Windows 10 Migrations, SCCM Admin Staffing, and the 1990’s are Still Calling

I’m back home after a few weeks of on/off travel and finally have time to unwind.  Like the last week, the others were focused on Windows 7-to-Windows 10 migration planning and piloting work with either MDT or Configuration Manager (SCCM).  After getting fisted that many times, oops, I mean, exposed to the internal workings of various customer environments, I often need some time and distance to put it all into an objective perspective.  And that rhymes, so that’s cool too.

Windows 10 Migrations

Thankfully, most of the customers I deal with have a clue.  And if they don’t have all of the questions figured out, they’re at least eager to get answers, either on their own, or by asking around.  That’s always a good thing.  Some however, seem to be content with status quo.

I’ve said it before, and I will say it again:  Stop spending time shoe-horning Windows 10 into another Windows 7.  The same old “new car” metaphor comes to mind:  How would you feel if you went to buy a brand-new vehicle, and the sales person said to you “Your new car will be ready by tomorrow, we need to remove all of the new features so it works just like your 5 year old model.  We figured you couldn’t handle the new features“.  Pardon my Brooklynese, but you’d probably bitch-slap them with a set of brass knuckles.  At the very least, you’d spray them with the coffee in your mouth, and then proceed to another dealership for a better experience.

Your new car will be ready by tomorrow, we need to remove all of the new features so it works just like your 5 year old model.  We figured you couldn’t handle the new features.

So, why would you do the same with “TECHNOLOGY”?  You are handling THE EPITOME of “TECHNOLOGY”, not a vehicle, toothbrush or coffee machine (okay, maybe a coffee machine is more awesome, but stick with me here).  I realize this situation is almost always a cultural one.  As in, business culture.  Years and years of communication degradation and sneering looks while roaming the hallways, between IT and “users”, needs to end.  Time for an olive branch, or a box of doughnuts, or a box of doughnuts infused with Xanax or something.  Anything to stop the old and start the new.  And here’s why:

Settling the passive-aggressive cold war solves multiple problems at once.  First, it paves the way for cooperation, which helps greatly with current and future projects and implementing change in the environment.  Second, it helps OFFLOAD work done by IT into the hands of users.  That’s right, you can offload work into the hands of users.  Repeat that last sentence until your mouth gets dry.  For example, SCCM “Software Center”.  Learn it.  Know it.  Live it.  Use it.  Third, educating users on new features feeds reasons 1 and 2 and helps them find things on their own.  You consider users too stupid?  Okay, find the smartest users in each group and empower them as field reps for your initiatives.

Spending hours and hours shoving shortcuts into specific places using scripts and Group Policy?  Stop!  Show users how to find their own shortcuts and use the “pin” feature.  Sell this as “IT isn’t going to control your desktop world anymore.  We’re giving you FREEDOM and SUPPORT.”  EVERY single place I’ve seen this attempted, it has done wonders.  I believe in it whole-heartedly.

SCCM Admin Staffing

This is ancillary to the above rant, but relevant.  More relevant than the discussions involving MDT at least.  What am I talking about?  I’m talking about customers who either decided on their own, or were mislead by overzealous sales people, on the realistic demands required of people who manage SCCM in a production environment.  There are several factors to consider which impact the amount of time this product demands:

  • The scale/size of the environment (including geographic spread)
  • The existing staffing resources (who, where, how many)
  • The types of assets being managed
  • The specific features to be enabled and leveraged in SCCM
  • The abilities of the people who will manage SCCM

I’m sure there’s a quantifiable method to derive meaningful numbers, but allegory seems to be nearly as effective:

  • Customer A has 5,000 Windows devices spread across 20 locations in 5 countries, with an IT staff of around 6 people.
    • There are 24 distinct hardware models in production
    • On average 2 new models are introduced per year
    • Customer A wishes to implement SCCM for imaging, app deployments, software updates, inventory and reporting and endpoint protection
  • Customer B has 5,000 Windows devices located in 2 locations in the same geographic area, with an IT staff of 2.
    • There are 24 distinct hardware models in production
    • On average 2 new models are introduced per year
    • Customer B wishes to implement SCCM for imaging, app deployments, software updates, inventory and reporting and endpoint protection

Guess which one isn’t going to enjoy coming to work much longer?

Dear managers: STOP TRYING TO BE CHEAP.  Staff your environment like you really want it to be effective.  If you plan to do imaging, and it doesn’t really matter what you intend to use, Acronis, Ghost, or any other shitty outdated trash you like rather than MDT or SCCM, you need to dedicate staff to that role.  Keeping up with drivers, firmware and software, all the glue-sniffing InfoSec stupidity (that should be managed in the environment, not entirely in the image), the Change Control meetings (you do have CC in place, right?), and the subsequent pilot and rollout work, is not something to be expected of anyone devoting 1 hour a week to it.  If you don’t have someone to assign to the role, hire someone.

This also applies to other time-suck roles like software updates, application deployments and reporting.  In some environments, when there are dedicated “business reporting” roles, and they learn about someone having access to pull reports from asset inventory data, they will converge on that person like refugees surrounding a relief truck in a war zone.  If  any of this applies to your environment, and you haven’t already, sit down with your admin folks and ask questions.  Try to learn what the role actually entails.  How much time they typically spend on each part of their job and what could be done to reduce the time.  Maybe you already have the tools to deal with it and just need some training or guidance.  Maybe you need to look for newer/better/different tools.  Regardless, do something.  Don’t sit back and wait for it to automate itself, because that’s not going to happen.

