Click on Pictures to View

To view a larger version of an image within a post, just click on the picture you want to view :)

Wednesday, December 16, 2015

PsTools & PsExec

If you haven't checked out the PsTools suite yet, go look it up (download link is at the bottom of this post).  It contains several handy tools to work on other machines remotely via command prompt.

My favorite and most used PsTool is psexec.  Psexec allows you to execute commands from a command prompt for another machine.  There are two methods to do this -

From an elevated command prompt (right click command prompt & run as administrator):

             psexec \\JenniPC -s cmd.exe

Replace JenniPC with the name of the remote machine you are trying to run the command on.  The
-s causes the command to be run under the System account.

This command changes the command prompt window to be connected instead to the remote machine.  For example, after running this command, if you run the command hostname it should return the hostname of the remote machine.  Cool, huh?

If you don't want to open/change the command prompt, you can just add your specific command to the end of the psexec command line.  For example:

        psexec \\JenniPC -s ipconfig

This runs ipconfig on remote computer JenniPC and returns the ipconfig output for that machine in the DOS box.

There are a few GUIs out there you can get for the tools, but none of them are perfect.  For example, FrontEnd for PsTools is good, but if you try to run ipconfig under the psexec it doesn't return the correct output - or any output for that matter.

Knowing how to navigate and use a command prompt is a neat skill to have so learning how to use PsTools from cmd.exe is worthwhile and more fun anyway in my opinion.


Resources:

PsTools Download:  https://technet.microsoft.com/en-us/sysinternals/pstools.aspx

FrontEnd for PsTools:  http://www.davitools.com/fepstools/

PsTools GUI: http://sourceforge.net/projects/pstoolsgui/

Tuesday, November 17, 2015

Global Address Book Not Available in Outlook 2013

Symptoms:  User cannot view shared calendars
                    Cannot check network address contacts / network address book not viewable
                    Outlook won't send email to contacts not in local Outlook email contacts address book
                    Offline address book for cached account was missing in computer files
                    User can send mail to network addresses in the OWA ("Outlook Web App") successfully

Solutions Attempted:

- Attempted to download the global address book from File -> Account Settings -> Download Address Book (default global address list did not show as an option to download)
- Shift + Ctrl + B to open the address book, did not show global address book in Address Book list or in Tools menu -> Options for address book
- Start -> Run -> Outlook /safe command to open Outlook in Safe Mode, but still showed same symptoms.

Resolution:

- Found a Microsoft article that directed me to delete a registry key.  Navigated to here for Outlook 2013:

HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\<profile name>

Then searched for the 001e660e registry entry.

Upon deleting this entry everything began working normally.

The user was then able to download the network address book, view shared calendars, and send mail to addresses in the global address book.


SOURCE:

https://support.microsoft.com/en-us/kb/3031401

Thursday, October 15, 2015

SCCM 2012 Query: Installed Application Version

Hello,

So I ran into this today - needed to find all machines in SCCM 2012 that have Microsoft Office 2007 installed but do NOT have service pack version 3 (SP3).

I created the query mentioned below and confirmed that this returned the correct machines by comparing with a colleage's different query version for the same task and checking samples of the machines' Office versions in Resource Explorer.

Here's the method:

In SCCM I looked up a machine that I knew had SP3 installed.  I right clicked and Start -> Resource Explorer -> Hardware -> Installed Applications and found the application in question - in this case Office 2007.  Microsoft Office Professional Plus 2007 was seen under the Display Name.  On the far right of the application entry is the version number.  I took note of both of these.

By the way:

Office ProPlus 2007 Service Pack 2 Version Number is 12.0.6424.1000
Office ProPlus 2007 Service Pack 3 Version Number is 12.0.6612.1000

So in my query I did this for the criteria:

Simple Value Installed Applications - Display Name is equal to Microsoft Office Professional Plus 2007
AND
Simple Value Installed Applications - Version is less than 12.0.6612.1000



You can also do "is not equal to" rather than "is less than."

This returned all the machines that had MS Office ProPlus 2007 service packs below SP3.

This process can of course be modified to query for any software listed in the Applications area of Resource Explorer.

Just in case someone wants it, below is the resulting criteria query language from the selected query options shown above.

select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client from  SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName = "Microsoft Office Professional Plus 2007" and SMS_G_System_ADD_REMOVE_PROGRAMS.Version < "12.0.6612.1000"


Additional Resources:

http://www.4kcc.com/How2/sp_version.html

http://pcsupport.about.com/od/keepingupwithupdates/a/office-service-pack.htm


Wednesday, October 7, 2015

Find Product GUID w/ WMIC or Powershell, & Other Useful Commands

Occasionally one needs to know what software is installed and its associated GUID.

