As everybody is probably already aware, we use Novell ConsoleOne and Zenworks where I work. ConsoleOne has some interesting features that require that whenever a Group Policy is being edited it takes over as the policy on the machine that is editing it. Rather than have a useful tool like Microsofts Group Policy Management Console, Novell likes to replace the local Group Policy and then just run gpedit.msc. Which is where my first gripe about gpedit.msc comes in:

GPEdit.msc requires line by line entry of things like, for example, port exceptions and program exceptions for the Windows Firewall. This is usually not an issue except that, as I have discussed in previous posts, we have been moving towards a Windows Domain environment. Firewall Exception rules are configured within two places in Group Policy: Domain Profile and Standard Profile. I have found that there is a need to move our current Standard Profile settings across to the Domain Profile settings. After a bit of registry searching I found a neat trick for doing exactly that.

In Novell, when a GPO is opened in gpedit.msc the Group Policy Contents are loaded into the normal registry locations (as per a normal GPO being applied to user and machine) and the contents are also loaded under a specific pair of registry keys. The HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects Key is created on loading gpedit.msc, and underneath a pair of Keys are created like {449E44B0-A4DC-4665-AE8F-68710E1BC1EC}Machine and {449E44B0-A4DC-4665-AE8F-68710E1BC1EC}User, where the GUID is randomly generated (or at least seems to be random) each time gpedit.msc is run. Under these keys are the branch on which the Group Policy Settings are configured.

So therefore in order to duplicate StandardProfile Settings I need to duplicate all keys and values underneath HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{GUID}Machine\Software\Policies\Microsoft\WindowsFirewall\StandardProfile\, where {GUID} is the randomly generated GUID for editing a Group Policy Object. So far from my research I have never seen more than one GUID appear underneath the Group Policy Objects key, though your mileage may vary. So the first step is to get the User and Machine keys from under the Group Policy Objects key.

Const HKEY_CURRENT_USER = &H80000001
Const HKEY_LOCAL_MACHINE = &H80000002
 
Const REG_SZ = 1
Const REG_EXPAND_SZ = 2
Const REG_BINARY = 3
Const REG_DWORD = 4
Const REG_MULTI_SZ = 7
 
strComputer = "."
 
Set objReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _
 strComputer & "\root\default:StdRegProv")
 
strKeyPath = "Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\"
strStandardPath = "\Software\Policies\Microsoft\WindowsFirewall\StandardProfile\"
strDomainPath = "\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\"
 
If keyExists(HKEY_CURRENT_USER,strKeyPath) Then
  subkeys = GetSubkeys(HKEY_CURRENT_USER,strKeyPath)
  If Not IsEmpty(subkeys) Then
    GPOMachine = subkeys(LBound(subkeys)) 
    GPOUser    = subkeys(UBound(subkeys))
 
    RegCopyTree HKEY_CURRENT_USER, strKeyPath & GPOMachine & strStandardPath, strKeyPath & GPOMachine & strDomainPath, False
  Else
    WScript.Echo "Policy not found, please try editing the policy manually"
  End If
Else
  WScript.Echo "Please start editing the Group Policy before running this script"
End If

The code here is the shell of the script. We need to flesh out the functions keyExists, GetSubkeys, RegCopyTree, and valueExists (which we can’t see just yet). So first we will have a look at keyExists:

Function keyExists(Hive, Key)
  On Error Resume Next
  Err.Clear
 
  ret = objReg.EnumValues(Hive,Key,arrValues,arrValueTypes)
 
  If ret <> 0 Then
    keyExists = False
  Else
    keyExists = True
  End If
  Err.Clear
  On Error Goto 0
End Function

Fairly straightforward, we try and enumerate the values of a key. If we succeed then the key does exist, otherwise it doesn’t. We will use the same principle for checking if a Value Exists.

Function valueExists(Hive, Key, ValueName)
  On Error Resume Next
  Err.Clear
 
  valueExists = False
  If Not keyExists(Hive, Key) Then
    Exit Function
  End If
 
  ret = objReg.EnumValues(Hive,Key,arrValues,arrValueTypes)
 
  If IsNull(arrValues) Then
    Exit Function
  End IF
 
  For i = LBound(arrValues) to UBound(arrValues)
    If LCase(CStr(arrValues(i))) = LCase(CStr(ValueName)) Then
	  valueExists = True
	  Exit Function
	End If
  Next
 
  valueExists = False
 
  Err.Clear
  On Error Goto 0
End Function

Here, we take the Enumeration of the Keys Values a step further and actually step through them looking for a match with ValueName. I have opted for a Case Insensitive search due to registry being case insensitive with value names.

Function GetSubkeys(Hive, Key)
  On Error Resume Next
  Err.Clear
 
  ret = objReg.EnumKey(Hive,Key,arrSubkeys)
 
  GetSubkeys = arrSubkeys
 
  Err.Clear
  On Error Goto 0
End Function

Possibly the simplest of the functions, GetSubkeys just returns an array of Keys underneath the current Key. The most indepth function we require is the RegCopyTree:

Function RegCopyTree(Hive, SrcKey, DestKey, Force)
  On Error Resume Next
  Err.Clear
  strComputer = "."
  Set StdOut = WScript.StdOut
  strValue = ""
  If Force <> True Then
    Force = False
  End If
 
  if Right(SrcKey,1) <> "\" Then SrcKey = SrcKey & "\"
  if Right(DestKey,1) <> "\" Then DestKey = DestKey & "\"
 
  ret = objReg.EnumValues(Hive,SrcKey,arrValueNames,arrValueTypes)
 
  For i= LBound(arrValueNames) To UBound(arrValueNames)
    'StdOut.WriteLine "Value Name: " & arrValueNames(i) 
	StdOut.WriteLine "Copying from: " & SrcKey & arrValueNames(i)
	StdOut.WriteLine "To          : " & DestKey & arrValueNames(i)
    StdOut.Write     "       Value: "
 
