Backup All GPOs using Powershell

I uploaded a new script to backup all GPOs and the Scripts folder located in th sysvol share.
It will be saved to a server in a folder named as the current date.

- Run this script using a schedule task

Open the Task Scheduler on your server.

Right-Click on "Task Scheduler Library" and select "Create a Basic Task".

Define a Name/Description, Trigger...

On the "Action" section you have to select Start a Program and enter the following options.

Program/script: powershell
Add arguments (optional): -file "C:\admin\Scripts\GPOBackup\GPOBackupV2.ps1"

On the "Finish" section checking "Open the Properties dialog for this task when I click Finish" and click "Finish".

To run whether user is logged on or not, select the option in the General tab, click ok and enter credentials.

- Import GPO Backups

To import the backed up GPOs you can use the GPMC:

Right-click "Group Policy Objects" and click on "Manage Backups..."

or using the Powershell command import-gpo:

https://technet.microsoft.com/de-de/library/ee461044.aspx

Windows Server Service Monitroing via E-Mail notification

Save the following powershell script to your server. Edit the underlined values matching to your environment.


 function sendMail{

     Write-Host "Sending Email"

     #SMTP server name
     $smtpServer = "smtp01.domain.com"

     #Creating a Mail object
     $msg = new-object Net.Mail.MailMessage

     #Creating SMTP server object
     $smtp = new-object Net.Mail.SmtpClient($smtpServer)

     #Email structure
     $msg.From = "server01.edomain.com@domain.com"
     $msg.To.Add("serveradmin@domain.com")
     $msg.subject = "server01 - ServiceX stopped"
     $msg.body = "ServiceX stopped on server01. Please check the server state."

     #Sending email
     $smtp.Send($msg)

}

#Calling function
sendMail


After that open the services.msc and browse to the service you want to monitor. Right-click the service, select "Properties" and click on the "Recovery" tab. On the third drop-down menu select "Run a Program" and select the saved powershell script.

WSUS Console Database Error after you start the Cleanup Wizard

This is caused because the partition doesn´t have enough diskspace.

I will show you how to solve this error doing the following steps.

- Stop UpdateService

- Cleanup some update files located in WSUSContent ( It must be enough , so a log file for the cleanup could be created on the WSUS partition. In my case the log file was about 2 GB)

- Start UpdateService

- Run the Cleanup Wizard

- After this run the following command:

C:\Program Files\Update Services\Tools>wsusutil.exe reset

The command "wsusutil.exe reset" tells WSUS to check each update in the database, and verify that the content is present in the WSUSContent folder. As it finds that the content is not present in the folder, it executes a BITS job to download the content from Microsoft. This process takes quite a bit of time and runs in the background.

How do you know when the process is complete?

The size of the WSUSContent folder is no longer growing, but to be sure check the SoftwareDistribution.log.

C:\Program Files\Update Services\LogFiles\SoftwareDistribution.log

If you start the "wsusutil.exe reset" command, you should see a line towards the bottom of the log which looks like this:

WsusService.14  ExecutionContext.runTryCode     State Machine Reset Agent Starting
... after a while you should see this-> ...

WsusService.14  ExecutionContext.runTryCode     State Machine Reset Agent Finished
 

Set Delegation rights on a specified GPO or all GPOs in your domain using Powershell

First you have to import the groupolicy module in powershell to execute cmdlets. This could be done with the following command:

import-module grouppolicy

Now you can use the following cmdlets to ease the Group Policy permission administration.

• Get-GPPermissions (used to query permissions on GPOs)
• Set-GPPermissions (used to apply permissions on GPOs)

In Windows Server 2012 the cmdlets will be without the s like "Get-GPPermission", but the old cmdlets also work, because Microsoft created an alias.


Find some examples to set permissions on GPOs.

This cmd sets the permission level for the "Test Users" security group to GpoRead for the GPO named "TestGPO1".

Set-GPPermissions -Name TestGPO1 -TargetName "Test Users" -TargetType Group -PermissionLevel GpoRead  


The following cmd sets the permission level for the "Sample GPO Read Access" security group to GpoRead on all GPOs in the domain.

Set-GPPermissions -All -TargetName "Sample GPO Read Access" -TargetType Group -PermissionLevel GpoRead


The following cmd sets the permission level for the "Sample GPO Edit Access" security group to GpoEdit on all GPOs in the domain.

Set-GPPermissions -All -TargetName "Sample GPO Edit Access" -TargetType Group -PermissionLevel GpoEdit



To verify that the commands works can use the "Get-GPPermissions" cmdlet to check it. See attached a sample to check if the first Set-GPPermissions command worked:

Get-GPPermissions -Name TestGPO1 -TargetName "Test Users" -TargetType Group

The console will show the following output:
-------------------------------------------
Trustee         : Test Users

TrusteeType     : Group

PermissionLevel : GpoRead

Inherited       : False   
--------------------------------------------

Lansweeper Report to list most Paidware Adobe software

Find attached a query to list most Adobe Paidware software.

Attributes will be listed in the following order:
AsstName | AssetTypename | IPAdress | Lastseen | SoftwareName | Username

Copy and paste the following query to your ReportBuilder in Lansweeper.


Select Top 1000000 tblAssets.AssetID,
  tblAssets.AssetName,
  tsysAssetTypes.AssetTypename,
  tsysAssetTypes.AssetTypeIcon10 As icon,
  tblAssets.IPAddress,
  tblAssets.Lastseen,
  tblSoftwareUni.softwareName,
  tblAssets.Username
From tblAssets
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Inner Join tblSoftware On tblAssets.AssetID = tblSoftware.AssetID
  Inner Join tblSoftwareUni On tblSoftwareUni.SoftID = tblSoftware.softID
Where (tblSoftwareUni.softwareName Like 'adobe acrobat%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Photoshop%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Creative Cloud%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Illustrator%') Or
  (tblSoftwareUni.softwareName Like 'Adobe InDesign%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Premiere%') Or
  (tblSoftwareUni.softwareName Like 'Adobe After Effects%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Audition%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Connect%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Audition%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Creative Suite%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Dreamweaver%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Edge%') Or
  (tblSoftwareUni.softwareName Like 'Adobe eLearning Suite%') Or
  (tblSoftwareUni.softwareName Like 'Adobe ExtendScript Toolkit%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Extension Manager%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Fireworks%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Flash Builder%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Flash Professional%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Illustrator%') Or
  (tblSoftwareUni.softwareName Like 'Adobe InCopy%') Or
  (tblSoftwareUni.softwareName Like 'Adobe InDesign%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Media Encoder%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Muse%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Photoshop%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Prelude%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Scout%') Or
  (tblSoftwareUni.softwareName Like 'Adobe SpeedGrade') Or
  (tblSoftwareUni.softwareName Like 'Lightroom%') Or
  (tblSoftwareUni.softwareName Like 'Adobe Bridge%' And tblAssetCustom.State =
  1)