Mikey's Powershell Blog

Finding Installed Applications (Get-ItemProperty vs. Get-WMIObject)

noreply@blogger.com (Unknown) — Sat, 04 Feb 2023 16:44:00 +0000

Greetings everyone!

Forgive my absence. I am working on my AZ-900 certification and there is a lot to learn!

This week I was given a list of servers. I was tasked with getting all the applications installed on each of those servers. So, I donned my PowerShell battle armor and faced the challenge.

First, I used the following code:
get-itemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-object DisplayName, DisplayVersion, Publisher, InstallDate | FT -AutoSize

This did give me a list of applications that had an Uninstall registry entry. However, I know there were other programs that were not on the list. So, I decided to use the following code:
Get-WmiObject -Class Win32_Product | Select-object Name | FT -AutoSize

It did give me more applications than the get-itemProperty code, but it took a lot longer for the list to appear. The Get-itemProperty took 65 milliseconds. The Get-WmiObject took 1 minute 22 seconds.

One article said to use Get-CIMInstance instead of Get-WmiObject in order to get a quicker response. Get-CIMInstance took 1 minute and 37 seconds. Oh, well.

I am still looking for a reason why the itemProperty command runs faster than the WmiObject command. But, my main point is that there are two different ways to list what is installed on a computer, and that Get-WmiObject lists more installed apps than the other command.

As always, post a comment if you have any questions, or if you know why one is faster than the other. I would appreciate it. 😀

Until next time...

Reviewing the Fundamentals

noreply@blogger.com (Unknown) — Mon, 16 Jan 2023 22:00:00 +0000

Greetings everyone!

I haven't posted in a while due to the holidays, the flu, and taking some much needed time off. But, I am back and I want to talk about how, sometimes, revisiting the fundamentals is beneficial.

I downloaded Jeff Hicks' "The PowerShell Practice Primer" (https://leanpub.com/psprimer). For $29.95, it is well worth the spend. Why? Well, let me tell ya...

As you all know, I love PowerShell! It has saved me a lot of time and headache, especially when managing Active Directory. So, I want to keep my skills sharp and I thought Jeff's book would do that for me. The exercises in the book showed me that I often overthink a solution to a problem. For example, Exercise 11 asks you to get all of the 'get' commands in the PSReadLine module. This was something I didn't know how to do. After fumbling with some of the cmdlets, I looked at the solutions and found the following:
Get-Command -module PSReadLine -Verb get

Another example, I am used to putting output into a variable and then doing a ForEach loop to get the information I need. Exercise 19 asks to create an XML file for all processes running under my account name. My solution was:

$processes = get-process -IncludeUserName
$me_process = Foreach ($process in $processes)
{
If ($process.UserName -like "*me*")
{
$process.ProcessName;$process.UserName
}
}
$me_process | Export-Clixml C:\users\trekr\documents\exer19.xml

As you can see, I used a variable and a ForEach loop...not efficient what so ever.

The solution was much simpler:

Get-Process -IncludeUserName | where-object {$_.Username -eq "$($env:USERDOMAIN)\$($env:USERNAME)" } | Export-Clixml -Path myprocs.xml

Pipelines make things simpler. I had forgotten that.

We should be creating efficient code. Which is why I decided to practice my skills. I feel that people who script, no matter their experience, benefit from stepping back and examining their coding style. Any little change may be what is needed to improving their coding.

I would be interested in your opinion on this. So, please feel free to comment.

Until next time...

NOTE: Jeff Hicks gave me permission to use the examples from his book. He's a good guy.

Finding Mailbox With a Specific Proxy Address

noreply@blogger.com (Unknown) — Mon, 19 Dec 2022 15:16:00 +0000

Hello everyone!

I recently got a request to find a mailbox that is using a specific proxy address. I have been working for my company for over 3 years and I found it interesting we haven't been ask to do this sooner. It is requests like this that shows the usefulness of PowerShell.

The first script that was created just checked Active Directory for the proxy address:
Get-ADUser -Filter * -Properties proxyaddresses | Select -Object Name,@{L="ProxyAddresses";E={($_.ProxyAddresses -match '^smtp:')}} | fl

You will get the following output:

Since I believe in the concept of "complete work", I changed the script to search Exchange Online for the proxy addresses. Connect to MSOL and use the following:
Get-MSOLUser -all | Select-Object UserPrincipalName,,@{L="ProxyAddresses";E={($_.ProxyAddresses -match '^smtp:')}} | fl

This will give you the same output format as the first script.

For both scripts, you can substitute "-match '^smtp:'" for something more specific. For example, if you want to search for proxy addresses that start with "HR', you can change the script as follows:
Select-object Name,@{L="ProxyAddresses";E={($_.ProxyAddress -match '^smtp:hr*')}}I

As always, I hope you found this information useful. Please feel free to post a comment or question.

Until next time...

Pulling list of Azure servers

noreply@blogger.com (Unknown) — Sun, 11 Dec 2022 15:31:00 +0000

Greetings everyone!

Sorry for the delay but I had either a cold, the flu, or, possibly, the plague. But I am back with another terrific script from my good friend, Ross Jurek.