There are a few simple ways to acquire this information for .msi's without going line by line through the Uninstall key in the Registry.

First there is the basic wmic method in a command prompt:

wmic product get

This will output a lot of information that is generally hard to look at, but nonetheless shows you the installed programs and their GUIDs if you can muddle your way through it (or output the results to a text file and search from there, which is discussed below)

Second you can simply call only application names and search for the product there, and then run a second command to find its specific GUID.

1) wmic product get name
2) wmic product where name="APPNAME" get Name,Version,IdentifyingNumber

Insert the application name acquired from step one where it says APPNAME (keep the quotes) in step two.


For any of the above commands, you can output them to a text file and or run them for a remote computer on the network.

Output to Text file named InstalledPrograms on C:
wmic product get name > C:\InstalledPrograms.txt

Run wmic command for a remote computer:
wmic /node:COMPUTERNAME {rest of command here}

Replace COMPUTERNAME with the hostname of the machine you want the results from.  Don't remove the /node: part.

Here's a neat trick using Powershell to get the information with output in a neat little table.  In powershell, run:

get-wmiobject -class Win32_Product | Format-Table IdentifyingNumber, Name, LocalPackage

To do the same only for a remote computer:

get-wmiobject - class Win32_Product -computername COMPUTERNAME | Format-Table IdentifyingNumber, Name, LocalPackage

Replace COMPUTERNAME with the hostname of the machine you want the results from.

This line will return all the subkeys and their registry values for the Uninstall registry key.


Get-ChildItem hklm:\software\Wow6432Node\microsoft\windows\currentversion\uninstall | ForEach-Object {Get-ItemProperty $_.pspath}


Other random but useful commands are listed below.

To get hardware information on a remote system (replace COMPUTERNAME w/ hostname):

systeminfo /s COMPUTERNAME

To see the currently logged on user of a remote system (replace COMPUTERNAME w/ hostname):

wmic /node:COMPUTERNAME ComputerSystem Get Username

To get the IP address of a remote system (replace COMPUTERNAME w/ hostname)

wmic /node:COMPUTERNAME nicconfig get ippaddress

FYI - here are the Uninstall reg key locations:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\CurrentVersion\Uninstall

***Many of these commands can take some time especially if done for a remote machine or if there are a lot of applications in question.  You may want to go get a cup of coffee after pressing enter and when you get back you'll have the information you need :) ***


Resources:

http://www.computerhope.com/wmic.htm

http://software-inventory.net/installed-software-audit

https://technet.microsoft.com/en-us/library/dd347651.aspx

http://stackoverflow.com/questions/29937568/how-can-i-find-the-product-guid-of-an-installed-msi-setup

http://betanews.com/2011/01/14/wmic-the-best-command-line-tool-you-ve-never-used/

http://blogs.technet.com/b/askperf/archive/2012/02/17/useful-wmic-queries.aspx

https://technet.microsoft.com/en-us/library/ee176852.aspx

Wednesday, September 30, 2015

How to Install McAfee Agent 4.x on a Mac

Here's a how-to about installing and "awakening" the McAfee Agent on a Mac computer.  McAfee articles and other sources are listed at the bottom.

First log on to the Mac as an administrator

Copy the file install.sh from this location:

<Your McAfee ePO Directory>\DB\Software\Current\EPOAGENT3700MACX\Install\0409

and paste it on the Mac's desktop.

Open a Terminal window (type "Terminal" in the spyglass)

Navigate to the desktop by typing cd desktop and press enter

Type sudo chmod +x install.sh and press enter

Type the administrator password when prompted...

Begin the installation by typing sudo ./install.sh -i and press enter

Type the administrator password again if prompted

The terminal will show notification once the installation is complete.

Wake up the agent by typing sudo /Library/McAfee/cma/bin/cmdagent -p

Enter the administrator password if prompted





Sources and Useful Links:

How to Uninstall & Reinstall the McAfee Agent on a Mac:

https://kc.mcafee.com/corporate/index?page=content&id=KB61125

How to Start, Stop and Restart the McAfee Agent on a Mac:

https://kc.mcafee.com/corporate/index?page=content&id=KB71313&actp=LIST

How to Use Command Line Switches with McAfee Agent on a Mac:

https://kc.mcafee.com/corporate/index?page=content&id=KB52707

How to Start and Stop McAfee Agent Services on Yosemite:

https://kc.mcafee.com/corporate/index?page=content&id=KB83950

Article about Managed and Unmanaged Agents of Macs in the ePO Orchestrator:

https://thegr8thurston.wordpress.com/2010/04/16/managing-mac-osx-mcafee-agents/

Friday, September 25, 2015

Can't Ping VLAN (ELAN) from Outside the Local LAN?

