Sending out Wireless Settings via GPO with Key

Microsoft are an interesting bunch. When it comes to wireless settings deployment they tend to forget that wireless networks have a passphrase required in order to connect. They provide you with tools to setup wireless profiles on machines yet don't allow you to deploy the wireless key via group policy.
You can sort of understand it from a security point of view, it is probably against some form of policy to dish out wireless keys to your users but it does mean its us poor buggers that need to manually type the key into each machine before allocating them out to members of staff or putting them in trollies for the pupils. (That is if you don't use imaging, such as Ghost/MDT/Ping)
Now after a hell of a lot of Group Policy searches via Google, there doesn't seem to be anyone who has bothered to write out a step by step guide on how to send out a wireless setting with the key pre-installed. So here I go, finally solving this damn issue that has tormented god knows how many people. The beauty of this method, is that it is Microsoft Approved, as you don't need any third party tools to do this. :)
Here we go.

1. First you need a machine, ideally freshly built, no crap on it. Windows 7 of course.

2. You need to set this machine up connected to the desired wireless connection you want, in this example we are going to say the SSID of the school is: ITMagic_WPA.

So join your network and type in the wireless key, in this example we shall say the wireless key is: NoWires12345

3. Once connected to the wireless, if you want to play around with certain settings like Infrastructure only etc, do it now. This method being taught will also allow for these customisations to be exported to :)

4. So now we have a fresh Windows 7 machine, connected to our wireless network ITMagic_WPA with the network key NoWires12345 correctly implemented.

5. Now we export it using Microsofts own NetSh Command line.

(You might be turning away now, thinking i've tried this route and didn't succeed, but if you are like me, you probably didn't have time to play with it enough to understand it. Well I found time and with a little scripting experience behind me, I figured it out. I still haven't found a website that tells you this part.)

Go to Start, type Cmd and open that black window of power. - (just open command line)

6. Type in
Netsh Wlan Show Profiles
You will be presented with a list of all the "Wireless Profiles" stored on your machine, if you have only connected to one network, you will have a massive list of.. one.

Nine times out of ten, this profile name is identical to your wireless SSID. So lets say I did it with my example profile, the command line would come back with the result:

User Profiles
===========

all user profiles : ITMagic_WPA

Well now I know the name of my profile, I can export it. Of course I don't just export the name, I export everything, the name, the key and any extra settings I might of set.

7. To export type in:
Netsh Wlan Export Profile Name="ITMagic_WPA" key=clear

Remember to obviously replace my example with your profile name.

8. By default, this command will save this file to the ".\WirelessConnectionName" , basically, this location is found in C:\Users\YourLoggedInUser\ folder.

9. You will find an xml file named something like Wireless Network Connection - SSID.xml, so mine would be Wireless Network Connection-ITMagic_WPA.xml. Or something like that, depends if your machine is untouched and fresh.

Save the xml file to a shared area where people have access to, lets say the netlogon folder just to keep things simple, I mean if you have a designated Scripts Share on your server, by all means stick it in there, but remember to change the below script to suit your network.

14. Right, so i've saved my XML file as a shorter name called "WirelessConnect.xml" and saved it to the
\\dc-01\netlogon folder

15. In the netlogon folder, create a txt document and type in the following script:

IF EXIST C:\WirelessSet.txt GOTO _ENDNetsh wlan add profile filename="\\dc-01\netlogon\WirelessConnect.xml" user=all >>C:\WirelessSet.txt:_END

Just make sure your UNC path, points at the xml file in your share.

16. Save this file as Win7Wireless.bat or something like that

17. Go to group policy, and set this wireless script to run at start up for all the wireless 7 machines on your network, once run, it won't rerun providing there is a file called WirelessSet.txt on the C:\ on that computer.

Your wireless is now deployed, with a key.

Hope this helps a few people!!

Dell Optiplex 390 fails to apply GPO settings

At work we have been deploying Dell Optiplex 390’s with XP using an MDT task sequence, the build works perfectly however once the machine attempts to apply group policy we have failures, this causes the machine to fail to install allocated msi packages. Obviously not a great situation to be in.
Following some research I have found that the issue appears to occur mostly in situations where a client is using a Gig speed network card and where network connections are teamed. The issue appears to be caused by the network card switching between speeds and full/half duplex to find the mode it can operate at. By adding a registry key we can prevent this checking from happening which will provide a more stable connection during the all important startup process.
This solution has been tested to work in our environment, obviously your mileage may vary and if you choose to make this change you do so at your own risk, playing with the networking settings in Windows may break more than it fixes however in our testing this has been an easy and successful workaround.