Ross created a script that will gather all Azure subscriptions, based on your Azure account, and list the virtual machines for each subscription. The following information is retrieved:
Name
OS
Location
The state of the VM

Here is the script:

Connect-AzAccount -Verbose -Tenant <your tenant ID>

$VMReport = @()
#Get All Subscriptions
$subs = Get-AzSubscription
#Arry to store list of VMs
$vmobjs = @()
#loop through each subscription

foreach ($sub in $subs)
{
#Display the current processing subscription
Write-Host "Processing subscription $($sub.Name)"
try
{
#Select the subscription
#please add the condition if you want to skip a particular subscription
Select-AzSubscription -SubscriptionId $sub.SubscriptionId -ErrorAction Continue

#Get all the VMs information
$vms = Get-AzVm

#loop through all the VMs
foreach ($vm in $vms)
{
$PowerState = Get-AzVM -Name $vm.Name -Status | select-object PowerState
$vm.Name , $vm.StorageProfile.OsDisk.OsType , $vm.Location , $PowerState.PowerState
$VMReport += New-Object psobject -Property @{
"VMName" = $vm.Name
"VMOSType" = $vm.StorageProfile.OsDisk.OsType
"VMLocation" = $vm.Location
"VMState" = $PowerState.PowerState
}
}
}
catch
{
Write-Host $error[0]
}

}

#export to csv format
Remove-Item c:\temp\AzureServerList.csv -ErrorAction Ignore
$VMReport | Export-Csv "c:\temp\AzureServerList.csv"

Disconnect-AzAccount

I have a Virtual Studio subscription and I didn't want that information to be part of the output. I made the following change to the $subs = Get-AzSubscription command
$subs = Get-AzSubscription | where-object { $_.Name -like "My Cloud*"}

I had an issue when I first tried the script. I kept getting the following message for each VM:
WARNING: There are more than 100 VMs in the result. Only the statuses of 100 VMs are shown to avoid throttling. To get the actual status of each VM, please provide a VM name with -Status parameter.

I talked with Ross about this and he recommended I either install or upgrade my Az module. So, if you get the error, try either of the following:
install-module -name Az -RequiredVersion 9.1.1
update-module -name Az -RequiredVersion 9.1.1

Again, I want to thank Ross Jurek for sharing this code with us.

Please leave a comment if you have any questions feedback.

Until next time...

Update on the MIM Script from Last Post

noreply@blogger.com (Unknown) — Sun, 27 Nov 2022 23:47:00 +0000

On PowerShell Power Users LinkedIn group, Tim Clapper posted a way to speed up the main script. Here two snippets from the the script I posted:

$results = get-aduser -filter * -properties * | where-object {$_.givenName -eq $FirstName -and $_.sn -like $tempLastName} | select-object givenname,sn | Measure-object

While ($results.count -eq 1)

#this checks if there is an account with the first name and last name. If $results.count is zero, the while loop is exited.

{

$tempLastName = $LastName + $counter

#This command now looks for a first name and last name+counter.

$results = get-aduser -filter * -properties * | where-object {$_.givenName -eq $FirstName -and $_.sn -like $tempLastName} | select-object givenName,sn | measure-object

$counter++

}

Tim recommended I make the following changes to speed up the script:
1. Instead of using the where-object statement, move the conditions to the -filter switch
2. Instead of using 'sn', use 'surname'

The changes would look like the following:

$results = get-aduser -filter(givenName -eq $FirstName -and surname -like $tempLastName) | select-object givenName,surname | measure-object

Within the While loop

While ($results.count -eq 1)

#this checks if there is an account with the first name and last name. If $results.count is zero, the while loop is exited.

{

$tempLastName = $LastName + $counter

#This command now looks for a first name and last name+counter.

$results = get-aduser -filter(givenName -eq $FirstName -and surname -like $tempLastName) | select-object givenName,surname | measure-object

$counter++

}

I've tested the code and it does run faster since the code isn't searching all of Active Directory with the Where-Object command.

Test the change for yourself and let me know what you think. You can find the full code and MIM activity screen shot at https://github.com/mikeegan400/MIM-Test-for-Unique-First-and-Last-Name

A huge thank you to Tim Clapper. He is one of the many PowerShell fans in the LinkedIn PowerShell group. I highly recommend you join!

Until next time...

Triumphant Return and a MIM Script

noreply@blogger.com (Unknown) — Mon, 21 Nov 2022 13:46:00 +0000

I'M BACK!! It has been way too long but I am back.

I will be posting more scripts that we create and use in the company I work for. They will be mostly GET- scripts against Active Directory, as well as the PowerShell commands we use in our Microsoft Identity Management (MIM) environment.

So, let's get started with a MIM script that we use to look for unique first name and last name within the MIM portal.

As you may or may not know, the MIM portal has PowerShell version 2.0 embedded in the portal. In order to use the get-ADuser, you need to be running PowerShell version 3.0. I was able to find a workaround so that the main script can be executed using PowerShell 3.0.

I created two scripts, the main scripts and the script that runs inside the activity.

This is the code that is running within the PowerShell activity:

As you can see, the command that starts with $templastname runs the PowerShell command but it runs it under version 3.0. This was how I was able to work around the PowerShell 2.0 limit within the MIM portal.

PARAM(

[parameter(mandatory=$true)]$FirstName

,[parameter(mandatory=$true)]$LastName

)

$tempLastName = powershell -version 3.0 -command "c:\scripts\test_unique_lastname.ps1 $firstName $lastname"

$tempLastName

This is the main script.

#This makes the variables available to the script.

PARAM(

[parameter(mandatory=$true)]$FirstName

,[parameter(mandatory=$true)]$LastName

)

#This loads the module in case it isn’t already loaded

import-module activedirectory

#This sets the counter for

[int]$counter = 2

$tempLastName = $LastName

#This command looks for an account that contains the first name and last name similar to what was entered in the portal

$results = get-aduser -filter * -properties * | where-object {$_.givenName -eq $FirstName -and $_.sn -like $tempLastName} | select-object givenname,sn | Measure-object

While ($results.count -eq 1)

#this checks if there is an account with the first name and last name. If $results.count is zero, the while loop is exited.