	If (Not valueExists(Hive, DestKey, arrValueNames(i))) Or Force Then
	  Select Case arrValueTypes(i)
			Case REG_SZ
				'StdOut.WriteLine "Data Type: String"
				'StdOut.WriteBlankLines(1)
				
				objReg.GetStringValue Hive, SrcKey, arrValueNames(i), strValue
				objReg.SetStringValue Hive, DestKey, arrValueNames(i), strValue
				StdOut.Write strValue
			Case REG_EXPAND_SZ
				'StdOut.WriteLine "Data Type: Expanded String"
				'StdOut.WriteBlankLines(1)
				
				objReg.GetExpandedStringValue Hive, SrcKey, arrValueNames(i), strValue
				objReg.SetExpandedStringValue Hive, DestKey, arrValueNames(i), strValue
				StdOut.Write strValue
 
			Case REG_BINARY
				'StdOut.WriteLine "Data Type: Binary"
				'StdOut.WriteBlankLines(1)
				
				objReg.GetBinaryValue Hive, SrcKey, arrValueNames(i), strValue
				objReg.SetBinaryValue Hive, DestKey, arrValueNames(i), strValue
				For Each x in strValue
		          StdOut.Write Hex(x) & " "
		        Next
 
			Case REG_DWORD
				'StdOut.WriteLine "Data Type: DWORD"
				'StdOut.WriteBlankLines(1)
				
				objReg.GetDWORDValue Hive, SrcKey, arrValueNames(i), strValue
				objReg.SetDWordValue Hive, DestKey, arrValueNames(i), strValue
 
				StdOut.Write Hex(strValue)
			Case REG_MULTI_SZ
				'StdOut.WriteLine "Data Type: Multi String"
				'StdOut.WriteBlankLines(1)
				
				objReg.GetMultiStringValue Hive, SrcKey, arrValueNames(i), strValue
				objReg.SetMultiStringValue Hive, DestKey, arrValueNames(i), strValue
				For Each x in strValue
		          StdOut.Write x
		        Next
		End Select 
 
		StdOut.WriteLine ""
    End If '' Force
  Next
 
  ret = objReg.EnumKey(Hive,SrcKey,arrSubkeys)
 
  For i = LBound(arrSubkeys) to UBound(arrSubkeys)
    If Not keyExists(Hive,DestKey & arrSubkeys(i)) Then
	  objReg.CreateKey Hive,DestKey & arrSubkeys(i)
	End If
	RegCopyTree Hive, SrcKey & arrSubkeys(i), DestKey & arrSubkeys(i), Force
  Next
 
  On Error Goto 0
End Function

This function takes the Hive, Source Key, Destination Key, and a Boolean Value to determine whether to Force overwriting existing values. It first creates the Destination key if it doesn’t already exist, then enumerates all values in the Source path, and writes them to the Destination path, creating new values or overwriting only if Force is set. This function has a lot of StdOut.Write calls to show the progress of the duplication. Running the script via CScript gives the following results:

Copying from: Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{678C8897-54AA-4FB9-AA72-6C227C287D12}Machine\Software\Policies\Microsoft\WindowsFirewall\StandardProfile\EnableFirewall
To          : Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{678C8897-54AA-4FB9-AA72-6C227C287D12}Machine\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\EnableFirewall
       Value: 1
Copying from: Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{678C8897-54AA-4FB9-AA72-6C227C287D12}Machine\Software\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications\Enabled
To          : Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{678C8897-54AA-4FB9-AA72-6C227C287D12}Machine\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\Enabled
       Value: 1
...

This should simplify the time taken for duplicating from Standard to Domain profile. For future reference this has also made it far easier to import/export port/program exceptions from policies I am editing. In future I may incorporate this into my Group Policy Firewall Exceptions Excel Spreadsheet in VBA to allow writing updated policies to the Policy.

After running this the settings will be seen to have changed in the Group Policy Editor Window immediately. I have tested this and checked that the Logging file is not replaced by “…\standard.log” where it should be “…\domain.log”.

Cheers, Chris.

Attached: RegFirewallProfileDuplication.vbs

After quite some time looking in to how to achieve my goal I came up with a rather simple, yet ultimately hacky, solution. Give the SYSTEM Account Administrative Privileges.

It turns out that the SYSTEM Account, despite not having Administrator level permissions, does have permission to modify group memberships. As such I came up with two functions to manage these permissions for itself:

'*****************************************************************
' Elevates the System Account to a Member of the Administrators Group
Function ElevateSystem
  strSystemUser = "WinNT://NT AUTHORITY/SYSTEM"
  Set objGroup = GetObject("WinNT://./Administrators,group")
  If Not objGroup.isMember(strSystemUser) Then
    objGroup.Add (strSystemUser)
  End If
End Function
 
'*****************************************************************
' Removes the System Account from the Administrators Group
Function RelegateSystem
  strSystemUser = "WinNT://NT AUTHORITY/SYSTEM"
  Set objGroup = GetObject("WinNT://./Administrators,group")
  If objGroup.isMember(strSystemUser) Then
    objGroup.Remove (strSystemUser)
  End If
End Function

I just run ElevateSystem at the start of the script and then RelegateSystem at the end of the script and I have no issue with permissions anymore.

Elegant, yet hacky. Hope somebody found this useful, because it sure beats creating (and then managing) a new Administrator User on thousands of Workstations.

N.B. I should also point out that if you are installing a script onto Workstations that you will be using this kind of workaround on, make sure you set the permissions on it. The last thing you need is somebody hijacking your script to do whatever they want with Administrative Privileges.

Cheers, Chris.

