Category Archives: Labs

Posts about computer labs and classrooms at Williams College

Mac OS – Remove Inactive Users

Each user that logs into one of the macs I support takes up almost 500 MB of space for their “home” directory. With some of my macs having hundreds of users these home directories can fill up the disk. Also, on my macs, AD users don’t create an account on the machine but they do create a home directory. Therefore, I don’t have an account to remove, just the home directory.

I created this script to search for and remove the user’s home directory for users that have not logged in in over 14 days. Using our JAMF server I can target macs with a disk that is 80% or more full to run this script.

#!/bin/sh
# Lynna Jackson, Williams College, Oct 19 2017

#finds users who haven't logged in in over 21 days and if they 
#aren't a "protected" account, deletes the user's directory
usersToDelete=`find /Users -type d -maxdepth 1 -mindepth 1 -mtime +14`   

for a in $usersToDelete ; do
case "$a" in "/Users/labadmin"|"/Users/Shared"|"/Users/root") 
  # Don't delete these accounts 
  echo ""$a" Protected User Not being deleted"
  ;;
  *)
    echo "Deleting: "$a""
    rm -R "$a"  
  ;;
esac
done

Windows 10 – Get Windows Update Log

Apparently windows 10 changed the windows 10 log format and you now need to run a power shell command to generate the log file as a text file that normal humans can read.

Open Powershell with “Run as Administrator”
give the command:

Get-WindowsUpdateLog

Then wait until all the log files have been found and parsed and you get the PowerShell command prompt back. Below is an example.

If you find that your windows update log goes back to the beginning of time and the resulting text log file is too large to read, you can temporarily move older log files from C:\Windows\Logs\WindowsUpdate

More details see: https://support.microsoft.com/en-us/help/3036646/how-to-read-windows-update-logs-in-windows-10-version-1607

PS C:\Windows\system32> Get-WindowsUpdateLog

Converting C:\Windows\logs\WindowsUpdate into C:\Users\labadmin\Desktop\WindowsUpdate.log …

Input
—————-
File(s):
C:\Windows\logs\WindowsUpdate\WindowsUpdate.20171011.120412.263.1.etl

0.00%100.00%

Output
—————-
DumpFile: C:\Users\labadmin\AppData\Local\Temp\WindowsUpdateLog\wuetl.CSV.tmp.00000

The command completed successfully.

WindowsUpdate.log written to C:\Users\labadmin\Desktop\WindowsUpdate.log

PS C:\Windows\system32>

Windows 10 – System-wide File Type Associations

List current filetype associations with these two different commands:

ftype
or
assoc

Change or create new ones:

Open an elevated command prompt.

Use FTYPE {fileType}={commandString} to create a file type and associated command to open the file.
Use ASSOC {.fileExtension}={fileType} to associate a file extension with the file type you created.

Example:

FTYPE MyCustomType=C:\Program Files\MyCustomProgram\MyProg.exe “%1”
ASSOC .custom=MyCustomType

These commands can be issued from the KACE server. See the SPSS example there.

Windows 10 – Clean Boot

https://support.microsoft.com/en-us/help/929135/how-to-perform-a-clean-boot-in-windows

Use msconfig to disable all non-Microsoft “Services” and “Startup” from starting

After booting clean, use msconfig to set your computer back to “Normal” boot.

JAMF – DEP and VPP Certificate Renewal

For the JAMF server we have yearly renewing certificates that connect our JAMF server to Apple’s servers for our hardware (DEP) and software (VPP) purchases.

