How to enable used space encryption using Invoke-MbamClientDeployment.ps1

First and foremost, if you have not had a chance to read the latest Technet article on how to enable BitLocker by using MBAM, please do so here!

It is an excellent guide that explains how to configure MBAM and Bitlocker inside of MDT. Unfortunately the guide does not explain how to enable used space encryption when you are not pre-provisioning your drive. It’s actually pretty simple and can be done by just modifying the registry.

Now I’m assuming that you have Invoke-MbamClientDeployment.ps1 in your task sequence but if you have not set everything up, please read the Technet article that I referenced earlier.

In your task sequence, please navigate to the step that calls Invoke-MbamClientDeployment.ps1. If you followed the Technet guide, the task name should be “Configure BitLocker for MBAM”. Now go ahead and add a Run Command Line step before the “Configure BitLocker for MBAM” step. Let’s name this step “Enable Used Space Encryption”.

In the command line field, you will want to enter the following command:

reg.exe add HKLM\SOFTWARE\Policies\Microsoft\FVE /v OSEncryptionType /t REG_DWORD /d 2 /f

And.. That’s it!

How to configure your Windows 10 default file associations in MDT

You will first need to configure all your file associations on a test machine. Once this has been done, you will want to run the following command to export your file associations:

Dism.exe /Online /Export-DefaultAppAssociations:%USERPROFILE%\Documents\DefaultAppAssociations.xml

The XML file will be exported to your Documents folder

Now you will want to place the XML file that we just exported into your Scripts folder inside of your MDT Deployment Share.

Once that is done, launch MDT and open your deployment task sequence. Locate the PostInstall folder and add a command line task above the Inject Drivers task.

Set File Associations
Set File Associations - 2

Lets go ahead and name the task Set File Associations. In the command line field, insert the following command:

Dism.exe /Image:%OSDisk%\ /Import-DefaultAppAssociations:%SCRIPTROOT%\DefaultAppAssociations.xml

Now you’re all set!

Query Available Windows Updates

The following script will allow you to query your available Windows Updates in Powershell and it will export it to a CSV file.

#Specify the location of where you want the CSV to be saved (Ex:\\Fileshare)
$location = "\\SHARE"

$MSsearch = New-Object -ComObject Microsoft.Update.Searcher
$Pending = $MSsearch.Search("IsInstalled=0") 
$Update = $Pending.Updates

$Title = $Update | Select-Object Title | foreach { $_.Title } 

$timeformat= "MM-dd"
$date = (Get-Date).ToString($timeformat)

if($Update.Count -eq 0) {
    Write-Host "There are no updates available for $env:Computername"

else {
    foreach($titles in $title){
        $kb = $titles.split('(')[-1].replace(')','')
        if($kb -like "kb*") {
            $table = New-Object –TypeName PSObject -Property @{ 
                'Title' = $Titles 
                'URL' = "$kb" 
        else {
            $table = New-Object –TypeName PSObject -Property @{ 
                    'Title' = $Titles 
                    'URL' = "Not Available" 
        $table | Select-Object Title, URL | Export-CSV -NoTypeInformation -Append "$location\Report.xml"

How to reinstall all of the default Windows 10 apps

This short loop will reinstall all the default Windows 10 apps.

$pkgname = Get-AppxPackage -AllUsers | foreach { $_.packagefullname }
foreach($name in $pkgname) {
    Add-AppxPackage -register "C:\Program Files\WindowsApps\$name\AppxManifest.xml" -DisableDevelopmentMode


It’s been a while since I have posted something, so here is a quick little function that can help you track your USPS packages right from your Powershell Console!

Example: Get-TrackingInfo -Trackingnumber YOUR-TRACKING-NUMBER-HERE

    Track your USPS Packages
    Track your USPS Packages right from the Powershell Console
    Get-TrackingInfo -Trackingnumber 555555555555
function Get-TrackingInfo  {
    Param([Parameter(Mandatory=$true)] $TrackingNumber)
    $invoke = (Invoke-Webrequest$TrackingNumber).allelements | Where-Object  {$_.tagname -eq "tr" } 
    $information = $invoke | Select-Object OuterText -Unique -Skip 3
    $information | Format-Table @{Label=’Tracking Information’;Expression={$_.OuterText}}

Unable to use your Windows Hello PIN?

