While working with at customer last we it was decided they wanted Credential Guard. Which in it self is a good thing. The problem was that they wanted this enabled as part of the Configuration Manager OSD.
Now normally automating things during ConfigMgr OSD isn’t to difficult however ConfigMgr has a problem with things that require double reboots. Since Hyper-V is a prerequisite for Credential Guard and Hyper-V requires a double reboot this poses a problem.
This might be solved by Microsoft in the future but for now you will have to employ a bit of a workaround. This consists of a couple of things, one is setting it up so you have a reboot not monitored by the task sequence and the other is installing the required roles and lastly you will also need to input the relevant registry values to enable the features.
Step 1 – Adding a reboot outside of the task sequence
This is something you should probably do anyway and it is documented in several blogpost before this one.
You will need to set a custom task sequence variable called SMSTSPostAction and set that to “Shutdown /r /t 30” this will cause a reboot 30 seconds after sequence thinks its done.
Step 2 – Creating the package
Download the script from here http://bit.do/bYZsr and put it in a folder on your CMSources share. Create a new package and a program and define the following as command line for running it: “PowerShell.exe –ExecutionPolicy ByPass –file “Enabled-CredentialGuard.ps1”
Don’t forget to enabled “Allow this program to be installed from the Install Package task sequence without being deployed”
Step 3 – Customize the task sequence
Lastly we customize the sequence to run this specific package at specific point in the sequence. The rule here is that it needs to be run after any other steps that can cause a reboot as the script will install and configure everything but the reboot should happen outside of the sequence as we configured it during step 1.
So for this customer that happens just before status is set to 5 as you can se in the picture below.
The last customization is to set an option on this to check for a task sequence variable. You should check for isUEFI equals true. This is to make this only applied to UEFI based machines as it will not work on legacy bios. If you want to you can add steps to check for Secureboot or other pre reqs.
The script – raw
<#
Created: 2016-04-02
Version: 1.0
Author : Peter Lofgren
Twitter: @LofgrenPeter
Blog : https://syscenramblings.wordpress.com
Disclaimer:
This script is provided "AS IS" with no warranties, confers no rights and
is not supported by the author
#>
Function Import-SMSTSENV{
try
{
$tsenv = New-Object -COMObject Microsoft.SMS.TSEnvironment
Write-Output "$ScriptName - tsenv is $tsenv "
$MDTIntegration = "YES"
#$tsenv.GetVariables() | % { Write-Output "$ScriptName - $_ = $($tsenv.Value($_))" }
}
catch
{
Write-Output "$ScriptName - Unable to load Microsoft.SMS.TSEnvironment"
Write-Output "$ScriptName - Running in standalonemode"
$MDTIntegration = "NO"
}
Finally
{
if ($MDTIntegration -eq "YES"){
if ($tsenv.Value("LogPath") -ne "") {
$Logpath = $tsenv.Value("LogPath")
$LogFile = $Logpath + "\" + "$LogName.log"
}
Elseif ($tsenv.Value("_SMSTSLogPath") -ne "") {
$Logpath = $tsenv.Value("_SMSTSLogPath")
$LogFile = $Logpath + "\" + "$LogName.log"
}
}
Else{
$Logpath = $env:TEMP
$LogFile = $Logpath + "\" + "$LogName.log"
}
}
}
Function Start-Logging{
start-transcript -path $LogFile -Force
}
Function Stop-Logging{
Stop-Transcript
}
# Set Vars
$SCRIPTDIR = split-path -parent $MyInvocation.MyCommand.Path
$SCRIPTNAME = split-path -leaf $MyInvocation.MyCommand.Path
$SOURCEROOT = "$SCRIPTDIR\Source"
$SettingsFile = $SCRIPTDIR + "\" + $SettingsName
$LANG = (Get-Culture).Name
$OSV = $Null
$ARCHITECTURE = $env:PROCESSOR_ARCHITECTURE
$LogName = $SCRIPTNAME
#Try to Import SMSTSEnv
. Import-SMSTSENV
#Start Transcript Logging
. Start-Logging
#Output base info
Write-Output ""
Write-Output "$ScriptName - ScriptDir: $ScriptDir"
Write-Output "$ScriptName - SourceRoot: $SOURCEROOT"
Write-Output "$ScriptName - ScriptName: $ScriptName"
Write-Output "$ScriptName - SettingsFile: $SettingsFile"
Write-Output "$ScriptName - Current Culture: $LANG"
Write-Output "$ScriptName - Integration with MDT(LTI/ZTI): $MDTIntegration"
Write-Output "$ScriptName - Log: $LogFile"
#Enable Hyper-V
If ([environment]::Is64BitOperatingSystem -eq $True) {
$InstallerName = "C:\Windows\sysnative\dism.exe"
}
Else {
$InstallerName = "C:\Windows\system32\dism.exe"
}
$Arg = "/online /enable-feature /featurename:Microsoft-Hyper-V-Hypervisor /all /LimitAccess /Norestart"
Write-Output "About to run $InstallerName with arguments $Arg"
$Result = Start-Process -FilePath $InstallerName -ArgumentList $Arg -NoNewWindow -Wait -PassThru
Write-Output "Finsihed installing Hyper-V-Hypervisor with exitcode $($Result.ExitCode)"
$Arg = "/online /enable-feature /featurename:IsolatedUserMode /LimitAccess /Norestart"
Write-Output "About to run $InstallerName with arguments $Arg"
$Result = Start-Process -FilePath $InstallerName -ArgumentList $Arg -NoNewWindow -Wait -PassThru
Write-Output "Finsihed installing IsolatedUserMode with exitcode $($Result.ExitCode)"
$Arg = "/online /disable-feature /featurename:Microsoft-Hyper-V-Tools-All /Norestart"
Write-Output "About to run $InstallerName with arguments $Arg"
$Result = Start-Process -FilePath $InstallerName -ArgumentList $Arg -NoNewWindow -Wait -PassThru
Write-Output "Finsihed removing Hyper-V Tools with exitcode $($Result.ExitCode)"
#Enable Credential Guard
$Path = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"
New-Item -Path $Path -ItemType Directory -Force -ErrorAction SilentlyContinue
New-ItemProperty -Path $Path -Name EnableVirtualizationBasedSecurity -PropertyType 4 -Value 1 -ErrorAction SilentlyContinue
New-ItemProperty -Path $Path -Name RequirePlatformSecurityFeatures -PropertyType 4 -Value 1 -ErrorAction SilentlyContinue
New-ItemProperty -Path $Path -Name HypervisorEnforcedCodeIntegrity -PropertyType 4 -Value 0 -ErrorAction SilentlyContinue
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name LsaCfgFlags -PropertyType 4 -Value 1 -ErrorAction SilentlyContinue
#Stop Transcript Logging
. Stop-Logging
|
System Center Ramblings 