PSADT snippits/cheatsheet

README.md

This is a updated PSAppDeploy Toolkit Cheatsheet from it's orginal author updated to V4 Syntax

This is a small gist with snippits I frequently use in PSADT - PowerShell App Deployment Toolkit.

Feel free to offer suggestions, if code I've provided no longer works, doesn't work with current windows versions, or if PSADT has provided native functionality for some of my 'PSADT adjacent' code,

I've also stole a few from here to get started, I've populated a bunch I use regularly.

Also, additional note that isn't strictly related to PSADT, but is helpful in deployment matters.. I've included an z_Example_App.exe.manifest file. From what I can see, when you come across a legacy app that requests administrator privilege on launch (but does not have 'run as administrator' checked in it's properties, you can overrule this behaviour by creating .exe.manifest file (named in accordance with the .exe's file name, e.g. notepad.exe.manifest), with the following within the file:

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

As opposed to:

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>

See example in this repo, or read more here and here

PSADT-Cheatsheet.ps1

## Commonly used PSADT env variables (v4)
$envCommonDesktop           # C:\Users\Public\Desktop
$envCommonStartMenuPrograms # C:\ProgramData\Microsoft\Windows\Start Menu\Programs
$envProgramFiles            # C:\Program Files
$envProgramFilesX86         # C:\Program Files (x86)
$envProgramData             # C:\ProgramData
$envUserDesktop             # C:\Users\{user currently logged in}\Desktop
$envUserStartMenuPrograms   # C:\Users\{user currently logged in}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
$envSystemDrive             # C:\
$envWinDir                  # C:\Windows

# Let op: deze env-variabelen worden beschikbaar nadat je een ADT-sessie hebt geopend
# of Export-ADTEnvironmentTableToSessionState hebt aangeroepen.

## How to load PSADT v4 functions/variables for manual testing
# (PowerShell venster als Administrator; module geïnstalleerd/opgenomen in het pad)
Import-Module PSAppDeployToolkit

# Open een (test) ADT-sessie zodat $adtSession + env vars beschikbaar zijn
$adtSession = Open-ADTSession -SessionState $ExecutionContext.SessionState `
    -DeploymentType 'Install' -DeployMode 'Interactive' -PassThru

# Exporteer de env-variabelen (zoals $envProgramFiles, $envCommonDesktop, etc.)
Export-ADTEnvironmentTableToSessionState -SessionState $ExecutionContext.SessionState

## Examples of exe install
Start-ADTProcess -FilePath '<application>.exe' -ArgumentList '/quiet' -WaitForMsiExec

Start-ADTProcess -FilePath "$($adtSession.DirFiles)\DirectX\DXSetup.exe" `
    -ArgumentList '/silent' -WindowStyle 'Hidden' -WaitForMsiExec

# Open notepad, maar ga direct door met script (niet wachten)
Start-ADTProcess -FilePath "$envSystemRoot\notepad.exe" -NoWait

# Execute an .exe, and hide confidential parameters from log file
$serialisation_params = '-batchmode -quit -serial <aa-bb-cc-dd-ee-ffff11111> -username "<serialisation username>" -password "SuperSecret123"'
Start-ADTProcess -FilePath "$envProgramFiles\Application\Serialise.exe" `
    -ArgumentList $serialisation_params -SecureArgumentList

## Example to install an msi
Start-ADTMsiProcess -Action 'Install' `
    -FilePath "$($adtSession.DirFiles)\<application>.msi" `
    -ArgumentList 'REBOOT=ReallySuppress /QN'

# Simpele MSI-install (standaard parameters uit config.psd1)
Start-ADTMsiProcess -Action 'Install' -FilePath 'Discovery 2015.1.msi'

#MSI installatie met argumenten
$ExecuteMSIResult = Start-ADTMsiProcess -Action 'Install' -FilePath 'Adobe_FlashPlayer_11.2.202.233_x64_EN.msi' -AdditionalArgumentList 'ALLUSERS=1', 'SOMEPROPERTY=TRUE' -PassThru
# MSI install + transform file
Start-ADTMsiProcess -Action 'Install' `
    -FilePath 'Adobe_Reader_11.0.0_EN.msi' `
    -Transforms 'Adobe_Reader_11.0.0_EN_01.mst'