{

$tempLastName = $LastName + $counter

#This command now looks for a first name and last name+counter.

$results = get-aduser -filter * -properties * | where-object {$_.givenName -eq $FirstName -and $_.sn -like $tempLastName} | select-object givenName,sn | measure-object

$counter++

}

#This value is returned to the PowerShell activity in the portal
$tempLastName

The scripts and the screenshots of the PowerShell activity are available in my GitHub account, https://github.com/mikeegan400/MIM-Test-for-Unique-First-and-Last-Name. Please feel free to contact me if you have any questions or comments.

Long time, no see

noreply@blogger.com (Unknown) — Mon, 17 Oct 2022 15:12:00 +0000

I have been doing a lot of PowerShell scripting in my current job. The best part is that most of the team are PowerShell enthusiasts. So, I am getting a lot of ideas and suggestions for new scripts...which I will share with you folks.

My plan is to post one day a week. The topics will vary from cool scripts to resources to helpful tips.

I am excited to get back to this blog. I hope you will all find it helpful.

Until next time,
Mike

Monitor Changes in a Folder

noreply@blogger.com (Unknown) — Tue, 11 Jun 2019 13:14:00 +0000

I receive a daily email from Powershell.com (www.powershell.com). When I saw this script I said to myself, "There were times I really could have used this.". Particularly when I wanted to know what files were affected when running an update. I saved this file as Run-fileWatcher.ps1:

In this example, I created a folder called Test_Folder

# Change the $folder variable to the folder you want to monitor

$folder = "C:\Test_Folder"
$filter = '*' # looks for all changes

try
{
   $fsw = New-Object System.IO.FileSystemWatcher $folder , $filter -ErrorAction Stop # the FileSystemWatcher component watches for changes in the LastWrite and LastAccess properties of a file.
}

catch [System.ArgumentException] # checks for errors
{
   Write-Warning "Oops: $_"
   return
}

$fsw.IncludeSubdirectories = $true
$fsw.NotifyFilter = [IO.NotifyFilters]'FileName, LastWrite'

do
{
   $result = $fsw.WaitForChanged([ System.IO.WatcherChangeTypes]::All, 1000)
   if ($result.TimedOut) { continue }

   $result

   Write-Host "Change in $($result.Name) - $( $result.ChangeType)"

} while ($true)

While the script was running, I created a file called Test.txt. Inside the file, I entered "This is a test." I saved the file to c:\test_folder, and the output was:

When I deleted the file, the output was:

It should be possible to write the output to a file, but I haven't tested that yet. I will put that on my list, as well as adding modification time and date.

I hope you found this helpful. Again, go to www.powershell.com and sign up for their email. Some of their scripts I use regularly.

Later,
Mike E

Finding Items in Group Policies

noreply@blogger.com (Unknown) — Tue, 04 Jun 2019 12:48:00 +0000

I have had occasion to look for specific information within a client's group policies. In particular, what drives are being mapped for a group of users. This client a quite a few organizational units (OUs) and, thus, quite a few groups policies (GPOs). To simplify this process, I looked for a Powershell solution to help me. This is what I found:

Param

(

# This section is the -StringToFind parameter

[Parameter(Mandatory=$true,

ValueFromPipelineByPropertyName=$true,

Position=0)]

[String]

$StringToFind

)

Begin

{

$GPOsToCheck = get-gpo -all |Sort-Object -property displayname # gather all GPO information and sort by displayname

Write-Host " Checking through" $GPOsToCheck.count "GPO's"

}

Process

{

$ListOFAffectedGPOs = @()

$count = 1

$GPOsToCheckCount = $GPOsToCheck.count

foreach ($item in $GPOsToCheck) # go through the list of group policies

{

$Result = Get-GPOReport -name $item.DisplayName -ReportType XML

if ($Result -match $StringToFind) # check if Result variable information matches the string

{

$ListOFAffectedGPOs += $item.DisplayName

}

else

{

}

Write-Host "$count of $GPOsToCheckCount"

$count++

}

Write-Host "List of GPO's that contain $StringToFind" -ForegroundColor Green

$ListOFAffectedGPOs

}

End

{

}

The syntax of the script is:
Get-GPOThatContains.ps1 -StringToFind password

Here is the output based on my home AD domain:

PS C:\scripts> .\Get-GPOsThatContain.ps1 -StringToFind password
Checking through 9 GPO's
1 of 9
2 of 9
3 of 9
4 of 9
5 of 9
6 of 9
7 of 9
8 of 9
9 of 9
List of GPO's that contain password
Default Domain Policy
testdest
TestSource
Windows 7 Screen Lock

The script finds all GPOs, evaluates each policy for the string to find (in this case 'password'), and lists the policies that have that string.

I have found this script very useful when we need to quickly find a GPO entry or when onboarding a new client.

I hope you have found this helpful. Please let me know if you have any questions.

Mike

Add Entry to Windows Event Logs

noreply@blogger.com (Unknown) — Sun, 26 May 2019 17:25:00 +0000

When I have created scripts, that are to used in Production, I put in code that will write events to a specific Event Log so, in the event of a failure, I can use my events as a starting point for resolving the issue.

Writing your own events is relatively easy. As an example, let's say I have a process that should be running 24x7. The first thing to do is to look for the process:
$process = get-process MyProcess -ErrorAction SilentlyContinue
The '-ErrorAction SilentlyContinue' is needed because the get-process code would fail if the process isn't running.

The next step is to make the appropriate event log available to add events:
New-EventLog -LogName Application -Source "My Process Code"
The 'Log-Name' parameter needs to have the correct event log. In this example, we want to add the events to the Application log
The '-Source' parameter is used to give name/label to the event.

