the local volume space. Making junctions is not an obvious process, you can do it from the disk manager and there is a tool in the Windows 2000 server resource kit called linkd. The POSIX tools included in the resource kit contain the UNIX command ln which can also create junction points and hard links; fsutil in XP can also. There are some third party tools too. It’s odd because I seem to remember that OS/2 had some kind of linking feature. Anyway, links of the UNIX type are a massively useful feature that has finally (with Vista, Windows 2008 and beyond) made it fully to NTFS and Windows. Vista, Windows 2008 and Windows 7 all have a command line tool called mklink. This can be used like the Unix ln command to create both hard links (which must be on the same volume) and soft links. Soft links under Windows can, in fact, span across SMB network drives as well. You might also like to look at another free tool called “Link Shell Extension” by Hermann Schinagl. This integrates into Windows Explorer, the web site also has a more complete explanation of the history of links in Windows. LSE does a number of clever things and is well worth a look. Hermann also has a “dupmerge” tool on his web site that will replace duplicated files with hard links. So now, if we want to tweak the HOSTS file for example (c:\windows\system32\drivers\etc\hosts), we don’t need to leave in place since that would mean that we would need an extra backup routine. Instead, copy it to somewhere that already gets backed up. Delete the original file and then from the command line:

Now you can edit the hosts file from either location, there is only one file (in %USERPROFILE%\BACKUPS). The difference being that even if you delete the file from its normal location, it will still exist in the “real” location. If you delete it from its “real” place in BACKUPS of course, the link will be broken and wont work. To link a complete folder, it is the same command with a /D parameter added. For example, I keep a folder of command line utilities such as ls, ssh and rsync in a folder on a USB pen drive. I sync that folder to the BACKUPS location on my hard drive for convenience but I need the folder in my PATH otherwise its hard to execute the utilities. I don’t want a really long path, it’s bad enough already, so I link the folder to c:\cmd with the following:

Now I add c:\cmd to the path and the utilities seem to be in both places. I’ve said in other posts that I like to reinstall Windows now and again but it can be a pain to restore all of the document files. Similarly, if you keep multiple operating systems on your hard drive, how do you keep your documents sorted? One way is to put all documents, videos, music, etc. onto a separate partition. Now, instead of going mad with the Windows registry trying to relocate your normal documents folders to another drive. Simply delete the normal documents folder – %USERPROFILE%\Documents\ under Windows 7 and relink it to the appropriate folder on the other drive as so:

Put this in a script that you run when you reinstall Windows and its easy and quick. One final note. You may find a few pieces of software that cannot cope with links. Certainly Subversion cannot though Bazaar can. Windows Explorer seems OK though as do utilities such as RSYNC.

Technorati : Backup, Batch, Configuration, Scripting, Vista, Win7, Windows Diigo Tag Search : Backup, Batch, Configuration, Scripting, Vista, Win7, Windows

Copy and Paste to OneNote (AutoHotKey script)

Julian Knight — Wed, 01 Apr 2009 09:05:00 +0000

After yesterdays OneNote tool post, I thought I’d do another while I think about it.

Another annoyance of OneNote is it’s lack of control over pasting information from the clipboard. I’ve raised a suggestion with MS to improve this; you can see my comment in the newsgroup.

To ease things a little if you need to copy and paste lots of stuff to OneNote, here is an AutoHotKey script to help. You need to assign this to a hot-key and have OneNote open in the background. Select something and press the hot-key and it will be pasted (using the current default paste option as this cannot be controlled) into the current note in OneNote.