I think I digressed a bit.

The 1990’s

If you’re still writing Kix, Batch or VBScript scripts to semi-automate your chores, why?

Is it because you’re still running them on outdated platforms?  Why?

Is it because “management” won’t approve updates to the platform environment?  Why?

Is it because “management” is afraid of change?  Why?

I’ll just say this:  The longer you continue to focus your attention and efforts on outdated shit, it only reinforces two things:

  • It further suppresses your skill set, and your marketability for applying for other jobs
  • It saves your employer money at the risk of increasing security vulnerabilities and reduced support options from vendors

If your goal is only to stockpile cash from your ridiculously high-paying job, so you can parachute out into something else, fine.  If you’re living paycheck-to-paycheck: get out!

Final thoughts:  The conveyor belt of technology change is not slowing down.  In fact it is speeding up.  Ask anyone who works with cloud services how often their tools are being updated (weekly).  Ask how often things like Windows and SCCM are being updated (monthly).  None of that was even conceivable 5 years ago.  The time to dump all the 10-year old practices isn’t now, it was a year ago.  Get moving!

Advertisements

Discussion Points / FudgePop again

20160305_121835

So I had a nice discussion about this FudgePop thing, which is starting to sound like a marketing ploy.  But trust me, it’s only a project, nothing being marketed.  I’m not sure if I’ll add any more stuff to it unless I get really bored or some sort of revenue scheme hatches from it.  Again, that’s unlikely at this point.  As with CMWT, GPODoc, and CMBuild, these are just for fun and exercise.  I’m pretty sure some of you are tired of hearing about this thing with a childish name attached to it, and that’s fine. But keep in mind, the same could be said about the U.S. government, but I digress. 🙂

In case you can’t tell already, I’m slowly getting back to blogging after a brief hiatus.  I still don’t know where this is going to go, or for how long, etc.  One day at a time.

So, given that this is all open source and available on GitHub, here’s some thoughts for anyone feeling bored enough to fork or branch this for a future pull, or just to run off and get rich while I toil for table scraps, here’s some roadmap thoughts…

Mighta, Oughta, Woulda, Coulda, Shoulda…

Inventory

Inventory collection and reporting would be fairly simple to add.  I already built a proof-of-concept branch to collect data and upload it to a SQL database in Azure.  Anyone can do that.  What I would do differently is store a local copy of the payload with a checksum, maybe store the checksum and timestamp in the Registry, along with a timestamp of “LastInventoryUpload”.  Then subsequent inventory cycles would compare the new output checksum against that previous and only upload if the values are different.  Sound familiar?

Offline Mode

Rather than reading the control XML in real-time on each execution cycle, it could download the latest version to a local cache.  Then continue to enforce that on subsequent execution cycles if there are no available Internet connections.

Smaller Stuff

Other suggestions for possible consideration:

  • Download caching for either (or both) the Files and Win32 Apps control groups (fairly simple)
  • Manage local Group Policy for workgroup computers (ideas) (somewhat complex and limited, but promising)
  • Add, modify local user accounts (easy)

What it can do now

As of build 1.0.16, FudgePop can do the following on remote computers which are configured with the agent service:

  • Chocolatey Packages
    • Install, Update, Remove
  • Win32 Application Packages
    • Install, Uninstall
  •  Files
    • Copy, Move, Rename, Delete, Download
  • Folders
    • Create, Delete, Empty
  • Windows Services
    • Modify/Configure, Start, Stop, Restart
  • Registry
    • Create, Delete (keys, values)
  • Permissions (ACLs)
    • Files/Folders: Modify
    • Registry: Not implemented
  • PowerShell Modules
    • Install, Update
  • Shortcuts
    • Create, Delete
  • AppX Applications
    • Remove
  • Windows Update
    • Force Scan/Download/Installation
  • Inventory
    • Basic HTML reporting
  • Targeting
    • Device = comma-delimited list of device names (NetBIOS names)
    • Collection = arbitrary name which is then assigned a comma-delimited list of device names.
    • Enable = true/false (per setting or group, or per control file)
    • Central authority = deploy changes from central XML file, even redirect to new XML files without touching remote device by hand.
  • Ingredients
    • PowerShell and XML, and a sprinkle of cloud storage (to host control files)
  • Tools
    • Visual Studio Code, Notepad++, Paint.Net (for the spiffy icon)

The Future

Who knows.  I don’t even know what my 401-k is doing tomorrow.

Quick Rundown on FudgePop and why the Silly Name

The name comes from a wine-infused discussion around Chocolatey, which was around Nuget, which was around Brooklyn Brewery’s Black Chocolatey Stout, which was bout $9 per bottle.  This post however, was sponsored by half a bottle of Pinot Noir, by an unnamed winery somewhere in Wineville.  FudgePop itself was contrived from a casual “bet” over a bottle of Dogfish Head 120 IPA that it’s possible to use nothing but free tools and features included with Windows 10 to manage a “group” of such devices from a central location, regardless of where those other devices are located.