So here's a short post.

I installed a Cisco layer 3 switch and moved all the configs for the local LAN's VLANs, ip routing, from the old switch and router etc. over to the new switch.

Everything seemed fine and dandy upon completion, and I could ping back to Headquarters from the remote site, and could get internet and intranet access, etc.

However, it turned out that Headquarters (or any other remote site than the one where I installed the switch) reported they could not ping the ELAN for that site.
So all data, voice and wireless VLANs for that site were pingable from Headquarters, but the ELAN was not pingable.

Back on site, everything seemed to be working, and I could ping everything from within the local LAN.  It just seemed that from OUTSIDE my local LAN, ELAN was unreachable.


Solution:


I double-checked the EIGRP routing statement on the layer three switch with a simple "show run."
Sure enough the ELAN IP address was missing from the EIGRP statement.

Once I added that in, I was able to ping the ELAN from outside the LAN and it was available for Telecomm's purposes.


So if you can ping inside the network, but not FROM outside the network, check your routing statement!

...also, if you are adding in equipment, make sure your configs are correct!


Short Info on ELANs:

http://www.c-sharpcorner.com/Interviews/answer/851/what-is-a-vlan-what-is-an-elan-what-is-the-difference




Friday, September 11, 2015

Customize Windows 7 Profile for OS Deployment

Here is how I customized the Windows 7 profile for mass deployment using an SCCM 2012 Task Sequence.

After some research, I wrote a .cmd script to modify the parts of the user profile I wanted customized.

The script does the following:

1) Renames old Windows 7 default user account picture filename
  • Ren "C:\ProgramData\Microsoft\User Account Pictures\user.bmp" user.bmp.bak

2) Copies the custom picture from the distribution point to the computer (sets the default account pic)
  • Copy "%~dp0user.bmp" "C:\ProgramData\Microsoft\User Account Pictures" /Y

3) Takes ownership of old Windows 7 default background filename as Administrators Group
  • Takeown /f C:\Windows\Web\Wallpaper\Windows\img0.jpg /A

4) Grant SYSTEM full control of the old default background filename
  • Echo Y | icacls "C:\Windows\Web\Wallpaper\Windows\img0.jpg" /grant "SYSTEM":F

5) Copies the custom picture from the distribution point to the computer (sets the default background)
  • Copy "%~dp0img0.jpg" "C:\Windows\Web\Wallpaper\Windows" /Y

6) Deletes the games folder from the startup menu for all users
  • Rd /s /q "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games"



I put all of those in a notepad text file with REMARK lines between them so I remember what each line does, then saved it as a .cmd file. (The below script also calls a second command script at the bottom)



I then copied all the relevant files that were needed (custom pictures, .cmd scripts, etc) to my distribution point(s).

After verifying that the script would run okay locally, I created a PACKAGE containing the .cmd file in SCCM 2012, and then added an "Install Package" line within my task sequence.

Package:

Task Sequence :


*Don't forget to tick the box that says "Allow this program to be installed from the Install Package task sequence without being deployed" option on the Advanced tab of the package program properties dialog box.

After running the task sequence, the computer had a new custom default profile picture for all local and domain users, a custom default background wallpaper for all local and domain users, and removed games folder from start menu.  The second script also sets the Control Panel view to "Classic" for all users, sets specific Windows icons on the desktop for all users, and sets the specified theme as well (actually, I removed the theme part from the second script because ours is managed via GPO so I don't know how well that part works with the changed background to custom image, or if it overwrites it, to be honest).

With this method of deploying the user profile picture and background, the end user can still opt to further customize their pictures themselves as well.





For further information on the second .cmd script, called in the script I wrote, see this article:

https://www.itsupportguides.com/windows-7/windows-7-default-profile-with-configmgr/


Sources:

https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/1703c3f4-a2ea-4c4a-a73f-a93e6d51b2bb/windows-7-user-profile-creation-overwrites-custom-wallpaper

http://www.askvg.com/simple-trick-to-replace-default-built-in-flower-profile-picture-for-all-user-accounts-in-windows-7/

https://community.spiceworks.com/how_to/22362-how-to-set-a-default-user-logon-picture-windows-7

http://www.bonusbits.com/wiki/HowTo:Change_the_Default_Background_and_User_Image_on_Windows_7e



Tuesday, August 11, 2015

Lenovo ThinkPad Helix 369X Battery Troubleshooting

I kept debating on what I should blog about next, and couldn't decide firmly on any one thing, so haven't written anything in a while.  Until now.

