Windows 7: How to Remove Games link from Start Menu with Group Policy

- Create a new GPO and link it under the OU that the user is located.

- Go to User Configuration, Policies, Administrative Templates, Start Menu and Taskbar and enable "Remove Games link from Start Menu".

...

-  You can also apply the following to prevent the user from acces and hide the A, B , C and D drive from my Computer.

- Go to User Configuration, Policies, Administrative Templates, Windows Components/Windows Explorer. Now enable "Hide these specified drives in My Computer" and Restrict A, B, C and D drives only. Also enable "Prevent access to drives from My Computer" and Restrict A, B, C and D drives only.


Note:
If the user is a administrator the policy will not be set.

Windows 8: Unattend Installation using WDS

---Setup---
 
- Download the ISO file for Windows 8 from the Microsoft Homepage.

- Extract the "Install.wim" and "boot.wim" with 7zip or another tool. The WIM files are located in the "sources" folder.

- Rename the Install.wim i.e. to Win8.ENT.EN and add it to your WDS Server.
Win8 = Windows 8
ENT=Enterprise
EN=English

- Add the boot.wim as boot image also to your server.

- On your server go to "\RemoteInstall\Images\Basic Images\" and create a folder that have the same name that your image have "Win8.ENT.EN".

- In the folder "Win8.ENT.EN" created a folder named "Unattend".

- Open Notepad and copy in the follwoing text and save it as ImageUnattend.xml in the "Unattend" folder. You have to change the domain join ,time zone and locale settings.

 <?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="specialize">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <ComputerName>*</ComputerName>
            <TimeZone>W. Europe Standard Time</TimeZone>
        </component>
        <component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <Identification>
                <Credentials>
                    <Domain>YOURdomain.com</Domain>
                    <Password>PW678231bn!8</Password>
                    <Username>domainjoin</Username>
                </Credentials>
                <JoinDomain>YOURdomain.com</JoinDomain>
            </Identification>
        </component>
    </settings>
    <settings pass="oobeSystem">
        <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <InputLocale>de-de</InputLocale>
            <UILanguage>de-de</UILanguage>
            <UserLocale>de-de</UserLocale>
        </component>
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <OOBE>
                <HideEULAPage>true</HideEULAPage>
                <NetworkLocation>Work</NetworkLocation>
                <ProtectYourPC>1</ProtectYourPC>
            </OOBE>
            <Themes>
                <DefaultThemesOff>true</DefaultThemesOff>
            </Themes>
            <UserAccounts>
                <AdministratorPassword>
                    <Value>AdminPW123!</Value>
                    <PlainText>true</PlainText>
                </AdministratorPassword>
                <LocalAccounts>
                    <LocalAccount wcm:action="add">
                        <Password>
                            <Value>AdminPW123!</Value>
                            <PlainText>true</PlainText>
                        </Password>
                        <Description>Admin Account</Description>
                        <DisplayName>Admin</DisplayName>
                        <Group>Administrators</Group>
                        <Name>admin</Name>
                    </LocalAccount>
                </LocalAccounts>
            </UserAccounts>
        </component>
    </settings>
    <cpi:offlineImage cpi:source="wim:d:/install.wim#Windows 8 Enterprise" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>

- The image will be automatically linked to your xml file.

- For HDD disk configuration settings you have to add a second xml. Save the following XML to "\RemoteInstall\WdsClientUnattend" and name it Unattend64.xml

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="windowsPE">
        <component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <DiskConfiguration>
                <WillShowUI>OnError</WillShowUI>
                <Disk wcm:action="add">
                    <CreatePartitions>
                        <CreatePartition wcm:action="add">
                            <Order>1</Order>
                            <Type>Primary</Type>
                            <Extend>true</Extend>
                        </CreatePartition>
                    </CreatePartitions>
                    <ModifyPartitions>
                        <ModifyPartition wcm:action="add">
                            <Active>true</Active>
                            <Format>NTFS</Format>
                            <Label>System</Label>
                            <Letter>C</Letter>
                            <Order>1</Order>
                            <PartitionID>1</PartitionID>
                        </ModifyPartition>
                    </ModifyPartitions>
                    <DiskID>0</DiskID>
                    <WillWipeDisk>true</WillWipeDisk>
                </Disk>
            </DiskConfiguration>
            <WindowsDeploymentServices>
                <Login>
                    <Credentials>
                        <Domain></Domain>
                        <Username></Username>
                        <Password></Password>
                    </Credentials>
                </Login>
                <ImageSelection>
                    <WillShowUI>OnError</WillShowUI>
                    <InstallImage>
                        <ImageName></ImageName>
                        <ImageGroup></ImageGroup>
                        <FileName></FileName>
                    </InstallImage>
                    <InstallTo>
                        <DiskID>0</DiskID>
                        <PartitionID>1</PartitionID>
                    </InstallTo>
                </ImageSelection>
            </WindowsDeploymentServices>
        </component>
    </settings>
</unattend>

- After this open the WDS console go to the "Client" tab, select "Enable unattended installation" and choose your created xml file for "ia64 architecture" and "x64 architecture". For ia64 change the XML.