Function StageAllUsers(DomainFQDN, strDomain)
   ' Enumerate all users that are Local and not built in accounts.
   strComputer = "."
   Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
   'Enumerate users where the User Domain is the Local Machine
   Set colItems = objWMIService.ExecQuery _
                  ("Select * from Win32_UserAccount " & _
                   "Where Domain = '" & GetComputerName & "' " & _
                   "And Disabled = FALSE And Name <> 'Administrator'")
   ' Stage each user
   For Each objItem In colItems
      ' Ensure the account actually has a profile (otherwise we can ignore it)
      If GetLocalUserProfile(objItem.Name) <> "" Then
         ret = StageUser(objItem.Name, DomainFQDN, strDomain)
      End If
   Next
End Function

The functions called here are GetComputerName, which returns the name of the local machine, and the other important ones are GetLocalUserProfile and Stage User. The first we can check is GetLocalUserProfile.

'Gets the Profile Path for the User passed in UserName.
' This requires the profile to exist on the local machine
' Returns an empty string on error
Function GetLocalUserProfile(UserName)
   On Error Resume Next
   GetLocalUserProfile = ""
   SDDL = GetLocalUserSDDL(UserName)
   If SDDL = "" Then
      Exit Function
   End If
   Set objShell = CreateObject("WScript.Shell")
   GetLocalUserProfile = objShell.ExpandEnvironmentStrings( _
                            objShell.RegRead( _
                               "HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\" & _
                               SDDL & _
                               "\ProfileImagePath"))
  On Error Goto 0
End Function

The registry path (including the SDDL, covered next) returns the profile path for the user. This relies on a function called GetLocalUserSDDL which goes as follows:

Function GetLocalUserSDDL(UserName)
   strComputer = "."
   Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
   'Enumerate users where the User Domain is the Local Machine
   'and the username matches the Supplied Name
   Set colItems = objWMIService.ExecQuery _
                     ("Select * from Win32_UserAccount  " & _
                      "Where Domain = '" & GetComputerName & "' " & _
                      "And Name = '" & UserName & "'")
   GetLocalUserSDDL = ""
   For Each objItem In colItems
      'Get the first returned SID/SDDL then exit
      GetLocalUserSDDL = objItem.SID
      Exit Function
   Next
End Function

This reads the SDDL (eg S-1-5-21-791012361-4073638415-1907800938-1006 or otherwise known as the String SID) for the User on the local machine. The next major function is Stage User:

Function StageUser(UserName, DomainFQDN, strDomain)
   Set objShell = CreateObject("WScript.Shell")
   ' Not Assuming "C:\Documents and Settings\" & UserName:
   '   Get SDDL of user via WMI interrogation of UserAccount
   '   Get Profile Location of user (from HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\" & SDDL & "ProfileImagePath"
   strProfile = GetLocalUserProfile(UserName)
 
   ' Set ACLs on ProfileLocation
   ret = objShell.Run("subinacl /subdirectories """ & strProfile & """ /grant=""" & UserName & "@" & DomainFQDN & """=F",0,True)
 
   ' Set ACLs on D:\UserData\%username%
   ret = objShell.Run("subinacl /subdirectories ""D:\UserData\" & UserName & """ /grant=""" & UserName & "@" & DomainFQDN & """=F",0,True)
 
   ' Reg load ProfileLocation\NTUSER.DAT into HKU\%username%
   ret = objShell.Run("reg load ""HKU\" & UserName & """ """ & strProfile & "\NTUSER.DAT""" ,0,True)
   ' Reg load ProfileLocation\Local Settings\Application Data\Microsoft\Windows\UsrClass.DAT into HKU\%username%_Classes
   ret = objShell.Run("reg load ""HKU\" & UserName & "_Classes"" """ & strProfile & "\Local Settings\Application Data\Microsoft\Windows\UsrClass.DAT""" ,0,True)
 
   'Try both of the following. One should fail, the other should pass.
   ' Set ACLs on HKU\%username%
   ret = objShell.Run("subinacl /subkeyreg ""HKEY_USERS\" & UserName & """ /grant=""" & UserName & "@" & DomainFQDN & """=F",0,True)
   ' If User is already logged in then the registry will be open at HKU\SDDL
   ret = objShell.Run("subinacl /subkeyreg ""HKEY_USERS\" & GetLocalUserSDDL(UserName) & """ /grant=""" & UserName & "@" & DomainFQDN & """=F",0,True)
 
   'Try both of the following. One should fail, the other should pass.
   ' Set ACLs on HKU\%username%
   ret = objShell.Run("subinacl /subkeyreg ""HKEY_USERS\" & UserName & "_Classes"" /grant=""" & UserName & "@" & DomainFQDN & """=F",0,True)
   ' If User is already logged in then the registry will be open at HKU\SDDL
   ret = objShell.Run("subinacl /subkeyreg ""HKEY_USERS\" & GetLocalUserSDDL(UserName) & "_Classes"" /grant=""" & UserName & "@" & DomainFQDN & """=F",0,True)
 
   ' Reg unload HKU\%username%
   ret = objShell.Run("reg unload ""HKU\" & UserName & """",0,True)
   ' Reg unload HKU\%username%_Classes
   ret = objShell.Run("reg unload ""HKU\" & UserName & "_Classes""",0,True)
 
   ' Get Domain User SID from ProfileLocation ACL
   arrSID = GetDomainUserSidFromFolderACL(strProfile, UserName, strDomain)
 
   If UBound(arrSID) > 0 Then
      ' Convert Domain User SID to SDDL
      WScript.Echo "Getting Sid for " & UserName
      SDDL = ArraySidToStrSid(arrSID)
 
      ' Stage Domain User Profile into Registry under HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\%DomainUserSDDL%
      ret = CreateAndLinkProfile(SDDL, arrSID, strProfile)
   Else
      'Account didn't exist in the domain or ACL failed to set on Folder
   End If
End Function

For the most part this function behaves by running external commands to mount registry hives, and set ACLs on folders and registry, all up until we call GetDomainUserSidFromFolderACL. This is where we retrieve the SID of the Domain User that we are pre-staging via the ACL we set earlier on the Local User Profile folder. This subverts the need to query Active Directory for the SID through other means.