Btw, I just uploaded 1.0.16 to the PowerShell gallery

Installation

Install-Module FudgePop
Import-Module FudgePop

Note: .NET framework 3.5 is recommended for some Chocolatey packages.  FudgePop does not install .NET 3.5 by default.

Use the following to confirm/verify the latest version…

Get-Module

Once the module has been installed on each subsequent victim, er, I mean “device”, scaling out is just a matter of replicating the same steps as the previous device.  On domain-joined devices, you can use Group Policy to deploy it as well as via PowerShell deployment from Intune for devices joined to Azure AD Premium.  Workgroup computers require manual intervention (hands-on, remote connection, etc.)

Functions

New-FudgePopTemplate

Creates a new XML control file using the default (sample) provided with the module.  Other samples are posted on the project GitHub site.  Note that all settings are disabled by default, and filled in with sample/example information only.

New-FudgePopTemplate -OutputFile "c:\devtest\control.xml"

Install-FudgePop

Configures default options such as control file location, enable/disable recurring scheduled execution, and hourly interval between scheduled executions.

Install-FudgePop

Invoke-FudgePop

Executes the FudgePop agent.  If you configured it correctly, magical things happen before your drunken eyes.  If you goofed up the configuration, it forces you to watch The View until your eyeballs bleed.  That last feature is not yet enabled.  Note that this function is what is called by the RunFudgePop.bat script during each scheduled execution (if scheduled execution is enabled).

Invoke-FudgePop -TestMode -Verbose
Invoke-FudgePop -Verbose

Remove-FudgePop

Disables and uninstalls FudgePop from a client device.  It then applies 440 volts of taser current to your genitals until you reinstall it.  jk

Remove-FudgePop -Complete

Show-FudgePop

Displays information about current configuration, last runtime status and rectal thermometer temperature of your cat or dog.  That last feature is not yet enabled.

Show-FudgePop

Get-FudgePopInventory

Bonus, low-calorie, gluten-free, and totally vegan function to export basic inventory data from your meth-addicted Windows device.  It was a proof-of-concept to export a basic set of juicy and utterly useless data into an Azure SQL database so I could win a bet and enjoy a free sushi lunch.  The Azure SQL interface is planned for a future version, but will ultimately depend on user feedback (i.e. does anyone really want that capability?) and how badly I want more sushi.

Get-FudgePopInventory
Get-FudgePopInventory -Computer d001,d002,d003
Get-FudgePopInventory -FilePath "c:\reports\"
Get-FudgePopInventory -StyleSheet "c:\reports\custom.css"

Help

The markdown files were cranked out by a team of recovering caffeine addicts fresh from the Port Authority bus terminal.  Actually, they were cranked out with PlatyPs, which is pretty cool, and doesn’t come from the bus terminal.  You can find them in the “docs” folder beneath the module path (e.g. “c:\program files\WindowsPowerShell\Modules\fudgepop\1.0.16\docs”).

Use FudgePop in a Sentence

Hey man.  I just took a FudgePop on your mattress.”

Sample Scenario

You’re drunk.  But that’s not unusual with your day job as an airline pilot.  You staggered out of an airport terminal, and fell face-first into a random Uber vehicle with the doors open.  You wake up the next morning at your apartment, in a bathtub filled with ice, and a clear plastic aquarium tube attached to where your left kidney used to be.  You get up carefully, and drag the tube with you to the kitchen and make some fresh ramen with Srirachi sauce and a cup of coffee.  The entire time you keep thinking that of all his pranks, your roommate did a fantastic job of making these sutures look and feel authentic.

You grab your roommate’s laptop which has Windows 10 1709 installed, and you logon as a local administrator account and open a PowerShell console using “Run as Administrator”

You set the execution policy to Unrestricted, while staring at the PowerShell book with Don Jones’ picture on it, and say to yourself, “I know, this is very very bad, but I live on the edge baby.”

Set-ExecutionPolicy Unrestricted

You then use one finger on each hand to type:

Install-Module FudgePop

…and press Enter.

(example only. actual results may vary, depending upon your alcohol intake and criminal record)

Then, you can’t help it, but you hurl directly onto your cat, who returns the favor by urinating in your snow boots.  You use the cat to wipe your face off, and return back to the keyboard and type:

Import-Module FudgePop

…and press Enter.

After an IV drip of Death From Above coffee, and a Cat Shampoo enema, you type:

New-FudgePopTemplate -OutputFile wtfisthis.xml

…and make a new control XML file.  You edit it to suit your test environment (computer names, collection names, apps, etc.) and copy the XML file to your GitHub Gist.  You get the “raw” Gist URL and copy the address to your clipboard.

You make some breakfast from whatever isn’t fuzzy in the fridge and then go back to the keyboard, where you cat fell asleep, causing the letter “zzzzzz” to overflow the buffer and make a machine gun beep sound.  You realize that wasn’t Cat Shampoo, but Drano that your poured into the Cat Shampoo bottle because the Drano bottle leaked after you dropped while trying to light your vaporizer with a match.  You scoot the kitty off the keyboard, brush off the hair balls and type…

Install-FudgePop

You answer the prompts with one hand, choosing to enable the scheduled run option for 3 hour intervals, while the other hand is manipulating a pair of greasy chopsticks you found in the trashcan because you couldn’t find a fork, spoon, or plastic spork anywhere.

