Author: Adam Fowler

Netwrix Sysadmin Blog Awards Finalist (and Winner!)

Posted on by Adam Fowler

 

Netwrix has picked this blog as one of the finalists in it’s blog awards! As their post on this says, the blogs shortlisted “based on the regularity of blog posts, the variety of topics covered and feedback from readers.” For anyone reading this, and particularly those who have supported, shared or commented; I really appreciate you support, and it’s little nods like this that just give another layer of approval and why I do this.

There isn’t too much else to say, but please continue to give feedback, comment (I really enjoy both the ‘this worked for me!’ or the ‘this didn’t work, but this did’ comments) or start your own blog up if you think of something to share – I’m happy to give advice to anyone, or host a guest blog post if you want to give it a try yourself :)

Here’s the list of all the finalists. Check out their blogs as there’s something for everyone there (I’ve had a look through all of them!)

Best Cloud Computing Blog


Best IT Security Blog


Best Tech Tips for System Administrators Blog


Most Humorous Blog


24/7 Tech Support Blog


IT Career Blog

 

Update 17th March 2017

adamfowlerit.com won it’s category for “Best Tech Tips for System Administrators”! Thanks Netwrix and I’m looking forward to playing with the Samsung VR unit :)

Winners list here

Azure AD Group-Based License Management For Office 365

Posted on by Adam Fowler

It’s finally here! At least in public preview…

The ability to allocate Office 365 licenses via groups is now available for everyone to use. This has been a long-awaited feature, up until now licenses have either been applied manually via the portal, or via scripts/3rd party software with logic applied for automation.

Now, you can automatically apply and manage license allocation using whatever logic you like. You can create on-premise AD groups, apply a license set to the groups, and members will be allocated the relevant licensing. If that doesn’t work for you, there’s also cloud based Dynamic Groups which let you use whatever logic you can come up with to add members to the group. You could do it on something like a department name, or use an extension attribute and populate that based on what license you want to allocate.

The above link covers a lot of information about how to deploy this. At the time of writing, I couldn’t get to the Azure Licensing page by searching for the word ‘Licensing’, and instead had to use a direct link: https://portal.azure.com/#blade/Microsoft_AAD_IAM/LicensesMenuBlade/Products

I’ve already deployed it, it seems to work quickly and without issue.

 

Once you’re done, you’ll need to remove the Office 365 licenses applied manually. This TechNet article shows the commands to use for removal. I used this:

$Users = Get-MsolUser -All | where {$_.isLicensed -eq $true}; $Users | foreach {Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -RemoveLicenses "litwareinc:ENTERPRISEPACK"}

This removes licenses from all your users, to be more specific add extra criteria to the first ‘Get-MsolUser’ command. Also note you need to swap ‘litwareinc’ with your tenant ID, and ENTERPRISEPACK with whichever license you’re removing. I’d recommend testing on one account first!

To see what your tenant’s license options are just use:

Get-MsolAccountSku

And you’ll see a list of the license options along with existing allocations.

If you have any questions please comment below.

How To Grep in PowerShell

Posted on by Adam Fowler

How to Grep in PowerShell:

Here’s some example commands in PowerShell to replicate Grep:

  • Get-Process | Where-Object {$_ | Select-String “foo”}
  • get-process | where ProcessName -like “*foo*
  • get-process | findstr foo
  • ps *foo*

Applies To : PowerShell

For those who have lived in the Linux/Unix command line, the ‘grep‘ command is a commonly used way of finding something that you want in a chunk of data.

Øyvind Kallstad did a great writeup of comparing a bunch of ways to use PowerShell instead of grep which is worth reading.

The article covers a bunch of scenarios, and is centered around starting with the ‘grep’ command and working with it. However, there’s the other common use case of running a different command, then piping those results to grep to search for something.

This blogpost was triggered by Janet who asked me this fair question:

https://twitter.com/missjte/status/834132904045342720
https://twitter.com/missjte/status/834133021829664770

As with poor cute cats, there’s more than one way to skin PowerShell.

I had to do some research and asking around on this, because normally I’d filter out the property of the object I was looking at, and work with that. Using the get-process example:

get-process | where ProcessName -like "*foo*

That works, but it’s still a lot clunkier than what a grep user would expect. An easier way would be to use the ‘findstr‘ program (which also has a bunch of useful swtiches):

get-process | findstr foo

I say program because ‘findstr’ is not a PowerShell cmdlet, but it’s still native to Windows and works perfectly fine. It’s case sensitive though, so you need to use -i for case insensitive results.

