I wrote the following program in order to get around this issue. Its called RDPon.exe and you can get it here:

With this you can:

• Query RDP status
• Enable RDP
• Disable RDP

I have sealed it as an exe so that you can right click it and choose run as to get at your admin account easily.

when right clicking  on an office document Adobe decided  “Combine supported files in acrobat” to be we all must have, fine in the wild… but not so good in a shared desktop environment.

To remove this from your Citrix environment / Desktop simply run this command:

REGSVR32 /u "C:Program FilesAdobeAcrobat 9.0Acrobat ElementsContextMenu.dll.

If you also wish to remove the New > file type associations that Adobe decide to push in, heres a script to do so:

REG DELETE HKEY_CLASSES_ROOT.xdpAcroExch.XDPDocShellNew /f
 REG DELETE HKEY_CLASSES_ROOT.xdpShellNew /f

Update:

With the move to 64 bit platforms, a new dll has been put in place:

C:Program Files (x86)AdobeAcrobat 9.0Acrobat Elementscontextmenu64.dll

This dll add’s the following items to the context menu:

• Convert to Adobe PDF
• Convert to Adobe PDF and Email.

If you wish to remove these, run the following command:

REGSVR32 /u "C:Program Files (x86)AdobeAcrobat 9.0Acrobat ElementsContextMenu64.dll"

The pre Requisits for this script are:

·         Installation of IIS 6.0 +

·         Installation of .net framework 3.5

·         Installation of J#

·         Installation of Citrix access management console framework (and web interface component).

·         Installation of citrix web interface.

Configure your variables for the management servers and farm names, then save the below as a batch file:

set sitemgrdir=C:Program FilesCitrixWeb Interface5.0.1
set mgmtservers=server0001;server0002
set farmname=farm01

“%sitemgrdir%”sitemgr.exe -c “WIDest=1:/Citrix/XenApp,Config=local,XMLService=%mgmtservers%,farmname=%farmname%,XMLSPort=80,WIDefaultSite=yes”‘)/?
“%sitemgrdir%”sitemgr.exe -c “PNADest=1:/Citrix/PNAgent,Config=local,XMLService=%mgmtservers%,farmname=%farmname%,XMLSPort=80″‘)/?

The script in full can be downloaded here

I was asked the following question recently when finishing our Citrix server deployment method.

We needed a script that would run on a computer as part of a sequence of scripts that would move a server from its current OU to the servers final resting place a terminal servers OU.

The below script achieved what we needed by using the computers %computername% variable to move the computer.

In our case the following apply:

·The computers name is using the variable %computername%

·The domain is domain.net

·The computers OU before the move is computers

·The OU we wish to move to is Terminal Servers

dsmove “CN=%computername%,OU=computers,DC=domain,DC=net” -d domain.net -newparent OU=”Terminal Servers”,DC=domain,DC=net

if you are unaware of the computers current OU before the move and you still wish to script the move, the following forum post will get you in the right direction.

Generally speaking this is no problem as how many batch files do you run take over 10 minutes?

This problem came to light for us when enteo began causing our ESX servers to purple screen of death during the pe stage of the build, which resulted in us moving our virtual servers to a stable ESX while we rebuilt. The problem was that the ESX was so slow with all the added servers that our scripted citrix updates were taking over 10 minutes, the script continued, rebooted the server during the updates and low and behold a very sick citrix server.

The trick to get around this, and i recommend this for any batch file you run in enteo, is to create a looping if statement in the enteo script to check for a registry key. Once you have this key created run your updates then delete the key as the last line in your batch file. This will cause enteo to loop even after the 10 minutes leaving your critical updates to install without fear of being.

heres the idea for the enteo script:

execute %systemdrive%longbatchfile.bat /?
:check
if exist regkey goto sleep
del %systemdrive%longbatchfile
Exitproc
:sleep
sleep 60
goto check

And in the batchfile create the reg key, do your work then delete it:

reg add hklmsoftwareenteo /v checkkey
update1
update2
update3
update4
update5
reg delete hklmsoftwareenteo /v checkkey

what will happen is simple, even if the script times out, the script will carry on sleeping until the key is deleted, no matter how long it takes.

