Administration

The content below is intended for administrators who are responsible for creating and executing scripts. Before you perform the tasks in this guide, please ensure you have correctly installed Specops Command.

Key Components

Specops command can be configured from any computer in the domain where the Administration Tools are installed. The Specops Command Administration Tools consists of the following components:

  • Group Policy Editor Snap-in: You can use the Group Policy Editor Snap-in to create, edit, and remove script assignments.
  • Specops Configuration Tool: You can use the Specops Configuration Tool to import your license keys and monitor the status of your Client Side Extensions.

You can also use the following component to administer Specops Command:

Specops Reporting: You can use Specops Reporting to view and create detailed reports for script feedback.

Group Policy Editor Snap-In

The Group Policy snap-in, installed with the Administration Tools, allows you to create, edit, and remove script assignments. These settings are stored as a part of the GPO. You can create script assignments for either computers and/or users.

New Script Assignment

  1. In the GPMC, expand your domain node and locate the Group Policy Objects node.
  2. Right-click on the desired GPO and click Edit…
  3. In the Group Policy Management Editor, expand Computer Configuration or User Configuration, Policies, Systems Management, and select Specops Command.
    Note: The Specops Command node allows scripts to be executed in both the computer and user context.
  1. Click New Script Assignment.

Configure Script Assignment

  1. In the Script Assignment name text field, enter a descriptive name for the script assignment.
  2. Specify the desired script language from the Script language drop-box.
  3. Use the Script editor to write your PowerShell script or VBScript. Alternatively you can import a saved script from file. Opening a saved script will replace the script in the script editor.
    Configure Script Assignment
  4. Use the Send feedback drop-box to configure the feedback options.
    Feedback Description
    AlwaysFeedback will be sent every time a client executes the script, regardless of the outcome.
    On errorFeedback will only be sent if an error occurs when executing the script.

    Note: This can be useful for limiting network traffic if scripts are executed often and on multiple computers.

    NeverNo feedback will be sent when executing this script.
  5. Click Test Script to execute the script on the local machine.
    Note: It is important to run the script before sending it to clients to ensure that there are no errors in the script.
  1. Click Sign Script… to sign the PowerShell script from Specops Command using a certificate with a private key.
    • Browse to the location of the PFX file.
    • Enter the certificate password, and click OK.
  2. To save the script assignment, click OK.

Undo script

Use the Undo script tab to undo the script for computers when they fall out of the scope of management.

  1. Enable the Undo script enabled checkbox to be able to add an undo script to the script assignment.
  2. Specify the desired script language from the Script language drop-box.
  3. Use the Script editor to write your PowerShell script or VBScript. Alternatively you can import a saved script from file. Opening a saved script will replace the script in the script editor.
  4. Use the Send feedback drop-box to configure the feedback options.
    Feedback Description
    AlwaysFeedback will be sent every time a client executes the script, regardless of the outcome.
    On errorFeedback will only be sent if an error occurs when executing the script.

    Note: This can be useful for limiting network traffic if scripts are executed often and on multiple computers.

    NeverNo feedback will be sent when executing this script.
  5. Click Test Script to execute the script on the local machine.
    Note: It is important to run the script before sending it to clients to ensure that there are no errors in the script.
  1. Click Sign Script… to sign the PowerShell script from Specops Command using a certificate with a private key.
    • Browse to the location of the PFX file.
    • Enter the certificate password, and click OK.
  2. To save the script assignment, click OK.

Target

Use the Target tab to scope which computers or users will receive the script assignment. A target consists of a set of criteria which the client will match against its own environment.

  1. Enable the Targeting enabled check-box.
  2. Select the Add target criterion drop box. You can add the following criteria:
    CriteriaDescription
    Membership criteriaThe Membership criteria consists of the following items:
    • Security groups
    • Organizational units
    • User name
    • Computer names
    • Sites
    • IP address range
    Environment criteriaThe Environment criteria consists of the following items:
    • Environment variables
    • Registry settings
    • Operating system languages
    Hardware criteriaThe Hardware criteria consists of the following items:
    • BIOS
    • Computer model
    • Processor type
    • Disk free space
    • Memory size
    Software criteriaThe Software criteria consists of the following items:
    • Operating systems
    • Installed software
    • Files
    WQLQuery the Windows Management Instrumentation.
  3. Once you have added the target criteria, they will be displayed in the list. From the list you can edit or remove a criterion.