- The user who start the installation, have to enter his credentials and to choose the uploaded Windows 8 image. You can also point to an image and provide the credentials in the XML.


---Settings that will be applied----

Admin Account => PW = AdminPW123!, Name = admin 
LocalAccounts>
                    <LocalAccount wcm:action="add">
                        <Password>
                            <Value>AdminPW123!</Value>
                            <PlainText>true</PlainText>
                        </Password>
                        <Description>Local Admin</Description>
                        <DisplayName>Admin</DisplayName>
                        <Group>Administrators</Group>
                        <Name>admin</Name>
                    </LocalAccount>
</LocalAccounts>

Computer name => Random
<ComputerName>*</ComputerName> 
For using the prestaged computer object in Active Directory use the following
<ComputerName>%machinename%</ComputerName>

Locale/Language => Germany for other locations see Windows Locale Codes
<InputLocale>de-de</InputLocale>
<UILanguage>de-de</UILanguage>
<UserLocale>de-de</UserLocale>


---Notes---

You can created your own XML with encrypted user passwords etc. using Windows ADK

WDS: WDS can not start Error 0x2740

Error message:
An error occurred while trying to start the Windows Deployment Services server.

 Error Information: 0x2740

This error could be occured because your site is using a DC without a GC role.

You can solve the issue by:

Make your local DC to a GC.
or
Pointing to your local DC and to a GC.
-Open the WDS console and right-click on the servername.
-Select properties and choose the advanced tab.
-Type in your local DC and a GC that can be reached from the local site.

Windows Server 2008: E-MAIL AD Account Lockout Notification

Hi,

today I want to show you one way for Account Lockout Notification, with a schedule task on a event, starting a batch file thats send a mail via blat.exe.

-Download the blat.exe

-Set the Mail server settings with the blat.exe on your server. For help type in blat.exe /?

-Create the LockoutALL.bat and copy the blat.exe to "c:\EventLogs" on your DC.

AccountLockoutSend.bat

del c:\EventLogs\4740.txt

wevtutil.exe qe Security /q:*[System[EventID=4740]] /rd:true /c:1 /f:text >> c:\EventLogs\4740.txt

c:\EventLogs\blat.exe c:\EventLogs\4740.txt -to Tim@companyX.com -subject "Account Lockout Company X"

-Create a schedule New task and set Run whether user is logged on or not

-Go to the "Trigger" tab and Select "New", choose "Begin the task: On an event" Event details -> Log: Security,Source Microsoft-Windows-Security-Auditing,Event ID: 4740

-In the "Actions" tab choose the "LockoutALL.bat".

-Save the task.

User Provisioning App for Exchange mailbox, Active Directory and Lync accounts

Hi guys,

this is a cool tool for User Account provisioning in your Microsoft environment.

"Z-Hire automates the IT account creation process for Exchange mailbox, Active Directory, Lync accounts and Office 365 cloud deployments. With just a click of the button, your Exchange mailbox, and Active directory and Lync accounts will be created simultaneousy. This app can also create and set custom settings for Office 365 accounts using templates. Z-Hire serves as the platform for new hire accounts by allowing auto-creation of major IT accounts with the option for custom scripts. Z-hire will increase your account deployment time by 600%, without the need for complicated and expensive identity management solutions. Some of the features include:
- Environment Auto discovery (AD/Exchange/Lync)
- Support for Active Directory, Exchange, Lync 2010 and Office 365 accounts
- Template based deployment (allows consistency for all user accounts)
- Office 365 account creation with major attributes
- Active Directory account creation with major attributes
- Active Directory group selection
- Active Directory duplicate SamAccountName verification
- Lync 2010 account creation supporting all policies
- Faster performance (compared to previous version)
- Best of all, it's freeware!"

Download Link:
Z-Hire-Employee-Provisionin App