Function GetDomainUserSidFromFolderACL(strFolder, strUserName, strUserDomain)
   Dim arrSID(0)
   GetDomainUserSidFromFolderACL = arrSID
 
   Set objFSO = CreateObject("Scripting.FileSystemObject")
   If Not objFSO.FolderExists(strFolder) Then
      Set objFSO = Nothing
      Exit Function
   End If
 
   ' Ensure that strFolder is of the form C:\\Documents and Settings\\UserName
    strFolderName = Replace(strFolder, "\\","\")
    strFolderName = Replace(strFolderName, "\","\\")
 
   Set wmiFileSecSetting = GetObject( _
      "winmgmts:Win32_LogicalFileSecuritySetting.path='" & strFolderName & "'")
 
   RetVal = wmiFileSecSetting. _
       GetSecurityDescriptor(wmiSecurityDescriptor)
   If Err <> 0 Then
       Exit Function
   End If
 
   ' Retrieve the DACL array of Win32_ACE objects.
   DACL = wmiSecurityDescriptor.DACL
 
   For each wmiAce in DACL
   ' Get Win32_Trustee object from ACE 
      Set Trustee = wmiAce.Trustee
      If (StrComp(Trustee.Name, strUserName, vbTextCompare) = 0) And _
         (StrComp(Trustee.Domain, strUserDomain, vbTextCompare) = 0) Then
         GetDomainUserSidFromFolderACL = Trustee.SID
         Exit Function
      End If
   Next
End Function

Although this subverts the need to Query Active Directory, this does also mean that we receive the SID in a format that is unexpected. Normally, via querying Active Directory we would have received a SID in an Octet String format. Querying the SID from WMI returned it in SDDL or String SID format. The format that we receive the SID from the ACL is in an Array of Integers. In order to Pre-stage an account we need the SDDL/String SID, and the only way to get this in VBScript is to manually convert it using some functions developed by Richard Mueller and Wilfred Wong in this newsgroup posting.

Instead of using only the code listed, we need to alter it for dealing with the SID array we received back from the ACL.

Function ArraySidToStrSid(arrSid)
   ' Function to convert OctetString (byte array) to Decimal string (SDDL) Sid.
   Dim strHex, strDec
 
   strHex = ArraySidToHexStr(arrSid)
   strDec = HexStrToDecStr(strHex)
   ArraySidToStrSid = strDec
End Function
 
Function ArraySidToHexStr(arrSid)
   ArraySidToHexStr = ""
   For Each x In arrSid
      ArraySidToHexStr = ArraySidToHexStr & _
         Right("0" & Hex(x), 2)
   Next
End Function

The HexStrToDecStr function is the same as it was from the Richard Mueller posting listed above.

Finally we just need to run through the actual staging of the account:

Function CreateAndLinkProfile(strNewSDDL, strNewSID, strProfilePath)
   WScript.Echo "Creating Profile for " & strNewSDDL & ": " & strProfilePath
   'Write Sid to registry
   ret = WriteRegBinaryToRegistry(HKEY_LOCAL_MACHINE,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\" & strNewSDDL,"Sid",strNewSID)
   ret = WriteRegStringToRegistry(HKEY_LOCAL_MACHINE,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\" & strNewSDDL,"ProfileImagePath",strProfilePath)
   ret = WriteRegStringToRegistry(HKEY_LOCAL_MACHINE,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\" & strNewSDDL,"CentralProfile","")
   ret = WriteRegDwordToRegistry(HKEY_LOCAL_MACHINE,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\" & strNewSDDL,"Flags",1)
   ret = WriteRegDwordToRegistry(HKEY_LOCAL_MACHINE,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\" & strNewSDDL,"State",0)
End Function

At this point if the Domain User logs in they get redirected to the existing local users profile. Then if rollback is initiated they log on with the Local User account with the same profile. This is seamless to end users, both forward and backward.

On a side note the functions for writing to the registry are through WMI due to needing to write Binary values to the Registry

Function WriteRegBinaryToRegistry(Hive, strKeyPath, strValueName, ArrValues)
   strComputer = "."
   Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _
               strComputer & "\root\default:StdRegProv")
   oReg.CreateKey Hive,strKeyPath
 
   oReg.SetBinaryValue Hive, strKeyPath, strValueName,ArrValues
End Function
 
Function WriteRegDwordToRegistry(Hive, strKeyPath, strValueName, Value)
   strComputer = "."
   Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _
               strComputer & "\root\default:StdRegProv")
   oReg.CreateKey Hive,strKeyPath
 
   oReg.SetDwordValue Hive, strKeyPath, strValueName,Value
End Function
 
Function WriteRegStringToRegistry(Hive, strKeyPath, strValueName, Value)
   strComputer = "."
   Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _
               strComputer & "\root\default:StdRegProv")
   oReg.CreateKey Hive,strKeyPath
 
   oReg.SetStringValue Hive, strKeyPath, strValueName,Value
End Function

Cheers, Chris.

Edit: DomainAccountProfileStaging.vbs has been uploaded as a complete file.

In this process I have come across an array of options in migrating accounts from a Local User account to Domain User account and transferring the profiles across to keep the user “look and feel” that they are accustomed to.

