SCCM Highlander

PSEXEC and Remote Desktop Troubleshooting If you cannot get onto a machine with remote desktop but can ping the machine then the following should resolve the issue. PSEXEC the machine with the commandline Psexec \\machinename cmd You should now be connected to the remote machine, now launch the following commands:- reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0 \\remotecomputername netsh firewall set service remoteadmin enable \\remotecomputername netsh firewall set service remotedesktop enable You should now be able to remote desktop the machine as normal. Uninstalling Applications Remotely with PSEXEC PSEXEC the machine with the commandline Psexec \\machinename cmd Now use WMIC to find the name of the software you would like to uninstall Wmic product get name Now use the software name you would like to uninstall in the following command:- wmic product where name="

Unchecking the tick box for Uninstall this application when it falls out of scope of management will cause no negative impacts, i.e no software will be removed. Unticking this and then allowing local GPOs to update would be a good first step in being able to remove the GPO settings completely (after a day or so). In this case the MDA Laptops assigned application settings. Further expanding on this the settings on whether to remove applications are local to the client:- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt\{GUInumber} REG_DWORD "AppState" 11 means to uninstall the software when falling out of the scope and 9 means it will stay.

In order to get the machine to PXE boot it is necessary to do the following:-        1. Navigate to Settings – Secure Boot – Secure Boot Enabled           Disable Secure Boot        2. Navigate to Settings - General – Advanced Boot Options            Enable Attempt Legacy Boot         3. Navigate to Settings – System Configuration – Integrated NIC       Select - Enable w/PXE       Check the – Enable UEFI Network Stack Start PXE Boot Press F12 on boot and then navigate to the IP4 network boot. Errors If you see the error:- PXE-E79: NBP is too big to fit in free base memory You have selected Onboard NIC instead of Onboard NIC ( IPV4) network boot.

To remove/block default applications that can't be removed at build time applocker can be used on windows 10 enterprise machines. First step is to create a new policy called:- Navigate to Computer Configuration -> Policies -> Windows Settings -> Application Control Policies -> Packaged app Rules Create a default rule so that everyone can access packaged application by default (we can then deny access to certain packaged apps) You will now see the following "Allow" rule created in the GPO If you right click you can see the rule properties and description Once the default rule has been created you can now start to block packages that you don't require:- Select the Deny option so that the package gets blocked. Next Select use an installed packaged app as a reference Select the package you would like to block A deny rule will then be created Confirmed Deny Rules Microso

Enable PXE Boot In order to get the machine to PXE boot it is necessary to do the following:-              1. Navigate to Settings – Secure Boot – Secure Boot Enabled     Disable Secure Boot         2. Navigate to Settings - General – Advanced Boot Options     Enable Attempt Legacy Boot         3. Navigate to Settings – System Configuration – Integrated NIC                 Select - Enable w/PXE                 Check the – Enable UEFI Network Stack           4. Navigate to Settings - General – Advanced Boot Options                        Boot List Options should be UEFI Start PXE Boot Press F12 on boot and then navigate to the IP4 network boot. Errors If you see the error:- PXE-E79: NBP is too big to fit in free base memory You have selected Onboard NIC instead of Onboard NIC ( IPV4) network boot.

Create a new GPO and navigate to User Configuration->Preferences->Windows Settings-> Registry. Generate a GUID for the registry key you are about to create Create the "DefaultScope" Registry Key with the GUID as the value data. Copy this key and then add the GUID and remove the Value name Copy and paste this key now 5 times so you should have the following 6 keys Update each key with the following Value names and Value Data:- Value Name Type Value Data DisplayName Google FaviconURL https//:google.com/favicon OSDFileURL https://microsoft.com/en-us/IEGallery/Google ShowSearchSuggestions REG_DWORD 00000001 SuggestionsURL http://clients5.google.com/complete/search?q={searchTerms}&client=ie8&mw={ie:maxWidth}&sh={ie:sectionHeight}&rh={ie:rowHeight}&inputencoding={inputEncoding}&outputencoding={outputEncoding} URL http://w

If you have an application that cannot be installed due to an existing install that has been broken in some way, try running the following command as a last resort:- msiexec.exe /fvecmus The command allows the MSI to install over the top of the old application that is stopping the install from completing.

The following error is displayed when launching Skype for business       Can't sign in to Skype for business – The server is temporarily unavailable. If the problem continues, please contact your support team. This issue maybe caused (in my case) due to the firewall blocking sipfed.online.lync.com:5061 https://technet.microsoft.com/en-us/library/gg398833.aspx You can test to see if the port is open or closed using telnet. A successful test will look as follows:-