Output Redirection

Frivolous PowerShell

noreply@blogger.com (v(^_^)v - Clint) — Tue, 27 Dec 2011 18:37:00 +0000

PowerShell is great for Windows enterprise heavy lifting and automation. It's also great for answering some of life's smaller, and perhaps more important, questions like "When will this 18 gigabyte download be done?". Granted, most browsers and download managers have a time estimate easily available. However, I found myself with a large download and no built in time estimate the other day. I don't know about you, but I'm not very good at figuring out how many hours a multiple gigabyte download will take at 475Kb/sec in my head. Turns out it's pretty simple in PowerShell:

PS>(get-date).addseconds(16.8GB/475KB)

Then again, when it told me that my download wouldn't finish until after midnight - I just went to bed!

This Should NOT Happen (Exchange 2010)

noreply@blogger.com (v(^_^)v - Clint) — Fri, 12 Aug 2011 16:26:00 +0000

Since I can't find a connect site to submit feedback to:

Get-Mailbox -Identity $null

WARNING: By default, only the first 1000 items are returned. Use the ResultSize parameter to specify the number of items returned. To
return all items, specify "-ResultSize Unlimited". Be aware that, depending on the actual number of items, returning all items can
take a long time and consume a large amount of memory. Also, we don't recommend storing the results in a variable. Instead, pipe the
results to another task or script to perform batch changes.

...Nope, looks like I'm wrong on this one. For the sake of consistency this is exactly what *should* happen.

RAID-5 is the Devil

noreply@blogger.com (v(^_^)v - Clint) — Thu, 10 Mar 2011 19:34:00 +0000

And I’ll tell you why. But first, the TLDR takeaway: If you have a storage array of anything over a terabyte or two DO NOT use RAID-5, use RAID-6 or something with superior fault tolerance. If you remember anything from this post remember that or you may find yourself in the position I’m in currently, lost data and all.

It really comes down to one little performance specification that until now I hadn’t ever really noticed: “Unrecoverable read errors”. For the latest Seagate home drive that statistic is 1 in 10¹⁴, for a standard SATA Enterprise class drive that number is an order of magnitude better, 1 in 10¹⁵. Remember those numbers and now read this excellent article as well as one of the referenced white papers from NetApp, and perhaps finish off with this StorageMojo post.

See the problem now? My backup server sure did when it ran afoul of a double drive failure. Perhaps it was just bad jujus, but my 6x1TB drive array (with hot spare) had a drive fail – and hit “Unrecoverable read error” while reconstructing the data to the hot spare. So now I’m working at evacuating the existing data and restoring from backups. To save yourself that trouble it’s worth remembering:

For large arrays, RAID-5 is the devil.

Monitoring/Logging Concurrent VDI Sessions with Host CPU & RAM utilization

noreply@blogger.com (v(^_^)v - Clint) — Fri, 04 Mar 2011 23:13:00 +0000

So we have spent the past few months sizing, installing, adjusting, and growing a proof-of-concept implementation of VMWare’s virtual desktop product, View 4.5. One question that was kind of fun to develop an easily digestible solution for was, “How can we keep track of and trend how the VDI solution is being used?” Naturally, I turned to my technical multitool of choice, PowerShell, for a solution.

As a simple logging and review tool we decided that we would like to know how many Remote Sessions were currently active, what the average CPU % utilization was, and the average % RAM utilization was. I added Disk and Network stats to the logs as well. For the Remote Session stats we have to use the ‘View PowerCLI’ PowerShell Snap-in, “VMware.View.Broker”. The last time I checked it was not available as a standalone installer nor was part of the standard VMWare PowerCLI distributable. Because of this we either have to run our powershell script locally on our view manager server, or use PowerShell sessions and remoting. In the interest of simplicity I chose to run the script locally on our View Manager server. For the Host(s) CPU, RAM, Disk, & Network utilization we’ll use the standard PowerCLI distributable. For historical purposes I log the information to a simple CSV file, and we use PowerGadgets for a “live” view of the statistics.

Okay, let’s check the script out. First things first, we make sure that the required snap-ins are available.

# Add the necessary snapins, throwing terminating errors 
# should they not be available on the machine
if (-not(get-pssnapin | ? { $_.name -eq 'VMware.View.Broker' }))
{
  add-pssnapin VMware.View.Broker -ErrorAction Stop
}
if (-not(get-pssnapin | ? { $_.name -eq 'VMware.VimAutomation.Core' }))
{
  Add-PSSnapin VMware.VimAutomation.Core -ErrorAction Stop
}

Easy enough. Next let’s get some script variables setup with some explanations along the way.

$today = Get-Date
$logPath = "C:\ViewStatLogs"
$logName =  "{0}.log" -f $today.ToString("yyyy-MM-dd")
$logexists = test-path $logPath\$logname

Here we’re just setting up our logfiles. For the script to function, we’ll need to make sure that the $logpath already exists. For the sake of space I setup the directory as compressed as well. Next we define the name of the logfile which will define how our logs are broken up. Currently mine are broken up by the day, though I’m thinking that it may be better to do them some other way…time will tell. $logexists should be pretty self-explanatory. Now for some variables that are a bit more interesting.

$dnsDomain = "mydomain.net"
$vCenterServer = "vCenter"
$vSphereHosts = @("ESXi03")
$statsToGet = @(  "cpu.usage.average",
                  "mem.usage.average",
                  "disk.usage.average",
                  "net.usage.average"
               )

So here we have $dnsDomain, which I use because I’m lazy and hate typing FQDNs all the time. Next is the vCenter Server that is used to manage the host/hosts that compose our View cluster. We’ll connect to this server to get the CPU/RAM/Disk/Network statistics. We’re still in “growing proof-of-concept” phase so we only have a single vSphere host running in our View cluster which is specified in $vSphereHosts. Next is an array of the statistics that we want to gather for each vSphere Host, in this case the average usage for cpu, mem, disk, and net(work). For more information on the statistics that are available, consult the help for the Get-Stat & Get-StatType cmdlets for the VMware.VimAutomation.Core snap-in. Next let’s setup the header for our CSV logfile, and create the file if it doesn’t already exist.

# Define the log header
$logHeader = "Time,SessionCount"
# Alter the header for each host/stat combo
foreach ($vsh in $vSphereHosts)
{
  foreach ($stat in $statsToGet)
  {
    $logHeader += ",{0}.{1}" -f $vsh,$stat
  }
}

# Create the log file if it doesn't exist
if (-not $logexists)
{
  Out-File -FilePath $logPath\$logName `
-inputobject $logHeader -force -encoding ASCII
}

Pretty straightforward stuff here as well. We setup the header with timestamp & sessioncount, then append each chosen statistic for each vSphere host. Now we’ll get our stats and write the information out.

$rSessions = @(get-remotesession)
$outString = "{0:HH:mm},{1}" -f (get-date),$rSessions.count

Connect-VIServer $vCenterServer
foreach ($vsh in $vSphereHosts)
{
  foreach ($stat in $statsToGet)
  {
    [int]$statVal = Get-Stat -Entity "$vsh.$dnsDomain" `
      -Start $today.ToShortDateString() -IntervalMins 5 -Stat $stat | `
      Select-Object -ExpandProperty value -First 1
    $outString += ",$statVal"
  }
}

Out-File -FilePath $logPath\$logName `
-inputobject $outString -append -encoding ASCII
# Close all vSphere PowerCLI server connections
Disconnect-VIServer -Force -Confirm:$false

Code very similar to setting up the header for the log. We grab all the remote sessions our View manager is tracking into an array, then use the count (length) of the array for the information we log. Next we connect to our vCenter server and for each vSphere Host we gather the last recorded 5 minute interval value of each chosen statistic. There are only so many interval values available by default, and you can find our what you have available by running the Get-StatInterval cmdlet. Next we write out the completed string to the logfile. Lastly we disconnect the VIServer session.

The last bit in this formula is setting up the schedule. You’ll get the most detailed information by setting up a scheduled task that runs on 5 minute intervals that match the intervals that you see when running Get-StatInterval and Get-Stat from the console. That said, I only run mine every 10 minutes – we’re really just looking for an overview. One thing to make sure is that the task is setup to run as a user that has the correct permissions to connect and gather statistics from your vCenter server, otherwise the whole script will just hang!

