Powershell makes life much easier than vbscript…. however it does have its downsides… signing policy can sometimes be a bit of pain and the modules you need have to be available…. which is an issue in particular for Windows PE.
Mick (good aussie name there) was nice enough to write a blog on how to import powershell into PE – without having to add it statically to the boot wim – http://mickitblog.blogspot.com.au/2016/04/import-active-directory-module-into.html
As a little shortcut from the blog, you can copy both the x86 and x64 required directories via robocopy rather than determining the version via powershell.
The next step however is the more important one…. a task sequence doesn’t allow us to run a powershell command in PE with credentials, we need a secure way of running the command. In this case, we want to delete a computer object….
Step 1 – Generate a key file (perform on any full OS)
$KeyFile = “\\sccm\PSource$\OSD.DeleteComputer\DeleteComputer.key“
$Key = New-Object Byte 16
$Key | out-file $KeyFile
Step 2 – Encrypt a password using the key
$PasswordFile = “\\sccm\PSource$\OSD.DeleteComputer\DeleteComputer.txt“
$KeyFile = “\\sccm\PSource$\OSD.DeleteComputer\\DeleteComputer.key“
$Key = Get-Content $KeyFile
$Password = “Your password here” | ConvertTo-SecureString -AsPlainText -Force
$Password | ConvertFrom-SecureString -key $Key | Out-File $PasswordFile
Step 3 – Create your script utilising the creds – (Below is the one I use to delete a computer object)
#SCCM TS Object
$tsenv = New-Object -COMObject Microsoft.SMS.TSEnvironment
$CompName = $tsenv.Value(“_SMSTSMachineName”)
# Get current path in order to get encrypted password
$MyDir = [System.IO.Path]::GetDirectoryName($myInvocation.MyCommand.Definition)
$User = “Domain\Account”
$PasswordFile = “$MyDir\DeleteComputer.txt”
$KeyFile = “$MyDir\DeleteComputer.key”
$key = Get-Content $KeyFile
$MyCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $User, (Get-Content $PasswordFile | ConvertTo-SecureString -Key $key)
# Remove the computer from AD
Remove-ADComputer -Identity $CompName -server <DC name required> -Credential $MyCredential -confirm:$false
One obvious risk is, this is not very secure. It will stop a random snooper type person from seeing a plain text password…. but it will not stop someone who is capable of pressing F8 to get into the running TS (if you have it enabled) and then grabbing the key and txt and being able to use them…. So, take this into consideration when choosing to use (or not use) for your environment.