The key details are as follows
Key Location : HKLM\System\CurrentControlSet\Services\Tcpip\Parameters
Key Name : DisableDHCPMediaSense
Key Type : Reg_Dword
Key Value : 00000001

These settings can either be added using a reg entry or a command line as follows

reg add HKLM\System\CurrentControlSet\Services\Tcpip\Parameters /v DisableDHCPMediaSense /t REG_Dword /d 00000001

In our case we have added a command line near the end of our task sequence which we have filtered using WMI in a way similar to the one we used in a previous post. In this case the WMI filter we used is as follows

Select * from Win32_ComputerSystemProduct WHERE Name LIKE "%Optiplex 390%"

Again we are running this against the root\cimv2 namespace. This query could be repeated in the task sequence options filtering for additional hardware which exhibits this particular issue, thereby allowing you to keep a smaller number of task sequences in your deployment share.

Update : 29-06-2012

We have begun rolling out Samsung N200 laptops, these also exhibit the issue with needing DHCPMediaSense to be set, for ease of use here is the WMI code needed

Select * from Win32_ComputerSystemProduct WHERE Name LIKE "300V3A/300V4A/300V5A/200A4B/200A5B"

Reference:

Technet User Discussion

Serverfault Question

Dell Laptop freefall sensor driver kills MDT Win XP

 

We have been building a large number of Dell Latitude E5410 and E5420 laptops using an MDT task sequence to install Win XP. The task sequence does not use a wim file for xp but is effectively the same as running a RIS style setup process.

We downloaded the driver pack which Dell make available for the E5420, in theory this contains all drivers needed in a single cab file, however we encountered an issue in that during setup the installation WMI either got corrupted or failed to install. Since MDT needs to use WMI in order to run this left us with a partly installed XP machine which fails to complete the task sequence. This issue did not present itself when we ran a test build with Windows 7.

As part of our troubleshooting we manually downloaded the drivers individually and added them to MDT, we missed the ST Microelectronics Freefall sensor as it was wrapped up in an installshield exe file but the task sequence completed succesfully. Helpfully Dell included a readme with the exe file which explained that we could run the setup.exe with the /s switch and this would allow a silent install with no reboot when done.

Using this information we imported the setup file into the MDT Deploymentshare as an application then added it near the end of the task sequence. In order to not need an extra task sequence just for the laptops we edited the options for the application installation step and added the filtering options to only apply if true and used a WMI query to test for the model type. The WMI query used is as follows

WMI Namespace : root\cimv2

WQL Query : Select * from Win32_ComputerSystemProduct WHERE Name LIKE "%Latitude E54%"

 

Query entry dialog box

Completed query entry in task sequence options.

 

Using these settings will allow the installation of Windows to complete leaving you with a fully working WMI installation and all of the drivers to give you a nice clean Device Manager.

Deploying Drivers

Have you ever just finished building a load of PCs, to have someone come up and ask for some dodgy piece of hardware to be installed on all PCs, and the drivers required are unsigned, and aren't pre-packaged in an easily deployable silent package or MSI. Or you've been given some dodgy new hardware (you know the companies I'm talking of), to install.

Well its easier than you think to deploy drivers as either a script or as part of an MSI package. I am assuming that you, the reader, are capable of writing a script and/or creating a suitable MSI, so I will not insult your intelligence by giving you a completed script/msi. If you're anything like me (God help you if you are!) you'll learn better by doing, rather than seeing.

Anyway, by using a small executable provide by Microsoft, DPInst.exe, available as part of the Windows Driver Kit (WDK), Download available here, we can indeed make drivers available on any windows OS system, to be installed as and when needed.

Once you have download and installed the WDK (btw you only need to install the tools part), you can find different architectural/language versions of the DPInst.exe in C:\WinDDK\7600.16385.1\redist\DIFx\dpinst (assuming you install to the default location, and the version number hasn’t changed since writing).

Place the correct version of DPInst.exe in with your driver .inf files. If you were to run the dpinst.exe now, you would be presented with a wizard for installing the drivers onto the system. If you were to step through the wizard, it will complete, but it will only be successfully if the drivers are signed.

However, that’s not what we really want, we need no user interaction at all, and we need to be able to install unsigned driver*. To install any drivers without the end user noticing, call the DPInst.exe with the following commands:

/Q  - This is for quiet install with no user interaction,
/LM – This is for unsigned drivers.

Now the drivers are installed, or technically they are made available to be installed when the hardware is connected. Now if your drivers are signed that is the end of the story, however, if like me, you have been given a host of cheap hardware made in china, with unsigned drivers, you will need to adjust the following 2 Group Policies*:

Computer Configuration>Windows Settings>security Settings>Local Policies>User Rights Assignment:
Policy: “Load and unload device drivers”
Setting: DomainName\Domain Users

User Configuration>Admin Templates>System>Driver Installation:
Policy: “Code signing for device drivers”
Setting: Enabled – ignore

Click here for a full overview of DPInst, and here for a full list of command switches.

