There's no place like pro. There's no place like pro. There's no place like pro.

Shift F10

Start ms-cxh:localonly 

 changepk.exe /ProductKey VK7JG-NPHTM-C97JM-9MPGT-3V66T

winget update and all that jazz

If you find yourself longing for the command line and want to update all the stuff, this may fulfill your CLI needs.

 powershell

# 1. Force the use of TLS 1.2 for secure asset downloading
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# 2. Download and install the Winget bootstrap script from PowerShell Gallery
Install-Script -Name winget-install -Force

# 3. Run the installer script to download winget and its required libraries
winget-install -Force

(Sometimes you need to run this: Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass)

Restart your PowerShell to refresh your environment path variables.

# 4. Run this command to update
winget upgrade --all

Server 2019
If you want to do this for Server 2019, follow this modified solution.

# 1. Bypass the execution policy for this session
Set-ExecutionPolicy Bypass -Scope Process -Force

# 2. Force TLS 1.2 to download files securely
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# 3. Download and register the specialized installation script
Install-Script -Name winget-install -Force
winget-install -Force

Because Server 2019 lacks the execution aliases, you must add the hidden 
system folder where winget.exe is deployed directly to your environment path. 
Run this block in the same PowerShell window

# Locate the installed application folder and add it to the system PATH
$ResolveWingetPath = Resolve-Path "C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_*_x64__8wekyb3d8bbwe"
if ($ResolveWingetPath) { 
    $WingetPath = $ResolveWingetPath[-1].Path 
    $SystemEnvPath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
    if ($SystemEnvPath -notlike "*$WingetPath*") {
        setx /M PATH "$SystemEnvPath;$WingetPath"
    }
}

Now, Close your current PowerShell window completely and open a new one to reload the paths.
# 4. winget upgrade --all

***One more thing***
On a few computers, I've had to run the following commands to force it to freshen things up and start working
Add-AppxPackage -RegisterByFamilyName -MainPackage Microsoft.Winget.Source_8wekyb3d8bbwe
Invoke-WebRequest 'https://cdn.winget.microsoft.com/cache/source.msix' -OutFile "$env:TEMP\source.msix" -UseBasicParsing
Add-AppxPackage -Path "$env:TEMP\source.msix"

Windows 11 Network Refresh Without Reboot

# Full-Network-Reset.ps1

# Run as Administrator for full effect

Write-Host "Restarting network adapters..." -ForegroundColor Cyan
$adapters = Get-NetAdapter | Where-Object { $_.Status -eq 'Up' }

foreach ($adapter in $adapters) {
    Disable-NetAdapter -Name $adapter.Name -Confirm:$false
    Start-Sleep -Seconds 2
}

foreach ($adapter in $adapters) {
    Enable-NetAdapter -Name $adapter.Name -Confirm:$false
    Start-Sleep -Seconds 2
}

Write-Host "Flushing DNS cache..." -ForegroundColor Cyan
ipconfig /flushdns

Write-Host "Releasing IP address..." -ForegroundColor Cyan
ipconfig /release

Write-Host "Renewing IP address..." -ForegroundColor Cyan
ipconfig /renew

Write-Host "Resetting TCP/IP stack..." -ForegroundColor Cyan
netsh int ip reset

Write-Host "Resetting Winsock catalog..." -ForegroundColor Cyan
netsh winsock reset

Write-Host "Network reset complete. You may need to restart your computer." -ForegroundColor Green

.Net said .No so this says .Youbetterorelsebuddy

 I was having trouble with .net framework install on new computers.  I'm not sure why it didn't work repeatedly, but found that if you pop a flash drive in with windows 11 on it, and use the following command it works.  

C:\Windows\System32>DISM.exe /Online /Enable-Feature /FeatureName:"NetFx3" /All /LimitAccess /Source:"D:\sources\sxs"

Inventory + Excel + VBA = ❤️

 If you are like me and you have to look at a lot of spreadsheets with things like lists of inventory, you probably start seeing the cells dance as you try to track across the row.  Is that just me?  Maybe it is a touch of dyslexia. 