One problem: In this scenario it makes for a very manual rollback strategy, no matter how much scripting and automation is involved in the migration process. This boils down to Novells implementation of “Dynamic Local User” which effectively creates a Local User Account that is not really bound to a User Account in eDirectory for Authentication or mapping purposes (which you can see if you look at the account SIDs).

So, how can you Migrate a local profile to a Domain User account while still maintaining a seamless rollback option (without using Roaming Profiles… This is out of the question)? The solution I have worked on is what I am terming “pre-staging” or “seeding” the Domain User Profile.

1. Enumerate all Local Enabled Users (except for “Administrator”)
2. Get the SID for that User (and the SDDL/String SID)
3. Read the Profile Path for that User from Registry
4. Set an ACL on that folder for <Domain>\<UserName> (we have the UserName being replicated between eDirectory and Active Directory
5. Mount the existing users NTUser.dat into HKU\<UserName>
6. Set ACL on HKU\<UserName> and all subkeys for <Domain>\<UserName>
7. Set ACL on HKU\<LocalUserSID> and all subkeys for <Domain>\<UserName> (just in case the user is actually logged in)
8. Dismount HKU\<UserName>
9. Mount the User Class hive (UsrClass.dat) into HKU\<UserName>_Classes
10. Set ACL on HKU\<UserName>_Classes and all subkeys for <Domain>\<UserName>
11. Set ACL on HKU\<LocalUserSID>_Classes and all subkeys for <Domain>\<UserName> (just in case the user is actually logged in)
12. Dismount HKU\<UserName>_Classes
13. Read the ACL on the Profile Folder (set Earlier) for <Domain>\<UserName> to get the Domain User SID
14. Convert the Domain User SID to an SDDL/String SID
15. Pre-stage/Seed the Domain User Profile by creating a new Registry key in HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\<DomainUserSDDL>
16. Write in a few choice keys, the two most important being ProfileImagePath (String) and Sid (Binary). (The others I seeded were the DWords State and Flags, which were set to 0, and CentralProfile, which was an empty string).

Once the eDirectory user is no longer a member of a DLU enabled User Profile Package, they will be forced to log on through the Active Directory Domain (yes, we are still logging on through the Novell Client). The Profile used for the Domain User will be the same as that used by the Local user. The added benefit is that our rollback strategy becomes “Add user to a DLU enabled User Policy Package” and gets them to log back into their original profile. To safely secure a situation where there is a catastrophic failure of the profile (loss) a backup of the profile can also be done at the seeding stage (just check %userdomain% for equality with %computername% to see if they are logging on with a Local account or a Domain Account).

This has had only minor testing at this stage, but as no paths have changed and there appears to be no problem with the Domain User using the existing Profile I believe this is a reasonably comprehensive solution. This, I must stress, is not a recommended way to deal with migrating users, but it is a tricky little feature that can be abused as I have just demonstrated.

Code (or VBScript) will follow soon

Cheers, Chris.

The Solutions I found include Check GroupWise Users for Password – Batch and Check GroupWise Users for Password – Exe, both of which made use of GWSend. Being an avid scripting aficionado myself I opted for the first, so I could make changes.

First step was to export all User Objects with NGW: Object ID into an Excel sheet using DSReport. Then export all GroupWise External Entities with NGW: Object ID to a different Excel Sheet. Finally I needed to export all GroupWise Resources, which do not have an NGW: Object ID, but their CN is effectively the NGW: Object ID for which we can log in and try to send emails. Upon completing this I compiled a single list of Allusers.csv which had the NGW: ObjectID/CN in the first column, and the DN for the Object Name and Location within the tree. This makes it far easier to track down the location of generic accounts (Something that none of the scripts account for).

So, my first run through the script ended in Fail. Apparently the above solutions are expecting Email Addresses without Spaces. So after fixing that up I run it again, and again hit a Fail. Apparently the above solutions fail to account for special characters (/ in this instance). So, I fix this up as well… My script runs, I get a report, then I realise that I have more results than original users. Apparently the above script also assumes that there is only 1 line in the result.txt file. So I modified the script to only print out a result once all lines of the result.txt file had been parsed, using a SET to determine if the “Error:” had been encountered or not (Error indicating that a Password is on the account, no Error indicating that there is No password).

So, now I run through and notice that the audit fails to log the full line of text, even though it is capable of actually running the audit against that account. Fortunately none of the accounts without passwords were affected by this, but I decided to fix this for future runs. To break down the issues I needed to fix into a list here is the summary:

1. We have spaces in our Email Account Names
2. We have /’s in our Email Account Names
3. We have &’s in our Email Account Names
4. We are trying to create a HTML file with the above special characters (specifically &)
5. & doesn’t tend to work too nicely in batch files when using an open Echo (tries to run everything after the & as a program
6. I wanted to be able to track back to objects (DN’s) as opposed to just the GroupWise Account Name

Spaces were easy to fix… When running the command against an account simply put the “account in quotes”. The next step is to handle the Email and DN objects as Strings within Quotes as well, but we don’t want to output the quotes, which means we need to handle them properly. Examine the following issue:

SET String=A String With Special Chars&Slashes/ In \ it^ OK
ECHO %String%

This will return “‘Slashes’ is not recognized as an internal or external command, operable program or batch file.” Also, if we try and escape each of the characters we run into issues too.

SET String=A String With Special Chars&Slashes/ In \ it^ OK
SET String=%String:^=^^%
SET String=%String:\=^\%
SET String=%String:/=^/%
SET String=%String:&=^&%
ECHO %String%

The Output ends up as “A String With Special Chars”. So, in order to fix this we need to handle the string within Quotes, and only output it at the end:

SET String="A String With Special Chars&Slashes/ In \ it^ OK"
SET String=%String:^=^^%
SET String=%String:\=^\%
SET String=%String:/=^/%
SET String=%String:&=^&%
ECHO %String:~1,-1%

Finally, our output is “A String With Special Chars&Slashes/ In \ it^ OK”, without the quotes. So the first part works now for my output to the Logs (although my logs are CSV so I tend to leave the quotes on just in case there is a lurking comma, but this does provide a pretty Output to the Console). Now we need to convert these for HTML output.