Here is how I did this process in May 2017:

1) Log into our JAMF server ( https://casper.williams.edu:8443 ) with a full admin account
2) Navigate to Management Settings – Global Settings – Device Enrollment Program
3) Click on Public Key to download our JSS key to the local computer

) Sign into our Apple School Manager account at https://school.apple.com/ with our AppleID of: [email protected]
5) Click on MDM – Upload Key
6) Once uploaded you should be able to click on Get Token to download the new token
7) Go back to our JAMF Server – Management Settings – Global Settings – Device Enrollment Program
8) Click on Williams JSS and then Edit
9) Then Upload Server Token

Remain logged into our JAMF server to update the VPP Certificate:

1) Log into the [email protected] AppleId at the website: https://volume.itunes.apple.com/
2) In the upper right corner click on [email protected] for a drop down menu, select Account Summary
3) In the MDM section, click on Download Token
4) While still logged into our JAMF Server navigate to Management

Settings – Global Settings – VPP Accounts

5) Click on Williams VPP then Edit
6) Finally click on “Renew Service Token” to upload the token you just downloaded from Apple

Phew. Done.
Log out of all accounts.

Mac – NoMAD – AD functionality to macs without binding

You can add AD functionality to a Mac without having to “Bind” it to the domain …

See:
See: https://www.nomad.menu/

Windows 10 – Removing old AD user account and profiles

There is apparently a way to delete accounts on systems that haven’t been used in over 30 days with an AD Group Policy setting. I found that this GP setting did not work on the Windows 10 systems I manage. Also, even if it did work, there are a few accounts on these systems that I do not want deleted even if they haven’t been used in months. Therefore, I came up with a powershell script based on many other people’s work that deletes user accounts and profiles that haven’t been used in over 30 days.

Download powershell script to delete 30 day unused user accounts and user profiles

Before running this script on your systems, edit it with a script editor to review the details within the script!!!

To run this script, I also recommend you open an administrative command prompt and give the commands:

cd c:\users

dir /od /ta

This will give you a sorted list of the accounts and the last time the account profile was accessed. You can compare that list to the accounts that will be deleted when running the script. Note that if the list of users to delete is long, you may get quota violations when running the script. When this happens I reboot and run the script again.

To run the script open a powershell window with “run as administrator” and run the script from whatever directory you have saved it in. When running the script be sure to check the list of accounts about to be deleted for any accounts you don’t want to delete. If you see any, you can exit the script as instructed and then edit the script to add the accounts you don’t want deleted to the line indicated in the script.

——————————-

On the windows systems I manage I have already pre-loaded my private version of the script in a specific folder so the steps to run this are:

1) Login with the lab administrator account
2) Open a Powershell command window “Run as Administrator” (click on the magnifying glass in the bottom left, type Powershell, Right-click on the PowerShell App and select “Run as administrator” …)
3) Give the following three commands:

set-executionpolicy unrestricted

C:\williams\DeleteOldUsers.ps1

set-executionpolicy undefined

Windows 10 – Install to external USB drive

Update (Sept 2017) –

An even easier way to do this is to copy your wim image to a windows 10 computer and run the “Windows to Go” application. In the Windows to Go app, choose the disk you want to install the image on and then choose the wim image you want to put on that disk.

The result should be a bootable windows 10 external disk that will boot on just about any computer!

Using a Windows 10 computer, follow the standard procedure to format the external drive and set it to be bootable in DiskPart:

Diskpart Diskpart> list disk Diskpart> sel disk 1 (be sure to select the correct disk!) Diskpart> clean Diskpart> create partition primary Diskpart> format fs=NTSF quick Diskpart> active Diskpart> assign letter=g Diskpart> exit Continue reading →

Mac – Microsoft Office 2016 – Disable First Run and Welcome screens

See the details at:
https://derflounder.wordpress.com/2016/01/17/suppressing-office-2016s-first-run-dialog-windows/

Mac – Active Directory Debugging and Logs

To debug an Active Directory binding issues

First set the directory error logging to “debug” with:
sudo odutil set log debug

then try the join …

set the error logging back to “error” with:
sudo odutil set log default

You’ll find the log file in:
/var/log/opendirectoryd.log

An excellent reference article with additional tips is at:
https://derflounder.wordpress.com/2012/03/29/diagnosing-ad-binding-problems-from-the-command-line/