At this point, we have the following code for the script:
$process = get-process MyProcess -ErrorAction SilentlyContinue
New-EventLog - LogName Application -Source "My Process Code"

Now that we have information about the process, and have the event log ready, we need to evaluate the $process variable. First, let's check to see if the $process was running:
if($process) {
     Write-EventLog -LogName Application -Source "My Process Code" -EntryType                             information -EventID 3000 -Message "My Process is running"
}
This line of code states that IF $process is true (because there is information in the variable), then write a event into the Application log, the source is My Process Code, the entry type is Information, give the event ID as 3000, and the message is the process is running.

Now, what if $process is empty, meaning the process was not running? We add and Else statement to handle this situation:
Else {
      Write-EventLog -LogName Application -Source "My Process Code" -EntryType Error -EventID 3001 Message "My Process is not running"
}
As you can see, only change we made were the entry type, the event ID, and the message.

In my scripts, I will add a line, in the Else code, that restarts the process. So, it would look like this:

Else {
      Write-EventLog -LogName Application -Source "My Process Code" -EntryType Error -EventID 3001 Message "My Process is not running"
      Invoke-expression "C:\Applications\MyProcess.exe"
}

Here is what the complete script will look like:
$process = get-process MyProcess -ErrorAction SilentlyContinue
New-EventLog - LogName Application -Source "My Process Code"

if($process) {

     Write-EventLog -LogName Application -Source "My Process Code" -EntryType                             information -EventID 3000 -Message "My Process is running"

}

Else {
      Write-EventLog -LogName Application -Source "My Process Code" -EntryType Error -EventID 3001 Message "My Process is not running"
      Invoke-expression "C:\Applications\MyProcess.exe"
}
I hope you find this article helpful. Please feel free to contact me if you have any questions.

Mike

I'm coming back

noreply@blogger.com (Unknown) — Wed, 22 May 2019 16:03:00 +0000

Greetings everyone!

After a lengthy hiatus, I will be coming back with some cool scripts I have been using over the last 14 months.

So, stay tuned!

Mike

BREAKING NEWS: Powershell isn't always the answer

noreply@blogger.com (Unknown) — Sun, 13 May 2018 22:56:00 +0000

Greetings!

It is hard for me to say that Powershell isn't the end all, be all for automation. But, at times, the simplest solution is the best. In this case it was stopping and starting custom applications.

We have a server that needs to run two custom applications. We will call these App1 and App2. These applications have to be running in the foreground. The first script stopped the applications by using a .bat file that contained the following code:
TASKKILL /IM App1.exe /F
TASKKILL /IM App2.exe /F

The script to start the applications contained the following code:
START C:\app1.exe
START C:\app2.exe

We were using Task Scheduler to run the scripts every morning at 4:00am. When the tasks ran, the apps would stop but the apps wouldn't start in the foreground.

At first we thought we could create a Powershell script to get the applications to run in the foreground. Unfortunately, we had the same problem when we created a scheduled task to run the Powershell script.

As we were trying to figure out why this was happening, our boss, Amos, came into the room and asked if he could take a look at the scheduled task. After a minute he said, "I found the problem. You have to use Run only when user is logged on. This setting will start the applications in the foreground. Using Run whether user is logged on or not will force the applications to start in the background." We made the changes and the applications started correctly.

So, we learned that it is necessary to know how to use the tools that will run your scripts.

I hope you find this useful.

Mike

Web Site Restart

noreply@blogger.com (Unknown) — Mon, 30 Apr 2018 13:28:00 +0000

Greetings,
We have had occasion to find a way to restart a web site when we get a notification that the site is unavailable. The restart process includes restarting the associated application pool (app pool) and the site itself. In PowerShell, this task is simple to accomplish. The code is as follows:

$wstate = Get-Website -Name 'Default Web Site'

$pstate = Get-IISAppPool -Name DefaultAppPool

if ($wstate.state -ne "Started") {

Restart-WebAppPool -Name DefaultAppPool

Start-Website -Name 'Default Web Site'

}

We will use the Default Web Site in this example. The first line ($wstate = Get-Website -Name 'Default Web Site'), gets all the information regarding the default web site, including its state (started, stopped). The second line ($pstate = Get-IISAppPool -Name DefaultAppPool ) gets the information regarding the app pool for the default web site.

Within the IF statement, if the state of the website ($wstate) is not 'Started' then the app pool is restarted (Restart-WebAppPool) and the web site is started (Start-Website).

To verify the site has started you can add the following commands to start a browser and browse to the site:
$url = 'http://<your web site>'

$ie.Visible = $true

$ie = new-object -ComObject internetexplorer.application

$ie.Navigate($url)

I hope this information is helpful.

Mike

When did these Pings run?

noreply@blogger.com (Unknown) — Mon, 23 Apr 2018 12:17:00 +0000

Greetings.

Took a little break from the blog. I'm back and I have a script I created for my colleague, Tom.

Tom called me and wanted to know if there was a way to get time stamps when pinging a server. To clarify, show a time stamp for each return value from the ping. In addition, the script should run like the Ping -t command and dump the output into a text file.

I researched how to ping within Powershell and found that the Test-Connection cmdlet will do what Tom has requested. I started by creating a variable that will be used by the While loop

$i = 1

Then, we create the While loop
While ($i = 1){

}
This will run the commands within the loop until $i is something other than 1.