I asked AI to help me find a solution and my AI buddy delivered.  Thank you AI overlord ❤️

Here is a simple VBA code snippet that you can use to highlight the row of the active cell:

1. Press Alt + F11 to open the VBA editor.
2. In the VBA editor, find your workbook in the Project Explorer window.
3. Double-click on ThisWorkbook to open the code window for the workbook.
4. Copy and paste the following code into the code window:

Private Sub Workbook_SheetSelectionChange(ByVal Sh As Object, ByVal Target As Excel.Range)

    Dim ws As Worksheet

    Set ws = Sh

    

    ' Clear previous highlights

    ws.Rows.Interior.ColorIndex = xlNone

    

    ' Highlight the active row

    ws.Rows(Target.Row).Interior.Color = RGB(255, 255, 0) ' Yellow color

End Sub

        5.  Close the VBA editor and save your workbook as a macro-enabled workbook (.xlsm).

Now, This code will highlight the row of the active cell in yellow. You can change the color by modifying the RGB values.

Security and the boy who didn't want to go touch every computer because of a printer driver update...

DON'T DO THIS.  I REPEAT  DON'T DO THIS

Open Group Policy Editor:

• Press Windows + R to open the Run dialog.
• Type gpedit.msc and press Enter.

Navigate to Security Options:

• Go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.
• Find the policy Devices: Prevent users from installing printer drivers.
• Set this policy to Disabled.

Allow Non-Administrators to Install Drivers:

• Navigate to Computer Configuration > Policies > Administrative Templates > System > Driver Installation.
• Find the policy Allow non-administrators to install drivers for these device setup classes.
• Set this policy to Enabled.
• Click the Show button under the Options section and enter the following GUIDs:
• Class = Printer {4658ee7e-f050-11d1-b6bd-00c04fa372a7}
• Class = PNPPrinters {4d36e979-e325-11ce-bfc1-08002be10318}

Disable Point and Print Restrictions:

• In Group Policy Editor, navigate to Computer Configuration > Policies > Administrative Templates > Printers.
• Find the policy Point and Print Restrictions.
• Set this policy to Disabled.

Restart Your Computer

Windows print to PDF

It's Friday and it's 4:02 PM. I have nothing more clever in me. I'm just ready to go home and pet my dog Lucy. Here's a poem about Lucy.

With fur like clouds, a snowy heap, 

Lucy the fluff, in slumber deep. 

A gentle giant, soft and white, 

A cuddly dream, a pure delight. 

Her paws like pillows, big and grand,

A wagging tail, across the land.

A loving gaze, a happy sigh,

My fluffy Lucy, reaching high!

Go to a command prompt and enter this command
dism /Online /Disable-Feature /FeatureName:"Printing-PrintToPDFServices-Features" /NoRestart
After it finishes, enter the following command and you should be good
dism /Online /Enable-Feature /FeatureName:"Printing-PrintToPDFServices-Features" /NoRestart

Awkward Introductions & Windows Hello

You know that feeling when you meet someone new and it just starts off a little awkward? You are then thinking to yourself it sure would be nice if I can start over. Well, this sometimes happens when you set up Windows Hello. IF you want to say goodbye to windows hello and start over, enter this command into powershell.

certutil -deletehellocontainer

My New Friends for Windows Hello for Business

I just wanted to list a couple sites that have recently been very helpful for me in regards to the Windows Hello for Business configuration in Intune. The first one is Nicklas Ahlberg with Rockenroll.tech. https://www.rockenroll.tech/2024/06/17/windows-11-whfb-disablepostlogonprovisioning/ Create a new custom Windows configuration profile Add a new row: Name: W11 – DisablePostLogonProvisioning OMA-URI: ./Device/Vendor/MSFT/PassportForWork/{TenantId}/Policies/DisablePostLogonProvisioning ❗(replace {TenantId}with your TenantId). Data type: Boolean Value: True The next new friend is dannyda.com. This link will give you fun command lines to use for changing WHfB behavior. https://dannyda.com/2020/01/14/how-to-enable-disable-windows-hello-windows-hello-for-business-via-group-policy-registry-command-prompt-cmd/

The Wizarding World of PowerShell Calendar Permissions

1. Open the PowerShells and connect to the Exchanges:
   Install-Module -Name ExchangeOnlineManagement
2. Log into the Exchanges:
   Connect-ExchangeOnline -UserPrincipalName <your_username>
3. Take a look at who has access to a calendar:
   Get-MailboxFolderPermission -Identity "Snoop@Dogg.com:\calendar"
4. Give permissions to Martha:
   Add-MailboxFolderPermission -Identity "Snoop@Dogg.com" -User "martha@Dogg.com" -AccessRights Reviewer
5. When you finish, don't forget to close the session:
   Get-PSSession | Remove-PSSession

 Extra Credit:  If you would like to see what rights Martha has to every account in your M365 tenet you can use the command below.  This will take a long time if you have a lot of accounts.

