Using Chocolatey to install your favorite software

This is a follow-up to one of my previous posts:

Chocolatey is like a package manager, but for Windows; a bit like the famous `apt-get` or `aptitude` for some GNU/Linux distros (...) I have created a curated list of my favorite ones; the ones I would install right away on a new computer, whether it is for work or even for home computing.

Therefore, to run any of the commands listed below, you will first need to install Chocolatey itself, which can be easily done with a simple command, so make sure you first check this post:

Install both Chocolatey and OpenSSH with SSHD in one Copy-Paste in Powershell

---

SUBSEQUENT CALLS

---

After completion, you may invoke commands such as:


# there were problems with former 'linkshellextension' installation
# and there was a bit of an overhead when issuing the commands...
#   choco install -y vcredist2015
#   choco install -y --ignore-checksums linkshellextension
# but it seems to work fine now.


choco install -y linkshellextension

choco install -y 7zip
choco install -y imagemagick
choco install -y git --version 2.21.0

choco install -y openvpn

choco install -y keepass

choco install -y notepadplusplus

choco install -y firefox

choco install -y googlechrome

choco install -y cherrytree --version 0.38.8
choco install -y guidgen-console
choco install -y lightshot
choco install -y synctrayzor

choco install -y winmerge

# java runtime environment
choco install -y jre8

# autoit minimum version: 3.3.8.1
# (autoit 3.3.6.1 not available via chocolatey)
choco install -y autoit --version 3.3.14.5

# scite4autoit3 minimum version: 3.5.4
# (scite4autoit3 3.2.0 not available via chocolatey)
choco install -y scite4autoit3 --version 19.102.1901.001

---

UNUSED

---

# git-lfs is already included in the main Git installer
# (this is true as of early 2019)
choco install -y git-lfs

# syncthing is already part of synctrayzor
choco install -y syncthing

# veracrypt competes with BitLocker on Windows, which works fine

choco install -y veracrypt

# As of May 2019, git-credential-manager-for-windows
# does not seem to be automatically added to the path!
# However this might not be a big deal since it seems
# to have been included into the main Git installer.
choco install -y git-credential-manager-for-windows

# the winbtrfs driver does not work for me
# (but that has nothing to do with Chocolatey)

# I might give it another try at some point though...
choco install -y winbtrfs

---

DEFECTS

---

# As of 2019-05-10, choco installs older v18.2.1 of smartgit,
# which causes problems because we are forced to upgrade as
# soon as it is installed
choco install -y smartgit

---

OTHER COMMANDS: "CHOCO SEARCH"

---

If you want to check if an application is included to the Chocolatey distribution service, or if you want to know its exact name, you may use the "choco search" command.

---

OTHER COMMANDS: "CINST"

---

An even faster way to call for an installation of a piece of software is to use "cinst" instead of "choco install".

Also, according to the help instructions, it should be possible to specify multiple application after the "choco install/cinst" command.

So we can therefore condense the previous list of calls into on single command (although I wrote on multiple lines and escaped using the backtick character, we should be able to copy-paste it just like that):

Optional:

choco feature enable -n allowGlobalConfirmation;

Default base install v2.0.2010.0:

cinst -y linkshellextension; ` cinst -y notepadplusplus; ` cinst -y winmerge; `  cinst -y 7zip; ` cinst -y git; `  ` cinst -y tightvnc; ` cinst -y openvpn; `  ` cinst -y firefox; `  cinst -y googlechrome; `  ` cinst -y jre8; ` cinst -y --version 3.3.14.5 autoit; ` cinst -y --version 19.102.1901.001 scite4autoit3

REMARK #1: Some (generic) lists may include an install instruction multiple times, usually at the beginning or the end of the script, this is on purpose. Lists like this can have multiple purposes and can be partially copy-pasted if we're only interested in a subset of the list. And running the same install request multiple time will only cause it to be ignored (unless the "--force" parameter was used, which is not the case).

REMARK #2: Also some pieces of software require very specific configuration, such as a VNC server, and we're better off running them separately, or at the very beginning and letting the rest of the automated install to carry on...

- tightvnc


REMARK #3: Some software may not be suitable for being installed on the system disk if it deals with data located on an independent disk of a virtual machine, in which case it's advised to use a portable application which you would install manually:

- synctrayzor

REMARK #4: I personally use my favorite (and most important) software in the form of portable programs, which I update myself, in which case it has to be removed from the default list:

- notepadplusplus, keepass, firefox

Other, ready to paste, multi-line commands such as the one above, can be found at this address:

Choco-based unassisted install

Install both Chocolatey and OpenSSH with SSHD in one Copy-Paste in Powershell

---

TL;DR

---

Start a PowerShell console with Administrator privileges and run the following :

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {[bool]1}; set-executionpolicy RemoteSigned -Force -EA 'SilentlyContinue'; iex ((new-object net.webclient).DownloadString('https://gist.githubusercontent.com/deskobj/f135af9b5404c594ee041c1688bc6f0a/raw'))

After the command has exited, we can expect the following to be true:

• CHOCO command available by default via PATH environment variable.
• SSH command available by default via PATH environment variable.
• SSHD service is running.