Now, we create the body of the script. We will run the script against Google (www.google.com)

test-connection www.google.com | select @{N='Time';E={[dateTime}::Now}},@{N='Destination';E={$_.address}},replysize,@{N='Time(ms)';E={$_.Responsetime}} | export-csv -append c:\ping.txt

In the 'select' statement:
@{N='Time';E={[dateTime]::Now}}....This will create a column called 'Time' and this column will hold information from the [dateTime]::Now expression

@{N='Destination';E={$_.address}}...this will create a column called 'Destination' containing the information in the $_.address field

replysize...this is the size of the reply pack in Bytes

@{N='Time(ms)';E={$_.ResponseTime}}...this will create a column called 'Time(ms)' containing the information in the $_.ResponseTime field

The last part of the statement will send the output to a file called Ping.txt in a comma-separated value (CSV) format

In the end, the script will look like this:

$i = 1

While ($i = 1) {

test-connection www.google.com | select @{N='Time';E={[dateTime]::Now}},@{N='Destination';E={$_.address}},replysize,@{N='Time(ms)'; E={$_.ResponseTime}} | export-csv -append c:\ping.txt

}

Some of you may be saying, "There isn't any code that changes $i to something other than 1." And you would be correct. This script will run until you manually stop the script, in most cases by using CTRL-C.

The output of the script will look like this:

I hope you find this script helpful. Be sure to comment if you have any questions.

Mike

Remoting into Workgroup PCs and a Book Recommendation

noreply@blogger.com (Unknown) — Mon, 09 Apr 2018 10:37:00 +0000

Greetings!

While trying to connect to a workstation on our network I discovered the workstation wasn't on our AD domain but was configured for WORKGROUP. That got me thinking, "Can I access WORKGROUP machines via Powershell?". And, by golly, you can. Here's how:

Prerequisite work (this needs to be done on each PC you want to access):
Make sure the workstations are within the same IP and subnet mask range

Open your firewall settings
On the left panel, select "Allow an app or feature through Firewall"
Click on "Change Settings". This will give you access to the apps and features in the list.
Scroll down and select Windows Management Instrumentation (WMI).
Click on the Private box
Scroll down and select Windows Remote Management
Click on the Private box
Click on OK
Close the Firewall window

Configuring Powershell:
Open Powershell with elevated privileges
At the prompt, type:
new-itemproperty -path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -name LocalAccountTokenFilterPolicy -propertytype DWord -value 1
NOTE: the LocalAccountTokenFilterPolicy setting sets how admin credentials are applied to a
remote computer. A value of 1 is what is used to build the evaluated token
At this point you should be able to create a PSSession to your computer by typing:
enter-pssession localhost
You should see a prompt similar to [localhost]: PS C:\Users.
Type exit-pssession to exit out of the session

If all of the above tasks work on both computers, you should be able to create a session from one computer to another. For example, I have two test workstations, 192.168.100.5 and 192.168.100.6. In order for me to create a session from 100.5 to 100.6, I will do the following:
On 100.5
enter-pssession -computername 192.168.100.6
The prompt will look list [192.168.100.6]: PS C:\users

From here I can start and stop services/processes. I can create files and directories. I will be looking for a way to copy files from a session to the host.

Again, to disconnect the session, type exit-possession

I know this seems like a lot of steps just to allow PSRemoting to WORKGROUP computers. But I know there are still some environments where they have non-domain computers. Why should they be deprived of experiencing Powershell's greatness?

Now, my book recommendation.
I don't do book reviews as well as I should. But, Don Jones' new book, "Be The Master", is worth reading. The main theme of the book is that we all have something to share/teach others. Mr. Jones uses the analogy of the master and apprentice. The master would share all of their knowledge with the apprentice, sometimes at the cost to the apprentice. This allows for a craft/talent to move on (and sometimes is improved upon) to future generations. What I got out of this book is that there are people out there who want to know things that I know. That is why I post stuff to this blog. I love Powershell and I want to share some of the things I have found.

It's a quick ready (about 105 pages) and is available via Amazon at $8.

Well that's what I have for this week. I hope you found both items helpful.

Mike

My Process Stopped Processing

noreply@blogger.com (Unknown) — Mon, 02 Apr 2018 18:32:00 +0000

Greetings,
Last week I was tasked to create a Powershell script that detects the status of a process running on a Windows 10 computer. If the process wasn't running, the script had to start the process. If the process is in a 'suspended' state, the script had to stop and restart the process. If the process was running, the script display a message.

Detecting the status of the process is relatively simple to do. The first thing you want to do is store the process information in a variable. We will call the variable $process:

$process = get-process myprocess -ErrorAction SilentlyContinue

It is necessary to add the -ErrorAction SilentlyContinue in order to get an empty variable if the process is not running.

Once we have the status of the process, you will have to check if the process is running. To do that we will using an IF statement:

if ($process)
     {

     }
else
     {
        invoke-expression "c:\processes\myprocess.exe"
     }

If there is something in the $process variable, then we will check the status of the running process. If the variable is empty, then we will start the process using invoke-expression (I will explain this later in the article.

So, if $process is not empty, the next step is to determine if the process is responding. One of the attributes of $process is .Responding. Within the brackets under the IF statement, use the following commands:
{
     if ($process.Responding)
     {
       Write-Host "Process is running"
     }
     Else
     {
        Stop-Process -name myprocess -Force
        invoke-expression "c:\processes\myprocess.exe"
     }
}

This code checks the status of $process.Responding. It will either be True or False. If the process is responding, then a message is returned. If the process is not responding, the process is stopped by force, and the process is restarted.

The reason for using invoke-expression is because my process has a user interface that must be visible when it is running. I couldn't use start-process because the interface would not appear.

