Just looking for some feed back

katiecolman · 2021-07-29T17:24:00.000Z

Sorry mods I don’t know where to put this. If I get the wrong group, feel free to shuffle to the right one.

So, I did some coding that normally in other jobs I have been chased away from. I get it. The guy who wrote the code, didn’t put in notes and he doesn’t want anyone messing up his code. But honestly in two days I have been able to script changes to new Window’s Account setups to make it really two touch. Once to image with WDT and then to log into the machine as the user and plug in a thumb drive that completes the changes my boss (who started his career as a science teacher) requested. Scale, adding desktop icons, changing home pages, disabling auto start on teams, setup the taskbar in a specific manner including removing and adding buttons.

I did most of this with Regedit scripts, (not the homepage setting of default app setting that was done with .XML and Powershell.) in just under two days.

We don’t have the cleanest AD, which I am working on so GPOs are a reliable option unless I start the object and containers that will use the policies myself from square 1.

Would there have been a better way to do this then scripting some powershell commands to add and edit registry values? Any thing in the WDS / WDT deployment I could have accessed that I missed?

I’ve been crash course learning WDT for the last month after the original setup on the server wiped out, and I don’t have a lot of time left to get this process as lean as I can. I have another two weeks or so and want to check with fellow Spicers if this acceptable, is there a better way, other suggestions.

Neally · 2021-07-29T17:32:13.000Z

beeeeeeeeEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEP

oh… not that kind of feedback… I’ll show myself out…

Neally · 2021-07-29T17:40:34.000Z

katiecolman:

Would there have been a better way to do this then scripting some powershell commands to add and edit registry values?

The issues is subjective. I’m biased, I love PowerShell, so I’d say that’s, for me, the best way to do it.

As most things in IT, there are various ways to approach it, there is nothing wrong it it, it’s just a different approach.

If that person is not super fit in PowerShell / scripting, I can see that they would not be a fan.

I’m sure WDT as all kinds of woodoo you can bake in so you do not have to later change reg keys and such, but again, was the goal achieved?
Does it really matter how as long as it’s reasonable? ¯_(ツ)_/¯ You be the judge.

weirdfish · 2021-07-29T21:16:30.000Z

I don’t have anything useful to add, but I just wanted to spice this up because this sounds completely awesome.

jagowu · 2021-07-29T21:17:53.000Z

Power shell is the way to go with MDT and windows and sccm. I wish I understood power shell a lot more than I do.

I think powershell mdt and the profiles are a good step. If these changes with the scripts do not cause issues with new and current users then you could gradually go to GPOs if you like.

This is really a preference on how to achieve the same goal.

Also i would like a copy of your scripts lol

general-tsao · 2021-07-30T10:48:58.000Z

IMHO Clean up that AD (it isn’t that hard), create a structure that makes sense to your organization and accomplish as much as you can with GP, the rest use your scripts to configure. GP is so valuable because it is a NO work solution once set up. Turn that PC on, join it to the domain, reboot and all that customization has been done for you with zero effort.

katiecolman · 2021-08-02T11:32:00.000Z

General Tsao:

IMHO Clean up that AD (it isn’t that hard), create a structure that makes sense to your organization and accomplish as much as you can with GP, the rest use your scripts to configure. GP is so valuable because it is a NO work solution once set up. Turn that PC on, join it to the domain, reboot and all that customization has been done for you with zero effort.

I am trying. The issue is more people then machine. My boss doesn’t understand it fully and he has had other people complain about trying and failing at GPO in the past so he has a mindset against it. -_-; Another fight that I might just squeeze by, by fixing it and apologizing later.

@jagowu

Here is what I have that I can share currently. I have to scrub some data when I have more time to post the rest.

Default App association is not my script but came from here:

https://kolbi.cz/blog/2017/10/25/setuserfta-userchoice-hash-defeated-set-file-type-associations-per-user/

This guys has done the leg work to defeat the unique hash that is a pain. If you need some help parsing it out let me know. It took me a second to fuly understand what he was doing. (Again I don’t script heavily.)