Today I resolved an issue that I want to address in this post related to a Lenovo ThinkPad Helix 369X series with a battery problem.

Some history:  The Lenovo had been dropped and was sent in for a screen replacement.

The symptoms:  Since the Lenovo was returned after repair by the manufacturer, the tablet portion hadn't worked properly regarding the battery.  When the tablet was on the keyboard dock (which has its own secondary battery), it would stay on but battery wouldn't last.  If you took the tablet off of the keyboard dock, the tablet would not turn on unless the power cable was plugged in.  If the tablet was on and then the power cable was removed, the tablet would die/shut off immediately.

The trial and error process:  So after some brief research I found this forum -

https://forums.lenovo.com/t5/ThinkPad-X-Series-Tablet-and/Helix-Battery-Plugged-in-not-charging/td-p/1117953

- that lead me to want to try a keyboard dock firmware update (although I recalled having done this firmware update for this particular device before).

http://support.lenovo.com/us/en/downloads/ds035554

After downloading and preparing to install the firmware update, it did indeed show that I already had the files on the machine from installing it at a prior time, however I went with it still.  It returned with an error that the primary battery (tablet battery) needs to be "present and charged" (or something along those lines) in order to install the firmware.  Needless to say the install aborted.

Then that led me to do some additional research.
I installed the Lenovo Power Management Driver for Windows 8.1
http://support.lenovo.com/us/en/downloads/migr-4gxpeg
and then went to the control panel and opened the Lenovo Settings and Management icon.  I was able to go to the Battery section, and saw that "No battery installed" was listed for the primary/tablet battery.  Hmmm..

I also found a battery firmware update for the Lenovo ThinkPad Helix,
http://support.lenovo.com/us/en/downloads/ds001322
and upon installing and attempting to run it, it stated that "no battery was found to update the firmware for."

Last I checked the basic settings in the Windows Device Manager under "Batteries" and nothing was really listed that represented a battery inside...

By this time I was very suspicious needless to say.  Now, we had called Lenovo a few days earlier about this and they had mentioned it is probably just some drivers related to the connection of the battery.  During all of this troubleshooting I had been on the phone waiting for support from them for 45 minutes.  By that time I decided "Screw it" and cracked open the tablet to see if 1) is there even a battery inside and 2) is it connected.  Considering Lenovo had repaired it and had taken it apart, it was highly possible that something wasn't connected right.

The resolution:  Using my handy case cracker, and remembering what I had seen about taking a Lenovo apart in this video from a previous project with this specific Lenovo -
https://www.youtube.com/watch?v=PgqASDqRSnI
I CAREFULLY opened up the tablet and lo and behold the battery cable connector was not fully in place.  Or in place at all really.

So after spending about an hour on hold with Lenovo to fix a battery problem, it turns out it was a hardware issue all along, which they would not have figured out over the phone anyway most likely.

While it seems so simple to just check for hardware, I feel that hardware is not necessarily the first thing to check with something like a tablet because of the more complex design of the hardware and having to take it apart in the first place if you don't know what you are doing (or don't have a youtube video to watch to show you how lol)

All in all, if your Lenovo ThinkPad Helix battery isn't working, and none of the drivers, firmware or any other fixes don't seem to be working - go ahead and make sure the battery is even present and connected properly!






Wednesday, July 22, 2015

How to Quick Format a Drive - Command Prompt

Knowing how to format a drive, whether a hard drive or flash drive, can come in very handy.  This article will briefly go over the types of file systems for disk partitions followed by how to format a drive - first using a command/DOS prompt.  I'll go over how to format using HP USB Storage Format Tool v2.2.3 in another post.

The most common choices for formatting are FAT32 and NTFS.

FAT32 is the older of the two formats and is read/write compatible with many operating systems, including Windows up to Windows 8, Mac OS X, and Linux.  It supports file sizes up to 4GB and up to 2TB volumes.  Also, FAT32 can be converted to NTFS without reformatting.