---

HISTORY OF THE ONE-LINER COMMAND
AND ITS BACK-END SCRIPT

---

The original command (from DarwinJS/ChocoPackages) reads as follows:

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {[bool]1};set-executionpolicy RemoteSigned -Force -EA 'SilentlyContinue';iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/DarwinJS/ChocoPackages/master/openssh/InstallChoco_and_win32-openssh_with_server.ps1'))

Additionally:

• JUL 26, 2018: Despite the recommendation "Not To", a cached (and modified) version of the script is made available.

• AUG 28, 2018: Enforced TLS 1.2 security protocol use.

• MAY 05, 2019: Added information about how to install Chocolatey on its own, using just a command line.

---

WHAT ABOUT INSTALLING CHOCOLATEY ONLY ?
(WITHOUT THE SSHD SERVICE)

---

To simply install Chocolatey, without SSH support, run the following PowerShell command, as Administrator:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; set-executionpolicy RemoteSigned -Force -EA 'SilentlyContinue'; iex ((new-object net.webclient).DownloadString('https://chocolatey.org/install.ps1'))

If you wish to install SSH later, you can still run the original command even if Chocolatey is already installed (the Choco installation step will just be skipped).

---

PREVENT SYSTEMATIC CONFIRMATIONS
(WHEN YOU KNOW WHAT YOU ARE DOING)

---

Chocolatey always asks if you are sure about installing a piece of software.

One way to address this problem is to always specify the `-y` switch when invoking `choco install`. For instance:

• `choco install -y git`,
• or the even shorter version being `cinst -y git`

But you can also disable this behavior altogether, on a global scale, forever, by running the following command:

choco feature enable -n allowGlobalConfirmation

It's probably a dangerous thing to set up, but it's really nice when you are familiar with the tool and use it repeatedly.

---

MORE SOFTWARE INSTALL SUGGESTIONS

---

Chocolatey is like a package manager, but for Windows; a bit like the famous `apt-get` or `aptitude` for some GNU/Linux distros (`dpkg` for Debian, `yum` for Fedora/RHEL/CentOS or `dnf` for RPM-based distros in general, `yast2` or `zypper` for OpenSuse, `emerge` for Gentoo, `pacman` for Arch). So it allows you to install software easily and effortlessly and the catalog of supported installs is growing.

I have created a curated list of my favorite ones; the ones I would install right away on a new computer, whether it is for work or even for home computing.

Read more:

Chocolatey software installation

Other, ready to paste, multi-line commands such as the one above, can be found on this page:

Choco-based unassisted install

The (default) generated homestead VM does not have an IPv4 address and how to fix this

When I first went on installing a Homestead VM, it did not get an IPv4 address. And there was nothing that indicated a failure:

• neither when the VM is booting (no errors, all appears "OK")

• using the "ifconfig" command, we can see that our adapters do not have an IPv4 address (whereas we were expecting 192.168.10.10 to be used)

• the “lspci” command allows us to see what devices are used. We can see the Ethernet controllers there.

tl;dr

I have written a much longer article about the analysis of the problem and all the possibilities offered by Virtual Box in terms of virtual ethernet adapters, and how to configure the Vagrant NIC Types, and you can read it here:

https://p19z.blogspot.com/p/
homestead-vm-does-not-have-ipv4-address.html

But a long story short:

Finally

Configuring the adapter type through the Vagrant file did not work as it created a third adapter and was ineffective.


But changing manually the NIC adapters in the VirtualBox VM setting and using Paravirtualized network adapter (virtio-net) finally gave the best results

Cloning a Windows VM that is part of a domain using Sysprep.exe

Introduction note

In the writing below, the term "SID" most of the time refers to the "Computer's Domain SID" (the SID of the computer accounts in the Domain). Windows OS also uses local SID(s) but those are meant to be harmless. For more information please read this excellent article from Mark Russinovich (cofunder of Sysinternals and writer of the NewSID tool) : http://blogs.technet.com/b/markrussinovich/archive/2009/11/03/3291024.aspx.

1. Using sysprep to change the SID

Cloning a VM that is part of a domain in order to use it simultaneously along with the original one is hard: on top of changing 1/ the MAC address, 2/ the computer name and 3/ the IP, we always run into mysterious problems when faced with the domain controller.