You look around for the mouse, but it’s gone.  After scouring the entire house/apartment, you find it buried in the kitty litter box.  You recover it, wipe it off on your pants and set it back on the desk and use it to poke around to see what all this FudgePop mess did to your roommate’s computer…

  • It created a registry hive under HKLM:Software\FudgePop
  • It created a PowerShell module folder under $env:PSModulePath
  • It created a Scheduled Task named “FudgePop Agent” under the root folder
  • It added $100 to your bank account (not really)

You go back to the PowerShell console, pause, look around for the cat, and think “what in the **** am I doing anyway?” and after 30 seconds of staring into space you remember that you were using your roommate’s laptop for an important experiment, and you continue on.

You type in…

Invoke-FudgePop -TestMode -Verbose

…so you can see everything it would have done if it weren’t using that stupid -TestMode switch.  It prompts you to trust some mysterious thing called an “untrusted repository”, but you’ve got 55 gallons of testosterone coursing through your veins, and no stupid sissy warnings are going to scare you off.  And besides, you can’t spell “untrusted” without the word “trust” so how could it be bad?  Just like your cousin who kept whining about putting that safety “on” when you were shooting at tin cans and you ignored him and shoot him in the foot.  Like that’s any excuse to use safety stuff.  Yeah.  But it’s okay, because FudgePop is only asking you to trust the PowerShell Gallery, so it can install some needed tools.

You toss back another glass of liquor, notice the cat staring at you, making you wonder if she spiked your glass with something special.  You ignore that feeling and type…

Invoke-FudgePop -Verbose

…just to see what it’s doing to diabolically reconfigure your roommate’s laptop into a tactical nuclear toilet flushing device.  Not really, but it’s likely that it’s creating a desktop shortcut for Internet Explorer, installed a bunch of Chocolatey packages like 7-Zip, Visual Studio Code, Office 365 ProPlus, and Putty, added some folders, files and registry keys, reconfigured some services, and installed a custom .MSI or .EXE from an on-premises server share (you know, the “Chris Hansen Kiddy Porn Undercover Arrest Me Kit 2015 Premium Edition.exe” with the important /S switch).

Everything looks great.

But, being that you don’t trust anyone who’s birth certificate says their name is really ‘skatterbrainz’ you decide to look under C:\Windows\Temp and find a “fudgepop.log” file and open it up.  Your skull falls in pieces on the floor due to the overload of retinal bombardment of verbosity and quantum-level granularity, and because you’re still hung over AF.  But that’s beside the point.  You make some tweaks to the control XML file, rub your hands together while nodding and grinning, laughing like a German lab scientist in a WWII movie, not realizing your cat is going to the bathroom on something else you value on the other side of the room.  You install FudgePop on another device and repeat the process.

You carefully tie that plastic kidney tube closed using the twisty-tie from the plastic bag you use for the litter box.

Later, your room mate returns, sees what you’ve done and pounds your face into the sofa and leaves.

I hope to return in 2018.  Until then: Happy New Year!

Random Stuff, Part 42

Between work, studying, tinkering and trying to have something close to being considered “a life”, I haven’t been blogging much lately.  And every time I get close to having that magical, mythical thing called “a life”, I have to travel.  I can’t complain, since it gives me new perspectives on “life”, which help me to feel like I have “a life”.

And speaking of travel, here’s a cheap diagrammatic view of how I roll (literally, since my suitcase does in fact have wheels)…

packing.png

This is just the backpack.  I also didn’t include tampons, whips, chains, hand grenades, latex gloves, surgical masks, or bags of unmarked pills.  Those tend to slow me down with TSA, and I’d rather they spend most of their time with their hands around my privates.  If I touch myself in public it looks unsettling, but when they do it for me, it’s professionalism at its best, and they love it when I smile during the procedure.

Speaking of TSA, I’ve found that the passive aggressive score follows the scale of the airport, at least in the U.S.  Meaning, the bigger the airport, the less humor they tolerate.  The friendliest bunch I’ve encountered would be Medford, Oregon (MFR), and the other end of the scale would be Boston (BOS).  I love Boston.  The TSA have a consistent and warm way of welcoming travelers to bean town with that glaring “I’ll stomp your face in if you make eye contact for more than 5 seconds!”

I’ve also been updating some PowerShell-related projects.  I have always maintained personal project time to keep my sanity.  It also makes my dog want my attention more.  She leaves me little gifts to express how much she misses my attention.  And at 95 lbs, the size of those gifts can almost clog the toilet.

Here’s a few examples of what too much caffeine, too much vlog watching, and access to PowerPoint will do to someone like me, a latent marketing student.  I’m just kidding, I would’ve gone into statistics as a “statistician” but it’s too difficult to pronounce after 3 or 4 beers, and the pay doesn’t come close to most IT related jobs.

fudgepop.pngFudgePop

 

cmhealthcheck.pngCMHealthCheck

gpodoc.pngGPODoc

cmbuild.pngCMBuild

They almost look professional.  And almost as if I know what I’m doing.  Cooked up with only a frying pan, a little butter, some chunks of PowerPoint and sprinkled with Paint.Net.  All four took a whopping hour to create.  The pencil was the most fun.  I highly recommend the shape tools (Boolean stuff, like Union, Subtract, etc.), you can spend hours immersed in that strange world, forgetting to shave and bathe too.