Schedule

Use the Schedule tab to specify when and how often a script assignment should be executed.
Schedule

  1. Enable the Scheduling enabled checkbox.
    Note
    : If this option is not enabled, the script assignment will be applied at every Group Policy interval both in foreground and background processing mode.
  1. You will have the following options:
    IntervalDescription
    OnceGPO executes script only once for the computer or user.
    Note:
    • If Once is set in combination with foreground in the computer part of the GPO, the GPO will affect the computer the first time it is re-started after the CSE is installed.
    • If Once is set in combination with foreground in the user part of the GPO, the result will be that the GPO will only affect the user the first time he/she log on to a computer after the CSE is installed on the computer.
    DailyGPO executes script daily. This is similar to the Every group policy interval option with the exception of allowing a time window to be used.
    WeeklyGPO executes script on specific days of the week.
    MonthlyGPO executes script on one or more specified days each month.
    Every group policy intervalGPO executes script every time the policies are applied for the computer or user.
  2. If you have selected the daily, weekly, or monthly interval, you can configure when for each interval the settings should be executed.
  3. From the Time windows settings you can also configure UTC time and Only once per time window.
  4. You can schedule scripts during both during booth and/or logon (foreground mode) and every group policy interval (Background mode). Enable the GPO Processing mode you would like to use.
    Note: If you select both, you will have the option to require synchronous mode.

Edit Script Assignment

  1. In the GPMC, expand your domain node and locate the Group Policy Objects node.
  2. Right-click on the desired GPO and click Edit…
  3. In the Group Policy Management Editor, expand Computer Configuration or User Configuration, Policies, Systems Management, and select Specops Command.
  4. Select the script assignment you want to edit, and click Edit Script Assignment.
  5. Make the necessary changes, and click OK.

Delete Script Assignment

  1. In the GPMC, expand your domain node and locate the Group Policy Objects node.
  2. Right-click on the desired GPO and click Edit…
  3. In the Group Policy Management Editor, expand Computer Configuration or User Configuration, Policies, Systems Management, and select Specops Command.
  4. Select the script assignment you want to delete, and click Delete Script Assignment.
  5. Click Yes in the Delete script assignment dialog box.

Detailed Feedback

After the Group Policies have been applied, you can view detailed feedback for a script assignment.

  1. In the GPMC, expand your domain node and locate the Group Policy Objects node.
  2. Right-click on the desired GPO and click Edit…
  3. In the Group Policy Management Editor, expand Computer Configuration or User Configuration, Policies, Systems Management, and select Specops Command.
  4. Select the desired Script assignment, and click Detailed Feedback.
  5. Use the top pane to set up the filter. You will have the following filter options:
    OptionDescription
    Succeeded executionsThe feedback will only display script executions that were completed without errors.
    Failed executionsThe feedback will only display failed script executions.
    BothThe feedback will display both succeeded and failed script executions.
    Normal executionsThe feedback will only display script executions that are not Undo executions.
    Undo ExecutionsThe feedback will only display undo script executions. Undo scripts are executed when a script assignment falls out of the scope of management for a computer or user.
    BothThe feedback will display both normal and undo script executions.
    All timeThe feedback will display all executions regardless of when they happened.
    Not older thanThe feedback will display executions on or after the selected date.
  6. Click Display to load the information according to the filter.
  7. You can remove dated information using the Delete Selected feedback Select the feedback you want to remove and click Delete Selected feedback.
    Note: If the script is executed again for the same computer or users, new feedback will be sent to replace the deleted information.

Powershell Snap-ins

PowerShell Snap-ins provide cmdlets and providers as well as other capabilities. If you use a cmdlet in a script that Snap-in must be present on the client for it to process. In Specops Command you can add PowerShell Snap-ins to be packaged and deployed to clients. You can also ensure these Snap-ins are the latest version.

