Deploying an EXE patch using GPO

Recently at my client site, we needed to push a Microsoft Patch that we couldn't push using our update solution. The ideal solution would be to wrap the executable up into an MSI and just push the MSI using a GPO. After trying this using a 3rd party MSI wrapper utility, we created an MSI and pushed it to all workstations, where the wrapper itself installed, but the executable failed to run. In the interest of time, we needed to engineer a solution quickly to push our patch to ensure that users would be able to continue to access certain resources within our infrastructure. I know that you can create a Setup package by using Visual Studio .NET (another tutorial here), but we didn't have the time to sit down and hammer out a solution and test it.

Instead, I suggested that we push the executable using a GPO and simple VB script. The trick is we'd have to build into the script a way to check to make sure the executable hasn't already been installed- otherwise every computer getting the GPO will run the executable every time it boots (something we don't want). After a bit of Googling, I wrote the following VB script, which does the following:

# Pseudo Code
Check if a reg key exists
If the reg key does not exist, execute the executable installer with switches to make it a passive installer
Once the executable complete, create a registry key marking that the install has completed

'Reg key to create. Doesn't have to be this key, but since this is technically a patch, put it in Windows Update
sRegKey="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"
sExePath = "\\path\to\executable"
sSwitches = "/passive /warnrestart:45" 'Check available flags on Executable for options here

' Suppress error in case values do not exist
On Error Resume Next

' Check for the Reg Key Marker
sRegMarkerValue = "" ' initial value
sRegMarkerValue = oShell.RegRead( sRegKey & "\WindowsXP-KBXXXXX-x86-ENU.exe")
On Error Goto 0

' To ensure update is only installed once, test the reg key marker
If sRegMarkerValue <> "yes" then

'Run the executable with switches
oShell.Run Chr(34) & sExePath & Chr(34) & " " & sSwitches, 1, True

' Create the Reg Key marker
oShell.RegWrite sRegKey & "\WindowsXP-KBXXXXX-x86-ENU.exe", "yes"
End If

After applying the GPO, we rebooted all of the workstations, and our patch was successfully applied!

Windows Batch Scripting and Win2k8 AD GPO Functionality

Created this script and saved it as a .bat file to loop through values stored in a comma-delimited file to reboot specific machines:

FOR /F %%A IN (filename.csv) DO (
ECHO. %%A >> result.txt %1
shutdown -m \\%%A -r -f -t 10 -c "Your workstation will reboot in 10 seconds for scheduled maintenance" >>result.txt %1
)

And some cool functionality that you can do using GPOs in AD 2008:

• Set/Change Local User Passwords on all workstations in the domain
• Map network drives without using vb scripts/batch files
• Map printers without using vb scripts/batch files
• Disable USB storage devices using REG keys
• Disable specific hardware devices (CDROM drives, imaging devices, etc)
  

RedHat Certified Technician

I am officially a RedHat Certified Technician! Although I'm not gaining any experience in RedHat on my current project, I managed to get RedHat training approved by my firm, and took the RH133 course last week. The course was great- I learned a good deal of administration tips and tricks and it really helped fill in some crucial voids in my Linux repertoire.

I'm hoping to continue on the Red Hat path to obtain my RHCE in the next year, hopefully in October if possible. Admittedly, Gentoo still holds a special place in my heart, but in terms of usability and enterprise server-grade Linux, Red Hat has gained a lot of points in my book, particularly with its implementation yum and system configuration tools.

The class also inspired me to take a closer look at Xen and KVM virtualization. I'm hoping to P2V my Windows 7 box at home, and instead use RHEL (or CentOS) as a hypervisor and run Windows 7 as a VM.

RH courses I'm hoping to attend (and gain certification in) in the coming months include:

• RH253 - Red Hat Linux Network and Security Administration
• RH318 - Red Hat Virtualization Administration

Fast Forward 8 Months

So again, I have criminally lapsed in my posts on this blog. Since that September post, I left my previous job at the University of Georgia, had a nice 2-week backpacking trip through Europe away from computers and familiar faces, and returned in mid October to begin work for the man a large technology consulting firm, based out of the Atlanta office.

I'm currently on a 6-month 10-month project for a federal government client, spending 4-5 days of the week in the greater DC area, working as, to my dismay, a "Windows Desktop Engineer." I've been able to grab a few server tasks on the side, and the role has afforded me some valuable experience with Windows Server 2008 and Active Directory, however I find myself a good distance away from where my true interests lie: Linux servers and virtualization technologies.

At work, I've learned a good bit about GPO authoring, Active Directory 2008 configuration and management, Ghost Suite 2.5, Windows Server 2008 implementation of DHCP and DNS, enterprise-level IT, and the nature of consulting.