## Install a patch (MSP)
Start-ADTMsiProcess -Action 'Patch' -FilePath 'Adobe_Reader_11.0.3_EN.msp'

## To uninstall an MSI (ProductCode)
Start-ADTMsiProcess -Action 'Uninstall' `
    -ProductCode '{5708517C-59A3-45C6-9727-6C06C8595AFD}'

## Uninstall a number of MSI ProductCodes
@(
    '{2E873893-A883-4C06-8308-7B491D58F3D6}',
    '{2E873893-A883-4C06-8308-7B491D58F3D6}',
    '{2E873893-A883-4C06-8308-7B491D58F3D6}',
    '{2E873893-A883-4C06-8308-7B491D58F3D6}',
    '{2E873893-A883-4C06-8308-7B491D58F3D6}',
    '{B234DC00-1003-47E7-8111-230AA9E6BF10}' # Let op: laatste zonder komma
) | ForEach-Object {
    Start-ADTMsiProcess -Action 'Uninstall' -ProductCode $_
}

## Copy a file to the correct relative location for all user accounts
$ProfilePaths = Get-ADTUserProfiles | Select-Object -ExpandProperty 'ProfilePath'
ForEach ($Profile in $ProfilePaths) {
    Copy-ADTFile -Path "$($adtSession.DirFiles)\Example\example.ini" `
                 -Destination "$Profile\Example\To\Path\"
}

## Remove registry key
# Volledige key inclusief alle subkeys
Remove-ADTRegistryKey -Key 'HKEY_LOCAL_MACHINE\SOFTWARE\Macromedia\FlashPlayer\SafeVersions' -Recurse
Remove-ADTRegistryKey -Key 'HKLM:\SOFTWARE\Macromedia\FlashPlayer\SafeVersions' -Recurse

# Verwijder specifieke value in een key
Remove-ADTRegistryKey -Key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'RunAppInstall'
Remove-ADTRegistryKey -Key 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'RunAppInstall'

## Create a reg key / set value
Set-ADTRegistryKey -Key 'HKEY_LOCAL_MACHINE\SOFTWARE\LMKR\Licensing' `
    -Name 'LMKR_LICENSE_FILE' -Value '@license' -Type String -ErrorAction SilentlyContinue

## To set an HKCU key for all users including default profile (v4 pattern)
[scriptblock]$HKCURegistrySettings = {
    # Let op: in v4 gebruik je $_.SID in plaats van $UserProfile.SID
    Set-ADTRegistryKey -Key 'HKEY_CURRENT_USER\SOFTWARE\Classes\AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9' `
        -Name 'NoOpenWith' -Value '""' -Type String -ErrorAction SilentlyContinue -SID $_.SID

    Set-ADTRegistryKey -Key 'HKCU\Software\Microsoft\Office\14.0\Common' `
        -Name 'qmenable' -Value 0 -Type DWord -SID $_.SID
}

Invoke-ADTAllUsersRegistryAction -ScriptBlock $HKCURegistrySettings

## Import a .reg file (veel nested keys)
Start-ADTProcess -FilePath 'reg.exe' `
    -ArgumentList "IMPORT `"$($adtSession.DirFiles)\name-of-reg-export.reg`"" `
    -WaitForMsiExec

## To pause script for <x> time
Start-Sleep -Seconds 120

## To copy and overwrite a file
Copy-ADTFile -Path "$dirSupportFiles\mms.cfg" -Destination 'C:\Windows\SysWOW64\Macromed\Flash\mms.cfg'

## To copy a file
Copy-ADTFile -Path "$dirSupportFiles\mms.cfg" -Destination 'C:\Windows\SysWOW64\Macromed\Flash\'

## To copy a folder
# Destination is de PARENT folder (dus niet de doelmapnaam zelf)
# Voor kopie naar root: gebruik "$envSystemDrive\" (inclusief backslash)
Copy-ADTFile -Path "$($adtSession.DirFiles)\client_1" `
             -Destination 'C:\oracle\product\11.2.0\' -Recurse