Get-Mailbox | ForEach-Object {Write-Host "Processing mailbox: $($_.PrimarySmtpAddress)" Get-MailboxFolderPermission -Identity "$($_.PrimarySmtpAddress):\calendar" | Where-Object {$_.User -like "martha@Dogg.com"} | Select-Object Identity, User, AccessRights

Microsoft Entra hybrid device pending

Failure to launch?  You can't unsee some things.  That Terry Bradshaw scene in the forementioned movie still haunts me.

This part is from Microsoft...

Resolve Microsoft Entra hybrid devices in pending state

During the initial phase of the hybrid join process, the device state is expected to be pending until the registration process is complete.

A device may remain in a pending state for the following reasons that an admin can address:

Microsoft Entra Connect device synchronization changes

Problems could occur if a change made in Microsoft Entra Connect caused the device ID to be out of sync with the machine. Validate Microsoft Entra Connect is functioning as expected and there was no recent configuration changes.

Required Microsoft endpoints may be blocked by network

Devices must be able to communicate successfully with the following Microsoft endpoints:

• https://enterpriseregistration.windows.net
• https://login.microsoftonline.com
• https://device.login.microsoftonline.com
• https://autologon.microsoftazuread-sso.com (If you use or plan to use seamless SSO)
• Your organization's Security Token Service (STS) (For federated domains)

After confirming the above scenarios aren't contributing to the pending state, run the following command ”dsregcmd /leave” in an elevated command prompt and restart the device to attempt to rejoin the machine. Changes may take up to an hour to show in Microsoft Entra.

If the issue is persistent after following the steps above,  for further assistance.

Step 1: Remove Stale Intune Enrollment Artifacts

Run these steps as local admin on the device.

1️⃣ Delete the EnterpriseMgmt scheduled tasks

Task Scheduler →
Task Scheduler Library →
Microsoft →
Windows →
EnterpriseMgmt

• You’ll see one folder with a long GUID
• Delete ALL tasks inside that folder
• Do NOT delete the EnterpriseMgmt root

2️⃣ Delete the matching enrollment registry key

Open Registry Editor and go to HKLM\SOFTWARE\Microsoft\Enrollments

Look for a GUID key that matches the one under EnterpriseMgmt

Confirm it contains a UPN value

Delete that GUID key

Step 2: Refresh Policy and Trigger Re‑Enrollment 

Open a command prompt and enter
gpupdate /force
shutdown /r /t 0

Am I too old to view the software installed on a remote computater?

Yall, I couldn't remember how to stealthy, geeky, and command liney check to see what was on a remote computer.  I thought I had a post about it but I could not find it.  So, here's an easy way to get your geek on.

Get-CimInstance -Class Win32_Product -Computer YoReplaceWithRemoteComputerName | where vendor -eq 'YoReplaceWithVendorName' | select Name,Version

If Peter Parker were to manage the Googles - GAM

 

GAM is an open source command line tool for making changes to objects in the Google Admin console. It is thoroughly documented at the Github Wiki. The options available for use with GAM are displayed in specific sections on the right-hand side of the GAM Wiki.

I always quote Peter Parker's Uncle Ben when discussing a tool like this.  
"With great power comes great responsibility" 
GAM is a powerful tool, and it could be easy to break a lot of stuff rapidly.  Google support may not be super forgiving if you tell them you deleted all your user accounts while using GAM.

If you need help, this page should be your next click.

Directory Commands

In my case, I needed a way to suspend a little over 1700 accounts that had been improperly processed for a few years.  Below is the command I used to suspend all the user accounts in the Inactive Students organizational unit.  Please note suspend 0 will make accounts active and suspended 1 will suspend the account.

gam ou "/Inactive Students" update user suspended 1

I should say, I'm not really sure what GAM stands for.  I assume it is Google Admin Manage(r) or something like that.  I couldn't find it listed anywhere.  

M365: I guess it's time to hybrid join

 Well, they finally pushed us to hybrid join all our clients to Microsoft Endpoint (otherwise known as intune).  It is actually really cool and made me excited about Microsoft again.  

You can do cool stuff like

• Finally, ditch WSUS servers in favor of Windows Update Rings (WUR)😍
• Deploy software packages and configuration profiles while the client is offsite
  
  Instructions to hybrid
  

Windows Updates Got The 0x80248007 Blues

Does your winders updates have the 0x80248007 blues?