So, great – we can log, but how to make a nice pretty picture out of it? That’s a question with lots of different answers. There’s a lot of different ways to visualize statistic data, you probably have your favorite, and the details will depend on your hosts and the statistics you want to track, so I’ll just share a quick pic of what we use to keep an eye on things using PowerGadgets.

Hope that can help or inspire somebody out there, Happy Friday!

A diversion

noreply@blogger.com (v(^_^)v - Clint) — Wed, 22 Dec 2010 20:05:00 +0000

Gonna take a break from the System Admin stuff for a second to share the best darn game deal out there right now. The Humble Indie Bundle. Pay what you want for 6 fun games, or pay more than the average ($7.44 when I wrote this) and get last years bundle as well! World of Goo is easily worth the price of admission. And you can activate all the games on Steam, or just download them and keep the DRM free installers. The Humble Indie Bundle, it's awesome.

Reset Live@Edu passwords with a simple Windows Form

noreply@blogger.com (v(^_^)v - Clint) — Thu, 16 Dec 2010 17:24:00 +0000

Once again, I’ve gone what seems like ages without taking the time to share. We’ve been so busy with implementing Microsoft’s Live@Edu service as well as piloting VMWare’s View I just haven’t taken the time. In any case, here’s a little form I put together in Primalforms that connects to Live@Edu, and allows you to search for your students and change their passwords easily. You can embed credentials, but by default the script will prompt for credentials each time the script is run. The code is below, I think I've decided to go with poshcode.org for pasting code and what not.

When is an empty string not an empty string?

noreply@blogger.com (v(^_^)v - Clint) — Fri, 01 Oct 2010 20:49:00 +0000

Man, it’s been a long time since I took the time to post something for which I apologize. It’s been a busy few months. But today we’ll get back into the swing of things with a mystery to solve. We start with a distilled version of an advanced function a friend of mine was working with:

function Test-Mystery
{
    [CmdletBinding()]
    param
    (
        [ValidateNotNullOrEmpty()]
        $paramOne
    )
    
    $paramOne
    $paramOne.length
}

Pretty straightforward advanced function stuff, we have a parameter that we need to validate. It can be anything it wants as long as it’s not null, and is not an empty string. If we test this, we’ll find that it works. Mostly.

PS > $x = "HELLO WORLD"
PS > Test-Mystery -paramOne $x
HELLO WORLD
11

PS > $x = ""
PS > Test-Mystery -paramOne $x
Test-Mystery : Cannot validate argument on parameter 'paramOne'. The argument is null or empty. Supply an argument that is not null or empty and then try the command again.
At line:2 char:23
+ Test-Mystery -paramOne <<<< $x
    + CategoryInfo          : InvalidData: (:) [Test-Mystery], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Test-Mystery

Okay, that works as expected. But let’s try that with input from the Read-Host cmdlet. First we’ll enter in a string, then we’ll just hit Enter to return nothing (in theory).

PS > $x = Read-Host "Test "
PS > Test-Mystery -paramOne $x
Test: HELLO WORLD
HELLO WORLD
11

PS > $x = Read-Host "Test "
PS > Test-Mystery -paramOne $x
Test:
0

Uhh….what? That totally should have exploded, and yet it doesn’t. Adding to the mystery is that the variable being assigned the return value from Read-Host is indeed a [System.String] variable and it is assigned the value of ‘’ (or an empty string). At least that’s what PSDebug tells us:

PS > $x = read-host 'test '
DEBUG:    1+ $x = <<<< read-host 'test '
test :
DEBUG:     ! SET $x = ''.

PS > $x.gettype()
IsPublic IsSerial Name    BaseType
-------- -------- ------ --------
True     True     String System.Object

PS > $x –eq “”
True

And so thus is given to us the mystery: when is an empty string not an empty string? Evidently, when it’s created by Read-Host. But, thankfully there is a fairly straight forward solution. We strongly type the variable being assigned the output from Read-Host.

PS > [string]$x = Read-Host 'Test '
Test :

PS > Test-Mystery $x
Test-Mystery : Cannot validate argument on parameter 'paramOne'. The argument is null or empty. Supply an argument that is not null or empty and then try the command again.
At line:2 char:13
+ Test-Mystery <<<< $x
    + CategoryInfo          : InvalidData: (:) [Test-Mystery], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Test-Mystery

I’ll pose this question on the PowerShell Technet Forums, and see if it this is ‘as designed’ or a genuine bug that we need to file on Connect. Until then, case (almost) closed.

Hey! A send email cmdlet!

noreply@blogger.com (v(^_^)v - Clint) — Fri, 06 Aug 2010 14:44:00 +0000

So from the ‘oh my god I can’t believe I hadn’t found this earlier’ corner comes this: PowerShell 2.0 ships with a new cmdlet called Send-MailMessage. Why is this kinda sorta a big deal (at least to me, haha)? PSCX will be deprecating the Send-SmtpMail cmdlet (that you may or may not have been using profusely, I know I have) in the next major revision. So it’s time to start going through scripts and updating as needed. Thankfully, the syntax is very similar. The only changes that I found I needed to make were:

Change –AttachmentLiteralPath/-AttachmentPath to –Attachments
Change –SmtpHost to –SmtpServer

Track Mass Exchange Mailbox Moves

noreply@blogger.com (v(^_^)v - Clint) — Fri, 09 Jul 2010 15:40:00 +0000

Moving a mailbox or two between Exchange databases and/or servers isn’t too hard to keep track of, but what if you’re moving 200? Or 2000? I came up with a little “one-liner” (can we really call a do loop a one-liner?) while migrating the bulk of our mailboxes from Exchange 2003 to 2010. Hopefully you can use it to help you keep an eye on things too. Here’s the script, first in a more traditional form, then in one-liner form for easy copy and paste into a shell session. It’s a do {} until ($false) loop so you have to Ctrl-C to break out of it.

Traditional Script Form

do
{
Clear-Host
$mr = Get-MoveRequest
$mr | Group –Property Status | Select Name,Count | Format-Table –auto
$mr | Where { $_.status –eq “InProgress” } | Select DisplayName,TotalMailboxSize,PercentComplete |
Format-Table –auto
Start-Sleep –seconds 60
} until ($false)

One-Liner Form

do { cls ; $mr = Get-MoveRequest ; $mr | group status | select Name,Count | ft –auto ; $mr | ? { $_.status –eq “InProgress” } | select DisplayName,TotalMailboxSize,PercentComplete | ft –auto ; sleep –seconds 60 } until ($false)

Hope you find that helpful!

Updated PDFCreator post

noreply@blogger.com (v(^_^)v - Clint) — Mon, 14 Jun 2010 18:21:00 +0000

I've updated my post on running PDFCreator as a service to the latest version, 1.0.1. It's also now a static page with a link at the top. Enjoy!

Things I learned from the Scripting Games 2010 #5

noreply@blogger.com (v(^_^)v - Clint) — Wed, 09 Jun 2010 18:51:00 +0000

In this final entry in the ‘Things I learned from the Scripting Games’ series, we’ll go over two different yet related bits of information. The first is displaying balloon tips in the notification area (System Tray). The second is displaying log-like feedback in a form generated in PowerShell. Because they both relate to presenting information or feedback to the user, and because it’s been awhile since I posted anything…and because I promised someone I would try real hard to update my PDFCreator post this week, both subjects fit in one post today.

Balloon Tips

Often times when we need to present the user with information in a graphical way, the messagebox is sufficient. However, because the messagebox is synchronous by default (that is, the script pauses execution until the messagebox is closed) and there isn’t an easy way to create an asynchronous messagebox, they don’t fit every scenario. Sometimes we just want to display some information to the user and move on. Enter balloon tips.