## To delete a file or shortcut
Remove-ADTFile -Path "$envCommonDesktop\GeoGraphix Seismic Modeling.lnk"

## Remove a bunch of specific files
@(
    "$envCommonDesktop\Example 1.lnk",
    "$envCommonDesktop\Example 2.lnk",
    "$envCommonDesktop\Example 3.lnk" # Laatste zonder komma
) | ForEach-Object {
    Remove-ADTFile -Path $_
}

## Remove a bunch of specific folders and their contents
@(
    "$envSystemDrive\Example Dir1",
    "$envProgramFiles\Example Dir2",
    "$envProgramFiles\Example Dir3",
    "$envProgramFilesX86\Example Dir4",
    "$envSystemRoot\Example4" # Laatste zonder komma
) | ForEach-Object {
    Remove-ADTFolder -Path $_
}

## Remove a bunch of specific folders, only if they're empty
@(
    "$envProgramFiles\vendor\app\v12\junk",
    "$envProgramFiles\vendor\app\v12",
    "$envProgramFiles\vendor\app",
    "$envProgramFiles\vendor",
    "$envProgramFilesX86\vendor\app\v12\junk",
    "$envProgramFilesX86\vendor\app\v12",
    "$envProgramFilesX86\vendor\app",
    "$envProgramFilesX86\vendor" # Laatste zonder komma
) | ForEach-Object {
    if (-not (Test-Path -Path "$_\*")) {
        Remove-ADTFolder -Path $_
    }
}
# Voor iedere map: als hij leeg is, verwijder.

## Import a certificate to system 'Trusted Publishers' store
Start-ADTProcess -FilePath 'certutil.exe' `
    -ArgumentList "-f -addstore -enterprise TrustedPublisher `"$($adtSession.DirFiles)\certname.cer`"" `
    -WaitForMsiExec
Write-ADTLogEntry -Message 'Imported Cert' -Source $deployAppScriptFriendlyName

## Import a driver (signed, cert in TrustedPublisher)
Start-ADTProcess -FilePath 'PnPutil.exe' `
    -ArgumentList "/a `"$($adtSession.DirFiles)\USB Drivers\driver.inf`"" `
    -WaitForMsiExec

## Register a DLL module
Register-ADTDll -FilePath "$($adtSession.DirFiles)\example\codec.dll"

# Legacy approach:
# Start-ADTProcess -FilePath 'regsvr32.exe' `
#   -ArgumentList "/s `"$($adtSession.DirFiles)\example\codec.dll`"" -WaitForMsiExec

## Unregister a DLL
Unregister-ADTDll -FilePath "$envProgramFilesX86\Vendor\App\Telemetry.dll"

## Make an install marker reg key for custom detections
# Resultaat: HKLM:\SOFTWARE\PSAppDeployToolkit\InstallMarkers\Microsoft_KB2921916_1.0_x64_EN_01
Set-ADTRegistryKey -Key "$configToolkitRegPath\$appDeployToolkitName\InstallMarkers\$installName"

## While loop pause (incase app installer exits immediately)
# Wacht tot voorbeeld-registry-key bestaat
while (-not (Test-Path -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{product-code-hereD}')) {
    Start-Sleep -Seconds 5
    Write-ADTLogEntry -Message "$appVendor - $appName - $appVersion is still not finished installing, sleeping another 5" `
        -Source $deployAppScriptFriendlyName
}

# Wacht tot voorbeeld-bestand bestaat
while (-not (Test-Path -Path "$envCommonDesktop\Example Shortcut.lnk")) {
    Start-Sleep -Seconds 5
    Write-ADTLogEntry -Message "$appVendor - $appName - $appVersion is still not finished installing, sleeping another 5" `
        -Source $deployAppScriptFriendlyName
}

## To Create a shortcut
New-ADTShortcut -Path "$envCommonStartMenuPrograms\My Shortcut.lnk" `
    -TargetPath "$envWinDir\System32\notepad.exe" `
    -Arguments '--example-argument --example-argument-two' `
    -Description 'Notepad' `
    -WorkingDirectory "$envHomeDrive\$envHomePath"

