Wednesday, February 10, 2016

Windows 10, Helping to understand the new update strategy

So at work I'm looking into Windows 10 and how we can best deploy it (in the not-so-near future) to our user base.

Like many, I've been skeptical about the whole thing. The security issues you read about, wifi password sharing and the like.  We for the past few days I've been reading about the three different 'editions' and how they handle simple things like Windows Updates.

Microsoft believes that people, even in the enterprise environment, want new features and functionality faster than ever.  That product life-cycles should be measures in months and not years.  Not sure where that retarded idea came from but that's how it is now.

First off let's get this out, there are three editions now and they all center around how often the OS is updated with new features.  You have:

Current Branch (CB)
Current Branch for Business (CBB)
Long Term Servicing Branch (LTSB)









Windows 10 release types and cadences
Although Microsoft releases flight builds to Windows Insiders, Microsoft will publish two types of Windows 10 releases broadly to the public on an ongoing basis:
  • Feature upgrades that install the latest new features, experiences, and capabilities on devices that are already running Windows 10. Because feature upgrades contain an entire copy of Windows, they are also what customers use to install Windows 10 on existing devices running Windows 7 or Windows 8.1, and on new devices where no operating system is installed.
  • Servicing updates that focus on the installation of security fixes and other important updates.
They say to expect 2 - 3 Feature Upgrades per year... which to me sounds like 2 - 3 full installs per year.  But wait! there's more.


The cumulative nature of all Windows 10 releases
It is important to note that, in order to improve release quality and simplify deployments, all new releases that Microsoft publishes for Windows 10 will be cumulative. This means new feature upgrades and servicing updates will contain the payloads of all previous releases (in an optimized form to reduce storage and networking requirements), and installing the release on a device will bring it completely up to date. Also, unlike earlier versions of Windows, you cannot install a subset of the contents of a Windows 10 servicing update. For example, if a servicing update contains fixes for three security vulnerabilities and one reliability issue, deploying the update will result in the installation of all four fixes.  

Great, just great.  Now every Feature Upgrade really does contain the sum of every other update.  Microsoft believe that every person out there has a good fat pipe to the internet, that 'It's 2016! 10mb+ broadband is everywhere!' At least that's my opinion anyway.
Don't stop reading yet, there's more news for the enterprise folks.
Windows Update use within enterprises
Although Windows Update greatly simplifies and accelerates update deployment, enterprises are not using Windows Update as broadly as consumers and small businesses. This is largely because Windows Update maintains control over which updates are installed and the timing of installation. This makes it difficult for IT administrators to test updates before deployment in their specific environment.
The role of Windows Server Update Services
To help address the concerns of IT administrators, Microsoft released Windows Server Update Services in 2005. Windows Server Update Services enables IT administrators to obtain the updates that Windows Update determines are applicable to the devices in their enterprise, perform additional testing and evaluation on the updates, and select the updates they want to install. Windows Server Update Services also provides IT administrators with an all or nothing way to specify when they want an approved update to be installed. Because IT administrators ultimately select and install most updates identified by Windows Update, the role of Windows Server Update Services in many enterprises is to provide IT administrators with the additional time they need to gain confidence in the quality of updates prior to deployment.
New Windows Update capabilities in Windows 10
To enable enterprises to manage more of their devices using Windows Update directly, Windows 10 provides IT administrators with a way to configure devices so that Windows Update will defer new feature upgrade installations until approximately four months after Microsoft first publishes them. The additional time can be used to perform testing or enable releases to gain additional time in market prior to deployment.
At the end of each approximately four month period, Microsoft executes a set of processes that require no action from enterprise IT administrators.* First, Microsoft creates new installation media for the feature upgrade by combining the original installation media with all the servicing updates published by Microsoft since the original media’s release. This reduces the time it can take to install a feature upgrade on a device. Second, Microsoft republishes the new media to Windows Update withtargeting instructions that state (in effect) “install this media on devices that are configured for deferred installation of new feature upgrades.” At this point, devices configured to defer installation will begin receiving and installing the feature upgrade automatically.
The role of Windows Update for Business
Although Windows 10 will enable IT administrators to defer installation of new feature upgrades using Windows Update, enterprises may also want additional control over how and when Windows Update installs releases. With this need in mind, Microsoft announced Windows Update for Business in May of 2015. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing releases. This article will be updated with additional information about the role of Windows Update for Business in servicing Windows 10 devices as it becomes available.

* This is what I really enjoy as an SA... control being taken away.  
Entire article here:  https://technet.microsoft.com/en-us/library/mt598226(v=vs.85).aspx

Granted according this article, which appears to be a constantly updated piece, is that the way things are right now I can maintain control over things like this by going with the LTSB release.

More to come.