AutoHotKey Script to copy pre-selected stuff from the currently active window
; to the currently open note in OneNote
;
; Usage: #include in your main AutoHotKey.ahk assigned to a hot key
; Limitations:
; 1) OneNote must be open - maybe change this in the future so that content goes to a new unfiled note
; 2) Doesn't swap back to original application
;
; Author: Julian Knight, http://www.knightnet.org.uk/contact.htm
; Version: 2009-04-01 v1.0

; We need a partial title match but we will also reset to previous setting
oldTitleMatchMode := A_TitleMatchMode
SetTitleMatchMode, 2

; Settings
winTitlePart := " - Microsoft Office OneNote" ; Partial title of ON windows

; Copy currently selected stuff
SendPlay, ^c ; Use sendplay to avoid unexpected interactions with Win key

; If OneNote is not started, give up
IfWinExist, %winTitlePart%
{
 ; Save the currently active window title
 WinGetTitle, actWin, A

 ; If OneNote is not active, activate it now
 IfWinNotActive, %winTitlePart%
 WinActivate, %winTitlePart%

 ; Check again, if ON active then paste else error
 IfWinActive, %winTitlePart%
 {
 ; Paste to ON &amp; Add some blank lines
 SendPlay, ^v`r ; Use sendplay to avoid unexpected interactions with Win key
 ; Switch window back to previously active
 WinActivate, %actWin%
 }
 else
 MsgBox, Could not activate OneNote window.

} else
 MsgBox, Can't find ON [%winTitlePart%]

SetTitleMatchMode, %oldTitleMatchMode%
return

Technorati : AutoHotKey, Configuration, Development, Microsoft, Office, OneNote, Scripting Diigo Tag Search : AutoHotKey, Configuration, Development, Microsoft, Office, OneNote, Scripting

Setting list item gaps in Microsoft OneNote (AutoHotKey script)

Julian Knight — Tue, 31 Mar 2009 05:58:00 +0000

Although I like Microsoft OneNote and use it continuously, it does have a few failings. One of these is the inability to set the default styles and layout for text. In particular, when you create a new paragraph or list entry in OneNote, the default – non-changeable – setting is to have no white space between the paragraphs. This is very poor design and makes more than a small amount of text quite unreadable. I’ve raised this with Microsoft but who knows if or when it might be sorted. In the mean time, I need a far quicker way of changing this. Currently, I’ve had to:

Select the container with the text I want to format
Use the menu to show the List Task Pane ([alt]o/L)
Mouse click on the text box to change (you cannot tab into it)
Change the 0.00 pt default to something like the 6.00 pt that I prefer
Close the List Task Pane Not nice! Having determined that there is nothing clever that can be done in OneNote, I decided that the old standy “AutoHotKey” would be useful. So I’ve created a script for AutoHotKey that will change the inter-list gap for the currently selected container.

OK, so it’s a bit rough-and-ready but it does save a whole lot of time. I’ve got this in my default AHK script so it is loaded whenever I log in and is activated with [win]z.

Technorati : AutoHotKey, Configuration, Development, Microsoft, Office, OneNote, Scripting Diigo Tag Search : AutoHotKey, Configuration, Development, Microsoft, Office, OneNote, Scripting

Changing system environment variables from the Windows command line

Julian Knight — Tue, 24 Mar 2009 11:21:00 +0000

There are several ways to change global or user environment variables manually in Windows. Most are well known so I wont repeat them here (e.g. in Vista or Windows 7, Control Panel/User Accounts, Change my environment variables). However, sometimes you want to do this from a command (aka script or batch) file. This is not as straightforwards as it might seem. That’s because if you simply set the variable – e.g. set FRED=JimBob – it is only set while you are in that command file. Once the script has finished, the variable will no longer be set. There are a number of examples of setting system or user environment variables available if you do a Google search but most of them are incomplete – they do not immediately make the new value available to all applications (and particularly to new command shells). To make sure that the new value is available system-wide, you have to tell Windows to refresh the environment variable list and the easiest way to ensure this happens is to change the variable from a [Windows Scripting Host][1] ([WSH][2]) script. Here is an example script to do this. Save this file as something like set-env.vbs somewhere convenient.