That’s great for simple stuff, but we’re sort of breaking what PowerShell does. You’re no longer dealing with a standard PowerShell object, so further piping and processing won’t really work.

The ‘proper’ PowerShell way would be to use the ‘Where-Object’ command:

Get-Process | Where-Object {$_ | Select-String "foo"}

A bit longer, but you can shorten ‘Where-Object’ to ‘Where’. Although more involved, it’s good to get into the habit of doing it this way, so when you’re piping this to the next command, it still says as a standard object that can be read and manipulated.’

(Update 24th Feb 2017) As Steve_N points out in the comments section, there’s a much shorter way of doing this:

ps *foo*

That’s it. Many PowerShell commands have inbuilt aliases, including ‘get-process’. You can see what this is with the command ‘get-alias -definition get-process’

This shows that ‘gps’ and ‘ps’ are both aliases to the command  ‘get-process’. You can also create your own aliases with the ‘set-alias‘ command.

The ‘*foo*’ part works because the command assumes the -name switch has been used, which lets you define what criteria to search and show in the ProcessName field. This is the same way that many commands don’t need the -identity switch used, because it’s written to assume you’re going to tell it what identity/username/upn to work with.

This can also be piped to something else, so it’s a winner. It’s less ideal for scripts though, because it’s much harder to read, and you can’t assume that everyone will know the short alias of a full command.

Also note that this isn’t grep related at all, so part of the answer to the original question is that you may not even need grep or select-string as it adds unnecessary overhead of getting data and parsing it, whereas this updated example filters the data as it’s obtained.

(Update ends)

PowerShell isn’t a Linux/Unix command line, but Microsoft have incorporated many of the concepts from bash. If you still can’t bear to use PowerShell on Windows, there’s always the Linux Bash Shell on Windows.

Thanks again to Steve Mclnerey for the grep advice :)

Why Haven’t You Deployed LAPS Yet?

Posted on by Adam Fowler

LAPS – Local Administrator Password Solution is an official Microsoft solution for doing exactly what it’s called – managing local administrator passwords on the computers you manage (both desktops and servers).

The solution is fairly simple – have a tiny client rolled out on each PC, that gets told by Group Policy to generate a random password. The local admin account gets set to that password, and Active Directory also gets told what that password is. That changes on a 30 day cycle

The end result is that anyone who obtains local admin access through that account, can’t access anything beyond that single computer – and, that’s only for 30 days maximum before it gets changed. Even if the computer is taken off the domain, your Active Directory will have a record against the computer of what the last set password was.

There’s a great overview, demo, and install files available from TechNet with Jessica Payne going into great detail on how it all works and showing you exactly what to do which I highly recommend after watching it personally.

As she says, it only takes 10 minutes or so to set up, and it’s that much more secure than using Group Policy to set everyone’s local administrator account to the same password (which by the way, doesn’t securely save the password in the Group Policy anyway) and running into issues when someone needs the local administrator password for one reason or another.

Oh, there is a tiny AD schema update, but it’s a single command and nothing to worry about :)

Once you’ve got LAPS set up, you use the LAPS UI program to view passwords:

Chris Brown has also written up a nice ‘how-to’ guide on setting up LAPS from end to end which is worth following too.

LAPS is easy to deploy, easy to manage and provides several security benefits… and it’s free. If you’re not using LAPS yet, it’s time to do it! Grab it from Microsoft here.

Gaming PC Build 2017

Posted on by Adam Fowler

My 5+ year old PC was finally ageing – Battlefield 1 was maxing out the Intel i5 CPU! It’s time to upgrade to a whole new kit. After some research and help from PC Part Picker, this is what I bought:

Intel Core i7-7700K 4.2GHz Quad-Core Processor

Deepcool Gammaxx 400 CPU Cooler

MSI Z270 GAMING M5 ATX LGA1151 Motherboard

Corsair Vengeance LPX 16GB (2 x 8GB) DDR4-3200C16 Memory

Intel 600p Series 512GB M.2-2280 Solid State Drive

Corsair 300R ATX Mid Tower Case Windows Edition

Corsair CS650M Modular 80 Plus Gold ATX Power Supply

You may notice there’s no GPU. I’ll be re-using my NVIDIA GTX970 as that was more recently updated. If I didn’t have that, I would have probably chosen a GTX1070. I also added in an old DVD drive and 1.5TB HDD because why not.