For me, the most challenging part of making a balloon tip function wherever the script is running is the fact that it requires an icon. How, exactly, is one to deliver an icon when (especially during the scripting games) all we have at our disposal is our PowerShell script file? Let’s get our object setup and then we’ll answer that question. First things first, load the forms assemblies:

[void][reflection.assembly]::Load("System.Windows.Forms, `
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089")

Now we can create a new NotifyIcon object, and setup the text for the balloon tip:

$notifyIcon = New-Object System.Windows.Forms.NotifyIcon
$notifyIcon.BalloonTipTitle = "Balloon Title"
$notifyIcon.BalloonTipText = "Balloon Text"

So, about that icon…turns out we can extract an icon from a file to use for the NotifyIcon object. What file with icons should every relevant Windows system have? Explorer.exe!

$notifyIcon.Icon = [System.drawing.icon]::ExtractAssociatedIcon(`
"$env:windir\explorer.exe")

OK, so now we have everything setup, let’s display that balloon tip. First we have to make the NotifyIcon visible, then we can display the balloon tip for the number of milliseconds we specify:

$notifyIcon.Visible = $true
$notifyIcon.ShowBalloonTip(3000)

There we go. Presenting information to the user in a way that doesn’t pause script execution, done.

Display Scrolling Text in a Form Window

Coming up with a “how many times would I actually use this” example for this particular technique has proven difficult. Maybe it’s because I don’t have much experience creating GUIs designed for end users. But that said, a wall (or box) of scrolling text seems so deceptively simple that it took me a while to figure out how to accomplish the task.

In advanced event 10 of the scripting games, one element was to present the user with progress of files being moved. Instantly the picture of the nullsoft installer with it’s wall of text during the install sprung into my mind. Achieving a similar effect isn’t too involved. Here’s how we do it.

First we’re going to setup 3 objects: a form, a textbox, and a button.

$form = new-object windows.forms.form
$form.Size = New-Object System.Drawing.Size(270,125)

$txtBox = new-object windows.forms.textbox
$txtbox.Multiline = $true
$txtBox.WordWrap = $false
$txtBox.size = New-Object System.Drawing.Size(250,60)
$txtBox.ScrollBars = [System.Windows.Forms.ScrollBars]::Vertical

$btn = new-object windows.forms.button
$btn.Location = new-object system.drawing.point(0,60)
$btn.Text = "Go!"

$form.Controls.Add($txtBox)
$form.Controls.Add($btn)

So we’ve assigned some size and location information to the controls and added the controls to the form, which is standard business so far. Two properties of the textbox control are important for this particualr task: Multiline & ScrollBars. We make sure to set the multiline property to true, and assign vertical scrollbars to the textbox. I also like to disable wordwrap, but that’s just me.

Next let’s setup the scriptblock that will run when we click the button:

$button_OnClick = {
    1..10 | % {
        $txtBox.Lines += $_
        $txtBox.Select($txtBox.Text.Length, 0)
        $txtBox.ScrollToCaret()
        $form.Update()
        start-sleep 1
    }
}
$btn.add_Click($button_OnClick)

So this is pretty simple. We create a variable ($button_OnClick) and assign it a scriptblock in which we have a small loop. We take the array created by the 1..10 range, and for each number we:

Add the number to the lines array property of the textbox
Move the caret (cursor) to the last character in the textbox
Scroll the textbox view to the caret
Update the form
Pause for a second

We add that scriptblock to the click event of the button by using the hidden method add_Click($button_onClick). As a side note in case you’re wondering, you use the –Force parameter of Get-Method to display hidden members. Lastly let’s show the form:

$form.showdialog()

Give that button a push! Sure it’s a simplistic example, but it can be used to pretty good effect. The $form.update() method caught me by surprise, probably because I’m pretty green with this GUI business. To see what happens without calling the update method, comment out or delete the $form.Update() line and run $form.showdialog() again. It’s like the whole form freezes while the loop runs! Bad jujus.

To see a more complete example you can check out my submission for Event 10 of the Scripting Games here.

Sorry for the reposts and instability

noreply@blogger.com (v(^_^)v - Clint) — Thu, 03 Jun 2010 05:00:00 +0000

I've been trying to troubleshoot an issue with the feed posting, and ended up deleting and reposting all the entries from the last month or so. Sorry about that, hopefully I can get the feed & keyword business straightened out soon.

Happy Wednesday!

Things I learned from the Scripting Games 2010 #4: Background Jobs

noreply@blogger.com (v(^_^)v - Clint) — Thu, 03 Jun 2010 04:35:00 +0000

Okay, so background jobs themselves aren’t really the subject of this post. But a handy function to make efficient use of them, and a ~~quick~~ gotcha when using background jobs via Start-Job is. Often times we need to execute the same code over and over, with one or two variations in each iteration. That's what the function we’ll look at today is built to do. The two mandatory parameters for this function, -scriptblock & -collection, really allow for some flexible backgrounding of similar tasks. Take a moment and think, how many times have I needed to run the same or similar code against 10+ computers, users, files, directories, etc. Probably doesn’t take too long before you have at least a few examples.

Before we get into the function let’s address the gotcha. I learned about a new parameter to Start-Job in Event #5 this year, ArgumentList. If you look at the documentation on this parameter it is a little bit misleading. I’ve filed a documentation bug on connect should you wish to vote for it. The short of it is, even though the parameter help doesn’t mention that the ArgumentList parameter works with the ScriptBlock parameter, it does. Which is pretty important. To illustrate this, try the following:

Create a variable
$arr = 1..5
Start a background job that writes that variable to output
$job = Start-Job –Scriptblock { Write-Output $arr }
Receive the job
Receive-Job $job
Notice that there is no output, sadface.

So, what happened? Why don’t we have any output? The answer lies in two bits of information. The first we get from Get-Help about_jobs:

Important: Background jobs that are started by using Start-Job or the AsJob parameter of Invoke-Command rely on the Windows PowerShell remoting infrastructure. To use these features, Windows PowerShell must be configured for remoting, even if the background job is run only on the local computer. For more information, see about_Remote_Requirements.

The second from Get-Help about_scopes:

Sessions: A session is an environment in which Windows PowerShell runs. When you create a session on a remote computer, Windows PowerShell establishes a persistent connection to the remote computer. The persistent connection lets you use the session for multiple related commands.
Because a session is a contained environment, it has its own scope, but a session is not a child scope of the session in which is was created. The session starts with its own global scope. This scope is independent of the global scope of the session. You can create child scopes in the session. For example, you can run a script to create a child scope in a session.

Aha! The variable scope is separate and distinct inside of the scriptblock that we pass to Start-Job. So we use the ArgumentList parameter to get the information that we need to the scriptblock. Let’s see that in action:

Create a variable:
$arr = 1..5
Start a background job, passing the variable as an argument:
$job = Start-Job –Scriptblock { Write-Output $args } –ArgumentList $arr
Receive the job
Receive-Job $job
Hey there’s our information!

Sweet. Hopefully that information will make working with background jobs a little easier for you. Below is a function I wrote as part of my solution for Event 5. It takes a scriptblock and a collection of items & iterates through the collection passing each item into the scriptblock. By default it displays a progress bar to keep you abreast of the progress of the jobs. For detailed information on how you can use it and examples, import the function into your powershell session and run ‘Get-Help Start-BackgroundJobs’
Get the function here.

Things I learned from the Scripting Games 2010 #3: Test-Connection

noreply@blogger.com (v(^_^)v - Clint) — Thu, 03 Jun 2010 04:35:00 +0000

Who knew there was a cmdlet designed just for testing remote connections? Not me, at least until the scripting games this year. For the past....forever, I've been doing something like the following to test remote connections

$pingResults = Ping-Host -HostName $ComputerName -Count 2 -Quiet -ErrorAction SilentlyContinue

if ($pingResults.received -gt 0)

{

    # Do something

}

And then I discovered test-connection! Now for simple quick tests we can just do:

if (Test-Connection $ComputerName -count 2 -quiet)

{

    #Do something

}

For larger groups of computers I'll still use PSCX's Ping-Host cmdlet due it's ability to ping all specified hosts asynchronously and it's speed. You've updated to PSCX 2.0, right? But Test-Connection is the right tool at the right price for quick connectivity checks. Learn more about Test-Connection with Get-Help Test-Connection or on Technet.