You can find the rest of this exciting stuff at https://www.powershellgallery.com/profiles/skatterbrainz/ – where I publish things I almost know how to do.  CMBuild is still in beta, so if you get really, really, reeeeeeally bored, and you have a lab environment in which to try things like this – feel free to post angry, hurtful, mocking and demoralizing comments and bug reports.  The more condescending the better. My doctor enjoys this too.  The visits for medication help his kids through another semester at medical school, and I don’t want to let him down.

Travel

I forgot to mention that MFR, while being a very small airport, also has some really nice artwork on the walls around baggage claim…

20171105_213501.jpg

Approaching Norfolk (ORF), the most dynamic and interesting place for underpaid IT professionals…

20171111_102616.jpg

Leaving San Fran (SFO).  The most dynamic and interesting place for well-paid IT professionals who can’t afford to live there…

20171110_193714.jpg

Getting ready to board my next flight.  I have the window seat just behind the wing…

20171110_204509_Burst01.jpg

Back in my office…

20170902_231019.jpg

Technical Stuff

In the past month, I’ve been dunked into projects involving a variety of different beatings, I mean challenges.

  • 2 involving MDT+Windows 10 with distributed/replicated MDT deployment shares.  One using DFS and the other using Nasuni, for the replication service.  Both worked out very well.
  • 2 involving Office 365 ProPlus.  One mixing C2R Office with MSI Visio and Project.  The other mixing C2R Office using O365/AzureAD licensing, with C2R Visio/Project using KMS licensing.  Neither was that difficult, but I did come away with a continued wonder and amazement at how something so simple (C2R deployments) could be left half-baked by Microsoft and nobody seems to care.
  • 3 involving Configuration Manager.  1 focused on SUP strategies for servers.  1 focused on being a crying shoulder for an overloaded admin and under-give-a-shit managers.  1 focused on replacing some horrific mess some other (independent) consultant attempted while in between binges of drinking and glue sniffing.

The rest of the time has been Azure, Intune, O365, PowerShell, PowerShell with Azure AD, PowerShell with Intune, PowerShell with System Center, System Center with PowerShell, PowerShell with PowerShell, and a little bit of PowerShell. I’d think by now I’d know something about PowerShell, but I’m not going to pat myself on the back just yet.

User Groups

Our geographic region seems to have very few IT-related user groups with regards to the population of professionals.  We do have a few, such as groups for Docker, SQL Server, .NET, Machine Learning/AI, and a few others.  So, I’ve been trying once again (third time) to get a Microsoft-related group off the ground.  And I’m happy to say it’s actually starting to get off the ground!  It’s called Hampton Roads Cloud Users Group.  “HRCloudGroup” on Slack, and Facebook.

For those not familiar with this interesting little area, it’s officially comprised of 7 cities in the southeastern corner of Virginia, at the North Carolina border.  Mouth of the Chesapeake Bay.  But the actual list of surround municipalities include Norfolk, Virginia Beach, Portsmouth, Chesapeake, Hampton, Newport News, Williamsburg, Yorktown, Suffolk, Surry, and Smithfield.  There’s also a large number of people who commute from North Carolina to jobs in this area, so it extends beyond Virginia.

Some call it “Tidewater”, which is a stupid name.  Some call it “Hampton Roads”, which is a less stupid name.  Some call it “that shitty place I hated being stationed at while in the Navy/Marines/Air Force/Army/Coast Guard/CIA/FBI/NSA/DEA/NATO…” eh, you get the idea.  I would venture to say it is the most militarized area of land in the United States, maybe in the world.  Every branch of military, intelligence, logistics, special operations, tactical operations, is located within a small enough radius to be a ridiculously appealing target for Russian satellites.  My house, is under the flight path between Little Creek JEB (SEAL team 6 or DEVGRU), Fort Story and Oceana NAS.  I can name the fighter jet, cargo plane, or helicopter models by sound alone. I just haven’t found a way to earn a living doing that yet.

Enough Rambo talk. Our group is still very small, at about a dozen members, with about 4 or 5 people attending the monthly meet-ups so far, we’ve been fortunate to get some very skilled, very creative members, so I couldn’t be happier.  I feel like my role is more of a facilitator than a leader.  The others have way more experience than I at this point, so I’m happy to just connect the wires and keep the engine running, and learn what I can along the way.  We’ve only had 2 meet-ups so far, but I’m optimistic.  Our next one is December 14, 2017 at 6pm.  If you live in the area, hit us up.

Miscellaneous

As if the entire blog post isn’t already “miscellaneous”.  Shit, my whole life is “miscellaneous” when I get down to it.  But who’s complaining? Okay, I do from time to time.  Anyhow, shotgun blast…

  • PlatyPS is cool.  Once you remember to actually put comments in the right places and import the module before running New-MarkdownHelp for fifth time and cursing at the monitor for not reading my my mind.
  • Carbon is still cool.  Even cooler.
  • The Tesla semi is freaking awesome.  The Roadster is obviously cool as well.  I can afford neither.
  • I had my first MSATA failure today.  A Lite On 256 GB card in my HP Elitebook.  RIP.  It was nice having you while you lasted.
  • Shout out to Whitner’s BBQ in Virginia Beach.  Still the best I’ve had anywhere I’ve traveled, and it’s right in my backyard.
  • Shout out to the group of kids who yelled across the busy street “I like your chocolate dog!!”  She loved it too.
  • I need fish food for the aquarium.  Off to the stores on a Saturday.  Wish me luck.

