@marcinozga said in Any Way to Automate Adding a New Computer to an AD Group?: @flaxking said in Any Way to Automate Adding a New Computer to an AD Group?: @marcinozga said in Any Way to Automate Adding a New Computer to an AD Group?: Ansible can do that. https://docs.ansible.com/ansible/latest/modules/win_domain_group_membership_module.html#win-domain-group-membership-module You can add new PCs to domain, and change their group membership, you just need to know computer names in advance. Which is just a layer on top of Powershell. The Active Directory Powershell module is still required. It's not required, or that module is included already in Windows 10 by default. Because I haven't had to install it on any machine I managed with Ansible. "win_domain_group_membership requires the ActiveDirectory PS module to be installed" https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win_domain_group_membership.ps1 They have it in the documentation as well "This must be run on a host that has the ActiveDirectory powershell module installed." https://docs.ansible.com/ansible/latest/modules/win_domain_group_module.html

@Obsolesce said in Deploy Azure resources with Terraform: @IRJ said in Deploy Azure resources with Terraform: @Obsolesce said in Deploy Azure resources with Terraform: @IRJ said in Deploy Azure resources with Terraform: @Obsolesce @IRJ said in Deploy Azure resources with Terraform: @Obsolesce Yeah good stuff. I have a couple Udemy courses on it. Something I didn't see in this article was that Cloud Shell has Terraform built in... so you really don't even need to install it. I try to keep things serverless and source controlled, so I wouldn't want to install Terraform. As long as it uses the latest version of terraform. There are many differences between current and last release. Cool. Yeah 11 vs 12 are much different. Alot of things have to be redone

@jt1001001 Thanks. If you are running from PDQ deploy, you won't see anything. But, if you are doing it from PS/ISE or similar, that would be a great help.

@pmoncho said in Windows RDS User Profiles - Migrate, Recreate or User Profile Disks?: @Dashrender said in Windows RDS User Profiles - Migrate, Recreate or User Profile Disks?: Cool, then you should have it easy. FYI - Published apps still create a full profile on the RDS box, Just the desktop isn't presented to the user. If the application allows them to browse around, they could typically see the drive letters, the mapped printers, etc... that's why you still need to lock all that stuff down. Thanks for the info. I will keep that in mind. I was debating about using UPD's like @wrx7m and that was my interest in this post. Also, still planning out where to put Connection Broker, WebAccess and Licensing but that is another post. For local profile management, UPDs are a lot cleaner. If we are not putting them on a file server across the network then a second partition/VHDX is set up for that task to keep them separate. With the inclusion of FSLogix with RDS CALs/SALs now it's a no-brainer, IMNSHO, to set the project up on the FSLogix version. Storage management is another reason why UPDs on a network or separate partition make sense. Keeping a local profile on the C:\ of the session host is messy and can cause issues down the road with users coming and going. As far as the Broker/Gateway/Web put those roles on one VM but separate from the Session Host.

MS licensing on Sharepoint is as easy as licensing gets. It can't be more straightforward. https://products.office.com/en-us/sharepoint/sharepoint-licensing-overview "For On-Premises, intranet sites are licensed using a Server/CAL (Client Access License) model. SharePoint Server 2019 is required for each running instance of the software, and CALs are required for each person or device accessing a SharePoint Server." It's that simple. CALs are requires for each person or device accessing SP. That's it. Nothing more or less. It's not just easy, but exactly what you'd logically expect the licensing to do if they were being rational.

@IRJ said in Windows Server 2012 R2 - Share Auditing for Changes: I know you use wazuh.. Check this out https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/index.html Thanks! Checking out setting this up. Hopefully, it will reveal the culprit.

@black3dynamite said in Salt - Can't Connect to Minions After Adding Them to Master: I sometimes have to add --timeout 60 so I can see a response salt FP01.domain.local test.ping --timeout 60 Seems to be working. I think that it was the firewall needing the exception AND using the --timeout 60 Thanks!

@dbeato said in Reset 120 Day Grace Period for Windows RDS Server with PowerShell: @scottalanmiller I assume you needed to do this while dealing with the RDS CALs on your post about that right? Yeah. They still have not come through, but there is a chance that they might today. We will see.

@black3dynamite said in Windows Server 2019 Need to Download and Run without AV Deleting Files: https://www.thomasmaurer.ch/2016/07/how-to-disable-and-configure-windows-defender-on-windows-server-2016-using-powershell/ For now, just temporary disable Real-Time Protection via PowerShell Set-MpPreference -DisableRealtimeMonitoring $true Download the executable and scan it manually before you install Start-MpScan -ScanPath C:\datastore\file.exe -ScanType QuickScan Enable Real-Time Protection after the install Set-MpPreference -DisableRealtimeMonitoring $false Excellent, now THAT did it.

@scottalanmiller said in Windows Server 2019 Basic Installation: @dbeato said in Windows Server 2019 Basic Installation: @Obsolesce said in Windows Server 2019 Basic Installation: @scottalanmiller said in Windows Server 2019 Basic Installation: @Obsolesce said in Windows Server 2019 Basic Installation: @scottalanmiller said in Windows Server 2019 Basic Installation: @JaredBusch said in Windows Server 2019 Basic Installation: The current install method brings Windows Server on parity with the Linux ecosystem really. You install, choose some options and end up at a prompt after reboot. Then you remotely add the features and shit you want. Yeah, very in like with Fedora, Ubuntu, or Deepin. Deepin might still be my favourite installer for normal stuff of the four. Did you have a Deepin install screenshot chain on here? No, but I do it so often, it would be easy to get. That'd be nice to see on here. Last post on it was below https://mangolassi.it/topic/14453/deepin-linux-15-4-1-install The install still looks like that. LOL that's not an installer. That's a push button, get peanuts. Nice though.