Things I learned from the Scripting Games 2010 #2: #Requires

noreply@blogger.com (v(^_^)v - Clint) — Thu, 03 Jun 2010 04:35:00 +0000

So this post comes from the "how embarrassing" folder. I've been fiddling with and using PowerShell since it was the Monad beta, and until the scripting games I didn't know about #Requires. '#Requires' is awesome. You just stick it at or around the start of your script, and the magic happens. There's a pretty good summary available in PowerShell if you type:

get-help about_Requires

But this all comes with a bit of a caveat, there isn't an option for #Requires for those nifty new things called modules! So we can '#Requires -version 2' to require PowerShell version 2, we can '#Requires -PSSnapIn Quest.ActiveRoles.ADManagement' to require the Quest AD snap-in....but we can't '#Requires -Module grouppolicy' to require a module. Bummer. So how can we require a module the "hard" way? Here's one way:

function Test-ModuleAvailability([string]$modulename,[switch]$Import)            
{            
    # Check to see if our module is available            
    [System.Management.Automation.PSModuleInfo]$results = `
          Get-Module -ListAvailable | ? { $_.name -ieq $modulename }            
    if ($results)            
    {            
        if ($Import -and $results.sessionState -eq $null)            
        {            
            #Import the module            
            Import-Module $results            
        }            
        #Return true, the module is available            
        $true            
    }            
    else            
    {            
        #Return false, the module is not available            
        $false            
    }                
}

With this function we can easily test for a module's availability, load it if it we need to, and throw an error if $false is returned:

if (-not $(Test-ModuleAvailability FileSystem -Import))            
{            
    Throw "Could not find or load required Module FileSystem"            
}

Not too hard, but maybe those PowerShell guys will hook us up with a beefed up #Requires statement later.

Until tomorrow!

Scripting Games Results

noreply@blogger.com (v(^_^)v - Clint) — Thu, 03 Jun 2010 04:35:00 +0000

Scripting Games Results

Wow, what a couple of weeks. Haven't posted much between the scripting games & Exchange 2010 training this week I've been really busy. Awaiting the official final results from the scripting games, but it looks like I've managed to snag 3rd in the 'Advanced Division'. Well...at least according to "Clint's Rules" which are different from the official rules - you can download the spreadsheet I created here. What can I say...I'm a little competitive by nature. But more importantly, man did I learn a lot from doing the exercises and from reading what other people submitted. This week I'll try to post one thing I learned each day (maybe even starting today if I can resist the play SC2 beta urge) this week since class is over at 4 and I'm all by myself. In fact....here we go, the thing I remember first is:

A way better method of looping/waiting for an event and then acting on it:

Look at lines 34-44 in Robert Robelo's Event 6 submission. Compare that to all the nasty global variables and junk I made to work inside the event handler in my submission for Event 6 (had to make a link to download, the link for my Event 6 submission blows up for some reason).

Which kinda ties into thing #1.5 that I learned - the scriptblocks you supply to the -Action parameter in Register-*Event create a separate variable scope that does not inherit the variables from the script scope etc. At least that's what it seems like....I could be wrong on that, I haven't looked for any documentation tbh.

So, in my opinion, the way that Robert does it is WAY better than the way I did it, which basically boils down to:

Create ONE global variable that will hold the event object when it is raised
In the -action parameter of Register-*Event just assign the $Event automatic variable (or a property of it if that's all you're interested in) to the global variable that you created in your script
Sleep loop until that global variable isn't $null anymore.

In fact, I totally stole this method from him and used it in a later event that involved eventing. So....thanks Robert :)

Speaking of Robert, why aren't you reading his blog instead of mine? He rolled #1 in the Advanced division according to Clint's Rules....better go check out what he has to say.

Until tomorrow, bubye!! v(^_^)v

Display a PowerShell session’s RAM and CPU utilization in the Title Bar

noreply@blogger.com (v(^_^)v - Clint) — Sat, 17 Apr 2010 01:03:00 +0000

So, I had a few other things I’ve cooked up this week that I was thinking about posting, but this was too much fun this morning. Here’s a little bit of code you can stick in your powershell profile that will update the title bar with the current PowerShell session’s memory usage (working set, technically) and CPU utilization.

# Setup the objects for titlebar manipulation            
# Append a #1,#2,#(n-1) to the process name if there are n pre-existing processes with the same            
# name, as this is how the Performance Counter system references the instances.            
$psProcess = gps -id $PID            
$psInstances = (gps -Name $psProcess.name).count            
if ($psInstances -gt 1)            
{            
    $psName = "{0}#{1}" -f $psProcess.name,$($psInstances - 1)            
}            
else            
{            
    $psName = $psProcess.name            
}            
# Create the Performance Counter Object to track our sessions CPU usage            
$Global:psPerfCPU = new-object System.Diagnostics.PerformanceCounter( "Process","% Processor Time", $psName )            
# Get the first 'NextValue', which will be zero            
$psPerfCPU.NextValue() | Out-Null            
# Create a timer object and set the interval to 1 second            
$Global:psTimer   = New-Object System.Timers.Timer            
$psTimer.Interval = 1000            
# Update the window's title bar every time the timer object raises the            
# elapsed event            
Register-ObjectEvent -InputObject $psTimer -EventName Elapsed -Action {            
    $psInfo = Get-Process -id $pid            
    [int]$ws = $psInfo.workingset/1MB            
    [int]$cpu = $psPerfCPU.NextValue() / $env:NUMBER_OF_PROCESSORS            
    $Host.ui.rawui.WindowTitle = "$($CurrentUser.Name) $($Host.Name) $($Host.Version) | $((get-location).ProviderPath) | RAM: $ws MB CPU: $cpu%"            
} | Out-Null            
$psTimer.start()

The hardest part was getting the CPU utilization right, but these two posts spell out the details pretty well:

Happy Friday!

PowerShell’s Try/Catch/Finally and –erroraction Stop

noreply@blogger.com (v(^_^)v - Clint) — Fri, 09 Apr 2010 21:11:00 +0000

Update: From an anonymous commenter, evidently error handing when using "-erroraction Stop" now works as one would expect in PowerShell version 3! However, if you're still using version 2 the information below should help you out.

When planning for exception handling, I’ve recently learned that forcing execution to stop by setting $erroractionpreference to ‘Stop’ or by using the –erroraction common parameter requires some special handling.

First let’s see what doesn’t work even though it seems like it should. Handling a normal terminating error is fairly straightforward:

Here we encountered an exception, got the exception’s type by inspecting the first element in the typenames member of the first error record’s exception’s base object, and then used that type name to catch the exception. This worked whether or not we specified the –ea or –erroraction parameter. This works because a ParameterBindingException is a terminating error. However, let’s see what happens when we try the same thing with an error that isn’t of terminating error family:

Hmm, bugger. We tried the same pattern, but this time it just doesn’t work. But…why? Without getting too long winded about it, I tried looking back through the automatic $error variable but couldn’t find an answer. So I tried a different tactic:

Aha! When we use –erroraction stop, the terminating exception isn’t the error that was encountered but an exception of type System.Management.Automation.ActionPreferencesStopException! But…wait, if that’s true, how do we know what type of error was encountered? Almost inexplicably the automatic variable $_ is set to the error record of the error that was encountered. If you know why, please share in the comments or send me an e-mail. Anyway, we can use that to re-throw the error as a terminating exception that can be caught and handled:

Basically we just wrap our command that makes use of the –erroraction stop inside two try/catch blocks. The inner block is used to trap the ActionPreferenceStopException generated by the erroraction parameter. In the inner catch block we throw the exception for the error that was caught which is then caught by the outer catch block statements and can the be handled. So, let’s finish with a generic pattern that one could turn into a code snippet or something:

     
001

002

003

004

005

006

007

008

009

010

011

012

013

014

015

016

017

018

019

020

021

022

023

024

025

026

027

028
     
try

{

  try

  {

    # Command that uses -erroraction stop or $erroractionpreference = 'Stop'

  }

  # Here we catch the Exception generated by the ErrorAction "Stop"

  # Only necessary if there is any processing we want to do if the

  # exception is of type ActionPreferenceStopExecution,

  #  otherwise this block can be deleted 

  catch [System.Management.Automation.ActionPreferenceStopException]

  {

    # Error Handling specific to ActionPreferenceStopException goes here

    # Rethrow the "real" exception as a terminating error

    Throw $_.exception

  }

  # All errors are caught and rethrown to the outer try/catch block

  # as terminating errors to be handled.

  catch

  {

    Throw $_.exception

  }

} 

# Here we can resume exception type handling as usual

catch #[System.Management.Automation.ItemNotFoundException]

{

  "Got it!"

