Teh Tech » Kaseya

All about the Shutdown Command

admin — Sun, 28 Mar 2010 01:21:44 +0000

The ability to restart and shutdown computers automatically or remotely is key to completing installs, fixing issues, or just having a hell of a time messing with end users. In this post ill detail all the switches and uses of the shutdown command.

For anyone that is not familiar with the command ‘shutdown’, it is a windows/dos function that controlls the the shutdown, logoff and restart of a compiter or server either locally or remotely.

Here are the switches

shutdown [-i | -l | -s | -r | -a] [-f] [-m \\computername] [-t xx] [-c "comment"] [-d up:xx:yy]

Just typing shutdown won’t do anything; you need arguments.

-i This will display the GUI interface for the shutdown command. This works well in some cases though you do get more flexability with the command line options.
-l This will log off the current session on the computer. This cannot be used on remote computers though.
-s This will turn off the computer, this can be done remotely, but carefull you can’t remotely press the power botton on the front of the box!
-r This will restart the local or remote computer. Usefull stuff.
-a This will cancel the shutdown restart or logoff process, this must be used before the shutdown commences (during the countdown).
-m This is what allows you to specify the name of the computer you want to perform the action on (shutdown, restart or abort).
-t This lets you chose how long you want to display the warning message for in seconds. You can use ‘-t 0′ to immediatly start the shutdown process with no message displayed.
-c This lets you specify the reason that you shutdown or restarted in the event log. There is a max of 127 chracters for this switch.
-f This forces all applications to close with no warning. This should almost always be used with a remote computer so you dont have a box asking if you would like to shave chnages to ‘untitled.txt’ on the screen instead of it actually rebooting.
-d This switch will let you specify the reason for the shutdown using microsoft reason codes. ‘u’ is for user code ‘p’ is for planned and the ‘xx’ is to specify a major reason, while ‘yy’ is to specify a minor reason.

So putting it all together.

shutdown -r -f -m\\remotecomputer -t 60 -c “reboot required to complete software install”

This will restart the the computer ‘remotecomputer’ after 60 seconds of displaying the message “reboot required to complete software install”. To abort the shutdown within 60 seconds, issue the following command.

shutdown -a -m \\remotecomputer

If the remote shutdown is not working for you remember that if you are in a workgroup the account you are logged in with must exist on, and have administrative rights on the remote computer. If you are on a domain, the user account must have SeRemoteShutdownPrivilege and SeShutdownPrivilege to accomplish this.

Here are some other interesting notes on this function/script: It can be batched and run as a scheduled task. For example, saving the above script as a restart.bat and scheduling it to run at a specified time will give you the ability to reboot a server at whatever time you want. Additionally, shutdown commands can be used via telnet. You can telnet to a remote computer or server and issue the shutdown command to reboot the target computer. Lets face it, sometimes you have to install something with administrative rights, but you don’t want to wait for it to finish. So just batch it and add a logoff command right after the install. I use this all the time when I install office. I login to a computer with an elevated account, and run a batch file to install office silently with a shutdown -l -t 0 at the end of the batch file, then lock the computer. The install will finish and the account will logoff, its a useful little trick. Lastly with Kaseya; since this is directly a shell command you can issue it with just a few steps.

Script Name: Shutdown

Script Description: Shutdown the computer using Shutdown.exe

IF True

THEN

Execute Shell Command

Parameter 1 : shutdown -s -f -t 1 -c “Setup complete”

Parameter 2 : 0

OS Type : 0

ELSE

Change the red to match your needs and away you go.

[ad]

Add Command Prompt Here Context Menu

admin — Fri, 26 Mar 2010 15:53:04 +0000

Easy fast administration means less stress. This nifty script aims to save you some time. This adds the right click context menu to all folders in explorer ‘cmd prompt here’. When you click this option a command prompt with the current directory will be displayed. This is a very useful tool for administrative functions and saves you the time of opening a command prompt and changing directory to the folder you need. Additionally, it gives you a really easy way to walk a user through opening a command prompt window when you need them to run something like ipconfig over the phone. This is a visual basic script and runs silently, so it can be deployed by login script, or GPO as well as kaseya. Just save it as a .vbs.