The rest:

#Set Power and Sleep Settings#

#Set in plain minutes, ac is battery and dc is plugged in#
powercfg -change -monitor-timeout-ac 7
powercfg -change -monitor-timeout-dc 7
powercfg -change -standby-timeout-ac 10
powercfg -change -standby-timeout-dc 5

#Scaling#

#DPI Value of a machine to be 1 less step than what it is currently at. So if a machine is set to be at 150% scaling it will move down to 125%. You also need to look up the name of the screen in question through the registry and replace the last section of the path with the current monitor models name. Good per Model.#

Set-ItemProperty -Path ‘HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\ScaleFactors\LEN889B0_1E_07E3_A3^CA42C57140D332784E8132BDA7D5356C’ -Name DpiValue -Value -1
Get-ItemProperty -Path ‘HKLM:\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\ScaleFactors\LEN889B0_1E_07E3_A3^CA42C57140D332784E8132BDA7D5356C’
Set-ItemProperty -Path ‘HKCU:\Control Panel\Desktop\PerMonitorSettings\LEN889B0_1E_07E3_A3^CA42C57140D332784E8132BDA7D5356C’ -Name DpiValue -Value -1
Get-ItemProperty -Path ‘HKCU:\Control Panel\Desktop\PerMonitorSettings\LEN889B0_1E_07E3_A3^CA42C57140D332784E8132BDA7D5356C’

#Remove apps#
#Remove the News and Interests from taskbar. 0 is show icon and text. 1 is show only icon. 2 is hide everything3
Set-ItemProperty -Path ‘HKCU:\Software\Microsoft\Windows\CurrentVersion\Feeds’ -Name ShellFeedsTaskbarViewMode -Value 2
Get-ItemProperty -Path ‘HKCU:\Software\Microsoft\Windows\CurrentVersion\Feeds’
#Remove the Task View#
#This icon only has on or off. So 1 is on and 0 is off#
Set-ItemProperty -Path ‘HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced’ -Name ShowTaskViewButton -Value 0
Get-ItemProperty -Path ‘HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced’

#Remove Cortana from the searchbar#
#This will create a dword value and set it so Cortana is disabled. Again 1 is on and 0 is off#
Set-ItemProperty -Path ‘HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced’ -Name ShowCortanaButton -Value 0
Get-ItemProperty -Path ‘HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced’

#Change Apps#
#Change the search bar from a field to an icon. 2 enables the field. 1 is the magnifying glass icon. 0 is hidden.#
Set-ItemProperty -Path ‘HKCU:\Software\Microsoft\Windows\CurrentVersion\Search’ -Name SearchboxTaskbarMode -Value 1
Get-ItemProperty -Path ‘HKCU:\Software\Microsoft\Windows\CurrentVersion\Search’

#Add Windows Ink Workspace button. Again 0 is Hide and 1 is show#
Set-ItemProperty -Path ‘HKCU:\Software\Microsoft\Windows\CurrentVersion\PenWorkspace’ -Name PenWorkspaceButtonDesiredVisibility -Value 1
Get-ItemProperty -Path ‘HKCU:\Software\Microsoft\Windows\CurrentVersion\PenWorkspace’

#Add Windows Touch Keyboard button. Again 0 is Hide and 1 is show#
Set-ItemProperty -Path ‘HKCU:Software\Microsoft\TabletTip\1.7’ -Name TipbandDesiredVisibility -Value 1
Get-ItemProperty -Path ‘HKCU:Software\Microsoft\TabletTip\1.7’

#Deploy Task bar XML icons:#

Import-StartLayout -layoutpath D:\TaskbarSetup.xml -Mountpath C:\

xml File for Taskbar icon. I named mine TaskbarSetup.xml Change this in the code above if you name is something else# #To add an icon, go to the start menu right click on the icon of the software you want to add to the taskbar and select open file location.#

#Copy the file path from … \Start Menu\Programs\ on and add it to a new line of code, then add the name of the .lnk file exactly as it appears. for the start menu.#

<?xml version="1.0" encoding="utf-8"?>

<LayoutModificationTemplate
xmlns=" http://schemas.microsoft.com/Start/2014/LayoutModification" ;
xmlns:defaultlayout=" http://schemas.microsoft.com/Start/2014/FullDefaultLayout" ;
xmlns:start=" http://schemas.microsoft.com/Start/2014/StartLayout" ;
xmlns:taskbar=" http://schemas.microsoft.com/Start/2014/TaskbarLayout" ;
Version=“1”>

defaultlayout:TaskbarLayout
taskbar:TaskbarPinList
<taskbar:DesktopApp DesktopApplicationLinkPath=“%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Chrome.lnk” />
<taskbar:DesktopApp DesktopApplicationLinkPath=“%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk” />
<taskbar:DesktopApp DesktopApplicationLinkPath=“%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Word.lnk” />
<taskbar:DesktopApp DesktopApplicationLinkPath=“%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Excel.lnk” />
<taskbar:DesktopApp DesktopApplicationLinkPath=“%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk” />
<taskbar:DesktopApp DesktopApplicationLinkPath=“%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\OneNote.lnk” />
<taskbar:DesktopApp DesktopApplicationLinkPath=“%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Publisher.lnk” />
<taskbar:DesktopApp DesktopApplicationLinkPath=“%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop 2021.lnk” />
<taskbar:DesktopApp DesktopApplicationLinkPath=“%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk” />
<taskbar:DesktopApp DesktopApplicationLinkPath=“%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Audacity.lnk” />
<taskbar:DesktopApp DesktopApplicationLinkPath=“%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Zoom\Zoom.lnk” />
<taskbar:DesktopApp DesktopApplicationLinkPath=“%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk” />
</taskbar:TaskbarPinList>
</defaultlayout:TaskbarLayout>

jagowu · 2021-08-02T12:05:54.000Z

Thanks for sharing. If you want to make all of these settings in a GPO and apply them from MDT rather than reg keys you can download this tool called LGPO and make a GPO and then export it and when deploying an image in MDT you can import/apply it.