}

And with that, Happy Friday!

Early preview of Group Policy Backup & Search Module

noreply@blogger.com (v(^_^)v - Clint) — Fri, 02 Apr 2010 17:12:00 +0000

Alright, it’s taken WAY longer than I thought it would, but I finally have something I think is worth sharing in its very unfinished state. First, what still sucks: the help is only slightly better than useless, the code itself is a bit jumbled and not well commented, not everything is formatted nicely when written to output, only 3 extensions (Software Installation, Scripts, and Policy/Registry – the big 3 for me) are implemented, and while the backup function works, you’re pretty much on your own for configuration at the moment. That said, what does work is pretty cool (in my opinion): You can search inside of your live group policy objects, as well as any archived XML Reports from Get-GPOReport, and get meaningful output!

Let’s go through an example. First we need to get our new module up and running. You can download the code for this post here. (Don’t have 7-zip? Get it.) Once you have the code downloaded extract the contents to one of your module directories:

%Windir%\System32\WindowsPowershell\v1.0\Modules
<My Documents>\WindowsPowerShell\Modules

A little up front configuration is needed. Inside our module’s folder is a file named cgpo.config.xml.dist. Create a copy of the file, rename it to cgpo.config.xml, and open it up in your editor of choice. Find the following lines:

<CGPOXmlCachePath>
    
</CGPOXmlCachePath>
<Domain>
    
</Domain>

The only required information is your domain, entered in the ‘contoso.com’ format. Type that in after the (admittedly unhelpful) comment. If you would like to specify a directory to use to cache XML reports, enter that following the comment in the CGPOXmlCachePath element. Our config file should look something like:

<CGPOXmlCachePath>
    <!-- If this Element is left blank the module will default to a subdirectory of the user's temp directory. –>
    C:\Temp\GPOXmlCache
</CGPOXmlCachePath>
<Domain>
    <!-- Help Goes Here –>
    sub.domain.com
</Domain>

Save the config file and open up ye’ PowerShell. First load up the grouppolicy module from Win 7’s RSAT, then our new module.

PS> ipmo grouppolicy
PS> ipmo cgpo

If all is well, you should just get your prompt back. Next, let’s check two variables to make sure our config file was read properly. Your output should look like this:

PS> $CGPO_Domain
my.domain.com
PS> $CGPO_ReportXmlCachePath
C:\Users\CLINT-~1\AppData\Local\Temp\CGPOReportXmlCache

Okay, all looks well. Let’s jump in! For kicks we’ll just do a “simple” search of our live GPOs. Your results will, obviously, vary.

PS> Search-CGPOReports “printer”
ScriptType Command                                  Parameters
---------- -------                                  ----------
Logon      fix-printers-Shortcut.cmd                phs
Logon      fix-printers-Shortcut.cmd                adm
Logon      fix-printers-Shortcut.cmd                fes
Logon      fix-printers-Shortcut.cmd                lms

Name          : Check published state
Category      : Printers
GPOName       : Default Domain Controller Policy
GPOReportPath : C:\Users\clint-admin\AppData\Local\Temp\CGPOReportXmlCache\1.xml

Name          : Show only specified Control Panel items
Category      : Control Panel
GPOName       : logon-RESTRICTED-autoLogon-phs-libusers
GPOReportPath : C:\Users\clint-admin\AppData\Local\Temp\CGPOReportXmlCache\105.xml

The formatting is ugly due to the default formatters in PowerShell. If all we want is a textual display of the results we can use the –summarize switch

PS> Search-CGPOReports “printer” –summarize
ScriptType Command                                  Parameters
---------- -------                                  ----------
Logon      fix-printers-Shortcut.cmd                phs
Logon      fix-printers-Shortcut.cmd                adm
Logon      fix-printers-Shortcut.cmd                fes
Logon      fix-printers-Shortcut.cmd                lms

Name                                     Category
----                                     --------
Check published state                    Printers
Show only specified Control Panel items Control Panel
Browse the network to find printers      Control Panel/Pri...
Show only specified Control Panel items Control Panel

OK, nifty, but what is we want to dig around inside a specific GPO?

PS> $x = Get-GPOReport –Name <GPONAME> –ReportType XML | Get-CGPOReport
PS> $x | Get-Member

Or look at/search historical (backup) information?

PS> $y = Get-CGPOReport –ReportPath “C:\GPOBackupLocation”
PS> Search-CGPOReports –gpoReportPath “C:\CGPOBackupLocation” –pattern “Microsoft Office”

Or find all the current group policy objects that contain logon/logoff/startup/shutdown scripts?

PS> Update-GPOReportCache
PS> $z = Get-CGPOReport –reportPath $CGPO_ReportXmlCachePath –IncludedExtensionDetails “Scripts”

Explore it, have fun, PLEASE PLEASE give me your feedback if you have any. You can leave it in the comments here, or feel free to send me an email directly. You can get the latest build via svn:

svn checkout http://clintgputilities.googlecode.com/svn/trunk/ clintgputilities-read-only

PowerShell Resources – Free and Otherwise

noreply@blogger.com (v(^_^)v - Clint) — Fri, 12 Mar 2010 19:34:00 +0000

Haven’t had much time to work on our group policy module lately, I’ve been pretty busy getting my co-worker’s collective feet wet in PowerShell. In the process I’ve been trying to find as many quality resources as I can for them to help them help themselves. Since I don’t have much to share on the csb.grouppolicy module front, here are the resources that I can remember (haha) and use all the time:

Free

http://powershell.com/cs/blogs/ebook/default.aspx
Free eBook by Dr. Tobias Weltner, who you may recognize as the creator of PowerShell Plus. 500+ pages of PowerShell goodness. My guys love it.
http://www.powershellcommunity.org/Default.aspx?base
Good launching point for learning PowerShell and exploring the PowerShell community. The community Blogs page in particular is a favorite of mine.
http://powershell.com/cs/
Another good launch point for learning and exploring.
http://poshcode.org/
Looking for a function or script? Look here, it may exist already. Have a script or function to share, post away. Love it.
http://www.powershellanalyzer.com/
A great PowerShell host. We’ve found that it really helps when inspecting all the different objects that you end up working with in PowerShell. And the chart output options are just plain cool.
http://www.powergui.org/, http://www.powergui.org/kbcategory.jspa?categoryID=21
Another great PowerShell host that extends the functionality of PowerShell above and beyond. Makes PowerShell a pointy-clicky affair that’s so easy, even your boss can use it! Also comes with a very competent script editor. The second link is to all the ‘PowerPacks’ that have been created. I love the Exchange 2003 one.
http://www.codeplex.com/Pscx
Essential PowerShell snapin/module. I don’t think I could function without the ping-host and resolve-host functions. Don’t think about it, just download it and set it up in your profile.
http://code.msdn.microsoft.com/PowerShellPack
A good module for PowerShell (v2 only I believe). I found the WPK module (WPF functions/scripts) is a bit difficult to wrap my brain around without a form designer for layout, but the TaskScheduler module is great, as is the IsePack.
http://www.primaltools.com/downloads/communitytools/signup.asp?tool=pforms
The free community edition of Sapien’s PrimalForms product. Makes writing admin GUIs much easier. Requires Name/e-mail submission, but is well worth the few seconds. Unfortunately it doesn’t save the script logic you put into the form, so if you start to get ambitious you’ll probably want to upgrade to the paid version. I sure did, $150 well spent imho.

