Monday, 6 February 2023

Remove pre-installed HP software during Autopilot

This was a task I was given by a customer recently. They wanted all the pre-installed HP software removed when provisioning HP ProBook 450 G8 laptops using Autopilot and Intune. As I like to tell customers, "if you can script it you can do it with Intune".

This was the list:

  1. HP Connection Optimizer
  2. HP Documentation
  3. HP ICS
  4. HP Notifications 
  5. HP Security Update Service
  6. HP Support Assistant
  7. HP Wolf Security
1. HP Connection Optimizer

This one is a little tricky and requires the help of an answer file. I got a little help from Reddit

Create an InstallShield answer file. Copy the text to Notepad and save as .iss file (I called it HPConnOpt.iss)

[InstallShield Silent]
Version=v7.00
File=Response File
[File Transfer]
OverwrittenReadOnly=NoToAll
[{6468C4A5-E47E-405F-B675-A70A70983EA6}-DlgOrder]
Dlg0={6468C4A5-E47E-405F-B675-A70A70983EA6}-SdWelcomeMaint-0
Count=3
Dlg1={6468C4A5-E47E-405F-B675-A70A70983EA6}-MessageBox-0
Dlg2={6468C4A5-E47E-405F-B675-A70A70983EA6}-SdFinishReboot-0
[{6468C4A5-E47E-405F-B675-A70A70983EA6}-SdWelcomeMaint-0]
Result=303
[{6468C4A5-E47E-405F-B675-A70A70983EA6}-MessageBox-0]
Result=6
[Application]
Name=HP Connection Optimizer
Version=2.0.18.0
Company=HP Inc.
Lang=0409
[{6468C4A5-E47E-405F-B675-A70A70983EA6}-SdFinishReboot-0]
Result=1
BootOption=0 

I copied the answer file to Azure storage and generated a shared access signature so that the file could be downloaded from anywhere.

Next is the script (UninstallHPConnOpt.ps1)

invoke-webrequest -uri "https://xxx.blob.core.windows.net/autopilot-scripts/HPConnOpt.iss?MySharedAccessSignature" -outfile "C:\Windows\Temp\HPConnOpt.iss"

&'C:\Program Files (x86)\InstallShield Installation Information\{6468C4A5-E47E-405F-B675-A70A70983EA6}\setup.exe' @('-s', '-f1C:\Windows\Temp\HPConnOpt.iss')

The script downloads the answer file and copies to C:\Windows\Temp. It then executes setup.exe for HP Connection Optimizer and calls the answer file. This uninstalls the app.

To deploy the solution via Intune, copy the script and answer file to a folder. Then create a Win32 app which results in a .IntuneWin file containing both files.

2. HP Documentation

This one is a bit more straightforward. The script sets the location to "C:\Program File\HP\Documentation" and then runs the uninstall command.

Set-location "C:\Program Files\HP\Documentation"
.\Doc_uninstall.cmd

Upload the script to Intune and assign to a group.

3. HP ICS

They're getting easier

$Prod = Get-WMIObject -Classname Win32_Product | Where-Object Name -Match 'ICS'
$Prod.UnInstall()

Upload the script to Intune and assign to a group.

4. HP Notifications

This one is the same format.

$Prod = Get-WMIObject -Classname Win32_Product | Where-Object Name -Match 'HP Notifications'
$Prod.UnInstall()

5. HP Security Update Service

Same format again.

$Prod = Get-WMIObject -Classname Win32_Product | Where-Object Name -Match 'HP Security Update Service'
$Prod.UnInstall()

6. HP Support Assistant

This one is a little different. It's an appx installation. Nicolaj Andersen has an excellent script for removing unwanted built-in appx apps during provisioning, except those that you explicitly whitelist. The script will remove the HP Support Assistant.

7. HP Wolf Security

Same format as before

$Prod = Get-WMIObject -Classname Win32_Product | Where-Object Name -Match 'HP Wolf Security'
$Prod.UnInstall()


These are the settings you need when you are deploying your scripts with Intune.

I hope this helps you and saves you time if have the same task. 

Until next time......



 

Monday, 2 January 2023

Silently install ten top Win32 apps with Intune

We've heard a lot about Winget and the Windows Package Manager recently. However we'll still need to be able to deploy Win32 apps via Intune for the foreseeable future, especially during an Autopilot process. This blog post isn't about using the Win32 Content Prep tool to convert apps into the intunewin format. It's about the research I carried out to understand how to install ten top apps (with a focus on the financial sector) silently and to detect them afterwards. This research can take a while so I thought it might save others some time.