Dim WSHShell
Set WSHShell = WScript.CreateObject(“WScript.Shell”)
WSHShell.RegWrite “HKCR\Folder\Shell\MenuText\Command\”, “cmd.exe /k cd ” & chr(34) & “%1″ & chr(34)
WSHShell.RegWrite “HKCR\Folder\Shell\MenuText\”, “Cmd Prompt Here”

[ad]

For Kaseya, save the above as cmd_here.vbs, and upload it to the server. Import this script and change the red location to match the location of the file on your server.

Script Name: cmd here
Script Description: Adds ‘cmd here’ to the context menu of explorer
IF True
THEN
Write File
Parameter 1 : c:\temp\cmd_here.vbs
Parameter 2 : admin\VBS\cmd_here.vbs
OS Type : 0
Execute File
Parameter 1 : c:\WINDOWS\system32\wscript.exe
Parameter 2 : c:\temp\cmd_here.vbs
Parameter 3 : 3
OS Type : 0
ELSE

[ad]

Change Windows Firewall From Command Line or Batch File

admin — Fri, 26 Mar 2010 00:01:24 +0000

I have a set of scripts I run when I prep a computer for deployment. At specific points applications require that the windows firewall be turned off in order to install correctly. This is namely ACT! and imagine time. They use a bunch of odd ports during install, so their documentation tells you to just turn off the firewall. Well here is what I found with a little research. From run or in a batch file there is a simple netsh command to disable the firewall and one to again enable it.

For imagine time my install script looks like this

netsh firewall set opmode disable
g:\Imagine_time\IT_SETUP.exe /q /p
netsh firewall set opmode enable

Effectively this will turn off the firewall, install the software silently from a share, and then enable the firewall again after install. I found something interesting with this in regards to kaseya too. Sometimes VNC can’t get through the firewall because it has defaulted or something went wrong. It turns out that if you run this as “system” you can actually disable the firewall remotely in many cases. This has been a very helpful script for when a computer shows ‘connectable’ but it just times out when attempting connection.

Script Name: Win Firewall Off

Script Description: Turns off windows firewall

IF True

THEN

Execute Shell Command

Parameter 1 : netsh firewall set opmode disable

Parameter 2 : 1

OS Type : 0

ELSE

Additionally, if you change enable to disable in the above script, you can enable the firewall remotely through kaseya as well.

[ad]

Change your Power Options to ‘Always On’

admin — Wed, 24 Mar 2010 07:31:24 +0000

It is anoying as hell when you push out an update or a patch and a computer is off. This hopefully will limit this problem. Although it is impossible to keep a user from shutting down this will at least keep the computer from doing it on its own. This can be pushed in a batch file, or deployed as part of a login script for rollouts, and of course through kasyea. Note this will only work on windows xp sp2 or higher.

Batch or login script:

powercfg /setactive “always on”

Kaseya

Script Name: Power Option – Always on

Script Description: Turns the computers power configuation to the ‘always on’ setting

IF True

THEN

Execute Shell Command

Parameter 1 : powercfg /setactive “always on”

Parameter 2 : 1

OS Type : 0

ELSE

[ad]

Automatically Remove Windows Search 4.0

admin — Mon, 22 Mar 2010 02:24:00 +0000

Microsoft has a funny way of sneaking ‘features’ in with patches. In this case Windows Search 4.0 is not really a feature as much as a problem. It was installed on a few of the networks I support as part of our weekly patching, and the next day I got a bunch of calls about reduced performance. I figured that people would complain until it finished indexing. Not the case, it seemed to cripple computers and crush servers. It indexed to the point of actually leaving no resources for users to authenticate to one of our terminal servers. I started looking for a fix and came up with this:

Kaseya:

Script Name: Remove Windows Search 4.0
Script Description:

IF Test File
Parameter 1 : C:WINDOWS$NtUninstallKB940157$spuninstspuninst.exe
Exists :
THEN
Execute File
Parameter 1 : C:WINDOWS$NtUninstallKB940157$spuninstspuninst.exe
Parameter 2 : /quiet /norestart
Parameter 3 : 3
OS Type : 0
ELSE

Windows logon script or batch file:

C:WINDOWS$NtUninstallKB940157$spuninstspuninst.exe /quiet /norestart

If you are using kasaya you can import that script directly and run it to remove the ‘feature’. You can also add the above line to a login script or batch file. This will automatically, silently remove the update with no user intervention or popup. it literally just disappears.

WARNING: running this on a terminal server with users logged in will cause new users to not be able to authenticate until you restart the server. Always follow best practice for software uninstalls. Careful when you run it on servers

Just a nice simple way to remove windows search 4.0 infection from your network.

[ad]

Make a Local User Account With VBS

admin — Thu, 18 Mar 2010 16:16:30 +0000

I deployed a bunch of new computers to a network using terminal services. Since the real authentication is at the server we standardize the local computer login to the username user1 and the password user1, just to keep things simple. So I needed a easy way to create this account locally on 30+ workstations. Here is what I came up with:

Option Explicit
‘ On Error Resume Next

Dim objComputer, objGroup, objUser, objWSHNetwork, strComputerName, FullName, Password, UserName, lngFlag
Const ADS_UF_DONT_EXPIRE_PASSWD = &H10000
Const ADS_UF_PASSWD_CANT_CHANGE = &H40
Set objWSHNetwork = WScript.CreateObject(“WScript.Network”)
strComputerName = objWSHNetwork.ComputerName
Set objComputer = GetObject(“WinNT://” & strComputerName)
Set objGroup = GetObject(“WinNT://” & strComputerName & “/Users”)

UserName = “user1”
FullName = “user1”
Password = “user1”

Set objUser = objComputer.Create(“User“, UserName)
objUser.SetPassword Password
objUser.FullName = FullName
objUser.SetInfo
objGroup.Add “WinNT://” & strComputerName & “/” & UserName

lngFlag = objUser.Get(“UserFlags”)
lngFlag = lngFlag Or ADS_UF_DONT_EXPIRE_PASSWD
objUser.Put “UserFlags”, lngFlag

lngFlag = objUser.Get(“UserFlags”)
lngFlag = lngFlag Or ADS_UF_PASSWD_CANT_CHANGE
objUser.Put “UserFlags”, lngFlag

objUser.SetInfo
objUser.SetInfo

What this does is it creats a user account on the local computer feel free to change the red values to fit your needs. It also flags the password as user cannot change and never expires. These sections of code (marked in purple) can be removed to fit your needs. Remember visual basic scripts are hangled by wscript.exe usually found in c:windowssystem32wscript.exe. Be sure to point the script to this if you are using it as a login script or pusing it through a third party application like kaseya.

here is a example of this being used in kaseya, copy the script, edit it to your needs, save it as user1.vbs, adn put it on the kaseya server. Run it an vola, user account across a network.

Script Name: User Account Creation
Script Description: Creats an account called user1 with the password user1 and sets it to never expire and user cannot change.

IF True
THEN
Write File
Parameter 1 : c:tempuser1.vbs
Parameter 2 : adminVBSadmin.vbs
OS Type : 0
Execute File
Parameter 1 : c:WINDOWSsystem32wscript.exe
Parameter 2 : c:tempuser1.vbs
Parameter 3 : 3
OS Type : 0
ELSE

Hope this helps, it took me a while to develop.

[ad]

Remotely Enable Remote Desktop

admin — Tue, 16 Mar 2010 13:56:36 +0000

This is for those ‘oh shit’ times when you can’t get to a computer when you need to. If you can get to the remote registry of a computer, you can change this key to allow RDP access to the computer, even if the box is not checked.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ControlTerminal Serverf\DenyTSConnections
DWORD value: 0

Or for you Kaseya people out there.