After the jump is an example of my code so you can see what we did to get around this

Enteo EScript:

Copy(‘.Extern$*.*’,’%windir%TempHotfix’)/TW
Execute(‘%windir%temphotfixhotfix_install.bat’)/?
: Check
If RegValueExists(‘HKEY_LOCAL_MACHINESOFTWAREEnteo’,’rebootstatus’)
goto Sleep
Delete(‘%windir%temphotfix*.*’)
RemoveDir(‘%windir%temphotfix’)/S/TW
Execute(‘%WINSYSDIR%shutdown.exe /r /t 30′)
ExitProc(Done)
: Sleep
Sleep(’60’)
goto Check

Batch file:

Rem Adding check registry key
Reg add “HKEY_LOCAL_MACHINESOFTWAREEnteo” /v rebootstatus /t REG_SZ /d “0” /f
msiexec /p %windir%temphotfixPSE450W2K3R02.msp /qn /norestart
msiexec /p %windir%temphotfixPSE450R02W2K3002.msp /qn /norestart
msiexec /p %windir%temphotfixPSE450R02W2K3004.msp /qn /norestart
msiexec /p %windir%temphotfixPSE450R02W2K3007.msp /qn /norestart
msiexec /p %windir%temphotfixPSE450R02W2K3008.msp /qn /norestart
msiexec /p %windir%temphotfixPSE450R02W2K3010.msp /qn /norestart
msiexec /p %windir%temphotfixPSE450R02W2K3014.msp /qn /norestart
msiexec /p %windir%temphotfixPSE450R02W2K3036.msp /qn /norestart
msiexec /p %windir%temphotfixPSE450R02W2K3037.msp /qn /norestart
Rem Clearing check registry key
reg delete HKEY_LOCAL_MACHINESOFTWAREEnteo /v rebootstatus /f

as with the above, the batch file controlling when the reg key is created and deleted determines when the script is allowed to end, regardless of enteo’s 10 minute rule.

]]> http://andrewmorgan.ie/2008/11/enteo-the-10-minute-rule-on-batch-files/feed/ 4 http://andrewmorgan.ie/2008/10/a-simple-but-effective-annoyance/ http://andrewmorgan.ie/2008/10/a-simple-but-effective-annoyance/#comments Tue, 21 Oct 2008 15:02:36 +0000 http://andymorgan.wordpress.com/?p=156 heres a funny one for you scripters out there, we had a chat in work a few weeks ago about just how effective scripting is and whether it is actually useful.

taking massive offense to this, i ofcourse decided to show said moaner just how effective batch files are!

Heres an evil one for you:

:starting

start cmd

goto starting

Thats it! watching moaners pc crease and die when i executed this in his session using psexec was my entertainment for the week.

And before you start emailing me, dont ask how i got it into his session. psexec.exe /?

Heres a few pointers i threw together to get your “post build” script in order starting with dummy accounts, passwords and user memberships.

Renaming the administrators account (admrename.vbs):

strComputer = “.”
Set wshShell = WScript.CreateObject( “WScript.Shell” )
strComputerName = wshShell.ExpandEnvironmentStrings( “%COMPUTERNAME%” )

Const ADS_UF_DONT_EXPIRE_PASSWD = &H10000

Set objWMIService = GetObject(“winmgmts:” & strComputer & “rootcimv2″)
Set colAccounts = objWMIService.ExecQuery _
(“Select * From Win32_UserAccount Where LocalAccount = True And Name = ‘Administrator'”)

For Each objAccount in colAccounts
objAccount.Rename “ADM” & strComputerName

The above script will rename the Administrator account to ADMcomputername, it can easily be changed to a static name deleting the & strComputerName and adding the full name in the “” ‘s.

Creating a local account using the command line (batch):

net user patchacc passw0rd /add /comment:”Patch account” /fullname:”windows Patch account” /active:yes /passwordchg:no /passwordreq:yes

the above script will create a username (patchacc) with password (passw0rd), the account will also be enabled.

Add an account to the local administrators(batch):

net localgroup /add administrators patchacc

The above command adds the username patchacc to the local group administrators, you can use the above command to add a domain account using net localgroup /add administrators domainusername.