NTFS (New Technology Files System) is the newer drive format and is read/write compatible with legacy Windows operating systems such as Windows NT 3.1 up to Windows 8.  Mac OS X (10.3 and above) can read NTFS, but (aside from other hacks and workarounds) they require third party utilities to write to an NTFS volume, making NTFS essentially only semi-compatible with OS X..  NTFS cannot be converted to FAT32 without reformatting.

While NTFS is supposedly faster than FAT32 formatted drives, FAT32 makes for a better choice if you ever need to transfer files between Windows and non-Windows systems (like Mac or Linux machines).


*The below instructions are assuming an external drive of some sort is being formatted from within Windows.  You can also format your internal hard drive if needed for an OS (re)install if you have the install media readily available of course!)

HOW TO QUICK FORMAT VIA COMMAND PROMPT (cmd.exe):

Type the following commands line by line in an elevated command prompt (elevate a cmd prompt by right clicking cmd.exe and select "Run As Administrator")

Type:

  • Diskpart
  • List Disk

**For the next command you will need to use your common sense as to which drive to select.  For example, if you know you have a 500GB hard drive internally, and want to format a 16GB flash drive that's connected, probably only two drives will be listed under "list disk" - Ex: Disk 0 shows as having a size of 500GB and Disk 1 as having a size of 16GB.  You will therefore want to "Select disk 1" (the flash drive - you do not want to unintentionally format your internal hard drive!).  You can also go to Disk Management (under Computer Management, along with Device Manager) and look at the drive numbers there.**

  • Select disk <insert disk #>
  • Clean
  • Create partition primary               (or create part pri for short!)
  • Format fs=NTFS quick     *OR*    Format fs=FAT32 quick
  • List volume                                     (or list vol for short!)
  • Select volume <insert volume #>  (use the same judgement you used earlier when selecting a disk number to select the volume number of the drive you just formatted)
  • Assign
  • Exit


More resources on NTFS vs FAT32:

http://www.pcmag.com/article2/0,2817,2421454,00.asp

http://www.guidingtech.com/11205/difference-between-ntfs-and-fat-32-file-systems/

http://www.howtogeek.com/177529/htg-explains-why-are-removable-drives-still-using-fat32-instead-of-ntfs/

More resources on using Diskpart to format a drive:

http://www.techhack.co.uk/2011/03/31/format-a-hard-drive-with-command-prompt/ - with screen shots

http://www.intowindows.com/bootable-usb/ - includes info on making a USB bootable (more to come in a future post!)

Tuesday, July 21, 2015

Testing Network Connectivity

Ok, first up is an article how to simply check network connectivity with "ip config," and help troubleshooting network connectivity issues by using "ping" in a command prompt.

Ping (or Packet InterNet Groper) sends ICMP echo requests to target hosts and listens for ICMP echo replies.  It measures round trip time from transmission to reception, and reports errors and packet loss.

If your ping receives the same amount of packets that it sent, you're good.

OK, so here are some useful network-connectivity-checking commands that can be done from within a command/DOS prompt.

IP CONFIG:


  1. ipconfig - Typing ipconfig in a command prompt gives you relevant network connection information (if present) on whatever various network adapters you may have in your machine.  The output includes IPv4 address, Subnet Mask, and Default Gateway.
  2. ipconfig /all - This command gives even more detailed ipconfig information including the device's hostname and physical (MAC) address
  3. ipconfig /release - This command will release (end) your network connection ip address
  4. ipconfig /renew -  This command will renew (re-establish) your network connection ip address
  5. ipconfig /flushdns - This command clears the local DNS cache
PING:

  1. ping 127.0.0.1 - Pinging this address (also known as the Loopback Address) tests that your TCP/IP stack isn't corrupt (look for four packets sent/received) and tests if your NIC is functioning on the physical level
  2. ping <your ip address> - pinging your own ip address (ex 192.168.1.100) tests if your NIC is functioning and that the computer was added to the network correctly
  3. ping <your gateway> - This tests if your default gateway is functioning and that you can communicate with a local host on the local network
  4. ping <an external address> - tests if routing and your internet connection are working

Take note that if your IP address shows as a 169.254.x.x address, your computer has an APIPA address  (automatically assigned private IP address) and you will only be able to communicate with hosts on your own subnet and cannot be routed anywhere.  This is often due to DHCP being unavailable to the machine.


Here's some additional information from Microsoft TechNet on pinging ip addresses:

New Blog Style/Content

I've decided to change the idea of this blog to be more of a record of the fixes I find during research and troubleshooting.  Not only for my own personal reference but to act as a sort of library to others who may be interested.

Enjoy.