Month: September 2018

The NTFS file system provides the ability to create a system representation of a file or directory in a location in the directory structure that is different from the file or directory object that is being linked to. This process is called linking. There are two types of links supported in the NTFS file system: hard links and junctions.

A hard link is the file system representation of a file by which more than one path references a single file in the same volume.

A junction (also called a soft link) differs from a hard link in that the storage objects it references are separate directories, and a junction can link directories located on different local volumes on the same computer. Otherwise, junctions operate identically to hard links. Junctions are implemented through reparse points.  more…

Basically, a junction just connects a source folder to a new target location…and Mklink is what makes the magic happen.

Example 1

Soft linking a Test folder and the Desktop folder

:: removing read only attribute
attrib "%userprofile%\Test" -r

:: deleting folder
rd /Q /s "%userprofile%\Test"

:: making link
mklink /j "%userprofile%\Test" "C:\users\%username%\Desktop"

Example 2

Soft linking C: drive profile\Desktop to D: drive profile\Desktop

attrib "%userprofile%\Desktop" -r
rd /Q /s "%userprofile%\Desktop"
mklink /j "%userprofile%\Desktop" D:\users\%Profile%\Desktop

Notes

Hard Links and Junctions

Registry Settings for Folder Redirection in Windows

Folder Redirection, Offline Files, and Roaming User Profiles overview

Registry

Reg keys for User Shell Folder redirection

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Name: AppData
Type: REG_EXPAND_SZ
Data: %USERPROFILE%\Application Data

Name: Desktop
Type: REG_EXPAND_SZ
Data: %USERPROFILE%\Desktop

Name: Personal
Type: REG_EXPAND_SZ
Data: %USERPROFILE%\My Documents

Name: My Pictures
Type: REG_EXPAND_SZ
Data: %USERPROFILE%\My Documents\My Pictures

Name: Start Menu
Type: REG_EXPAND_SZ
Data: %USERPROFILE%\Start Menu

Cloud

OneDrive Guide for Enterprises

Deploy OneDrive apps by using System Center Configuration Manager

Deploy OneDrive apps by using Intune

Network utilization planning for the OneDrive sync app

Redirect and move Windows known folders to OneDrive

Deploy and configure the new OneDrive sync app for Mac

OneDrive Group Policy

Use Group Policy to control OneDrive sync client settings

Manually Testing

1. Move the contents of the user’s profile folder (example: Documents) to the OneDrive cloud storage sync location on their local hard drive: %userprofile%\Documents to
$userprofile%\OneDrive\Documents.

2. Create a GPO to redirect the Documents folder from %userprofile%\Documents to
%userprofile%\OneDrive\Documents. This can be done using either Folder Redirection policy, or a registry mod.

3. Ensure that the OneDrive sync client is installed on other enterprise computers.

4. When the user logs in for the first time on a new computer, they will authenticate to OneDrive.

Automated Redirect Solution

* Using the Desktop folder as an example…

Move Data
robocopy /MOVE /E /PURGE “%userprofile%\Desktop” “%userprofile%\OneDrive\Desktop”

Make Link
mklink /D %userprofile%\Desktop %userprofile%\OneDrive\Desktop

Update User Shell Folder
reg add “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders” /v Desktop /t REG_EXPAND_SZ /d ^%USERPROFILE^%”\OneDrive\Desktop” /f

Reboot
reboot, or reload explorer.exe

tags: Junctions scripting, linking automation, folder redirection, OneDrive redirect, OneDrive automation, MrNetTek

This is a code snippet from a larger script. I’m using it to return a “marked” profile.

if not exist D:\Users for /f "tokens=1 delims= " %%a in ('dir /b c:\users') do (
set profile=%%a
if exist C:\users\%profile%\desktop\marker.txt goto :eof
)

echo Detected migration profile: C:\users\%profile%

Output

Detected migration profile: C:\users\myuser

Notes

reg Query “HKLM\Hardware\Description\System\CentralProcessor\0” | find /i “x86” > NUL && set OS=32BIT || set OS=64BIT

if %OS%==32BIT goto 32Bit
if %OS%==64BIT goto 64Bit

net sessions >nul 2>&1
if %errorlevel%==0 echo User is admin

Microsoft Quick Assist is a Windows 10 app that enables two people to share a computer over a remote connection so that one person can help solve problems on the other person’s computer.

After reading the documentation, I realized there were no configurable features or options.

I’m not sure why Microsoft does this; they create some good tech, and then bog it down with needless extra windows and clicks. At least provide methods to configure the windows.