Chocolate dog.  Aka “Dory”

20171117_131721.jpg

Random Thoughts and Stuff

While packing for travel I was having a conversation around the “state of IT” with a friend. So I figured (A) it might be worth jotting down some of the key points, and (B) do it before I fly out, in case some underpaid mechanic forgets to tighten that one bolt that holds the engine onto the wing.  Actually, who am I kidding, that mechanic probably earns more than I do.  Anyhow…

this is rambling, so drink plenty of medication and smoke your wine before continuing.

(travel-packing sidenote: Oreo is 15 years old, and like most humans, used to hate my guts.  Eventually, as daughter number 3 moved out, and I became her sole source of attention and food, she has become my friend.  She follows me around all day.  Every time she sees my suitcase out the night before I travel, she does this.  I’ll need to go over that ball cap with a ball of tape in the morning.)

The Future of SCCM and MDT and EMS

This is admittedly a Microsoft-centric topic. The discussion mentioned above was about “how long” will SCCM and MDT be “of interest” to consumers?  Obviously, I do not own a real crystal ball.  I only have a Dollar Tree knock-off, and I don’t have access to real business data, therefore I rely upon what scientists often refer to as ‘shit talking‘.

I’ll admit, after day 1 at MS Ignite this year, I was feeling the angst.  For example, while riding the bus back from the conference center to the hotel, staring out the window, I kept thinking “why, why, why did I leave app-dev to move into this infrastructure rat race?!  wtf was I thinking?!” and “I hope my dog isn’t chewing up my last pair of flip flops right now.”  It really felt like the job market for anyone walking around a typical IT shop today, would be dried up to around 10% of that volume within 5 years.  And who really knows?  It could go in any direction.  I think everyone is in agreement that there is already a major tectonic shift in play, with traditional operations moving into software-defined operations.  The thought of learning things like JSON, Git, VSTS, on top of PowerShell and Azure, is adding wrinkles to quite a few faces I see.

The mere mention of “new certs” is probably having a measurable effect on the sales of alcohol, tobacco and firearms, which should keep these guys employed for a long time.  For many I’ve known over the years, the feeling is like being shoved onto a rollercoaster by your drunk buddies, against your will, and now you’re approaching the top of the first peak in the run.

After 3 more days, and soaking up session content, food, beer, and more importantly: engaging vendors in deep discussions out on the expo floor, my initial expectations of SCCM/MDT doom were relaxed quite a bit.  Mainly out of realizing the following points:

  • The majority of imaging work I see being done at most mid-sized and large customers is refresh of existing hardware.  The mix of new vs. reuse is cyclical at most larger shops, due to budget cycles and SLA’s about hardware refresh programs.  So at various times in a given year, there’s more new imaging, but for the remainder of the year it seems to be more refresh/reuse.
  • Most of the (above) people I’ve spoken with are very interested in AutoPilot, but quite a few hadn’t yet been allowed access to the preview at the time I spoke with them (I think most are now seeing it in their portals)
  • In-place upgrades are still a minority (far too low in my opinion)
  • The description of “automatic redeployment” got their attention, but most are still tied to the comfort of a “clean wipe and load” for various reasons.
  • Ultimately: Regardless of what anyone says, things which “work” have a very VERY tough time dying in the IT world.  Hence why so many machines still run XP.  I’d also wager my tombstone that Windows 7 will easy to find running on machines in 2027.  That’s because I’m planning to be cremated on a Walmart grill.  But that’s beside the point.

The weeks after Ignite I’ve made it a point to casually interview my customers to get a feel for where they see the biggest and most immediate changes coming.  It’s a delicate thing to ask, since it can easily smell like a sales pitch.  Sales pitches have a distinct odor that is often confused with bus station toilets or dead cows laying in the sun.  However, most of them are well aware of my dislike for sales people in general (some of my friends are in sales, so there are exceptions).

  • The biggest hurdles they have today are keeping up with device models and drivers, patching, moving to some new system for IT operations (ticketing, change mgt, etc.), and endless training of each new-hire who is replacing three who just left.  See what I did there?
  • The single biggest complaint about imaging in general revolves around drivers.
  • There’s still quite a bit of frustration and confusion I hear around Intune capabilities.  Some is related to Intune agent vs. agentless, management; Some is around app deployment capabilities; Some is inventory reporting.

Windows 10

I still spend way too much time explaining Windows 10 servicing models and the naming convention.  They were just starting to grasp CB, and CBB, but now “Semi-Annual” and “Semi-Annual Targeted” are leaving them in one of two modes: pissed off or chuckling.  The most common response I hear from the former is around the constant renaming of things in general.  “Active, Live, Visual, and now CBB, then Semi Annual Targeted, WUS, then WSUS”, and so on.  Their words, not mine.

I’m always surprised to find so many shops still heavily invested in MDT and doing very well with it.  The other interesting thing is that the majority of them assume they’re doing everything wrong and are panicked when I arrive that I’ll redline their papers.  In fact, most of them are doing very well.  They’ve read the blogs, the tweets, bought the books, watched the videos, done the TechNet labs, and so on.  A few have been lucky enough to attend training and/or conferences as well, but that’s a very small percentage.