Not Quite As Free

http://www.idera.com/Products/PowerShell/PowerShell-Plus/
Undeniably my #1 PowerShell tool. With the new community script searching functions in 3.1, competent code editor, debugger, variable inspector, and learning center, I can unreservedly recommend this to anyone with $145 to spend. If you can only buy one PowerShell utility, buy this one.
http://www.softwarefx.com/sfxSqlProducts/powergadgets/
Way too cool. Used it to build a ‘live’ help-desk statistics gadget for our department. Impressed the boss so much he licensed it for everyone in a heartbeat.
http://www.manning.com/payette2/
As far as I’m concerned, the book to buy. I read once “If you want to learn Debian, install Debian. If you want to learn Fedora, install Fedora. If you want to learn Linux, install Slackware.”. This book is kinda like that. There’s a lot of books on how to use PowerShell in a particular scenario, and they’re great books, but they don’t necessarily teach you PowerShell. My copy of this for v1 is tattered, dog-eared and well worn for good reason. If you want to learn PowerShell, pre-order this book and start reading.
http://www.primaltools.com/products/info.asp?p=PrimalForms
The pay for version of the PrimalForms product from Sapien. The form designer portion is great. My only real gripe with the program is that it seems like the script editing & execution portion should be tied into PrimalScript (assuming you have it installed) much tighter than ‘export and open’. Without the debugger, bookmarking, etc. functions that I’m used to using in PrimalScript…it’s a little painful to use to do much code logic in. But, like I said above, everything considered it’s $150 well spent.

Hope you can find something new and useful in that list! If we end up doing some in-house training on how to use some of these tools, perhaps I can post tutorials or something as a result….hmmm. If you have any favorite tools that I don’t have listed, please post them in the comments section; I love new toys!

Snippets for Comment Based Help and Advanced Function Parameters in Powershell v2

noreply@blogger.com (v(^_^)v - Clint) — Wed, 24 Feb 2010 16:54:00 +0000

Been working quite a bit on the module for group policy, and almost have something I feel is worth sharing. In the meantime, if you have a script editor that supports the concept of “snippets”, or saved re-usable bits of script code, you might find this little bit useful. I’ve had a hard time remembering the syntax and all the options for some of the new cool stuff we can use in scripts and functions in Powershell v2, so I saved these little bits after scouring the output of Get-Help for comment based help and advanced functions for (hopefully) the last time, haha.

Comment Based Help:

     001

002

003

004

005

006

007

008

009

010

011

012

013

014

015

016

017

018

019

020

021

022

023

024

025

026

027

028

029

030

031

032

033

034

035

036

037

038

039

040

041

042

043

044

045

046

047

048

049

050

051

052

053

054

055

056

057

058

059

060

061

062

063

064

065

066

067

068
     <#  

.SYNOPSIS

  A brief description of the function or script. This keyword can be used

  only once in each topic.

.DESCRIPTION

  A detailed description of the function or script. This keyword can be

  used only once in each topic.

.PARAMETER  

  The description of a parameter. You can include a Parameter keyword for

  each parameter in the function or script syntax.

.EXAMPLE

  A sample command that uses the function or script, optionally followed

  by sample output and a description. Repeat this keyword for each example.

.INPUTS

  The Microsoft .NET Framework types of objects that can be piped to the

  function or script. You can also include a description of the input 

  objects.

.OUTPUTS

  The .NET Framework type of the objects that the cmdlet returns. You can

  also include a description of the returned objects.

.NOTES

  Additional information about the function or script.

.LINK

  The name of a related topic. Repeat this keyword for each related topic.

.COMPONENT

  The technology or feature that the function or script uses, or to which

  it is related. This content appears when the Get-Help command includes

  the Component parameter of Get-Help.

.ROLE

  The user role for the Help topic. This content appears when the Get-Help

  command includes the Role parameter of Get-Help.

.FUNCTIONALITY

  The intended use of the function. This content appears when the Get-Help

  command includes the Functionality parameter of Get-Help.

.FORWARDHELPTARGETNAME 

  Redirects to the Help topic for the specified command. You can redirect

  users to any Help topic, including Help topics for a function, script,

  cmdlet, or provider. 

.FORWARDHELPCATEGORY  

  Specifies the Help category of the item in ForwardHelpTargetName.

  Valid values are Alias, Cmdlet, HelpFile, Function, Provider, General,

  FAQ, Glossary, ScriptCommand, ExternalScript, Filter, or All. Use this

  keyword to avoid conflicts when there are commands with the same name.

.REMOTEHELPRUNSPACE 

  Specifies a session that contains the Help topic. Enter a variable that

  contains a PSSession. This keyword is used by the Export-PSSession

  cmdlet to find the Help topics for the exported commands.

.EXTERNALHELP  

  Specifies the path to an XML-based Help file for the script or function.  

  For more information about the cmdlet Help XML-based Help file format,

  see "How to Create Cmdlet Help" in the MSDN (Microsoft Developer Network) 

  library at http://go.microsoft.com/fwlink/?LinkID=123415.

#>

Advanced Function Parameters:

     001

002

003

004

005

006

007

008

009

010

011

012

013

014

015

016

017

018

019

020

021

022

023
     [parameter(

   #Mandatory=$false,

   #Position=0,

   #ParameterSetName="SetName",

   #ValueFromPipeline=$false,

   #ValueFromPipelineByPropertyName=$false,

   #ValueFromRemainingArguments=$false,

   #HelpMessage="Help goes here"

)]

#[Alias("Alias"]

#[AllowNull()]

#[AllowEmptyString()]

#[AllowEmptyCollection()]

#[ValidateCount(min,max)]

#[ValidateLength(min,max)]

#[ValidatePattern("RegEx Goes Here")]

#[ValidateRange(min,max)]

#[ValidateScript({ $_ -eq "something" })]

#[ValidateSet("One","Two","Three")]

#[ValidateNotNull()]

#[ValidateNotNullOrEmpty()]

[System.Object]

$parameterName = "DefaultValue"

Hope that's helpful!

Using Powershell to search XML GPO Reports – Part II – Software Installation

noreply@blogger.com (v(^_^)v - Clint) — Thu, 11 Feb 2010 17:44:00 +0000

In Part I of our series in querying group policy reports, we learned how to:

Turn the XML output from Get-GPOReport into a System.XML.XMLDocument object
Build a System.XML.XMLNamespaceManager from the information in the XMLDocument object
Use XPath with the namespace manager and document to extract information from the report, including the Extension elements.

We left off with the Get-CGPOReportExtensionData filter, and some questions about it’s output. This week we’ll look at the output from the filter, and then use that output in another filter to transform the XML report information into an object with the details of a Software Installation extension that can easily be worked with using Powershell’s standard comparison operators and formatting cmdlets.

First, let’s examine the output of Get-CGPOReportExtensionData. When output to the console it looks like:

fullReport             : #document
extensionNamespaceURI : http://www.microsoft.com/GroupPolicy/Settings/SoftwareInstallation
namespaceMgr           : {e, q1, , xml...}
extensionNamespaceName : q1
extensionData          : Extension
GPOName                : apps-Publisher

Lets go through what each of these are.

‘FullReport’ is the XMLDocument object built from the XML output of Get-GPOReport that we found matching extension information in. This is useful in the event that we want to extract information about the group policy object itself.
‘ExtensionNamespaceURI’ is the URI for the namespace that we need in order to use XPath queries to extract information from the extension element.
‘ExtensionNamespaceName’ is the namespace name for the same thing. The namespace name is important as we have to use it in the XPath queries we build later on, the URI somewhat less so but I included it just for the sake of the completion compulsion I had at the time I wrote it.
‘NamespaceMgr’ is an XMLNamespaceManager object that, because there are namespace declarations in the XMLDocument, is necessary to be able to use the methods of the XML classes that accept XPath queries.
‘ExtensionData’ is the extension XMLNode that matched the ‘-extensionName’ parameter of Get-CGPOReportExtensionData. It will prove quite useful to use in our XPath queries later.
‘GPOName’ is the name of the group policy object that contains the matching extension data. Pretty straightforward stuff.