## Modify ACL on a file
$acl_to_modify = "$envProgramData\Example\File.txt"
$acl = Get-Acl -Path $acl_to_modify
$ar = New-Object System.Security.AccessControl.FileSystemAccessRule(
    'BUILTIN\Users', 'FullControl', 'None', 'None', 'Allow'
)
$acl.SetAccessRule($ar)
Set-Acl -Path $acl_to_modify -AclObject $acl

## Modify ACL on a folder
$folder_to_change = "$envSystemDrive\Example_Folder"
$acl = Get-Acl -Path $folder_to_change
$ar = New-Object System.Security.AccessControl.FileSystemAccessRule(
    'BUILTIN\Users', 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow'
)
$acl.SetAccessRule($ar)
Set-Acl -Path $folder_to_change -AclObject $acl

## Add to environment variables (PATH in this case)
$path_addition = 'C:\bin'

# System-wide PATH
[Environment]::SetEnvironmentVariable('Path', $env:Path + ';' + $path_addition, 'Machine')

# User PATH
[Environment]::SetEnvironmentVariable('Path', $env:Path + ';' + $path_addition, 'User')

# Process-scope PATH (alleen tijdens script)
[Environment]::SetEnvironmentVariable('Path', $env:Path + ';' + $path_addition, 'Process')

## .NET 4.x comparison/install (v4 registry helper)
$version_we_require  = [version]'4.5.2'
$version_we_want_path = "$($adtSession.DirFiles)\NDP452-KB2901907-x86-x64-AllOS-ENU.exe"
$install_params      = '/q /norestart'

if ((Get-ADTRegistryKey -Path 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full' -Value 'Version') -lt $version_we_require) {
    Write-ADTLogEntry -Source $deployAppScriptFriendlyName -Message ".NET version is < [string]$version_we_require, installing"
    Start-ADTProcess -FilePath $version_we_want_path -ArgumentList $install_params -WaitForMsiExec
}

# Exit codes for reboot required (v4: Exit-Script -> Close-ADTSession)
# Soft reboot: SCCM gaat verder maar eist later een reboot
Close-ADTSession -ExitCode 3010

# Hard reboot: SCCM gaat niet verder zonder reboot
Close-ADTSession -ExitCode 1641

## Create Active Setup to run once per user, and run an executable as the user
Copy-ADTFile -Path "$($adtSession.DirFiles)\Example.exe" -Destination "$envProgramData\Example"

Set-ADTActiveSetup -StubExePath "$envProgramData\Example\Example.exe" `
    -Description 'AutoDesk BIM Glue install' `
    -Key 'Autodesk_BIM_Glue_Install' `
    -ErrorAction SilentlyContinue

## Create an Active Setup to import a .reg file once per user
Copy-ADTFile -Path "$($adtSession.DirFiles)\many_registry_keys_for_app_x.reg" `
             -Destination "$envProgramData\Hidden\Path"

Set-ADTActiveSetup -StubExePath "reg.exe IMPORT `"$envProgramData\Hidden\Path\many_registry_keys_for_app_x.reg`"" `
    -Description 'My undesirable way of applying registry keys' `
    -Key 'Undesirable_Reg_keys' `
    -ErrorAction SilentlyContinue

## Helper function to find uninstall strings / MSI codes / display names
function Get-Uninstaller {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [string] $Name
    )

    $local_key     = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*'
    $machine_key32 = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
    $machine_key64 = 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'

    $keys = @($local_key, $machine_key32, $machine_key64)

    Get-ItemProperty -Path $keys -ErrorAction SilentlyContinue |
        Where-Object {
            $_.DisplayName  -like "*$Name*" -or
            $_.PsChildName  -like "*$Name*"
        } |
        Select-Object PsPath, DisplayVersion, DisplayName,
                      UninstallString, InstallSource, InstallLocation,
                      QuietUninstallString, InstallDate
}
## end of function

z_Example_App.exe.manifest

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> 
    <assemblyIdentity version="1.0.0.0"
            processorArchitecture="X86"
            name="Example_App.exe"
            type="win32"/> 
<description>elevate execution level</description> 
   <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
      <security>
         <requestedPrivileges>
            <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
         </requestedPrivileges>
      </security>
   </trustInfo>
</assembly>