The pace at which organizations are getting their Windows 10 rollouts moving is gaining speed and volume.  However, the Office aspect has thrown a wrench into quite a few (see below)

Office

This reminded me of a discussion I had at Ignite with the Office team on the expo floor.  It was around the issue of third-party extensions (add-ons) for Office, and how many are produced by small shops which do not stay current with Office versions.  The result I’ve continued to see is a fair amount of shops who can’t upgrade Office until the third-party vendor puts out an update or a new version.  Then there’s the cost factor (is it free or not?).  In many of those cases, the hold-up triggered the IT department to wait on other projects such as Windows 10.

The number of Access applications interfering with Office upgrades has dropped significantly for me in the past 3 years.  Not just the projects I’m working on, but also from reports I get from other engineers and customers.  That’s a good thing.

Controls vs. Controls

I’m still seeing a continued reliance on inefficient control mechanisms with regards to device and user configuration management.  Way too much effort put into the imaging side, and not enough on the environment side.  Way too much on the “nice to have” side, vs. the “gotta have” side.  Not enough attention is being paid to ‘baseline’ and ‘continuous’ control models, and when to use which one, and how best to apply tools for each.  For example, hours and hours spent on wallpaper, shortcuts, and folders in the imaging process, being manually adjusted with each update cycle, rather than letting Group Policy Preferences step in and mop that shit up with one hand.

I’ve had fairly good results convincing customers to drop the continuous meddling with reference images, instead, (at least trying to)…

  • Change the data storage process to keep users from storing anything valuable on their device
  • Remove as many non-critical configuration controls as possible
  • Move continuous controls to the environment (GPO)
  • Move baseline controls to the environment wherever possible (GPP)
  • Move remaining baseline controls to task sequence steps

There are obviously exceptions that require mucking with the install.wim to make a new .wim, but I’m finding that’s only REALLY necessary in a small percentage of the time.  The vast majority of controls I see are voluntary and serve little functional or operational benefit.  Things like hiding Edge, Forcing IE, hiding Cortana, forcing Start Menu and Taskbar items, etc.  Just educate users to avoid them.  Treat them like adults and who knows, maybe they’ll stop urinating on your office chair.  Try it and see.  The worst you’ll get is whining (you get that anyway), but the best (and most likely) outcome is less work for you and less risk of something breaking.

Role and Salary Compression

It not only continues to thrive, it seems to be accelerating its pace.  Almost every customer I meet tells me how they’re expected to do more with fewer people, less training, less budget, and shorter time constraints.  Most haven’t had a significant raise in a long time.  This seems more prevalent at companies which are publicly-traded than those which are not, but it affects both.  Personally, I see a correlation with public organizations and cost reduction priorities over innovation and revenue increase.  Then again, I have no formal training in such matters, so again, I’m probably talking shit.  Again.

Intune

Speaking of Intune.  I’ve been spending more time with it this past week, along with Azure AD, and AzureADPreview powershell module.  I’ve always like the concept of what Intune and EMS are aimed at. The mechanics are still frustrating to me however.  There are plenty of design quirks that drive me batshit crazy.  Like devices / all devices vs. Azure AD devices, and the differences in how provisioning an app for iOS or Android and Windows, from the Windows Store no less.  As Ricky Bobby would say, “it’s mind-bottling”.

Then again, I’m not at all a fan of the “blade” UI paradigm.  The Blade model is (in my humble, semi-professional, almost coherent opinion) marginally efficient for direct touchscreen use, but for mouse and keyboard it blows chunks of post-Chipotle residuals.  I’m sure that will infuriate some of you.  But that’s just how I feel.  Drop-down menus, panels, heck, even ribbons, are more efficient in terms of hand and finger interaction (mouse, touchpad) for operations involving closely related tasks (settings, options, etc.)  Ask yourself if moving ConfigMgr to a blade UI would make it better?  Or Office?  If you think so, try switching to another brand of model glue.

Back to Intune.  I would really look forward to seeing it mature.  Especially in areas like agent vs. agentless device management (it’s very confusing right now, and the differences are weird), AutoPilot, Redeployment/Reset, and expanding the features for deploying applications, remote management (TeamViewer, etc.), and GPO-to-MDM migration.  I’m thinking Windows desktops and laptops of course (if you hadn’t already figured that out).  Phones are great, but nobody, who isn’t masochistic, is going to write a major app using their phone most of the time.  Auto-correct and latent-rich touch screen typing, would cause most PowerShell, C# or Ruby code writers to massage their head with a running chainsaw.

I think I digressed a bit.  sorry about that.

Other Stuff

I’ve spent some after-hours time keeping my brain occupied with scripting and app-dev projects.  I’ve been doing Windows 10, Windows Server 2016, MDT and SCCM lab builds and demos for months, along with real implementation projects, and starting to burn out on it all.  I needed a break, so I’ve managed to get a few things done and few in the pipeline:

I ran across a couple of (seem to be) abandoned Git projects focused on DSC for building ConfigMgr sites, but none of them appear to be factored into a template construct.  Meaning?  That they’re still built on specific parameters, or require extensive customization for various roles, configurations, environments.  I’m still poking at them and forked one to see what I can make it do.  In the meantime, I’m moving ahead with CM_BUILD and CM_SITECONFIG being merged into a new CMBuild PowerShell module.  So far so good.  And when that’s done, I’ll go back to see what I can in that regard with DSC and applying that towards Azure VM extensions.

