https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# microsoft-fslogix
s
This message was deleted.
a
Remove ConfirmImpact = 'High' from the script.
k
Will try...thx
Still not working 😞
a
Anything logged? What's the command line you're using?
k
If I use the -whatif switch I can get it to generate a log file
Nothing logged
-Targets "\\domain.local\NETLOGON\Applications\FSLogix\Cleanup\targets.xml" -LogFile "%userprofile%\desktop\log.log" -Confirm:$false
this is the switches
a
You might need to wrap it in a batch file to use %userprofile% in the log file path. Also check that the command line works when running it manually.
k
It does work manually, and I actually have tried wrapping it in a batch file, same result
a
Is there an associated event log?
I've had a look - have set it up as a logon and logoff script with parameters embedded. Tried script locally and on the network. Not creating the log file and I can't work out why
k
Thanks for testing...please let me know if you get it to work
a
This works - if I make some changes to the parameters and hard code all parameters (instead of passing them via the command line), it then works.
This should work - Remove ConfirmImpact = 'High' and change Mandatory = $True to Mandatory = $False for the Targets parameter. Not sure why that fails, even though you have a -Targets parameter specified. Best to change the default path to $Env:LocalAppData as in the screenshot above
I've also pushed an updated version of the script to fix logging, so download the new version
I'll update the script to prune old log files as well
k
Very nice...thank you
a
k
thx
Hi Aaron Sorry to bother you again. I am still having some problems running the Remove-ProfileData.ps1 configured as a logon script via a GPO. I have made the changes mentioned here - https://docs.stealthpuppy.com/docs/fslogix/profile If I run the script manually, there is no issues. OS - 2019 VDA - 1906.2
Hi Aaron Sorry to bother you once again. I may have found the reason as to why the Remove-ProfileData.ps1 script will not execute during a logon script GPO. I have configured AppLocker, and it looks like it has something to with the script not getting executed.
I see this error everytime I configure the script as a logon script. From what I can see is that it has something to do with Contrained Language Mode in Powershell: https://argonsys.com/microsoft-cloud/library/powershell-constrained-language-mode-and-the-dot-source-operator/
a
Can you sign the script using an internal code-signing cert?
I'll try some testing in constrained mode when I can.
k
Thx Aaron :)
a
Try this version - in my basic testing it works in constrained language mode: https://github.com/aaronparker/FSLogix/blob/master/Profile-Cleanup/Remove-ProfileData-Constrained.ps1
Note that I've change or removed a few things - elapsed time, size output is in MB instead of MiB and ConfirmImpact is gone, so the script will just delete stuff and won't ask for confirmation (i.e. removed support for the 
-Confirm
switch.
k
Great...I'll test it ASAP
Hi Aaron I have been doing some more testing and I still see the script getting blocked by AppLocker. I get an event id 8007 in my MSI and Script AppLocker event log. I have tried different combinations which involves configuring the ps1 file as a logon script in the PowerShell Script pane. I have also tried "wrapping" the script in a .cmd file, bypassing the execution policy. I have tried using WEM as well. What am I doing wrong here?
Open in Slack
PreviousNext
Powered by