https://www.microsoft.com/en-us/download/details.aspx?id=55319

Me personally I started Win10 with custom reg keys and .xmls’ but as time goes on it just seems a lot easier to maintain with GPOs.

Here are some other items I have used in the past.

Remove Cortana completely: (powershell)

Get-AppxPackage -allusers Microsoft.549981C3F5F10 | Remove-AppxPackage

Power Adjustments

powercfg.exe /change monitor-timeout-ac 0

powercfg.exe /change monitor-timeout-dc 0

powercfg.exe /change standby-timeout-ac 0

powercfg.exe /change standby-timeout-dc 0

powercfg.exe /change disk-timeout-ac 0

powercfg.exe /change disk-timeout-dc 0

REM: Lid Close Action (Do Nothing)
powercfg /setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000

REM: Power Button Action (Shutdown)
powercfg /setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 003

REM: Sleep Button Action (Do Nothing)
powercfg /setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 000

REM: Start Menu Button Action (Shutdown)
powercfg /setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 a7066653-8d6c-40a8-910e-a1f54b84c7e5 002

REM: Lid Close Action (Do Nothing Battery)
powercfg /setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000

REM: Power Button Action (Shutdown Battery)
powercfg /setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 003

REM: Sleep Button Action (Do Nothing Battery)
powercfg /setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 000

REM: Start Menu Button Action (Shutdown Battery)
powercfg /setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 a7066653-8d6c-40a8-910e-a1f54b84c7e5 002

Install Cert (Run Command Line)

certutil.exe -f -addstore TrustedPublisher MYCERT.cer

Remove QuickAssist (Powershell)

Remove-WindowsCapability -online -name App.Support.QuickAssist~~~~0.0.1.0

Remove Windows Features

Easy way to do this is after you deploy an image make a list of the features that are and are not installed.

In your task sequence, at the top, click Add > Roles > Uninstall/Install Roles and features. Choose Windows 10 as the OS and you pick and choose.

Remove Roles within a Task Sequence CMD Line with No Restart

dism /online /disable-feature /NoRestart /featurename: ← input feature name here

example: dism /online /disable-feature /NoRestart /featurename:SmbDirect

Disable User First Sign-in Animation (MDT CMD Line)

cmd /c REG ADD “HKLM\SOFTWARE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System” /V EnableFirstLogonAnimation /T REG_DWORD /D 0 /F

Batch file to adjust Default User/New User Logins

reg.exe load HKEY_LOCAL_MACHINE\defuser c:\users\default\ntuser.dat

reg.exe delete HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v OneDriveSetup /f

REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Policies\Microsoft\Windows\Explorer" /V HidePeopleBar /T REG_DWORD /D 1 /F

REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /V SearchboxTaskbarMode /T REG_DWORD /D 0 /F

REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /V RotatingLockScreenOverlayEnabled /T REG_DWORD /D 0 /F
REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /T REG_DWORD /V RotatingLockScreenEnabled /D 0 /F

REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /T REG_DWORD /V SystemPaneSuggestionsEnabled /D 0 /F
REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /T REG_DWORD /V SubscribedContentEnabled /D 0 /F
REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /T REG_DWORD /V SoftLandingEnabled /D 0 /F
REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /T REG_DWORD /V SilentInstalledAppsEnabled /D 0 /F
REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /T REG_DWORD /V PreInstalledAppsEnabled /D 0 /F
REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /T REG_DWORD /V OemPreInstalledAppsEnabled /D 0 /F
REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /T REG_DWORD /V FeatureManagementEnabled /D 0 /F
REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /T REG_DWORD /V ContentDeliveryAllowed /D 0 /F

REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /V DisableWindowsSpotlightFeatures /T REG_DWORD /D 00000001 /F

REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows Defender" /V UIFirstRun /T REG_DWORD /D 00000000 /F

REG ADD "HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Edge" /V HideFirstRunExperience /T REG_DWORD /D 1 /F

reg.exe unload HKEY_LOCAL_MACHINE\defuser