 

Notes from during the build:

Lining up the motherboard back panel into the case, and then getting the motherboard to line up with it. It looked like it was in place, but not enough to have the screws in the case line up with all the holes in the motherboard.

CPU Fan – Completely my fault, I put the wrong brackets on. I was still thinking of my old 1155 pin CPU when I followed the back of the box instructions, rather than the 1151 pins that my new CPU was. Then I had to work out how the weird clips worked, as there was a single line of instruction: “Well note: turn before push”. Apparently that means don’t turn at all, which took some trial and error to discover.

Working out how to install M.2 SSDs – this wasn’t really a problem, just something I hadn’t done before. It’s held in place with a screw and screw holder, which I eventually found already in the motherboard, but in a hole designed for the largest M.2 card possible.

This case is pretty good for HDDs and DVD Drives – it’s a screwless solution for both, but you do need to access both sides of the case. Both sides also come off easily with 2 thumb screws.

I did a bit of cable management, which previously I hadn’t bothered with as I’d be changing things around every couple of months (I remember adding my 9th 320GB HDD to my PC years ago, and then trying to juggle SATA and power cables around to make it all work). The case again was pretty good for this, I just fed the cables through to the bottom side of the motherboard, then brought them back out again where they needed to go.

CPU was just a drop in the right way, have the arrows line up job. Pushing the bracket back onto the CPU to hold it into place is a little worrying, more force is required then I was comfortable applying.

PSU is modular, so you can have just the cables you need coming out of it which reduces clutter. 650w is overkill I’m sure for this, as I could have bought a 550w for half the price but it wouldn’t have been modular, and I also like keeping my options open for future changes. Installation of the unit was sliding in and putting a couple of screws on.

The GPU I already had fits in with lots of room – it looks like they’ve changed the design of the PCI-E slot which used to have a plastic tab to bend to insert or remove the card – that’s changed to a tab that’s the same style as the RAM sockets.

RAM hasn’t changed at all installation wise :) The only trick is to make sure you populate the right slots – check the manual, but usually it’s also on the motherboard too (which it was in this case).

Idling temps after install were around the 39oC – but after overclocking and leaving it a few days, it seemed to settle lower at 37oC.

 

Getting the software going:

Thankfully after getting it all together and installing Windows 10, there were no issues. Lucky I installed that DVD drive, as the network device wasn’t installed with a default driver, and I had to load it off the included CD-ROM. Yep, 2017 and we’re still loading base drivers that way.

The amount of utilities provided by MSI is a bit silly, and it’s really hard to tell what any of them do until you install them. I’ve got one that claims to give a fast boot – the few seconds it takes without that is fast enough already. The MSI Command Center is useful as it shows CPU/RAM settings and speeds, as well as system temp. The MSI Gaming App was the one that let me turn off the motherboard’s LED, rather than setting it to ‘breathe’ where it would fade in and out in one of 7 amazing colours.

I also used the motherboard’s inbuilt overclocking ‘gaming mode’ option – it upped the CPU from 4.2Ghz to 4.8Ghz. I found another option around the RAM where I set that to 3200Mhz, and it did it’s thing on changing settings to match that RAM speed. If you’re not going to do this by the way, don’t get the ‘K’ series Intel I7, or RAM faster than 2400Mhz because that’s all it will run at out of the box.

Also, if you have a look at some comprehensive reviews you’ll see that there’s barely any benefit in the 7th generation Kaby Lake Intel CPUs vs the 6th generation Skylake (don’t ask me why Skylake is one word, and Kaby Lake is two words either), if you aren’t using the onboard GPU which gets the biggest gains. Right now, the price is pretty much identical between the 6700K and 7700K which is why you might as well go the newer one – there’s no negatives there.

This setup is very quiet too, there’s minimal noise from any fans which is great.

 

Here’s some pictures of the build process. I’m happy to report that after a few days and testing Battlefield 1, I’ve had zero blue screens, and CPU sits around 60% max when playing.