Edit the installation command with your executable name. Note that I've used the presence of a file as my detection method for many of the apps. You can be more specific with this rule by configuring a file version if that's what you need.

Bloomberg Terminal:

Provides coverage of markets, industries, companies and securities across all asset classes.

Download the latest “Bloomberg Terminal” installer 


  • Silent install: sotr102_5_80.exe /s maindir=“C:\blp\” conn_type=Private
  • Detection (file or folder exists): C:\blp\Wintrv\wintrv.exe

Refinitiv FXall:

Formerly Reuters, a complete end-to-end solution for your FX trades


There is one additional consideration with this application. A response file must be generated in order to install it silently. Generate the response file by running this command (as administrator):

Refinitiv-FXall-Setup.exe -r installer.properties

The installation wizard launches. Follow the wizard to the end. This installs the application and creates the response file. This file must be saved in the same folder as the EXE when the app is being converted to a .Intunewin file.
  • Silent install: Refinitiv-FXall-Setup.exe -i silent
  • Detection (file or folder exists): C:\Program Files\Refinitiv\Refinitiv FXall_\7.9.0.53\Refinitiv FXall_.exe

Anaconda:

Anaconda Distribution is the world’s most popular open-source Python distribution platform. Download 

  • Silent install: Anaconda2-4.2.0-Windows-x86_64.exe /InstallationType=AllUsers /S /D=C:\Program Files\Anaconda2
  • Detection (file or folder exists): C:\Program Files\Anaconda2\pythonw.exe

Morning Star Direct:

Morning Star Direct is an investment & portfolio analysis software, which gives you the tools to build strategies and products.


Morning Star Direct is a pretty straightforward installation as it is MSI based. However there are two additional consideration here.
  • Firstly, the Morning Star Direct application forces a reboot, which happens automatically and without warning. We have to use the parameter REBOOT=ReallySuppress to prevent that. A reboot is still required to complete the installation but the user is notified to restart.
  • Secondly, there are two installations.
    • The Morning Star Direct prerequisites can be downloaded from here 
    • The Morning Star Direct application can be downloaded here 
    • The Prerequisites app has to be added as a dependency for the Morning Star Direct application and is installed first.
  • Silent install: msiexec /i "prerequisite.msi" /qn
  • Detection : MSI {7FA41A52-1D83-4C2D-A432-475AA3F7881B}
  • Silent install: msiexec /i "direct.msi" /qn REBOOT=ReallySuppress
  • Detection: MSI {D9C2A982-D2E0-4E83-B8FD-8E7B8160EBA2}

SQL Server Management Studio:

This app was developed by Microsoft and is used for configuring, managing, and administering all components within Microsoft SQL Server. It can be downloaded here


  • Silent install: SSMS-Setup-ENU.exe /quiet
  • Detection (file or folder exists): C:\Program Files (x86)\Microsoft SQL Server Management Studio 18\Common7\IDE\Ssms.exe

Visual Studio Code:

Visual Studio Code is a lightweight but powerful source code editor. Download

  • Silent install: VSCodeSetup-x64-1.74.2.exe /silent
  • Detection (file or folder exists): C:\Program Files\Microsoft VS Code\Code.exe

Power BI Desktop:

Get a 360° view of your business data and quickly connect, shape, visualize, and share data insights through Power BI. Download


  • Silent install: PBIDesktopSetup_x64.exe -s ACCEPT_EULA=1
  • Detection (file or folder exists): C:\Program Files\Microsoft Power BI Desktop\bin\PBIDesktop.exe


Adobe Reader:

This app can be downloaded here


  • Silent install: AcroRdrDC2200320258_en_US.exe /sALL /rs /msi EULA_ACCEPT=YES
  • Detection (file or folder exists): C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Sophos Antivirus:

This app can be downloaded here



  • Silent install: SophosSetup.exe --quiet
  • Detection (file or folder exists): C:\Program Files\Sophos\Sophos UI\Sophos UI.exe exists

Remote Help:

Remote help is a premium add-on application that works with Intune and enables your users to get assistance when needed over a remote connection. 



Remote help must be installed on each device before that device can be used to participate in a remote help session. You can download the latest version of remote help directly from Microsoft 
  • Silent install: remotehelpinstaller.exe /quiet acceptTerms=1
  • Detection (file or folder exists): C:\Program Files\Remote help\RemoteHelp.exe
-----------------------------------------------------------------------------------------------------------------------

That's it, that was the ten apps that I recently had to deploy via Intune for a financial services customer. I hope you find it handy if you need to work with one of them. It was difficult to get this information for some of the apps as the enterprise installation documentation was only available with a support contract.