The entire script will like as follows:
$process = get-process myprocess -ErrorAction SilentlyContinue
if ($process)
     {
       if ($process.Responding)
        {
          Write-Host "Process is running"
       }
     else
        {
         Stop-Process -name myprocess -Force
          invoke-expression "c:\processes\myprocess.exe"
        }
     }
else
     {
        invoke-expression "c:\processes\myprocess.exe"
     }

I hope you find this script helpful. Be sure to add a comment if you have any questions, comments, or corrections.

What are these Execution Policies? And, how can they help me?

noreply@blogger.com (Unknown) — Mon, 26 Mar 2018 14:40:00 +0000

Greetings!

I have been writing scripts for a while but I haven't been too concerned about the scripts do since I'm only gathering information and not changing anything. Then, I started creating scripts that create and update Active Directory accounts. I want to make sure that the scripts don't create havoc within AD or any other part of the server. To do this I looked to Execution Policies.

Execution policies are used to set the rules for Powershell scripts on a server. These policies will help scripts from violating the rules. There are six different policies:

Restricted
     This policy is the default policy set when Powershell is activated.. With Restricted, you cannot run an entire script but can run individual commands. This policy also blocks the execution of module files (.psm1), configuration files (.ps1xml), and profile scripts (.ps1)

AllSigned
     This policy allows scripts to run on a server. However, all scripts and configuration files need to be signed by a trusted publisher, like Verisign. If you run a script that hasn't been classified as trusted or untrusted, you will be prompted for credentials. This is more secure but there can be bad scripts written that have been signed.

RemoteSigned
     This is the default policy in Windows Server 2012 R2. If you download a script from the Internet, you will need a digital signature from a trusted source. The benefit of RemoteSigned is that scripts created on local computers do not need a digital signature. Similar to AllSigned, dangerous scripts can still be signed.

Unrestricted
     Unsigned scripts can run (this can be dangerous). You will be warned when you start an unsigned script from the Internet.

Bypass
     This policy lets any script run and there are no warnings or prompts. Bypass is helpful if you are calling a script from a command line or from out of Task Scheduler. Do not use bypass when you are running an unverified script. Bad things can happen.

Personally, I try to never use Unrestructed, Unrestructed, or Bypass. However, you may find a need to use one of these settings. Just make sure you know risks of each one.

"Can you see if my account is locked out?"

noreply@blogger.com (Unknown) — Mon, 19 Mar 2018 15:32:00 +0000

Greetings!

Have you ever gotten a call or email or trouble ticket asking for help with a user whose AD account keeps getting locked out? At my current company, we had a rash of this happening. We found this occurred when people changed their Active Directory password. In these days of people being able to access work email or work Instant Messaging, it is important to make sure these folks are changing the passwords on their personal devices.

In some cases, we can look to the domain controllers to find out where the lock is occurring. I found this handy script from Mike F Robbins blog site (http://mikefrobbins.com/):

#Requires -Version 3.0

<#

.SYNOPSIS

Get-LockedOutUser.ps1 returns a list of users who were locked out in Active Directory.

.DESCRIPTION

Get-LockedOutUser.ps1 is an advanced script that returns a list of users who were locked out in Active Directory

by querying the event logs on the PDC emulator in the domain.

.PARAMETER UserName

The userid of the specific user you are looking for lockouts for. The default is all locked out users.

.PARAMETER StartTime

The datetime to start searching from. The default is all datetimes that exist in the event logs.

.EXAMPLE

Get-LockedOutUser.ps1

.EXAMPLE

Get-LockedOutUser.ps1 -UserName 'mikefrobbins'

.EXAMPLE

Get-LockedOutUser.ps1 -StartTime (Get-Date).AddDays(-1)

.EXAMPLE

Get-LockedOutUser.ps1 -UserName 'mikefrobbins' -StartTime (Get-Date).AddDays(-1)

#>
[CmdletBinding()]
param (
[ValidateNotNullOrEmpty()]
[string]$DomainName = $env:USERDOMAIN,
[ValidateNotNullOrEmpty()]
[string]$UserName = "*",
[ValidateNotNullOrEmpty()]
[datetime]$StartTime = (Get-Date).AddDays(-3)

)
Invoke-Command -ComputerName (
[System.DirectoryServices.ActiveDirectory.Domain]::GetDomain((
New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $DomainName))
).PdcRoleOwner.name

) {
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740;StartTime=$Using:StartTime} |
Where-Object {$_.Properties[0].Value -like "$Using:UserName"} |
Select-Object -Property TimeCreated,
@{Label='UserName';Expression={$_.Properties[0].Value}},
@{Label='ClientName';Expression={$_.Properties[1].Value}}
} -Credential (Get-Credential) |
Select-Object -Property TimeCreated, UserName, ClientName

When you run this script, you will be prompted for a user name and password. This user name must have access to the domain controllers.

.\Get-LockedOutUser.ps1 -UserName 'mike1'

Not only does this script look for individual accounts using the -UserName attribute but you can leave off all the parameters and you will get a list of all the accounts, on the domain, that are currently locked out.

.\Get-LockedOutUser.ps1

I want to thank Mike F Robbins for writing a terrific script that has helped me many time. I hope it can help you all, as well.

Mike

What Version of Windows Server Am I Using?

noreply@blogger.com (Unknown) — Mon, 12 Mar 2018 10:58:00 +0000

Greetings!

I have had occasions where I wanted to inventory all my servers and what version of Windows Server is running on those servers. Larger companies can use System Center Operations Manager (SCOM) to get that information. However System Center can be expensive and overkill for small to medium businesses.