These are the boxes I don’t want to see

THIS IS ALL EXPERIMENTAL 

Perhaps this will help you in your implementation of Quick Assist. Much of this is undocumented, and things I just figured out on my own. If you want the documented portions of Quick Assist, see Demo or FAQs.

How do you get rid of extra windows in Quick Assist, when Microsoft provides no methods or documentation to developers? You ProcMon it…and watch what the app is doing. The two main attributes that helped me control the app were memory utilization and app path. I did tinker with TCP ports for a bit, because QA uses specific ports, but moved on to simpler, faster methods. Note, all code ended up being compiled. If you’d like to look at ports, ProcMon and netstat can help.

* I will also be throwing this into WinDbg and IDA Pro, to see if I can remove the windows via assembly. If I figure that out, I’ll post the code.

Killing QuickAssist

wmic /interactive:off process where “name like ‘quickassist.exe'” call terminate

Launch Quick Assist, skipping ‘Give Assistance’

C:\Windows\System32\QuickAssist.exe /Q

Note, /Q can be anything…once  there is a single character after the .exe, the prompt defaults to ‘Enter Code’ (awesome).

Controlling the general flow of Quick Assist

This is how I prevent window 1, and then go on to control windows 2 and 3. Something to think about, not only do you need to prevent the windows from appearing, but you also need to make sure the Pause function continues to work properly.

@echo off
SETLOCAL ENABLEDELAYEDEXPANSION
title QuickAssist

:: set path to current directory
cd "%~dp0"

:: VARIABLES
set dynamic=1
set static=1
set numMon=1

:: HOW MANY MONITORS DOES USER HAVE?
for /F %%a in ('wmic path Win32_PnPEntity where "Service='monitor' and Status='OK'" get DeviceID /VALUE ^| find /C "="') do set numMon=%%a
:: kill current quickassist
start /min /b "" killquickassist.exe
taskkill /f /im NoSleep.exe
taskkill /f /im quickassist.exe
wmic /interactive:off process where "name like 'quickassist.exe'" call terminate
timeout /t 1

cls
Echo Launching QuickAssist...

:: LAUNCHES 64BIT PROCESS
start /min /b "" runquickassist.exe

:: RUN NOSLEEP - KEEP MACHINE AWAKE DURING SESSION
:: this is just something extra I added
start /min /b "" NoSleep.exe

:: give quickassist.exe enough time to load
timeout /t 20

:: verify quickassist is running
start /min /b /low /wait TASKLIST /FI "IMAGENAME eq quickassist.exe" | find /i "quickassist.exe" || exit
:CONNECT
Echo Waiting for remote connection...
timeout /t 1
echo.

for /f "tokens=5" %%g in ('tasklist /fi "imagename eq quickassist.exe"') do set dynamic=%%g
start /min /b /low /wait TASKLIST /FI "IMAGENAME eq quickassist.exe" | find /i "quickassist.exe" || exit
set dynamic=%dynamic:,=%
echo %dynamic%
if %dynamic% lss 145000 goto CONNECT
:: WAIT UNTIL MEMORY OF PROCESS EVENS OUT
timeout /t 30

:: RETURN CURRENT PROCESS MEMORY
for /f "tokens=5" %%g in ('tasklist /fi "imagename eq quickassist.exe"') do set dynamic=%%g

:: remove comma from memory
set dynamic=%dynamic:,=%

:: sets a weighed value based on how many monitors
set /a x=%numMon%*15000
:: will be used to allow Pause, but not end session
set /a y=23000+%x%

:: set comparison value
set /a static=%dynamic%-%y%

echo Current Memory: %dynamic%
echo High Mem value: %static%
echo Number of Monitors: %numMon%
echo Differential: %x%
echo Comparison Value: %y%
set /a major=%static%-%y%

timeout /t 2
:LOOP
echo Remote Support is connected...
@timeout /t 1 >nul
echo.
for /f "tokens=5" %%g in ('tasklist /fi "imagename eq quickassist.exe"') do set dynamic=%%g
set dynamic=%dynamic:,=%
echo MINOR: %dynamic% lss %static%

:: USED TO HANDLE WHETHER OR NOT TO CLOSE QUICKASSIST

:: deal with while remotely connected and on pause
if %dynamic% lss %static% goto END
if %dynamic% equ running goto END
:: STILL IN TESTING
:: deal with complete app close
:: LOWEST MEM BEFORE CLOSING QUICKASSIST
echo MAJOR: %dynamic% lss %major%
if %dynamic% lss %major% goto END

goto LOOP

:END
start /min /b "" killquickassist.exe
taskkill /f /im quickassist.exe
taskkill /f /im NoSleep.exe
wmic /interactive:off process where "name like 'quickassist.exe'" call terminate

echo done!
exit /b 0