And there is even worst: the same goes for (some) backups. For instance, I recently backed-up (ie. copied) a VM and upgraded it to Service Pack 3. After the system was upgraded, I switched the VM off and turned the backup on: the domain rejected the old version of the VM. I assume that the controller stored the upgraded system type and refused to grant access to the domain when running an older XP SP2 system. Needless to say, this backup is quite useless :(

So, cloning a VM creates conflicts difficult to solve. Even if it has been taken off the domain prior to duplication! My network administrator pointed out that this is caused by the SID of the machines, but we never really knew what the solution was in order to work around this problem (from a user point of view, not from the network admin point of view). Now, I just found a possible solution in the Xen documents. The tool mentionned below (sysprep) is not specific to Xen, but to Microsoft. (Source: http://xen.org/files/XenCloud/guest.pdf, Chapter "Preparing to clone a Windows VM".)

Computers running Windows operating systems are uniquely identified by a Security ID
(SID). When cloning a Windows VM, it is important to take steps to ensure the uniqueness
of the SID. Cloning an installation without taking the recommended system preparation
steps can lead to duplicate SIDs and other problems. Because the SID identifies the computer
or domain as well as the user, it is critical that it is unique. Refer to the Microsoft
KnowledgeBase article 162001, "Do not disk duplicate installed versions of Windows," for
more information.
sysprep modifies the local computer SID to make it unique to each computer. The sysprep
binaries are on the Windows product CDs in the \support\tools\deploy.cab file.

And, more specifically, the process being:

5. Copy the contents of \support\tools\deploy.cab from the Windows product CD
to a new \sysprep folder in the VM.
6. Run sysprep. This will shut down the VM when it completes.

7. Convert the VM into a template.
8. Clone the newly created template into new VMs as required.
9. When the cloned VM starts, it will get a new SID and name, run a mini-setup to prompt
for configuration values as necessary, and finally restart, before being available for use.

And this important remark:

The original, sysprepped VM (the "source" VM) should not be restarted again after the
sysprep stage, and should be converted to a template immediately afterwards to prevent
this. If the source VM is restarted, sysprep must be run on it again before it can be safely
used to make additional clones.
For more information on using sysprep, refer to the Microsoft TechNet page "Windows System Preparation Tool".

So, in short, two points to be remembered:

1/ running sysprep destroys the SID and shuts the VM down

2/ a new SID is created when the VM is turned back on and added to the domain.

2. Operating systems supported

2.a) XP and Server 2003

sysprep.exe has to be installed separately.

There is a great article that explains how to create a template machine that will also prompt for a new name on next start: http://capitalhead.com/articles/force-sysprep-to-prompt-for-a-computer-name-during-mini-setup-in-windows-xp.aspx

I strongly recommend duplicating the VM before deleting the SID (for backup purpose of course!).

2.b) Windows 7 Professional and Server 2008 R2

I can confirm that sysprep is already present in the C:\Windows\System32\sysprep directory. Note that you have to run Explorer with Administrator privileges in order to see those files (press Win+R and type "sysprep").

3. Template instantiation

Computer makers such as Dell or HP use sysprep.exe to configure the computers: this tool allows you to install and configure programs (or drivers) on a computer, to create local accounts, etc. and then delete the SID and therefore make the computer ready for first use. The template can be copied as many time as you want, but each copy will have to be activated separately, an IP will have to be set for each computer and the Name and Domain configured. And that is it. Every program installed before the SID deletion will remain on the computer. All the user accounts created will remain as well and so does the application data.

An other interesting thing with this process, is that if you had two accounts ( say MYCOMPUTER\Administrator and MYDOMAIN\UserLambda ), then those users will find their desktop just as it used to be before the machine became a template and was re-instantiated again.

But this may have drawbacks and here is an exemple of what NOT to do (yeah I did it, no big deal really, but it creates an overhead of work upon each instantiation): so for instance, 1/ installing LogMeIn Hamachi and creating an account and then 2/ deleting the SID and re-instantiating the VM multiple times is... well, stupid. Hamachi settings are not reset by sysprep.exe because this tool is not part of the system and it does not use the SID either. Therefore every new VM will attempt to use the same Hamachi account and this will cause conflicts. The only solution then is to uninstall and reinstall the Hamachi client on every new computer.

A good practice here would have been to install the Hamachi client before templatisation, but never switch it on (or at least not configure it). The user of each instantiated VM would then already have the program at hand and just would have to run it and create his account himself.

3. Conclusion

I've successfully used the sysprep tool on an server2008 r2 system and it worked great but I did not have such luck with my old XP SP2 system and I will leave it there.

At the end of the day, sysprepping your OS is not very straightforward, but this an irreplaceable process when you need to duplicate a virtual machine that is part of a domain.

Thank you for reading,