In order to get the list I wanted, I used the following PowerShell script:
Import-Module ActiveDirectory

Get-ADComputer -Filter * -Properties OperatingSystem, OperatingSystemServicePack, OperatingSystemVersion | Where-Object {$_.OperatingSystem -like '*server*'} |

Select-Object -Property Name, OperatingSystem, OperatingSystemServicePack, OperatingSystemVersion

It is important to include the Import-Module command. If the command is missing the Get-ADComputer command will not work and you will get an error.

The output from the script will look like the following:

Name      OperatingSystem                    OperatingSystemServicePack           OperatingSystemVersion

-----     ---------------                    --------------------------            ----------------------

Server1   Windows Server 2008 R2 Enterprise   Service Pack 1                             6.1 (7601)

Server2   Windows Server 2008 R2 Enterprise   Service Pack 1                             6.1 (7601)

Server3   Windows Server 2008 R2 Enterprise   Service Pack 1                             6.1 (7601)

This script displays the ease of using Powershell. By using just a couple commands, you can pull the information you want.

I hope you find this script helpful. Good luck and happy scripting.

Mike

Powershell Notes For Professionals

noreply@blogger.com (Unknown) — Mon, 05 Mar 2018 12:28:00 +0000

Greetings!

As a person who really enjoys scripting in Powershell, I am always looking for resources that focus on Powershell. The other day I got an email from GoalKicker.com offering a free document called "PowerShell Notes for Professionals." This is a great reference that contains explanation and examples on everything from getting started with Powershell to how to use hashtables to signing scripts...and much more.

Also, GoalKicker has many such documents on different programming languages. Like I said this is a tremendous resources for the scripter/programmer. I highly recommend them.

That's what I have for this week. Have fun!

Mike

Why Isn't This Cmdlet Working?

noreply@blogger.com (Unknown) — Mon, 19 Feb 2018 13:01:00 +0000

Last week I was working on a script that creates a list of scheduled tasks on all of our remote servers. I wanted the script to create the list using Export-CSV. However, everything I ran the script I would get the error:
The term 'Export-CSV' is not recognized as the name of a cmdlet

Export-CSV is not recognized!? I have been using this for years!

I did some research and found out that some minor versions of Powershell Version 2 did not include Export-CSV. In order to correct this it was necessary to update the version of Powershell.

How can you check the version of Powershell? Use the following script to get the Powershell versions on all your servers:
$adServers = $()

$adServers += get-adcomputer -Filter * -Properties * -SearchBase "OU=Servers,DC=abc,DC=com" |Select-Object Name

foreach ($server in $adServers) {

Invoke-Command -ComputerName $server.Name -ScriptBlock { $PSVersionTable.PSVersion } | export-csv -append C:\PSVersionsbyServer.csv

}

Updating Powershell is very simple but will require a reboot. Go here to get the Powershell update. This is version 5 and called WMF 5. Be sure to following the prerequisites.

Again, the update will require a reboot.

Having to update the one server, so Export-CSV will work, brought up the need for my company to make sure all of our servers are running a consistent version of Powershell. If you have a lot of servers to update, make sure you have a solid plan and communicate the changes to your user base.

I hope this information was helpful. Good luck.

Script To Get Version of Powershell

noreply@blogger.com (Unknown) — Wed, 14 Feb 2018 19:22:00 +0000

Hello again!

I have time today to add another post on this blog. This script is what I use to get a list of all servers and what version of Powershell is installed on the server.

We are using this script to determine which servers will need to be updated to version 5:

$adServers = $()

$adServers += get-adcomputer -Filter * -Properties * -SearchBase "OU=ou1,DC=abc,DC=com" |Select-Object Name

$adServers += get-adcomputer -Filter * -Properties * -SearchBase "OU=ou2,DC=abc,DC=com" |Select-Object Name

foreach ($server in $adServers) {

Invoke-Command -ComputerName $server.Name -ScriptBlock { $PSVersionTable.PSVersion } | export-csv -append C:\PSVersionsbyServer.csv

}

As in other posts, I defined a variable called $adServers to hold the names of servers. There are two OUs that contain server information. That is why I have two get-adcomputer statements.

In the FOREACH loop, I used Invoke-Command to query each server for the Powershell version. I like using Invoke-Command because is saves from having to do a lot of extra coding such as creating and entering PSSessions.

Exporting variables to Export-CSV

noreply@blogger.com (Unknown) — Wed, 14 Feb 2018 13:37:00 +0000

Greetings!

I was asked to create a data feed (a text file) that contained the following information from Active Directory:
Employee Number
Employee Email Address
The last part of the employee's ObjectSID
Employee Login

Getting the information was relatively simple. Since the information was in three different Organizational Units (OUs), I had to run 3 separate Get-ADUser statements, as follows:

$ouUsers = $()

$ouUsers += get-aduser -Filter { objectClass -eq "user"} -Properties * -SearchBase 'ou=ou1,dc=abc,dc=com' | Where-object {$_.Enabled -eq "True" -AND $_.employeeid -ne $null } | Select-Object employeeid,samAccountName,objectSID,EmailAddress #| export-csv -NoTypeInformation rwsc_info.csv

$ouUsers += get-aduser -Filter { objectClass -eq "user"} -Properties * -SearchBase 'ou=ou2,dc=abc,dc=com' | Where-object {$_.Enabled -eq "True" -AND $_.employeeid -ne $null } | Select-Object employeeid,samAccountName,objectSID,EmailAddress #| export-csv -NoTypeInformation rwsc_info.csv

$ouUsers += get-aduser -Filter { objectClass -eq "user"} -Properties * -SearchBase 'ou=ou3,dc=abc,dc=com' | Where-object {$_.Enabled -eq "True" -AND $_.employeeid -ne $null } | Select-Object employeeid,samAccountName,objectSID,EmailAddress #| export-csv -NoTypeInformation rwsc_info.csv

Note: be sure to have the $ouUsers = $() statement or the variable will continue to grow since the script uses += for each get-aduser statement.