* Please note that installing unsigned drivers and/or modifying Group Policy is done at the readers own risk, and the writers of “Thoughts of a Primary School Tech” are in no way responsible/liable for any loss/damage caused to any system(s) by following the instructions provided here. Whilst every effort has been made to ensure this works correctly on any windows system, your milage may vary.

Adobe Reader 10 cannot open pdf from UNC path

If you have deployed Adobe Reader 10 and get messages saying that your users cannot open .pdf files from a network location the likely culprit is that protected mode is enabled.
You can turn this mode off using a registry edit as below:

Registry Editing Method
Open notepad and paste the following command, when pasted save as a .reg file.

REG ADD "HKCU\SOFTWARE\Adobe\Acrobat Reader\10.0\Privileged" /v bProtectedMode /t REG_DWORD /d 0 /f

Alternative Method

If using Server 2008R2 you can set a preference to make a change to the registry for users as below

Open Group Policy Management from Start > Administrative Tools > Group Policy Management

Create a new Group Policy Object

Give the GPO a suitable name

Right click and select edit

Expand the User Preferences menu option

Expand the Windows Settings and select Registry

In the blank area in the right hand pane right click and select New > Registry Item

Ensure that the settings are to ‘Update’ the registry key, also check that the selected hive is HKEY_CURRENT_USER.

In the Key path enter ‘SOFTWARE\Adobe\Acrobat Reader\10.0\Privileged’

Enter ‘bProtectedMode’ into the Value box

Change the value type to REG_DWORD

In the value box enter ‘0’

Click OK and you are done.

This is how the finished registry entry should look.

Older Smart Boards with Windows 7 x64

Some Smart boards back in the day came didn't want to be that easy and decided to use a "USB-Serial Controller" device to connect to your computer. Now in Windows XP 32bit this came within the standard Smart Drivers you can easily download from SmartTech, but unfortunately with a 64bit operating systems, especially Windows 7, this device commonly is not found within this driver pack and needs to be sourced via a third party.

Luckily with help from a blog from Visible Procrastinations there is a easy solution to this.

Installing a fresh copy of SMART Notebook 10 doesn’t load the drivers for this adapter, and Windows ‘yellow triangles’ the device as an unknown ‘USB-Serial controller’. Reading the technical bulletin, we should be able to install the driver from the original SMART Board ie. D:\STI2303X.inf – unfortunately this is not the case.

Having a look at the properties of STI2303X.sys which is the driver that should be being loaded we find;

* Original File name: USB2SER.SYS
* Product Name: PL-2303 OnlyUSB Link Cable

A quick search on Google and we can acquire drivers from the Prolific support site.;

PL-2303 USB to Serial Bridge (H, HX, X) Installshield Driver Setup Program
Installer version & Build date: 1.3.0 (2010-7-15)
Windows 98/ME Driver: v2.0.0.19
Windows 2000/XP/Server2003 (32 & 64-bit) WDM WHQL Driver: v2.0.13.130
Windows Vista/7/Server2008 (32 & 64-bit) WDF WHQL Driver: v3.3.11.152
Language Support: English (default), Chinese (Traditional), Chinese (Simplified), Japanese
For Prolific USB VID_067B&PID_2303 Only

Now in device manager, right click your problem driver and manually source the inf file from the following directory.

C:\Program Files (x86)\SMART Technologies\SMART Product Drivers\PNP Drivers\HidBoard.inf

And we have a working SMART Board.

Update: Recently I have discovered that the 10.8 version of this software is slightly different in where it stores its drivers. If this solution does not work, try to use the drivers included within the orginal install that are hidden in "C:\program files (x86)\SMART Technologies\Drivers\x64" (or x86 if you're on a 32bit machine). It was just by pure luck I found this worked.

Group Policy Setting - Verbose vs normal status messages

During a major roll out of software using Group Policy on a Windows 7 Client System, I had cause to want to know what was happening during the roll out, to see if any software was sticking. To enable more detailed messages on screen (other than "Please Wait") enable the following in an appropriate GPO:

Computer > Policies > Administrative Templates > System > Verbose vs normal status message

This setting displays a number of extra status messages during the start up and shutdown of the computer and when the user is logging on and off. Some of the verbose status messages you will see are (but not limited to):

Software Deployment
Mapping Drives
Playing Logon Sound
Mapping Printers
Applying Power Settings
Stopping Services

You will still see your Applying Computer settings and Preparing Desktop messages however these will be shown for a lot shorter time.

Also by enabling this option end users think that their PC is faster, due the reduced time each message is displayed. It certainly seems to speed it up for me anyway. This is still a handy setting to enable as at the very least will help your IT support troubleshoot log on performance issues.

This setting will work on Windows 2000 and above and it will also show the processing of newer Group Policy Preferences.

Original Source:
http://www.grouppolicy.biz/2009/11/group-policy-setting-of-the-week-2-verbose-vs-normal-status-messages/