Until next time.....

Tuesday, 27 December 2022

Re-enabling Defender on Windows 2016 servers via command line

I've carried out a number of Microsoft Defender for Endpoint deployments recently. I find that workstations are easy enough to deal with but it can be a pain working with low level servers. Windows Defender shipped natively with Windows 2016 Servers and organizations came up with some pretty creative ways to stop Defender from running. In fairness, at the time, Defender caused some pretty serious CPU spikes when co-existing with a third party antivirus solution.

I've come across three scenarios in particular. They are easy enough to deal with in the UI but I just wanted to show how you can also deal with these using commands. This was essential for me when working at scale and using management tools to automate the solution.

Scenario 1: the Defender feature had been uninstalled.

The Defender features can be added back using the "Add Roles and Features wizard". Don't forget to add the sub-features as well.

Scenario 1 command line:

Dism /Online /Enable-Feature /FeatureName:Windows-Defender-Features

Dism /Online /Enable-Feature /FeatureName:Windows-Defender

Dism /Online /Enable-Feature /FeatureName:Windows-Defender-Gui

Don't forget to add a reboot step afterwards.

Scenario 2: Defender service had been disabled.


You'll be notified that the Defender service is stopped and you won't be able to start it. I found this scenario when Microsoft Defender Antivirus was disabled through Group Policy.


First make sure that you reverse this policy. Just set it to Not Configured, do not choose Disable.

Scenario 2 command line:

Then re-enable Defender using this command:

MpCmdRun.exe -wdenable

It must be executed from "C:\Program Files\Windows Defender" and you must add a step to reboot the system afterwards.


Scenario 3: Defender is turned off.


Essentially this means that Real-time protection is turned off.


It can be turned on in Settings > Windows Defender.

Scenario 3 command line:

You can turn on Real-time protection programatically using PowerShell

Set-MpPreference -DisableRealtimeMonitoring 0


You don't need a reboot for this one.

I hope this information is helpful to automate your Defender deployment. 

Until next time.....


Wednesday, 14 December 2022

Windows 10 devices not enrolling in Intune

This is just a quick post to describe a customer issue I encountered this week. Customer had previously configured Azure AD Connect and all devices were hybrid joined. They had just implemented a GPO to enrol the devices into Intune

Administrative Templates > Windows Components > MDM > Enable automatic MDM enrollment using default Azure AD credentials

However no devices were enrolled.

I looked a the event viewer on one of the devices and this told me where the problem was. In the DeviceManagement-Enterprise-Diagnostics-Provider log I saw this error

Auto MDM Enroll: Device Credential (0x0), Failed (Unknown Win32 Error code: 0x8018002b)

I figured that this was nothing to do with credentials but was caused by the user not being assigned a license. I was half right. The user had been assigned a license but it was a standalone Intune license. This is not enough for automatic Intune enrollment, that also requires an Azure AD Premium P1 license. I explained that it was still possible to enrol each device manually, but advised that wasn't a sustainable approach. 

Customer cancelled the Intune licenses and EM+S E3 licenses were provisioned. Problem solved and devices are now being automatically enrolled.

Moral of the story: Standalone Intune licenses are not recommended. You "may" get away with them if you are just managing mobile devices (Android & iOS), but not when you are managing Windows. EM+S or M365 is recommended.

Until next time....




Saturday, 15 October 2022

Disabling screen rotation on Windows tablets with Intune

I had a recent requirement to disable screen rotation for Windows tablets. 

This is easy to do within Windows. There is a Display setting to turn on the Rotation lock. However, I had to automate this using Intune. There doesn't seem to be a Windows CSP for this so it's not possible to use a custom OMA-URI policy. 


However, this is something you can do by configuring the registryIf you navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AutoRotation you'll see that the Enable key is set to 1. This needs to be changed to 0 to disable screen rotation. This is easy to configure with a PowerShell script:

New-ItemProperty -Path Registry::HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AutoRotation -Name Enable -Value 0 -Force -PropertyType DWord

Once you have the script, upload it to Intune. Select Devices > Scripts > Add (Windows 10 and later). Choose the script location and configure the following:

  • Run this script using the logged on credentials - NO
  • Enforce script signature check - NO
  • Run script in 64 bit PowerShell Host - YES

Assign the script to a group of Windows tablets and screen rotation will be disabled.

I hope this helps. Until next time......