Once I had all the information in the $ouUsers variable I create a FOREACH loop:
foreach($ouUser in $ouUsers)

It is within this loop I did two things:
1. Collect the last section of the ObjectSID
    Since the ObjectSID is separated into 8 parts (separated by a '-') I used the following code:
         $sid = $ouUser.objectSID # This puts the information into a separate variable
         $empSID = $sid.Value.Split('-',8)[7] # the '-' is the separator. '8' tells how many array items.  # '[7]' is the last item in the array (array items start at [0])

2. Export the information to the CSV file
    This was the section that took me the longest to figure out. I though all I had to do was gather all
    the information into another variable and then export the data to a file (i.e., $data | Export-CSV
    c:\documents\datafile.csv). This did not work. All I got was the length of each variable.

   I did some research and found the following solution:

       [pscustomobject]@{

        EMPLOYEEID = $ouUser.employeeid

        EMAILADDRESS = $ouUser.EmailAddress

        SINGLESIGNON = $empSID

        NETWORKLOGON = $ouUser.samAccountName

       } | export-csv -append -NoTypeInformation datafile.csv

The full FOREACH loop is as follows:
      foreach($ouUser in $ouUsers) {

        $sid = $ouUser.objectSID

        $empSID = $sid.Value.split('-',8)[7]

         [pscustomobject]@{

          EMPLOYEEID = $ouUser.employeeid

          EMAILADDRESS = $ouUser.EmailAddress

          SINGLESIGNON = $empSID

          NETWORKLOGON = $ouUser.samAccountName

        } | export-csv -append -NoTypeInformation datafile.csv

      }
As I said, getting the data to a CSV file took me a few hours to figure out. I was able to find the solution on the StackOverflow web site (http://stackoverflow.com).

Let me know if you have any questions regarding this script.

See you soon,
Mike

Powershell Scripting Environments, Part I

noreply@blogger.com (Unknown) — Fri, 20 Oct 2017 12:02:00 +0000

Earlier this year, I said I would give some information regarding some of the many scripting tools you can use for creating Powershell scripts. Here are just a couple of those tools that I currently use or have used in order to create my scripts:

1. PS Shell

This is equivalent to the Command Prompt. When the shell is started, you will see PS C:\

You can initialize variables within the shell. Let's set the variable $messsage to 'This is a test'

We can see what is in the variable by running $message

The variable and contents are keep in memory and can be used with further cmdlets.

The drawback, for me, is that making changes involves either typing in a command again, or using the arrow keys to bring back a command you ran. It may not be a problem if there are only a couple of lines to the script. But, if you want to create a script with a lot of code, you going to want to use an integrated scripting tool.

2. Integrated Scripting Environment (ISE)

The ISE is provided by the Windows OS. You can start the ISE by typing ISE in the Powershell shell

The ISE will appear

This environment allows you to create and run a script in the right panel. When you run the script the output will appear in the left panel.

Here are a couple of tool bar items you should know how to use:

Click this if you want to run the entire script. The keyboard equivolent is F5

This allows you to run a specific line or group of lines in the script. For example

By clicking on the

You will only run the $users line of the code. You can then check what is in the $users variable by typing $users in the left panel.

This is equivolent to CLS, it clears the output panel.

I like using the ISE because a) it comes with Windows, and b) it allows you to create, update, and run individual lines of a script.

I hope you find this information helpful. Next week, I will show you some popular free or pay tools that add some additional functionality to the scripting environment.

Adding Security to Invoke-Command Script

noreply@blogger.com (Unknown) — Mon, 09 Oct 2017 11:18:00 +0000

Last week, I posted a script to gather user information from a different domain. In that script the -Credential parameter was set to a specific account name. When running the script, a prompt would ask for the password. Although it worked it isn't the most secure way of getting the information.

This week, let's add some additional security and eliminate the need for any additional information.

First, you need a way to store an encrypted password. The following script will do just that:

$credfilepath = "c:\scripts\password_file.txt"

$cred = read-host -AsSecureString "`nPlease enter the new password "

$cred | ConvertFrom-SecureString | Set-Content $credfilepath

The first line sets the $credfilepath variable to where you want the credential file to reside.

The second line is what will prompt you for the password of the account you will be using to run the Get-ADUser statement in the main script.

The third line reads the $cred variable, converts the $cred information from a secured string to an encrypted string, and stores the information in the file assigned to the $credfilepath variable.

Once you have the password in an encrypted format, we can make the following changes to the original script:

$pwd = get-content C:\scripts\password_file.txt | ConvertTo-SecureString

$EXTUser = '<domain>\<user name.'

$cred = New-Object System.Management.Automation.PSCredential $EXTUser, $pwd

invoke-command -ComputerName server1.mydomain.net -Credential $cred -ScriptBlock { get-aduser -filter * -Properties * -SearchBase 'OU=Titles,DC=MyDomain,DC=Net' | Select-Object DisplayName,sAMAccountName,ObjectSid | FL }

The first line variable converts the encrypted information in password_file.txt to a secured string.

The second line variable holds the account that has permissions to run the script.

The third line variable gets the credential information using the System.Management.Automation.PSCredential class.

Change the -Credential value, in the Invoke-Command line, to -Credential $Cred.

Now, when you run the script, you will not be prompted for a password.

I use this type of security method a lot at my real job. In my opinion, it is a easy way to add a level of security to scripts.

Please let me know if you have any questions about this script.