Note that in Vista or above, you will need to run the command file with elevated privileges for this to work. The normal command prompt gets this automatically but if you want to run the file from Windows Explorer, you will need to create a shortcut and change the settings. You can now use this in your batch command scripts, for example:

Technorati : Batch, Configuration, Scripting, VBS, Windows Diigo Tag Search : Batch, Configuration, Scripting, VBS, Windows

proxy.pac files, Mozilla (Firefox & Thunderbird) and Vista or Windows 7

Julian Knight — Fri, 27 Feb 2009 08:55:00 +0000

I’ve found a problem with Mozilla based products and proxy settings. To automatically configure a proxy for use by Internet browsers, you can use a file called “proxy.pac“. This is a JavaScript function that is loaded into the browser when it starts and redirects requests via a proxy where required. All of the descriptions for this file you will find on the Internet will provide the following example of checking your current IP address. This is used for laptops where the IP address will change depending on where you are. You can check when the laptop is on the corporate network and redirect requests via the corporate proxy as needed:

Well, this does not work for Mozilla based applications (for example Firefox and Thunderbird) if you are using Microsoft Vista or Windows 7. That is because, under those operating systems, the internal function myIpAddress() does not return an IPv4 address as expected (e.g. 10.10.10.5) but an IPv6 address instead (e.g something longer with lots of “:”). In order to make your proxy.pac file work with both IE and Mozilla, use something like:

You can discover your IPv6 address in several ways but the trusty command line “ipconfig /all” shows you everything you need. See also this discussion on the Mozilla support forums: proxy.pac myIpAddress() returns incorrect format?

Del.icio.us : Configuration, Software, Vista, Win7 Technorati : Configuration, Software, Vista, Win7 Diigo Tag Search : Configuration, Software, Vista, Win7

Font sizes and DPI

Julian Knight — Thu, 17 Jul 2008 06:40:00 +0000

This seems to be a problem that won’t go away. It seems inordinately hard to get a good looking set of fonts of the correct size. It is not that there aren’t some nice fonts available; there are, at last, some fonts under Linux that often look superior to the Microsoft ones. It’s just that it is difficult to get the whole look and feel correct.

This is especially true when mixing Gnome based applications (Firefox and Thunderbird for example) and KDE. OpenOffice also refuses to play nicely.

Anyway, grumping over, there is an excellent [article on the Mozilla site][1] about how to improve some of this by getting the correct DPI settings for your monitor (this is especially noticeable on my 24″ beast!)

The article is [here][1]. [1]: http://www.mozilla.org/unix/dpi.html

Flashing the BIOS from Linux (Phoenix BIOS)

Julian Knight — Mon, 14 Jul 2008 07:30:00 +0000

I haven’t looked at the BIOS on my ageing ASUS A8N-SLI motherboard for ages – in fact not since I switched it fully to Linux – so how do you update the Phoenix BIOS without DOS or Windows? I don’t bother with a floppy disk any more and creating a DOS boot CD just for this once every x years job is a faff!

Well there is an [article here][1] that might help.

Hmm, apparently that article doesn’t really help – except that it tells you ways to create custom bootable CD’s containing DOS, the BIOS updater and the BIOS file. Ho hum, I guess I’ll get round to it soon as I am looking to put a dual core Athlon in the PC which requires a new BIOS. [1]: http://www.cyberciti.biz/tips/howto-flash-your-system-bios-under-linux.html

Changing backspace to go back through history (FireFox for Linux)

Julian Knight — Sun, 06 Jul 2008 14:15:00 +0000

Us old-time Windows bods get used to our keyboard shortcuts I’m afraid. One of the most useful is using the backspace key in the browser to go back through the browsers history.

Unfortunately, this is not the default under Linux (alt-left arrow is the default).

FireFox has an easy way to fix this. Put “about:config” in the address bar and “backspace” in the search entry. You should see the entry “browser.backspace_action”. Change this to 0.

What did I install? (For OpenSUSE)

Julian Knight — Fri, 04 Jul 2008 12:47:00 +0000

One thing that I didn’t get around to doing since I moved from Ubuntu was to work out how to make a note of what has been installed. This is slightly complicated by the fact that you can install stuff straight from an RPM file as well as through YAST (from the repositories or 1-click links). Well, I finally got round to working it out and here is a summary. To see what you have done with the YAST installers, just look at the log! sudo cat /var/log/YaST2/y2logRPM | more But to get everything, use the raw RPM commands: These commands show the last installed rpm packages

rpm -qa --last | more

Grep for a date:

rpm -qa --last | grep "Sun 23 Mar 2008"

Dont forget that grep takes regex’s

rpm -qa --last | grep ^kde

Another way:

rpm -qa --queryformat '%{NAME} - INSTALLED - %{INSTALLTIME:date}\n'

Or maybe:

rpm -qa --queryformat '%{installtime} %{name}-%{version}-%{release} %{installtime:date}\n' | sort -nr +0 | sed -e 's/^[^ ]* //'

UPDATE 2008-07-18: I don’t know if this feature was available prior to OpenSUSE 11.0 but you can now use the Software Management tool in YAST to generate a nice, XML list of all installed packages. Switch the filter to “Repositories” and select the “@System” repo. Then choose the menu “File/Export”. Very useful.