The only information we didn’t cover generating in the last part of this series is the extensionNamespaceURI and extensionNamespaceName, so let’s quickly cover that. The group policy folks were kind enough to make the namespace URI suffix for each extension the same as the extension’s name, without any spaces. So generating that from the extension name that we’re looking for is pretty straightforward:

    $extensionURISuffix = $extensionName -replace " "

Armed with that information we can generate the URI and use a method of the XMLElement, ‘GetPrefixOfNamespace’, to get the namespace prefix…which I now realize I have been calling the namespace name. Oops, gonna have to fix that. Anyway:

    # Get the extension specific namespace name
    $extensionNamespaceURI = "http://www.microsoft.com/GroupPolicy/Settings/$extensionURISuffix"
    $extensionNamespaceName = $extension.GetPrefixOfNamespace($extensionNamespaceURI)

And that’s about it for the basic information about the group policy object down to the extension. So now let’s dig into our first extension, Software Installation, in some detail. Don’t forget to download the updated module code and save it as a module (<moduleFolder>\clint.gputilities\clint.gputilities.psm1), and to import it into your Powershell session (Import-Module clint.gputilities) as well as importing the grouppolicy module. First, let’s get some output from our first filter to work with:

PS > $swiExtensions = Get-GPOReport –All –ReportType XML | Get-CGPOReportExtensionData –ExtensionName “Software Installation”
PS > $e = $swiExtensions[0]

At this point we should have an object, $e, that we can dig into. But to dig into it we need the namespace manager, how handy that it’s right there for the picking:

PS > $nsMgr = $e.namespaceMgr

Yeah, we could just use $e.namespaceMgr all the time but that’s kind of a pain. Next we need the namespace prefix in order to use XPath to dig into the extension information. I promise I’ll fix the variable name by next part in the series…

PS > $ns = $e.extensionNamespaceName

Alright, now we can start digging. Each software installation element can contain multiple package child elements. We only use MSI packages here, so that’s what we’ll be looking at, but if someone has an XML report for one of the few other types of installation packages I’d be glad to incorporate those. Let’s gather the MsiApplication nodeset:

PS > $msiNodes = $e.extensionData.SelectNodes(“./$ns`:MsiApplication”,$nsMgr)

There are a few things to note here. First, that we finally put the namespace prefix ($ns) from our extension data to use. Second, that we have to use the Powershell escape character ‘`’ before the colon following the namespace prefix variable. Why? Because of the way variables can be addressed. For instance, when we want to check the username environment variable we use:

PS > $env:username

The ‘:’ says, “Go to the env psdrive, and select the username childitem”. So the statement is generally ‘$PSDrive:ChildItem’. So then this has implications when we use variable expansion inside of a string. Continuing the username environment variable example, if we wanted to include it inside of a string we can use multiple methods:

PS > “My username is: “ + $env:username
PS > “My username is: {0}” –f $env:username
PS > “My username is: $env:username”

The same string will be produced in all three cases, “My username is: clint”. See the potential problem with our XPath string? We need Powershell to recognize that the namespace prefix is followed by a literal colon, otherwise it’s going to go looking for a psdrive with the name of our namespace prefix, and probably come up with nothing. So we use the ‘`’ escape character to tell Powershell the colon is literal and our XPath queries work. That diversion aside, next we’ll select the first child node in the event that there are more than one MsiApplication elements:

PS > $m = $msiNodes.item(0)

Now let’s look at how $m is presented by the console’s output:

PS > $m

Identifier          : {297a8ec5-2e10-49ed-931e-90d7cef549cb}
Name                : Microsoft Publisher 2002
Path                : \\server\share\MS Publisher 2002\PUB.MSI
MajorVersion        : 10
MinorVersion        : 0
LanguageId          : 1033
Architecture        : 0
…

Hey, easy from here, we’re done…right? Not quite. Yes, the way Powershell surfaces XML objects can make them a bit easier to work with, but it does have its flaws and starts to break down as noted in Processing XML with PowerShell. So let’s use the XML object itself to create a custom PSObject that fits our needs and that we can re-use down the pipe. There are essentially two types of XMLNodes in $m, those that only contain a single XmlText node, and those that contain other elements. The elements that only contain a single XmlText node are the easiest to create a property from. Let’s take ‘Identifier’ as an example:

PS > $m.SelectSingleNode("./$ns`:Identifier",$nsMgr).InnerText
{297a8ec5-2e10-49ed-931e-90d7cef549cb}

That’s not too tough. Which is good, because there’s a lot of those nodes in the MsiApplication node. The nodes that contain other element nodes are more complicated to turn into properties directly, most notably the SecurityDescriptor element (which we won’t tackle yet), but this can be accomplished using script blocks. Let’s take ‘Upgrades’ as our example this time. The XML itself it looks like:

<q2:Upgrades>
<q2:Mandatory>true</q2:Mandatory>
<q2:PackageInfo>
    <q2:GPOIdentifier>
      <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{7A2F01E5-895E-4029-AC3D-9F478DB4DEA7}</Identifier>
      <Domain xmlns="domain.comhttp://www.microsoft.com/GroupPolicy/Types">domain.com</Domain>
    </q2:GPOIdentifier>
    <q2:GPOName>adm-WorkStations</q2:GPOName>
    <q2:Name>Microsoft Office XP Professional</q2:Name>
    <q2:Identifier>{45b72218-66bf-41e0-beeb-881eab80dd31}</q2:Identifier>
</q2:PackageInfo>
</q2:Upgrades>

So here the ‘Mandatory’ element should be simple enough to extract, in fact in our module I decided to break it out into it’s own property, UpgradesMandatory. To get at it is fairly straightforward:

PS > $m.SelectSingleNode("./$ns`:Upgrades/$ns`:Mandatory",$nsMgr).InnerText

However, there can be multiple ‘PackageInfo’ elements under ‘Upgrades’, so we need a little more power to turn that into a property that’s complete and easy to work with. I chose to create a PSObject array and add properties to each object that reflect the data contained in GPOIdentifier, GPOName, Name, and Identifier. Though the following code isn’t complete yet, it will be soon and gets the idea across:

[PSObject[]]$arrUpgrades = @()
foreach ($p in $m.SelectNodes("./$ns`:Upgrades/$ns`:PackageInfo",$namespaceMgr))
{
    $arrUpgrades += New-Object PSObject -Property @{
        GPOIdentifier = $null #TODO: Get GPOIdentifier
        GPODomain            = $null #TODO: Get GPODomain
        GPOName                = $p.SelectSingleNode("./$ns`:GPOName",$namespaceMgr).InnerText
        Name                = $p.SelectSingleNode("./$ns`:Name",$namespaceMgr).InnerText
        Identifier    = $p.SelectSingleNode("./$ns`:Identifier",$namespaceMgr).InnerText
    }
}
Write-Output $arrUpgrades

We can follow a similar pattern to create objects from other complex nodes. So, big deal, what can we do now? Just had a use for this yesterday, in fact. We’re working on migrating most of our software distribution from Group Policy to System Center Configuration Manager and needed to know what software was being installed through Group Policy. So using this module we were easily able to produce that info with:

PS > Get-CGPOReportSoftwareInstallationData | Select-Object name,majorversion,minorversion –unique | Format-Table name,majorversion,minorversion –auto

Name                                        MajorVersion MinorVersion
----                                        ------------ ------------
Microsoft Publisher 2002                    10           0
Microsoft Office XP Professional            10           0
Microsoft Office Professional Edition 2003 11           0
Sun Java Runtime Environment                1            4

Now that I’ve been working on this little project for a few weeks off and on, I’m thinking about reworking the filters a bit for workflow reasons. So the next time we see this module it will be a little bit different, but all the guts of working with the XML remain the same. The next entry in the series we will at least complete extracting the SecurityDescriptor information, but I’m sure I’ll get more work done on this than that. The current version of the module is below.