1. Hold down the Winders Key and Press R. Type services.msc and enter.  If you are running as a standard user (you not be running with admin privileges), I like to run a command prompt by right click run as administrator.  Then you can type services.msc into the command prompt to run services.msc with elevated privileges. 

2. In the Services window, find the Windows Update and right-click it to select Stop.

3. Using the File Explorer or command prompt, navigate to the partition or drive where Windows is installed. Find the following path.  Usually this will be the C:\SoftwareDistrobution\DataStore

4. Delete everything in the DataStore folder.

5. Now go to C:\SoftwareDistrobution\Download and delete everything. 

6. You can now go back to services.msc and start the Windows Update service.

7. Find Windows Update or Automatic Updates, right-click it and select Start from the context menu.

Now you should be able to check for updates again to be sure everything is working.

Powershazzille Exchange Folder Size

From the Lazy Admin.  Cool dude Connect to Exchange Online with PowerShell - The Best Method (lazyadmin.nl)

1.  Launch an elevated PowerShell window

2.  Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
        a. Say Y

3.  Install-Module -Name PowerShellGet -Force
        a. Say Y

4.  Install-Module -Name ExchangeOnlineManagement -Force

5.  Update-Module -Name ExchangeOnlineManagement

6.  Connect-ExchangeOnline -UserPrincipalName john@contoso.com

Now that you are connected you can run the next command to get the folder size information.  Replace username with the user you want to look up.

7.  Get-MailboxFolderStatistics username | Select Name,FolderSize,ItemsInFolder

When you finish, don't forget to disconnect

8.  Disconnect-ExchangeOnline

Installing .mis and .exe packages with Intune

1.       Go to this link and download the converter.  If you want more instructions, click here.

2.       After downloading the IntuneWinAppUtil.exe, you may want to move it over to an easy to find folder on your computer.

3.       Run IntuneWinAppUtil.exe and follow the prompts.  The file will ask you for the following.

a.       Folder location of your source .msi or .exe

b.       The filename of the .msi or .exe

c.       The destination of the new .intunewin file we are creating

4.       Now you can head on over to endpoint.microsoft.com>Apps>Windows

a.       Click Add

b.       Select the app type Windows app (Win32)

c.       Select the .intunewin file you created earlier

d.       Fill out all the important information.  I like to be sure and add a logo image to make it easier for end users if you are going to allow them to select it in the company portal.

e.       Install command: if you converted a MSI the field should already be populated.  If you converted an exe file, you would use the setup.exe /s command in the

f.        The quest for the uninstaller

                                                               i.      You will need to run this powershell script to find the uninstaller identifying number.

                                                             ii.      get-wmiobject Win32_Product | Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize

                                                           iii.      Now you will need to put the msiexec.exe /x {unique identifying number from step 1} /qb command in the uninstall command in your Intune Win32 Application

M365: Whitelisting Stuff Against My Better Judgment

 Well, there are a few options on M365 when looking for where mail flow is hanging up.  I've never been really sure why you have to add it in multiple places.  Probably has something to do with the service it hits first in the mail flow.

• Sometimes it helps to add a mail flow rule "admin.exchange.micros>Mail flow>Rules"
•  Add a new rule but just remember to enable it.  
• Another option is to take a look at the SPAM filter "Security.microsoft.com>Email & collaboration>Policies & rules>Anti-Spam policies>Anti-spam inbound policy (Default)"
• Policies & rules > Threat Policies >Preset security policies.  Select the policy you want and then walk through the wizard until you get to the Impersonation protection section.  Then you will eventually come across the trusted senders and domains feature.

M365 User blocked from sending emails

 This was a fun one.  Microsoft blocked a user from sending emails a few weeks after the original incident.  When I looked to see where the user would normally show as blocked in the online interface, it was not identified as blocked.  So, the only thing I could think of was to check it in PowersHell.  (Why do I have to use PowersHell for everything...)

1.  Install PowersHell 7 (it is much easier to connect to exchange online)

2.  connect-exchangeonline and login when prompted

3.  get-blockedsenderaddress to see if the account in question was blocked

4.  remove-blockedsenderaddress -senderaddress flast@domain.com

Computers with trust issues

 This can be a dark world so sometimes our computers develop trust issues.   This is a powershell command to fix the trust relationship.  I wish it was this easy with humans...

Reset-ComputerMachinePassword -Server DomainController -Credential DomainAdmin

• Server — the FQDN name of any domain controller;
• Credential — domain user (with permission to add the computer to the domain) or domain admin account.