Setting a password to never expire (pwd.vbs):

Set objUser = GetObject(“WinNT://” & strcomputer & “/username“)
objPasswordNoChangeFlag = objUser.UserFlags XOR ADS_UF_DONT_EXPIRE_PASSWD
objUser.Put “userFlags”, objPasswordNoChangeFlag
objUser.SetInfo

The above scriptlet will simply set the password to the “username” account to never expire, dont try to do it with net user, it doesnt work… ever.

Creating a dummy administrator account:

net user Administrator Notreal123 /add /comment:”Bogus Admin Account” /fullname:”Bogus Admin Account” /active:no /passwordchg:no /passwordreq:yes

The above script will create a disabled user called administrator (rename the current administrator first), with password of Notreal123.

After the jump is an example of how to tie them all into one super script and the source files.

http://www.4shared.com/file/64993533/ef9ff324/users.html

REM copy the entire cotents of the zip to a share name on your network, add the share to the below statement.
set netdir=servernameshare

@echo Creating Patch account & net user patchacc passw0rd /add /comment:”Patch account” /fullname:”windows Patch account” /active:yes /passwordchg:no /passwordreq:yes
@echo.
@echo Renaming admin account & cscript /b “%netdir%admrename.vbs” & echo Complete
@echo.
@echo Fixing password & cscript /b “%netdir%pwd.vbs” & echo Complete
@echo.
@echo Adding Dummy account & et user Administrator Notreal123 /add /comment:”Bogus Admin Account” /fullname:”Bogus Admin Account” /active:no /passwordchg:no /passwordreq:yes
@echo.
@echo adding patch to local admins. & net localgroup /add administrators patchacc

pause

Often when restarting a server its nice to get a complete timeline of when the server went down and subsequently comes back up. I found this script a while back but found it lacked the later port 3389 to enable remote desktop again. I editted the following script from eric and have been using it for a very long time now.

http://www.ericwoodford.com/use_ping_to_notify_when_server_reboots

I have modified it slightly to include a program called portqry, when a server is restarted it monitors ping responses until the server goes down. It then continually pings the server until it gets a response. Once a responce on icmp is received it will query port 3389 (remote desktop) until it gets a response indicating the server is now ready to be logged into again.

you can either type rebooter “servername” or simply type rebooter and the program will ask you for the servers name.

After the jump is the code, and the zip file i have uploaded packaging it all together.

The script is available here with all the neccessary batches/programs, best to extract them to your %windir%system32 where they can be accessed from cmd.

http://www.4shared.com/file/64988601/c29bd123/rebooter.html

echo off
 CLS
 Set A=0
 Set ServerName=%1
if not '%1'=='' goto :Pass1
 Set /p ServerName=[What is the server name?]
 if not '%ServerName%'=='' goto :Pass1
 echo Failed to get Server name..
 Goto :End
:Pass1
 Title Checking %servername%
 Echo Checking Server %ServerName% for response
 echo Check # _
 :Pass1a
 ping %ServerName% > %servername%-results.txt
 find /C "Request timed out" %servername%-results.txt > %servername%-fresults.txt
for /F "skip=1 tokens=1,2 delims=:" %%a in (%servername%-fresults.txt) DO (
 if NOT "%%b"==" 0" goto :TimedOut
 cls
 Echo Checking Server %ServerName% for response
 echo Check # %A%
 Set /A A+=1
 Goto :Pass1a
 )
 :TimedOut
 Set DownTime=%TIME%
 Title %servername% DOWN
 Echo Server Down %DownTIME% Passes: %A%
 Set B=0
 :Pass2
 ping %ServerName% > %servername%-results.txt
 find /C "Request timed out" %servername%-results.txt > %servername%-fresults.txt
 for /F "skip=1 tokens=1,2 delims=:" %%a in (%servername%-fresults.txt) DO (
 if "%%b"==" 0" set uptime=%time% & set c=0 & goto :BackUp
 CLS
 Echo Checking Server %ServerName% for response
 echo Check # %A% - Server Down: %DownTime%
 Echo Waiting For Server to come up: %B%
 Set /A B+=1
 Goto :Pass2
 )
:BackUp
 Title %servername% Pinging
 cls
 Echo Checking Server %ServerName% for response
 echo Check # %A% - Server Down: %DownTime%
 echo Server Pinging Again: %uptime% - Passes: %B%
 Echo Checking rdp port:
 portqry -n %servername% -q -e 3389
 Set /A C+=1
 if %errorlevel% NEQ 0 goto :backup
 del %servername%-fresults.txt
 del %servername%-results.txt
 cls
 Title %servername% UP
 Echo Checking Server %ServerName% for response
 echo Check # %A% - Server Down: %DownTime%
 echo Server Pinging Again: %uptime% - Passes: %B%
 echo RDP available @ %time% - Passes: %C%
 @echo.
 Echo Server down @ %downtime% Service restored @ %time%
 pause
 :End