PowerShell Snap-in

If a script is added to a Specops Command policy, and a cmdlet or provider called in that script is from a PowerShell Snap-in, then the snap-in will appear in the list. The local version of the snap-in will be compared against the version contained in the GPO. This will assist in keeping versions of the snap-in up to date.

Licensing

You can update your license from the Group Policy Editor snap-in.

  1. Open the Group Policy Management Console.
  2. Right-click on the GPO node, and select Edit.
  3. In the Group Policy Management Editor, expand Computer Configuration, Policies, Systems Management, and select Specops Command.
  4. From the Command menu, click Licensing.
  5. Click Import license file…
  6. Browse to the location of the TXT file, and click Open.
  7. Click OK.
Specops Configuration Tool

The Specops Configuration Tool allows you to manage the various components of your installed Specops products such as importing license keys and monitoring the status of your Client Side Extensions.

Computers

  1. Search for a computer by using one or more of the below criteria:
  • Number of days of inactivity
  • Computer name
  • Client version
  1. Click Search.
  2. The computers that meet the criteria will appear in the list. For a detailed list of your computers including database ID, computer name, heartbeat, and version, click Export Computer List to File.
  3. Enter a file name.
  4. Click Save.
  5. Select a computer from the list, and click Delete Selected Computer Records to delete records for the computer.
  6. In the Delete Computer Record dialog box, click Yes.

License

Import License

  1. Open the Specops Configuration tool.
  2. Select the Specops Command tab.
  3. In the navigation pane, select License.
  4. Click Import License.
  5. Browse to the location of the TXT file, and click Open.

Export License Information to File

  1. Open the Specops Configuration tool.
  2. Select the Specops Command tab.
  3. In the navigation pane, select License.
  4. Click Export License Information to File.
  5. Enter a file name, and click Save.
Specops Reporting

The Specops Reporting component is entirely web based and can be accessed from your browser. The URL for Specops Reporting depends on where the component was installed. Command Reports provide a good overview of the feedback gathered from the script assignments.

View predefined Reports

  1. Enter the URL for Specops Reporting.
  2. In the navigation pane, expand Specops Reporting, and click Specops Command.
  3. The predefined reports are grouped into categories. Select a report from the below categories:
  • Computer
  • User
  • Extension Status

View predefined reports

Create a new report

You can customize the view of the information gathered by creating a new report definition.

  1. Enter the URL for Specops Reporting.
  2. In the navigation pane, click Create new report.
  3. Specify the following fields:
    FieldStep
    Report nameEnter a report name.
    Report categorySpecify a report category.
    Report descriptionEnter a report description
    ColumnsAdd columns to the report. You will be able to specify the Column heading, Field, and Display name.
    GroupingsTo group data in the report data, select a column and drag and drop it in the group panel. This will remove the column from the visible columns and display a grouping rectangle for the column in the group panel.
    FiltersAdd any filtering of data by clicking on the Filters tab and selecting additional filter data and values to filter by.
    Import report definitionYou can import report definition from the import web page or from a file.
    Export report definitionsYou can export a report definition from the export web page. The export page displays a complete list of all reports in the database grouped by report categories.
  4. Click Save.

Edit an existing report

  1. Enter the URL for Specops Reporting.
  2. In the navigation pane, expand Specops Reporting, and click Specops Command.
  3. Click Edit next to the report you want to modify.
  4. Make the necessary, and click Save.

Export Report data

You can export report data in a PDF or a CSV format for further processing.

  1. Enter the URL for Specops Reporting.
  2. In the navigation pane, expand Specops Reporting, and click Specops Command.
  3. Select the Report you want to export.
  4. If required, select the client computer from the Computer drop box, or the user from the User drop box.
  5. Specify the page size in the Page size drop box.
  6. From the Export to drop box, select the report format.
    Note: If you select PDF, you will also need to specify the page layout from the drop box.
  1. Click the green button next to Export to.

Delete a Report

  1. Enter the URL for Specops Reporting.
  2. In the navigation pane, expand Specops Reporting, and click Specops Command.
  3. Click Delete next to the report you want to delete.
  4. Click OK.