What Linux system files might need editing?

Julian Knight — Wed, 02 Jul 2008 04:08:00 +0000

Whilst great strides have been made by the Linux community to provide GUI’s for many tasks, it is still a command line driven OS at it’s heart. This, of course, is one of its strengths as everything can be scripted too. However, for none IT techies, it is very daunting. Here I’m listing some of the system files I’ve had (or at least wanted) to change by hand. It’s a very quick reference, largely for my own benefit should I need to rebuild my system.

/etc/X11/xorg.conf

Even now you might need to hand crank this file to get all of the settings you need
/etc/bash.bashrc.local

SUSE does not include /sbin in the default path
/etc/cups/cupsd.conf

Printer server subsystem (CUPS) configuration – may need to tweak the access permissions
/etc/cups/mime.types

Added some stuff to speed up printing from the FireFox web browser. See the [article on Google Answers][1] for details
/etc/fstab

What and how disk partitions get mounted at boot time – may need to change permissions or may wish to remove certain entries
/etc/host.conf

See nsswitch.conf
/etc/hosts

Useful to override host name to address mappings for development and testing work
/etc/motd

What people see if they log in to your system using a command line shell
/etc/nsswitch.conf

Controls how network names are looked up. Tweaking this can make DNS lookups a lot faster
/etc/samba/smb.conf

Configure access to Windows type resources on the host machine
/etc/samba/smbfstab

Configure if/how the host system automatically mounts Windows resources from other machines so that they appear as Linux mounts. Use this rather than /etc/fstab if you want the embedded password only visible to the root user
/etc/sudoers

Which users can sudo. You can also configure particular applications to automatically get sudo privaledges if you want to (hint: it is rather nice to set up a script that updates all installed software packages)
/etc/sysconfig/network/ifcfg-br0

If you want to bridge two network interfaces (see the last post for information on why you would want to do this), you have to set things up by hand
/etc/sysconfig/network/ifcfg-eth1

SUSE has an excellent GUI for managing network interfaces but just occasionally you might need to manually tweak one
/etc/sysconfig/network/routes

The SUSE network configuration GUI seems to have a tendency to loose the default route
/etc/syslog-ng/syslog-ng.conf

Configure logging levels
/etc/syslog.conf

As above
/etc/udev/rules.d/50-udev-default.rules

UDEV handles automatic creation of device files based on event rules. On my system I had to tweak the permissions on a USB scanner so that the scanning software [VueScan][2] could get access. You can also add rules to run scripts when certain hardware is detected.
/usr/NX/etc/node.cfg

Configuration for the [NX server][3]. [NX][3] is a method of getting remote access to the screen of a machine.
/usr/NX/etc/server.cfg

As above This list applies to a desktop machine running OpenSUSE 10.3 It is quite likely that some of these files do have a GUI but sometimes it is just easier to get in there and edit. [1]: http://answers.google.com/answers/threadview?id=579755 [2]: http://www.hamrick.com/ [3]: http://www.nomachine.com/

Fast storage using tmpfs

Julian Knight — Mon, 17 Mar 2008 05:00:00 +0000

Here is a link to an article on using tmpfs (and the commonly pre-defined /dev/shm mount for tmpfs) as a high-speed, in-memory filing system. This is very handy for small-ish amounts of data in files that get a lot of access. Just remember that you will loose it if the host crashes! You can use this for SqlLite database files too. [Create turbocharged storage using tmpfs][1] [1]: http://kevin.vanzonneveld.net/techblog/article/create_turbocharged_storage_using_tmpfs/