Specops Command

  • Article

We realize that true PowerShell diehards might already be disappointed by this gift guide. Why? “Because the only thing we really want is the ability to use PowerShell for logon scripts, but there’s no way that the Scripting Guys can give us that. Is there?” No, we’re sorry, there isn’t. The truth is, the Scripting Guys can’t give you the ability to use PowerShell for logon scripts.

But that’s OK, because the good folks at Special Operations Software can.

Specops Command

While in Barcelona for TechEd IT Forum, the Scripting Guys got to see a private demo of Specops Command, a revolutionary product that combines the management power of Windows PowerShell with the delivery infrastructure of Group Policy. Admittedly, that might sound like something a marketing team would write. A product that combines the management power of Windows PowerShell with the delivery infrastructure of Group Policy? Now that sounds exciting.

Trust us, though: it is exciting. Even better, take it from PowerShell architect Jeffrey Snover. Upon seeing Specops Command Jeffrey remarked, “When I finally understood what they were doing, the top of my head exploded." Specops Command is that cool.

Note. As far as we know, Jeffrey was just being colorful when he said the top of his head exploded. Although he does seem to wear hats a lot more often than he used to ….

So what does it mean to combine the management power of Windows PowerShell and the delivery infrastructure of Group Policy? Well, for one thing, that means you can run Windows PowerShell scripts as logon scripts. With Specops Command it becomes a cinch to deploy and target logon scripts, something that isn’t true when it comes to deploying and targeting logon scripts using Group Policy alone. And, again, we mean that you write .PS1 scripts using Windows PowerShell and then run them as actual logon or logoff (or startup or shutdown) scripts, no tricks involved.

Note. What if you aren’t quite ready to make the switch to PowerShell? No problem; Specops Command can also deliver VBScript scripts for you.

Now, we know what you’re thinking. You’re thinking, “That’s great, except I don’t have Windows PowerShell installed on any of my client machines. I’m sure this Specops thing is pretty cool, but I don’t want to have to install PowerShell a few hundred times just so I can run PowerShell logon scripts.”

Listen, we understand; nobody wants to install PowerShell a few hundred times. Well, nobody other than Specops Command. You say that Windows PowerShell isn’t installed on some of your computers? No problem; Specops Command will detect that PowerShell is missing and will install the software for you. And, just for the heck of it, it will also make sure that any required snapins or providers get installed as well. Want to know a secret? Even if you never run a single logon script Specops Command is worth is just as a way to install and update Windows PowerShell on all your machines.

Did we just hear the top of your head rumbling? Well, no wonder, especially when you consider the fact that Specops Command gives you amazingly fine-grained control over the days, and times, that scripts will run on all the targeted machines. That’s right, you aren’t limited to logon/logoff scripts; you can run a script – on all your machines – any time you want. Want to run a script every time Group Policy refreshes? No problem. Want to run a script every Saturday morning at 2:00 AM? No problem. Want to run a script each day, but only between 12:00 noon and 1:00 PM? No problem. As you can see the possibilities might not be endless, but they’re pretty darn close:

Here’s another cool feature for you. Suppose you have a script (and a GPO) targeted towards a particular security group; that means that user Ken Myer, who’s a member of that group, is affected by that GPO and its accompanying script. Now suppose Ken Myer is removed from that group. Specops Command enables you to create an “undo script” that will execute the moment Ken is removed from the group, a script that might undo any settings (registry keys, drive mappings, etc.) that were in force when Ken was a member of the group. Think about that for a moment.

Good point; maybe you shouldn’t think too hard about that. After all, if everyone gets too excited and the top of everyone’s head explodes, well, put it this way: we don’t have anywhere near enough hats to go around.

To make a long story short, Specops Command is simply an incredible piece of software. And here’s the best part: you can get most of the functionality of Specops Command absolutely free. That’s right: absolutely free. Anyone can download a free version of Specops Command that runs PowerShell scripts as logon scripts; that installs PowerShell for you; that runs user scripts under elevated credentials. Oh, and that’s a free version you can install and use forever and ever; there’s no time limit or expiration date.

Note. So if the free version is that cool why would you want to actually buy a copy of Specops Command? Well, among other things, the full version offers the undo scripts we mentioned earlier; includes an incredibly rich reporting mechanism; and offers more finely-granular targeting of scripts. For details, and pricing (which varies depending on the number of seats purchased) contact Special Operations Software.

And since you asked, yes, you can manage Specops Command using Windows PowerShell; the software ships with several cmdlets designed to do that very thing. For example, this command removes all the script assignments from a GPO named Script Center:

Remove-ScriptAssignment -Name * -GPOName 'Script Center'

Very cool, huh? Have a hard-to-please Windows PowerShell user on your gift list? They’ll be very pleased with Specops Command.

Next: Script Editors