Have you recently replaced your motherboard and now you cannot use your Windows Hello Pin? Try logging in with an Administrator account and deleting everything inside of the following directory:

That should clear your PIN and allow you to create a new one in Settings > Accounts > Sign-in Options.

Prevent users from creating Office 365 Groups

The script below will block users in a specified OWA Policy from creating Office 365 groups. The script uses Out-GridView to allow you to select which OWA Policy you want to assign this rule to.

#Office 365 Credentials
$username = "USERNAME"
$password = "PASSWORD"

try {
    #Attempts to connect to Office 365 and install Modules
    Import-Module MSOnline
    $pass = convertto-securestring -String "$password" -AsPlainText -Force 
    $credential = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $pass
    Connect-MsolService -Credential $credential -ErrorAction Stop
    $ExchangeSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "" -Credential $credential -Authentication "Basic" -AllowRedirection
    Import-PSSession $ExchangeSession >null
catch [Microsoft.Online.Administration.Automation.MicrosoftOnlineException] {
    #Logs error for incorrect password
    Write-Host "Please verify your username and password"
    Write-EventLog -LogName Application -Source "Office 365 Log" -EntryType Error -EventId 1 -Message "OFFICE 365 AUTOMATIC LICENSE ASSIGNMENT`n`nError Connecting to Office 365! Please verify your user name and password"

catch {
    #Log for any other error
    Write-Host "Error Connecting"
    Write-EventLog -LogName Application -Source "Office 365 Log" -EntryType Error -EventId 1 -Message "OFFICE 365 AUTOMATIC LICENSE ASSIGNMENT`n`nError Connecting to Office 365!"
$OWA = Get-OwaMailboxPolicy | Select Identity | Out-Gridview -Title "Select one or more OWA Policies" -PassThru | foreach { $_.Identity } 
if($OWA.count -eq 0) {
    Write-Host "Please rerun the script and select an OWA Policy"
else {
    if($OWA.count -gt 1) {
        foreach($MultiOWA in $OWA) {
            Set-OwaMailboxPolicy -Identity $MultiOWA -GroupCreationEnabled $False
    else {
        Set-OwaMailboxPolicy -Identity $OWA -GroupCreationEnabled $False

Automate your Meraki Client VPN Connection

Cisco does a great job with their documentation but unfortunately they didn’t do so well with explaining how to configure their VPN connection for medium to large scale companies. Their documentation only explains how to configure the connection manually, so I decided to use my Powershell skills to write up something really quick. Luckily for us, this task is extremely simple with Powershell.

The following script will automatically configure your Meraki VPN connection on Windows 10:

$ServerAddress = "VPN SERVER ADDRESS"
$ConnectionName = "VPN CONNECTION NAME"
$PresharedKey = "YOUR PRESHARED KEY"
Add-VpnConnection -Name "$ConnectionName" -ServerAddress "$ServerAddress" -TunnelType L2tp -AllUserConnection -L2tpPsk "$PresharedKey" -AuthenticationMethod Pap -Force

This script can be deployed using GPO, your existing system management system or even added to your images with MDT or SCCM.

I hope this helps someone out!

Automatically join a machine to your domain

This short script will join a machine to your domain. This can be useful as a post start up script that will launch after a machine has been imaged.

$domain = "DOMAIN"
$password = "PASSWORD HERE" | ConvertTo-SecureString -asPlainText -Force
$username = "$domain\USERNAME HERE" 
$credential = New-Object System.Management.Automation.PSCredential($username,$password)
Add-Computer -DomainName $domain -Credential $credential

Feel free to comment if you have any questions!

Operating System Audit

Recently I noticed that Kaseya (our system management system) does not always update the operating system name when a computer has been upgraded. It can take a while for a computer to report back in and provide accurate information. Since we finished up our Windows 10 upgrades, we wanted to be 100% sure that we upgraded all our machines. So to verify this information I wrote a script to find out every machine’s operating system in our network.

Read more