Script Name: OH SHIT RDP ON
Script Description: Enable Remote Desktop

Script Name: rdp
Script Description: Enable Remote Desktop

IF True
THEN
   Set Registry Value
     Parameter 1 : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ControlTerminal Serverf\DenyTSConnections
     Parameter 2 : 0
     Parameter 3 : REG_DWORD
         OS Type : 0
ELSE

If you use Kaseya you can run this script accross your network or as part of your inital setup to prevent “Oh Shit” moments in the first place.

[ad]

Service Pack 3 Rollout Options Switches and Scripts

admin — Sun, 14 Mar 2010 19:52:12 +0000

Okay so Service Pack 3. Scary I know, I am always weary of big service pack rollouts. However if you don’t update to SP3, you are open to contracting some nasty bugs. Here are some simple install possibilities if you don’t have it on your network yet. I suggest that you take a look at some of the install articles on SP3 and some of the complications people have experienced before doing a mass rollout. Below are some options that might be helpful to you, but as always test on a few computers before rolling out to a bunch. You might also want to check out this link for a explanation of the switches and arguments for installation. In my scripts below the switches I use will force all aplications closed, and do a backup of of the replaced files, and make a log. A progress window is displayed during the install and at the end the computer is rebooted. I found this to be the best option for rollouts as you can see the progress bar to estimate time remaining, and you do have a log and a backup if things go wrong. I suggest you find the right mix of switches that work for you though.

1. Windows Update: Works on small networks, though it might not be the best option on any network with more than a few computers.

2. Network Install: The file is available from Microsoft here. Then all you have to do is install it, or script it. I used this script to accomplish this at a few of my locations. Note that you can run it over the network, but I like to copy it locally, just incase there is a network failure or i need to rerun it later for some reason.

Title DO NOT CLOSE!!!
color 1f
echo off
net use x: Serversp3
md c:downloads
md c:downloadssp3
copy x:windowsXP-KB936929-SP3-x86-ENU.exe c:downloads
net use x: /delete
cls
echo A UPDATE IS INSTALLING ON THIS COMPUTER. DO NOT RESTART OR CLOSE THIS WINDOW. WHEN THE UPDATE IS COMPLETE THE COMPUTER WILL RESTART AUTOMATICALLY.
c:downloadsWindowsXP-KB936929-SP3-x86-ENU.exe /passive /forcerestart /forceappsclose /d:c:tempbu /log:c:tempbuxpsp3.log

3. Kaseya with cURLing: This will create a ton of bandwidth usage if you push this to more than a few computers on the same network, as every computer will be downloading it to their local disk. So I don’t recommend this to a really large network, and it is also best done at night just so you don’t get any complaints of slowness. Also note that you are going to have to have curl on your kserver to make this work. Check out this post for a quick explination of cURL or just download it here The script will check to see if the computer is running SP3 already, if it is it will stop, if not it will download it and run an unattended install followed by a reboot.

Script Name: sp3 curl
Script Description:
IF Check Registry Value
Parameter 1 : HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionCSDVersion
= :Service Pack 3
THEN
ELSE
Execute Shell Command
Parameter 1 : md c:temp
Parameter 2 : 0
OS Type : 8
Execute Shell Command
Parameter 1 : md c:tempsp3
Parameter 2 : 0
OS Type : 8
Write File
Parameter 1 : c:tempsp3curl.exe
Parameter 2 : admincurlcurl.exe
OS Type : 8
Execute File
Parameter 1 : c:tempsp3curl.exe
Parameter 2 : http://download.microsoft.com/download/d/3/0/d30e32d8-418a-469d-b600-f32ce3edf42d/WindowsXP-KB936929-SP3-x86-ENU.exe -o “c:tempsp3WindowsXP-KB936929-SP3-x86-ENU.exe”
Parameter 3 : 3
OS Type : 8
Execute Shell Command
Parameter 1 : c:tempsp3WindowsXP-KB936929-SP3-x86-ENU.exe /passive /forcerestart /forceappsclose /d:c:tempbu /log:c:tempbuxpsp3.log
Parameter 2 : 0
OS Type : 8

[ad]

Reset a Local Account Password With VBS

admin — Thu, 11 Mar 2010 15:25:03 +0000

Today I added a bunch of old computers with different local admin account passwords to our domain. So, since I am all for doing things the easy way I came up with a quick script. I added the computers that I needed the admin account reset on to an active directory OU and applied this script.