Monday, February 8, 2016

Ubuntu 12.04 LTS - Mount terminated with status 32

I have a cloned Ubuntu 12.04 vm (ESXi 5.5) that was giving the below error while mounting an NFS share:

mount.nfs: Connection timed out
mountall: mount /netapp [514] terminated with status 32


/etc/fstab:

cat /etc/fstab
netapp:/vol/vol0/custom /netapp nfs intr 0 0




After much time spent Googling I discovered that a number of other folks had resolved this issue by either installing or replacing their GUI.  Following another advise I installed KDM, then shortly after I remembered by dislike for KDE so I replaced it with GDM.

Some might argue the mount issue can't be related to a GUI, to that I can't argue.  But I know what resolved my error.  For good measure though after the fact I altered my mount line to:

netapp:/vol/vol0/custom /netapp nfs intr,_netdev,timeo=15,retrans=7  0 0

Monday, February 1, 2016

Powershell - Inactive computer accounts, 90 days

A little script I wrote a while back, it will return to the screen, all computer objects that have a LastLogonTimestamp of older than 90 days.


# Calculate the UTC time 90 days ago, in FileTime (Integer) format and convert it to a string
$LLTSlimit = (Get-Date).AddDays(-90).ToFileTimeUTC().ToString()
# Create the LDAP filter for the AD query
# Searching for enabled computer accounts which have lastLogonTimestamp older than 90 days
$LDAPFilter = "(&(objectCategory=Computer)(lastlogontimestamp<=$LLTSlimit) (!(userAccountControl:1.2.840.113556.1.4.803:=2)))"
# Create an ADSI Searcher to query AD
$Searcher = new-object DirectoryServices.DirectorySearcher([ADSI]"")
$Searcher.filter = $LDAPFilter
# Execute the query
$Accounts = $Searcher.FindAll()
# Process the results
If ($Accounts.Count –gt 0) {
# Create an array to store all the results
$Results = @()

# Loop through each account

ForEach ($Account in $Accounts) {

# Create an object to store this account in
$Result = "" | Select-Object Name,ADSPath,lastLogonTimestamp
# Add the name to the object as a string
$Result.Name = [String]$Account.Properties.name
# Add the ADSPath to the object as a string
$Result.ADSPath = [String]$Account.Properties.adspath
# Add the lastLogonTimestamp to the object as a readable date
$Result.lastLogonTimestamp = `

[DateTime]::FromFileTime([Int64]::Parse($Account.Properties.lastlogontimestamp))

# Add this object to our array

$Results = $Results + $Result
}
}

# Output the results
$Results | Format-Table -autosize
# Extending this script to disable the discovered accounts is as easy as adding this code snippet to the end:
# Disable each account
#ForEach ($Result in $Results) {
#$ADSIAccount = [ADSI]$Result.ADSPath
#$ADSIAccount.PSBase.InvokeSet("AccountDisabled", "True")
#$ADSIAccount.SetInfo()
#}

Tuesday, January 19, 2016

Powershell - Export-CSV all users in a specified OU

Today I needed this gem and had forgotten to save it last time.. so this time it's saved AND posted.


echo off
Import-Module activedirectory

$export=read-host "Please enter the export path"
$ou=read-host "Please enter the OU in ldap format (ou=employees,ou=people,dc=domain...)"
get-aduser -filter * -searchbase "$ou" -properties Displayname, Samaccountname | export-csv "$export"


Monday, January 18, 2016

Java Deployment

So an issue arose lately where I needed to push out a Java install for a select few computers in my domain because of an upcoming Oracle Go-live. Since the numbers are around 50-60 out of 400 computers I definitely don't want to push it to all of them.

Originally I went the GPO route.  I had a script designed that worked on a test vm, a coupe GPO's to push out both the java install itself but also the deployment.properties, and exceptions.sites however I ran into issues getting the exceptions to appear in the gui and I had an environment setting string that I needed to enter.

*I ran into trouble finding the above, so for future generations since Oracle failed to document this.. if you need a custom env setting for your java it can be added to the deployment.properties file much like:

deployment.javaws.jre.0.args=-Djava.vendor\="Sun Microsystems Inc."


Back to the deployment.. with so much trouble and inconsistencies I ran into using GPO I opted instead for PDQ Deploy from Admin Arsenal.  Within 30 minutes of installing the Demo version I had a package created that successfully pushed Java with the exceptions list correctly. It's VERY fast too, and the library they have (accessible after buying a license) is immense! $500 is a big pill to swallow for one seat and I kinda wished the library access was allowed for longer than 1 year however this product is going to help me out tremendously in the near future.  Since I was able to expense this to a larger project and it won't hit my department I'd say it's a double-bonus in my situation.

However since I am unable to generate a list of only the computer objects for users that require this specific version of Java now we have to tackle deploying enterprise-wide.  Once we do PDQ Deploy will handle it with relative ease.