As the language bar is part on the office installation, i did not want to go fiddling with the installation properties incase it knocked anything else in the office install out of sync but i did need to remove it from 70+ citrix servers without much overhead.

I read an article recently on the citrix forums and it suggested that ctfmon.exe was the owner of the language bar, once i knew this i wrote a script to deny users access to this file, which in turn would block from running.

I decided to use xcacls as a command line utility, i used xcacls to straight out deny members of the users group (locally) to access the file, this is done like this:

xcacls.exe C:windowssystem32ctfmon.exe /E /d users /Y

if you are using windows 2000, you can copy the xcacls.exe to an network share and run it from there without any issue.

serversharexcacls.exe %SystemRoot%system32ctfmon.exe /E /d users /Y

and if you want to hit 60+ servers remotely, use psexec

psexec @servers.txt -u domainusername cmd /c “servernamectxutilsxcacls.exe %SystemRoot%system32ctfmon.exe /E /d users /Y”

Servers.txt would be in the same directory as psexec, and would contain the server names one per line.

I’ve uploaded the script here:

Update:

As of server 2008 / windows vista the above fix no longer works, this is due to the language bar being heavily integrated.

The following key controls the language bar in these operating systems:

HKEY_CURRENT_USERSoftwareMicrosoftCTFLangBar

Showstatus (DWORD).

To hide the language bar, set the value of showstatus to 3.

This can be done using a mandatory profile or group policy as below:

I used dsget to pull the user information from the group, below is the command i used:

dsget group “cn=Groupname,ou=DLs,ou=Exchange Recipients,dc=ie,dc=domain,dc=company,dc=com” -members >> 1.txt

the above command enumerates the “groupname” group in an ou called dls, in an ou called exchange recipients in the domain ie.domain.company.com. if your ou or domain structure is different trim out (or add) what you need.  The -members at the end of the file will dump only the usernames in FQDN format.

Once the script is run check the current directory for a textfile called 1.txt.  This text file will contain the usernames you need in FQDN format like below:

“CN=Tom Thumb (IE),ou=Dublin,dc=ie,dc=domain,dc=company,dc=com”
“CN=Mike Hunt (IE),ou=Dublin,dc=ie,dc=domain,dc=company,dc=com”

In order to get the email address’es i decided not to try and read from the file, instead i just ran the same command again and piped the results to another dsget query.

dsget group “cn=Groupname,ou=DLs,ou=Exchange Recipients,dc=ie,dc=domain,dc=company,dc=com” -members | dsget user -email >> 2.txt

The above will pull the results we saw in 1.txt, but instead it passes it straight into another query (dsget user -email) and sends those results to a text file. 2.txt should contain the users primary email address:

tom.thumb@company.com
mike.hunt@company.ie

Now simply copy the contents on both text files into neighboring columns in excel and you have your report

Update: 13/08/2012

An old friend of mine Rob reminded me that this post existed and wondered how to do it with powershell. Luckily This is much, much easier to do with Windows Powershell!

On a server with the active directory module for powershell installed (normally a domain controller), run the following commands: (replace the group name with your own one).

[sourcecode language=”PowerShell”]

#######Change the below values#######
$groupname = "My Group Name"
$exportfile = c:tempreport.csv
#####################################

if (!(get-module -ListAvailable | where {$_.name -eq "ActiveDirectory1"} -ea 0)){
write-warning "The ActiveDirectory PowerShell module is Not Installed!"
break}
else{
write-host "Importing Active directory module";import-module activedirectory -ea 0
Get-ADGroupmember $groupname | %{get-aduser $_.samaccountname -properties cn,samaccountname,emailaddress | select cn,samaccountname,emailaddress | export-csv -notypeinformation $exportfile}
}
[/sourcecode]