SET String=%String:^&=^&%
SET String=%String:<=^&lt;%
SET String=%String:>=^&gt;%
ECHO %String:~1,-1%

Just provides that little added extra safety net for an echo directly into a HTML log. I am annoyed that I didn’t manage to figure this out earlier as I had some scripts I went directly to VBScript for to avoid the & errors I was getting. I had no idea that it was my subsequent SET x=%x:a=b%, SET x=%x:c=d% calls on an unquoted string.

The one caveat I have found to this is fixing quote marks within a string. I have yet to find a way to strip them effectively without breaking the string/batch file in the process. The closest I have come will work in most situations, but requires a placeholder you have to be sure will never exist within your string:

SET String=Thi\s" is ^a &t"es/t
SET String="%String:"="%"
Set String=%String:^=^^%
SET String=%String:&=^&%
SET String=%String:/=^/%
SET String=%String:\=^\%
SET String=%String:"=^"%
ECHO %String:~1,-1%

One other note I’d like to add is that of Padding numbers. This is a fairly well known feature of WinBatch, but I found it useful for getting well aligned output for which record I was currently up to:

Set _Num=0
...
SET /A %_Num%=%_Num%+1
SET DispNum=     %_Num%
Echo %DispNum:~-4%

This pads the leading digits with spaces and specifies that I want a 4 character long string returned for the end of the string. (so ” 1″ in the first instance but in my case up to ” 900″ or “9091″).

Hope this adds a little food for thought.

Cheers, Chris.

Beginning Game Programming: A GameDev.Net Collection

Well, as some of you may know, I was involved in writing a series of articles that started back in 2001 and continued until 2004 on some simple programming concepts using C++. An Introduction to Pointers, Structures and Linked Lists has now made a home for itself inside the new GameDev.Net book; Beginning Game Programming: A GameDev.Net Collection. This book is a collection of edited articles that have been posted to GameDev.Net over a period of years.

This has brought me some inspiration to actually progressing towards some other Authoring ideas. Whether I can get the time to actually develop some of them is questionable, but considering I have a lot of experience working with scripting inside both Active Directory/Exchange shops, to Novell/Groupwise shops, some of the ideas and tools I have had to develop within these environments could lead to some interesting uses. There are many scripting sites out there but I find that to get information on this type of scripting in one location is nigh on impossible. So, there is one idea.

Another idea would be headed back towards the Game Development realms. Again, there are many books and sites that contain a lot of information on how to go about entering into these kinds of pursuits. My main problem with the information is tying it all together, as well as considering the planning implications from starting a Game Development project, until you have completed it. For those who know me well I am an avid procrastinator when it comes to my Game Development pursuits, so this is the least likely idea to succeed. It is, however, an idea I would like to start pursuing.

On a side note, there are a few unpublished articles from the “Introduction to…” series that start to get into some more Advanced ground. I will attempt, first, to complete these so that I can get my head clear of what I need to do to move forward.

I should also say: please buy the book. The proceeds of which, however, do not go to me. So feel free to follow this link to purchase the book through my Amazon Affiliates account. That way I can get a bit more scratch to start working on some of these other projects.

Cheers, Chris.

After a rather hectic week of scripting a solution and then distributing it under an excessively short deadline, I have been asked to provide stats on the result of forcing this solution out to clients. The solution that I had to develop keeps tabs on a System Volume Image of PCs, and ensures that this Image never gets out of date too far. Currently I am not forcing a Store every restart, as the planned solution was to do, but I do inform the client that their current Image is out of date and ask them if they want to do a Store now. If they click on Yes then their PC is rebooted and the Store is done (providing that one of many flaws in the current Store process do not interrupt the process).

Because of some of the issues that we have had, as well as Managements want to view the impact of what we have done in a statistical format, I was required to provide a secondary application, which is just an updated version of an AutoIT Script that logs the Image Date into a log file during login. Because this file was preexisting it has been used in this way to gather stats for some time.

The issue is that the log file includes EVERY instance of a login for a PC, and I want only the most recent with the timestamp of the image, not all the other instances, or the log values that are too old (I was unable to clear the logs due to current procedure). Therefore I was required to learn some new things in the VBScript world. This solution is surprisingly fast considering how much data it is required to crunch in order to produce the output CSV file.

Const ForReading = 1
Const ForWriting = 2

Dim arrLines()
i = 0

Set objDictionary = CreateObject("Scripting.Dictionary")
Set objFSO = CreateObject("Scripting.FileSystemObject")

objStartFolder = WScript.ScriptFullNameobjStartFolder = Replace  (objStartFolder, WScript.ScriptName, "") 

Set objFolder = objFSO.GetFolder(objStartFolder & "Logs")

Set colFiles = objFolder.Files
For Each objFile in colFiles
    Set textFile = objFSO.OpenTextFile(objFile.Path, ForReading)

    Do Until textFile.AtEndOfStream
        Redim Preserve arrLines(i)
        arrLines(i) = textFile.ReadLine
        i = i + 1
    Loop

    For i = Ubound(arrLines) to LBound(arrLines) Step -1
        splt = Split (arrLines(i),",")

        If (UBound(splt) < 19) Then
            i = LBound(arrLines)
        Else
            If Splt(19) <> "" Then
               If Not objDictionary.Exists(splt(1)) Then
                  objDictionary.Add splt(1),splt(19)
               End If
            End If
        End If
    Next

    ReDim arrLines(0)
    i = 0
    textFile.Close
Next

Set writeFile = objFSO.CreateTextFile(objStartFolder & "Stores.csv")
For Each strKey in objDictionary.Keys
   writeFile.WriteLine strKey & "," & objDictionary.Item(strKey)
Next
writeFile.Close

In this particular script the splt Array has 20 columns (or 19 for those items that were prior to me updating the script). Column 2 (or splt(1)) is the PC Name, and Column 20 (or splt(19)) is the Timestamp of the Image. This script reads through every file in the Logs folder (in the same path as the script) and reads the file in reverse until it comes across the entries with only 19 columns. For every unique PC Name that it finds it adds this into a Dictionary object with the Timestamp as the value. The Dictionary is then written to the new CSV file one at a time.