Option Explicit
‘ On Error Resume Next
Dim objComputer, objWSHNetwork, strComputerName, objUser
Set objWSHNetwork = WScript.CreateObject(“WScript.Network”)
strComputerName = objWSHNetwork.ComputerName
Set objComputer = GetObject(“WinNT://” & strComputerName)
Set objUser = GetObject(“WinNT://” & strComputerName & “/accountname, user”)
objUser.SetPassword “password”
objUser.SetInfo

If you would like to use this with Kaseya all you have to do is copy the above script name and name it password.vbs. Change the variables to meet your needs and then upload it to the server. Then just import the script below and change the path of the password.vbs to match the path of your file.

Script Name: Password Reset
Script Description: This resets an account password to a password of your choice with no intervention from the user.
THEN
Write File
Parameter 1 : c:temppassword.vbs
Parameter 2 : adminVBSpassword.vbs
OS Type : 0
Execute File
Parameter 1 : c:WINDOWSsystem32wscript.exe
Parameter 2 : c:temppassword.vbs
Parameter 3 : 3
OS Type :

This script pulls the computer name from the computer so it is completely portable. This can also be used to reset any local accounts not just admin accounts and can be pushed through active directory or another script management application like Kaseya or n-able. Remember that wscript.exe is what handles .vbs in windows, so be sure to point the script to the right location (usually c:windowssystem32wscript32.exe). Just change the above accountname to match the account you wish to reset and insert the password you wish to set it to.

[ad]

Curling: Installing Adobe Reader With cURL

admin — Mon, 08 Mar 2010 22:09:17 +0000

Don’t worry, you wont need a broom for this. cURL is a free opensoure, crossplatform, tiny application used for file transfer over urls, and browser emulation form command line. It is avaliable here http://curl.haxx.se/ . I happened across this while back while looking for a way to remotely download files from microsoft without user intervention and this has proved to be very useful. So heres how it works to do a basic download. In this example we are downloading Adobe Reader 9 from adobe.com.

http://ardownload.adobe.com/pub/adobe/reader/win/9.x/9.0/enu/AdbeRdr90_en_US.exe -o “c:tempadobeAdbeRdr90_en_US.exe”

Essentially you use the syntax -o

The ’-o’ switch will output the file where you want it to go, the directory must already exist though. Additionally this will work only for URLs that do not begin with HTTP. Telnet, TFTP, FTP, and many other common protocols are supported. If you need to curl from a HTTPS site you must also download the open SSL package from http://curl.haxx.se/.

Now to put it all together. This script can be used as a batch file to download and install Adobe Reader 9 from Adobe.com without any user intervention. The download is automated, and the necessary switches to completely automate the installation are below. The instalation of adobe is completely silent, it installs for all users with no user input or display. Give it about 5 min to complete the install after the curl finishes. This script can be used in a login script on a domain, or pushed through a management application such as Kaseya.

md c:temp
md c:tempadobe
c:tempcurl.exe http://ardownload.adobe.com/pub/adobe/reader/win/9.x/9.0/enu/AdbeRdr90_en_US.exe -o “c:tempadobeAdbeRdr90_en_US.exe”
c:tempadobeAdbeRdr90_en_US.exe /sAll /rs /l /msi”/qb-! /norestart ALLUSERS=1 EULA_ACCEPT=YES SUPPRESS_APP_LAUNCH=YES

Note that you can change the path to your curl.exe to match where you have stored it on your computer.
[ad]