I’ve come to realize that there’s 4 basic types of southern dialect in America:  Fast, Slow, Twangy and Crooked Jaw.  Think about it, and you’ll see that’s true.

The shortest distance between two points is often the most expensive.

If you never fail, you’re not trying hard enough.

If you fail most of the time, you’re probably in the wrong career path.

I’m on travel next week.  Expect more of the same stupid tweets about mundane stuff.  If you tire of me, unfollow me.  I don’t mind.  It’s just Twitter after all.  I will do my best to keep my camera ready for anything interesting.  I need to watch some air crash documentaries now, to get my mind relaxed for tomorrow.

FudgePack

Pardon the headline and semi-questionable graphic, but it’s all I had to work with on short notice.

As a result of way too much caffeine, tempered with a sudden burst of alcohol and intense, yet clueless conversation with a colleague, the following hair-brained idea sprang up. This required immediate action, because, stupid ideas have to be enacted quickly in order to produce rapid failures and immediate lessons-learned…

Idea: What if you could manage remote, non-domain-joined, Windows 10 computers from a web page control mechanism, for “free”, where the local user has NO local admin rights, to do things like run scripts, deploy or remove applications, etc.?

What if? Aye?

So, Chocolatey came to mind. Partly because I was eating something with chocolate in it, but mostly because I love the Chocolatey PowerShell packaging paradigm potential, and that’s a heavy string of “P”‘s in one sentence.  Anyhow, it felt like one of those sudden Raspberry Pi project urges that I had to get out of my system, so I could move on to more important things, like figuring out what to eat.

Caveats:

  1. The machine would need to be configured at least once by someone with local admin rights.
  2. The machine would need to be connected to the Internet in order to receive updated instructions
  3. The admin needs a little knowledge of technical things, like proper coffee consumption, shit-talking and locating clean restrooms

Outline of Stupid Idea

  1. Drop the FudgePack script into a folder on the device (e.g. C:\ProgramData\FudgePack, file is Invoke-FudgePack.ps1)
  2. Create a Scheduled Task to run under the local NT Authority\SYSTEM account
    1. Task should only run if a network connection is active
    2. Task should only run as often as you would need for immediacy
    3. User (device owner) should be able to invoke Task interactively if needed.
  3. Host the control data somewhere on the Internet where the script can access it

Procedure for Stupid Idea

  1. Here’s the FudgePack app control XML file.  Make a copy and edit to suit your needs.
  2. Here’s the FudgePack PowerShell script.  Douse it in gasoline and set on fire if you want.
  3. Here’s an example Scheduled Task job file to edit, import, point at, and laugh.

Setting up and Testing the Stupid Idea

  1. Copy the appcontrol.xml file somewhere accessible to the device you wish to test it on (local drive, UNC share on the network, web location like GitHub, etc.)
  2. Edit the appcontrol.xml file to suit your needs (devicename, list of Chocolatey packages, runtime date/time values, etc.)
  3. Invoke the script under the SYSTEM account context (you can use PsExec.exe or a Scheduled Task to do this)
  4. Once you get it working as desired, create a scheduled task to run as often as you like
  5. Send me a box filled with cash – ok, just kidding.  but seriously, if you want to, that’s ok too.

More Stupid Caveats

  1. It’s quite possible in this day and age, that someone else has done this, and likely done a better job of it than I have.  That’s okay too.  I searched around and didn’t find anything like this, but my search abilities could quite possibly suck.  So, if someone else has already posted an idea identical to this, I will gladly set this aside to try theirs.  After all, it’s about solving a problem, not wasting a sunny, beautiful Saturday behind a keyboard.

Cheers!

CMHealthCheck is now a PowerShell Module

What is it

CMHealthCheck is a PowerShell module filled with bubble wrap, Styrofoam peanuts, and 2 possibly useful functions, aimed at collecting a bunch of data from a System Center Configuration Manager site server, and making a pretty report using Microsoft Word.  But doing so without needing to manually download and store a bunch of script files and so on.

It’s still based on the foundations laid by Rafael Perez, with quite a bit of modification, prognostication, prestidigitation, and some coffee.  Special thanks to Kevin (@thenextdotnet) for helping point me in the right direction to move it all from scripts into a module.

Why is it

I get asked (okay, told) to help customers find out why their site servers are running slow, showing red or yellow stuff, or just to get them ready to upgrade from whatever they’re on to whatever is the latest and greatest version of ConfigMgr.  They also like a pretty Word document with a spiffy cover page.

How to use it

  1. Install the module on the ConfigMgr CAS or Primary server you wish to audit –> Import-Module CMHealthCheck
  2. Run the Get-CMHealthCheck function (see documentation on Github – linked below)
  3. Install the module on a Windows computer which has Office 2013 or 2016 installed (hopefully NOT the same computer which was audited)
  4. Run the Export-CMHealthCheck function (see documentation on Github – linked below)
  5. Save the Word document and mark it up.

Where to Get it

How to Complain About it

Because I know some of you will, but that’s okay.  Without complaints, we have no way of identifying targets.  Just kidding.  I need feedback and suggestions (or winning lottery numbers and free food coupons).  Please use the “issues” link on the GitHub repository to submit your thoughts, gripes and so on.