@pmoncho said in The Hidden Cost of Licensing Windows Server - Activation: @scottalanmiller said in The Hidden Cost of Licensing Windows Server - Activation: Just looking at this with a customer that just put in a new Windows 2019 server. The machine was purchased with a volume license agreement for Server 2019 Standard. Everything should be super easy, in theory. Problem is, license key from the volume license center doesn't work. We spend a bit of time trying to get this to apply, but no luck. I have run into a similar situation this morning and not being able activate the VLSC liscense. Before I decided to call MS and getting frustrated, I was able to activate from an elevated command line. cscript c:\windows\system32\slmgr.vbs /ipk <product key> Throwing this out here in case someone comes along this post at a later time. I've heard that that often works. We had tried that in our case and it had failed.

@Reid-Cooper said in General Guidance on Windows Admin Center WAC: @Obsolesce said in General Guidance on Windows Admin Center WAC: Yes you do need to either add other devices manually or by importing a list... but it's a one-time thing so it's a non-issue IMHO. Not bad for tiny environments. But at any scale, how does that handle machines being added in the future? You have to manually add every new machine after every change to WAC? I've only had about 100 servers and a handful of Win10 in it, so I'm not familiar with handling that at scale. It really only requires a txt file of a list of devices which is simple to maintain in any aspect. I only had to import that to get everything back in. If I added a new server, I would add it to the text file then add that server.

Our go-to solution for VSS problems is to set up a dedicated snapshot volume. Otherwise we were getting timeouts and M$ does ugly things that don't make sense when VSS doesn't work properly.

@wrx7m said in PowerShell - Off-boarding Script: @dafyre said in PowerShell - Off-boarding Script: @wrx7m said in PowerShell - Off-boarding Script: @dafyre I think I found where you got it - https://www.powershelladmin.com/wiki/Powershell_prompt_for_password_convert_securestring_to_plain_text Anyway, I am not sure where, in my script, I should place that function. You'd put the actual function at the top of your script, and then just $myPassword=convertFrom-SecureToPlain -securepassword $MySecurePassword Wherever you need the password in plain text form. Thanks. It mostly works. The only problem is that it isn't actually using the password I specify at the top. It is somehow generating its own and then writing it at the end. I put in write-host "Plain Text Says: $plainText" and it shows the password that I typed in for the secure variable at the beginning, followed by the one that it generated. Plain Text Says: $#@%4#@177 Jof91348 Works fine for me here.... Check and make sure you don't have an extra write-host or anything somewhere.

@Emad-R said in Download Windows Server 2019: @scottalanmiller https://software-download.microsoft.com/download/sg/17763.253.190108-0006.rs5_release_svc_refresh_SERVER_EVAL_x64FRE_en-us.iso Thanks @Emad-R with this link you don't have to go through all the paperwork.

@gjacobse said in Add a User to Remote Desktop Users in Windows Remotely: I seem to remember doing this via ScreenConnect CMD Only works if SC is installed, which if it was, we'd not need to do it

Not yet.

@scottalanmiller lol

@DustinB3403 said in Windows Server 2012 Essentials Cannot Find Login Server for AD: That's rough. Very

Thanks all

@scottalanmiller Right and they leap at that without a full picture, that's all I was admittedly trying to say.

So what we are pretty sure we have narrowed it down to is a WiFi device that reports the temperature of the refrigerator to an online portal that sends out notifications when there is an out of range event. There is an inside the fridge sensor and that sends the information to a receiver outside the fridge. The receiver part is what has the WiFi built in. I think the inside sensor to outside receiver communicate using 900 Mhz. Who would have thought to check the refrigerator?

@obsolesce said in Handling DNS in a Single Active Directory Domain Controller Environment: @scottalanmiller said in Handling DNS in a Single Active Directory Domain Controller Environment: @obsolesce said in Handling DNS in a Single Active Directory Domain Controller Environment: @stuartjordan said in Handling DNS in a Single Active Directory Domain Controller Environment: I believe the forest level with Samba can only be 2008R2 though. If you're not using Windows AD, what's it matter? If he's merging in DFS, it might. It's rare to do, but could matter. Oh I see, so Windows AD and other services were involved at some point. Depending on what you want to do, sometimes AD has to support it.

@phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt: @scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt: @phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt: @scottalanmiller said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt: @phlipelder said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt: @jaredbusch said in Get Wildcard SSL Certs for IIS on Windows with LetsEncrypt: @scottalanmiller my problem with Certs on Windows, in general, is that you almost always have to copy it around to multiple servers to make everything work well, and that jsut defeats the purpose of LE. Based on what is on the site, Microsoft has an intrinsic trust with LE's root store. I should be able to set up a RD Session Host with a LE certificate for publishing and there should be no untrusted publisher for RemoteApps or Session Host desktops once the certificate's thumbprint is published via Group Policy? One would hope that they would. LE is like the standard in SSL Certs. It's from the EFF, way more trustworthy than other cert authorities, IMHO. Snag: Valid for 90 days. In larger RDS farm settings this would be a bear to manage. That means the need for an automated process. It is expected to be automated. SSL Cert updates should not be intrusive. All of the tools for LE SSL Certs are designed around the idea that you will automate them and never need to worry about them again. It's about being less of a snag, not more of one. Got it thanks. Looks like a bit of a learning curve then. It's not bad. I find learning the LE pieces easier than learning to do it the old fashioned way And with LE it is "learn once and ignore", rather than "learn once, forget, do again in a year or two all over again."