In order to get the stats on how effective this has been, I paste a couple of Excel Macros:

=COUNTIF(B:B,">22/08/2008")
=COUNT(B:B)

The magic date here is the 22nd of August 2008. This was chosen purely because it was a recent date, and it was newer than most of the Images for the PCs within the IT Department, who already had the AutoStore scripts working on their machines. Which provided for a controlled Environment for testing some of the modifications I was forced to make last minute.

One thing that I could do to improve the accuracy of this script is to pull out all the Workstation Names from Novell using LDAP and get a total overall status of where the Store dates are across all PCs, but that would pollute the pool with a large number of machines that have been decommissioned (they still appear as a Workstation in Novell until they have not been logged on to for 3 months, then they fall off the system).

On a side note, I have to pull in the Logs into the Logs directory in some way, which is achieved for me by running a Batch file which I have written as follows:

@ECHO OFF
ECHO Pulling Logs %DATE% - %TIME%>>Log.txt
ECHO.>>Log.txt
%~d0
cd %~dp0
FOR /F "tokens=*" %%A IN (Sources.txt) DO (
  FOR /F "tokens=1 delims=" %%Z IN ("%%A") DO (
     COPY "%%AlogsLogIn.csv" "%~dp0Logs%%Z.csv" /A /D /Y /Z >>Log.txt
  )
)
ECHO.>>Log.txt
ECHO Current Stores being Rebuilt at %DATE - %TIME%>>Log.txt
WScript Stores.vbs
Start Excel Stores.csv
ECHO Log Pull Finished at %DATE% - %TIME%>>Log.txt

This script uses a file called “Sources.txt” which is a list of paths on newlines which point to where each of the Logs are stored. Each line consists of something like \ServerNameSYSPUBLIC. The line FOR /F “tokens=1 delims=” %%Z IN (“%%A”) allows me to pull out the servername from each line in the file, so that when I copy the file from the server, I can rename it so that its source can be identified.

I think this will conclude todays lesson in VBScript and Batch, and I’d best get back to studying.

Cheers, Chris.

For completeness I also made the function a little more generic, so it takes the Volume Label as the Variable, and falls back to “IMAGE” if none was passed.

Function GetVolumeNumberHidden(Label)
   On Error Resume Next
   Const ForWriting = 2
   Const ForReading = 1
 
   If Label="" Then
      Label="IMAGE"
   End If
 
   Set oShell = CreateObject("WScript.Shell")
 
   Set oFSO = CreateObject("Scripting.FileSystemObject")
   TempFile = oShell.ExpandEnvironmentStrings("C:\Temp\dp.txt")
   ListFile = oShell.ExpandEnvironmentStrings("C:\Temp\dl.txt")
   Set oFile = oFSO.OpenTextFile(TempFile,ForWriting,True)
 
   oFile.WriteLine("LIST VOLUME")
   oFile.Close()
 
   oShell.Run "%comspec% /c diskpart /s " & TempFile & _
      " > " & ListFile, 0, True
 
   Ouptut = ""
   Str = ""
 
   Set oFile = oFSO.OpenTextFile(ListFile,ForReading)
 
   Do until oFile.AtEndOfStream
      Str = oFile.ReadLine
      If InStr(Str,"Volume") > 0 Then
         If Not (Mid(Str,10,3) = "###") Then
            DriveLetter = Mid(Str,16,1)
            VolumeNumber = Trim(Mid(Str,10,3))
            If StrComp(Trim(Mid(Str,20,12)),Trim(Label))=0 Then
               GetVolumeNumberHidden = VolumeNumber
 
               oFile.Close
               If oFSO.FileExists(TempFile) Then
                  oFSO.DeleteFile TempFile, True
               End If
               If oFSO.FileExists(ListFile) Then
                  oFSO.DeleteFile ListFile, True
               End If
 
               Exit Function
            End If
         End If
      End If
   Loop
 
   oFile.Close
   If oFSO.FileExists(TempFile) Then
      oFSO.DeleteFile TempFile, True
   End If
   If oFSO.FileExists(ListFile) Then
      oFSO.DeleteFile ListFile, True
   End If
End Function

This function now makes its way into the Completed stage and now I move on to other things. I have been working very frantically on my AutoStore script. This function is used in both the Store/Restore installation, and the AutoStore script itself, in order to get the timestamp of the previously stored image files. Some of the other fun things I have been playing with involve Novell Workstation Policy Packages, and Package Schedules. In order to initiate the AutoStore process I have created an array of Package Schedules that calls my AutoImage.vbe file. I noticed that during the process of Installation, the MSI had not completed before the AutoImage.vbe file was attempted to be run. This lead to a WScript error because the target file did not exist. I modified the run information to the following:

C:\Windows\System32\cmd.exe /c "if exist (
   C:\SOE\AUTOSTORE\AutoImage.vbe) (
      start wscript C:\SOE\AUTOSTORE\AutoImage.vbe Interval=14 Force )"

At first glance it may seem that some of this can be discarded, however it is all required. In order to first check that the file exists without requiring ANY script to have been installed onto the target machine we need to use “if exist” which requires running through cmd.exe because it is a command interpreter command, not a stand alone executable. If we do not use Start then the command screen stays open while the script runs, or while a popup box explaining to users that they need to reboot is displayed. This appears a disjointed visually and lead to me wanting to close all those blank black windows. WScript does not explicitly need to be called, but since I want to specify WScript instead of CScript I have included it for completeness sake.