In what little time I have at home every few weekends (I tend to spend weekends in different cities or staying in DC), I've been playing around with Windows Server 2008 and Active Directory architecture in a virtual environment. Since leaving UGA, I had to forfeit my VMWare Workstation license, and thus have been learning to use Sun's VirtualBox. Aside from the networking, I've found that many of the standard features are comparable to VMWare Workstation.

In the coming weeks, I hope to have the opportunity to play around with Xen virtualization and KVM in Linux. More on that later!

Mounting ISOs in Windows 7

One feature that I was hoping Windows 7 would have (as Linux has had it since I can remember) is the built-in ability to mount ISOs... but alas, again Microsoft disappoints. To add insult to injury, neither Daemon Tools nor PowerISO work reliably in Windows 7. Windows XP SP3 broke Daemon Tools (something with sptd-SCSI Pass Thru Direct), and PowerISO installs on Windows 7 only unreliably, apparently determined by the particular workstation's hardware- here at work my coworkers who use Dell 740s have no problem, but the install always fails on my Dell GX620.

So what's the solution? Pismo File Mount. And it may be better than PowerISO or Daemon Tools anyways. It allows much more granular control of the mounted ISO, such as mounting for the owner only and establishing access (rw,r) for other users. It also allows you to mount ISO where they are, as opposed to a virtual disk, allowing quicker and better Windows explorer integration.

Adobe PDF Printer on Windows 7

Apparently Adobe Professional's Adobe Converter printer does not install cleanly on Windows 7. To manually install the printer, I did the following:

1. Start > Control Panel > View Devices and Printers
2. Add a Printer
3. Add a Local Printer
4. Create a new port
5. Named it AdobePDF
6. If Drivers auto populate, select Adobe PDF Converter, else
   
7. Click "Have Disk"
8. Browse to "C:\Program Files (x86)\Adobe\Acrobatx.x\Acrobat\Xtras\AdobePDF
9. Click any of the Adobe PDF Converters
10. Click "Use the driver that is currently installed (recommended)"
11. Name the Printer (I used the default "Adobe PDF Converter")
12. Right-click on the printer > Printer Properties
13. Go to Advanced tab
14. Click "Print directly to the printer" so that it doesn't spool printing

And now it works as intended! Just another odd quirk with Windows 7...

VMWare NAT on Windows 7

While I would never dream of switching my home workstation to a new version of Windows within its first few months on the market, particularly when it is still only in RTM, at work is a different story.

I could probably still get by using XP Pro on my workstation, and put Windows 7 in a VM, I find self-immersion to be the best method to fully learn a new OS, as it forces me to get it set up completely, otherwise I can't do work.

While I've run into a few annoyances thus far (no Daemon Tools or PowerISO, urg), nothing yet has been a show stopper... until I tried accessing the internet in my XP Active Directory administration virtual machine in VMWare using NAT.

Apparently Windows 7's new compartmentalized network security breaks VMWare's NATing ability. Note in the below screen shot how the VMWare Network adapter is identified by Windows as being on a public network, thereby disabling its connection.


I was able to still use Bridged networking within VMWare, but this was not practical at work since we have to specific each connected machine's MAC address in our DHCP tables to assign it an IP- a bit overkill for an only occasionally non-critical VM.

So after some digging and a bit of troubleshooting, I found a workable solution thanks, in part to this article, using Win7's Internet Connection Sharing (ICS). One important caveat to note is that Win7's networking has changed in a few minor ways that require a bit of deviation from the article. Below is a summary of steps:

1. Run the Virtual Network Editor as Admin
2. Go to Host Virtual Adapters tab, remove all VMNet instances (default are VMNet1 and VMNet8)
3. Click Apply
4. Click Add, select VMnet1
5. Click Apply
6. Go to the Host Virtual Networking tab
7. Click the > next to VMnet1 and change the address and subnet to use the Win7 ICS network (192.168.137.0 / 255.255.255.0) <- note how this deviates from the article
8. Click Apply
9. Go the NAT tab and select VMNet1
10. Click Edit and change the Gateway to the ICS gateway IP (192.168.137.1)
11. Click Apply and restart the NAT service
12. Go to the DHCP tab
13. Add VMNet1 and remove all others
14. Click Apply
15. Select Properties of VMNet1 in DHCP Tab
16. Enter a Start and End Address for DHCP (I used 192.168.137.50 to 192.168.137.75)
17. Click OK then Apply

19. Go to Network Connections in the Windows 7 Control Panel
20. Right Click on your Local Area Connection > Properties
21. Go to Share Tab and check both boxes (Allow other network users to connect through this computer's Internet connection and Allow other network users to control or disable the shared Internet Connection [optional])
22. Click OK

23. On each VM, go to Network settings and select Host Only Networking for every VM that needs to NAT out to the network

Done! Seemed to do the trick on my XP SP3 VMs, and now I can administer our AD tree and group policy!