In order that the command window does not show up for most of the background calls to the script I have ensured that it runs in the SYSTEM security space. The Unsecure System space is used only for those functions where the script requires user input or provides user feedback. This limits the interruption to the general use of the PCs.

I spent much of the past few days creating and modifying the scripts, and I spent all afternoon packaging the script into the MSI and creating the Policy Packages. I have also now documented the Policy Package creation process and documented the usage of the script. Hopefully I can get it all slapped together and rolled out, as we need to force a store before Monday, when an updated software package is being forced out. I have to love the communication we get prior to these things. I have had to kill myself to get the modifications done to their current point, and as yet they are untested for machines which have not received some of the custom modifications we have implemented. All will come to light tomorrow.

Cheers, Chris

The one issue that we had with mounting this specific Volume is that if a USB Drive or a Virtual CD/DVD drive is installed on the machine, it modifies the volume numbering scheme. The volume we were previously attempting to mount was Volume 3. This became Volume 4 in the even that another drive was connected, or a higher number depending on how the USB drive was partitioned.

Not a grand issue, but one that was overlooked by the Corporate boys when they released one of their imaging tools (the hidden volume is the Image volume). I modified their install script to use a bit more smarts when attempting to find the volume it needs.

Function GetImageVolumeNumber
   On Error Resume Next
   Const ForWriting = 2
   Const ForReading = 1
 
   Set oShell = CreateObject("WScript.Shell")
 
   Set oFSO = CreateObject("Scripting.FileSystemObject")
   Set oFile = oFSO.OpenTextFile( 
      oShell.ExpandEnvironmentStrings("C:\Temp\dp.txt"),ForWriting,True )
 
   oFile.WriteLine("LIST VOLUME")
   oFile.Close()
 
   set proc = oShell.Exec ("diskpart /s C:\Temp\dp.txt")
 
   Ouptut = ""
   Str = ""
 
   Do while Not proc.StdOut.AtEndOfStream
      Str = proc.StdOut.ReadLine
      If InStr(Str,"Volume") > 0 Then
         If Not (Mid(Str,10,3) = "###") Then
            DriveLetter = Mid(Str,16,1)
            VolumeNumber = Trim(Mid(Str,10,3))
            If StrComp(Mid(Str,20,5),"IMAGE")=0 Then
               GetImageVolumeNumber = VolumeNumber
               Exit Function
            End If
         End If
      End If
   Loop
End Function

This function simply uses the output from DiskPart in order to find the number of the volume named “IMAGE”. This is then returned to the call point and can be used in place of the previous DiskPart calls to “SELECT VOLUME 3″ and “ASSIGN MOUNT=C:\Temp\Image”. The only issue with this Shell Exec call is that it cannot be hidden, as then we cannot retrieve the output. This is not a real issue as the Console screen should just flash up and close quickly. Alternatively I could have fed the output into a text file and read it from that, but part of me is always interested in seeing new ways to do things, which was reading from StdOut in this instance.

So this leaves my MSI to be a shell that copies files to an “install” location, then runs a VBScript that mounts the volume and copies those files to the Image Drive. Not ideal, but the best solution I have at the moment. The Corporate guys are considering implementing this in the next version of the Imaging Tool, but in the meantime I will simply replace all the buggy files for my own Administrative Area.

Oh, and I know somebody is going to mention the Shell ExpandEnvironmentStrings call that is unneccessary. This is because it was originally using %temp%. I left it there for now in case I start using %temp% again. Then I can just do a find-replace for “C:\Temp” to “%Temp%” to return it to its previous functionality.

Cheers, Chris.

Trav and I have approached the Server team with an idea on distributing apps more effectively, relying mainly on network addresses of the PCs to correctly locate an application server. This brings up a few logistical hurdles.

1. The restructuring of our Applications such that we can point to a mapped network drive instead of relying on UNC paths.
2. The fact that some applications are released with site specific information. As we currently have to modify every new release of these apps to include that information, we should approach the issue from a more managable perspective.
3. The Implementation of Login Scripts to Base Drive Mapping on current Network Location instead of the Current Login or Workstation Context or Group (as this then provides a benefit of decreased WAN traffic for Mobile Computers and Distributed Applications).
4. The Politics of testing and gaining approval for implementing a new process into something that is seen as a working system. This is possibly the greatest hurdle to overcome in regards to the push for initiative.

At least with respect to point Number 4, Trav and I raised this with one of our counterparts in the Server Team, and although we were given some good reasons why some of the ideas we initially had could not go any further than the drawing board, he did provide some additional ideas on how to proceed to at least implement some positive change so that we can all manage our site specific apps (Point number 2) more effectively.

The thing we need to concentrate on first is going to be appropriating some hardware and then building an environment in which we can test some of our theories that are not being implemented. In the mean time I will start testing some of the ideas that the team has approved at this point.

Hopefully we can implement a ZfS Server that creates NALs under the District Container (as opposed to our site containers) which uses %DEST-APPS1% as X:\ instead of a UNC path, and use a Cluster Wide Login Script to appropriately map X:\.

One parting thought on another issue this could have on us, that the X:\ drive is not consistent around the state. From ZfS’s perspective, everything is all well, however there are a lot more things stored on the X:\ drive that are used constantly from a Technical perspective. This will possibly require some more training, or at least another drive mapping…

Until I start looking into DFS at least

In three weeks time we shall see what position I am in though, before too many things are set in stone.

Cheers, Chris.