Download clint.gputilities.psm1

Get the users that have logged on to a computer

noreply@blogger.com (v(^_^)v - Clint) — Mon, 01 Feb 2010 18:17:00 +0000

Here’s a multi-line adaptation of a quick one-liner I threw together the other day. I might have to turn this into a function and add it to my profile if I get asked this question too many more times. To answer “Who used computer x between these dates?” we can use:

 001

002

003

004 

005

006

007 
 Get-EventLog -Before '01/26/2010' -after '01/25/2010' -ComputerName computername -LogName Security | `

    where-object `

    {

        ($_.username -notmatch '^NT  AUTHORITY\\(SYSTEM|NETWORK SERVICE|LOCAL SERVICE|ANONYMOUS LOGON)$') `

        -and ($_.category -eq "Logon/Logoff")

    } | `

    select-object timegenerated,username,category,message | sort timegenerated | format-table -auto

Hope that can save some of you a little time :)

BackTrack 4 Final Now Available

noreply@blogger.com (v(^_^)v - Clint) — Mon, 01 Feb 2010 17:57:00 +0000

I’m a little behind the curve here, as the final build was posted on the 11th of January. Oh well. For the security conscious administrator, the backtrack suite makes a great tool. If you don’t know what it is, or taken the time to at least check it out, cut some time out to do so soon. It will open your eyes a bit, I promise :)

The final build, available in either .ISO or VM-ware forms, can be downloaded from http://www.backtrack-linux.org/downloads/

If you can, use the torrent links. Your download will most likely be much faster.

Using PowerShell to search Group Policy XML Reports

noreply@blogger.com (v(^_^)v - Clint) — Fri, 29 Jan 2010 20:01:00 +0000

I was going to write about creating, editing, and saving XML files using the System.XML objects today but discovered it had been covered quite well already after a quick Google search. So instead we’ll jump ahead a little bit and use PowerShell & .NET’s XML capabilities to dive into the GPO Reports that can be generated using Get-GPOReport from the grouppolicy module.

This will be the first in a small series of posts that should end up with us having a module capable of searching for any group policy setting that is recorded in the XML reports. That’s the goal, but I’m posting as I get things 90% complete so hopefully all this proves useful and you’ll be willing to bear with me.

Before that, if you need a little XML for PowerShell primer, I suggest giving these posts a read first:

Processing XML with PowerShell
Processing XML with PowerShell II
XML Part 1: Playing with RSS Feeds and XML Content
XML Part 2: Write, Add And Change XML Data

With the basics out of the way, onto the fun! Well, OK, not quite yet. First the requirements:

Windows 7 or Server 2008 R2 with the RSAT installed

That was easy. The first thing we’ll need to do is import the grouppolicy module.

PS C:\> import-module grouppolicy

But, without a group policy report to work with we’re not much of anywhere so let’s get a collection of all our reports ( probably not a good idea if you have thousands of GPOs, you’ll have to fend for yourselves ), then pick the first one to inspect.

PS C:\> $allGPOReports = Get-GPOReport –All –ReportType XML
PS C:\> $GPOReport = $allGPOReports[0]

If we inspect $GPOReport through it’s GetType() method we’ll see that it’s just a string at the moment.

PS C:\> $gporeport.gettype() | ft -auto

IsPublic IsSerial Name   BaseType
-------- -------- ----   --------
True     True     String System.Object

It’s a really long string, but a string nonetheless. Let’s do a couple of things to get a good look at it. First we’ll dump it to a file so we can open it in our favorite XML viewer/editor. Then we’ll create a System.XML.XMLDocument object to work with in PowerShell.

PS C:\> out-file -InputObject $GPOReport -FilePath C:\Temp\gporeport.xml
PS C:\> $xmlReport = New-Object system.xml.xmldocument
PS C:\> $xmlReport.LoadXml($GPOReport)

I’ve been working with a few different XML editors lately and I think I’ve settled on <oXygen/> XML Editor but we’re still in our trial period, so we’ll see. If you don’t have access to an XML IDE, then something like NotePad++ is a great alternative. Anything with syntax highlighting and code folding for XML will prove handy, however. Once you have the gporeport.xml file open, let’s look at the second line:

<GPO xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.microsoft.com/GroupPolicy/Settings">

We’re going to need those namespace declarations in order to query our report for anything, so lets setup a namespace manager with the proper information. First we’ll get the collection of namespaces declared in the line above, then populate the namespace manager with those.

PS C:\> $nsMgr = New-Object System.Xml.XmlNamespaceManager $xmlReport.CreateNavigator().NameTable
PS C:\> $namespaces = $xmlReport.CreateNavigator().GetNamespacesInScope('All')
PS C:\> foreach ($key in $namespaces.keys) { $nsMgr.AddNamespace( $key, $namespaces.$key ) }
PS C:\> $nsmgr.AddNamespace( "e", $nsmgr.DefaultNamespace )

Why that last line? The short of it is we have to prefix anything in the XML document in the default namespace with a named namespace in order for .NET to find it. The long version is in the MSDN docs. I call mine “e” because it’s easy to type. You can pick whatever you want as long as it doesn’t collide with other namespaces in the document. Okay, so now we have a System.Xml.XMLDocument object to search, and most of the namespaces we need. Most? Yep, most. But we’ll tackle that later. For now, let’s see what we get looking for an extension.

PS C:\> $xmlReport.SelectNodes( "//e:ExtensionData", $nsMgr ) | ft -auto

Extension Name
--------- ----
Extension Security
Extension Public Key
Extension Registry
Extension Remote Installation

Hey! We got results, awesome! Yours probably look different than mine, but that’s OK. So now with just a little work and a little XPATH know-how, we can look inside of our GPO reports for extensions, and a whole lot more. Last Modification Time when the report was run?

PS C:\> [datetime]($xmlReport.SelectSingleNode( "/e:GPO/e:ModifiedTime", $nsMgr ).'#text')

Friday, September 04, 2009 4:16:13 PM

Where was this GPO linked to when this report was generated?

PS C:\> $xmlReport.SelectNodes( "/e:GPO//e:LinksTo", $nsMgr ) | ft -auto

SOMName      SOMPath                                             Enabled NoOverride
-------      -------                                             ------- ----------
Aaron-PC     domain.org/00-hardware/WorkStations/ADM/ws/Aaron-PC true    false
projectorPCs domain.org/00-hardware/WorkStations/projectorPCs    true    false
psd267       domain.org                                          true    false

Which of our GPO reports have configuration for the “Files” extension?

PS C:\> $allGPOReports | Get-CGPOReportExtensionData -extensionName "Files"

fullReport             : #document
extensionNamespaceURI : http://www.microsoft.com/GroupPolicy/Settings/Files
extensionNamespaceName : q4
extensionData          : Extension
GPOName                : DriveMaps_Files_Folders_Shortcuts

fullReport             : #document
extensionNamespaceURI : http://www.microsoft.com/GroupPolicy/Settings/Files
extensionNamespaceName : q1
extensionData          : Extension
GPOName                : apps-Deploy-Audacity

Hey, what the, where did “Get-CGPOReportExtensionData” come from? And what’s with the q1/q4 namespace junk? Get-CGPOReportExtensionData is the first function in our module we’re working on. No doubt it will evolve over the next few weeks as we snorkel around (I leave the deep diving to the pros and MVPs) in the XML reports, in fact I found a better way to extract namespace info from the extensions while I wrote this post, though I haven't updated the module with it yet. The code for the module is below. Just save it as "clint.gputilities.psm1" in one of your module folders in a subdirectory called “clint.gputilities” and then import it into your PowerShell session to start using it. Hopefully we can come up with a better name by the time we’re done.

PS C:\> Import-Module clint.gputilities

Next week we’ll refine this filter a bit, and dig into our first extension: Software Installation. See you then!

     001

002

003

004

005

006

007

008

009

010

011

012

013

014

015

016

017

018

019

020

021

022

023

024

025

026

027

028

029

030

031

032

033

034

035

036

037

038

039

040

041

042

043

044

045

046

047

048

049

050

051

052

053

054

055

056

057

058

059

060

061

062

063

064

065

066

067

068

069

070

071

072

073

074

075

076

077

078

079

080

081

082

083

084

085

086

087

088

089

090

091

092

093

094

095

096

097

098

099

100

101

102

103
     filter Get-CGPOReportExtensionData

{

<#   .SYNOPSIS 

     Queries XML Reports generated by Get-GPOReport for specific Extension information 

.DESCRIPTION

  Finds the extension specified by the parameter ExtensionName in the     Report or Reports

  (i.e. Files, Registry, Software Installation).  Tacks on     the namespace information

  necessary to query the extension onto the report     as a custom PSObject and writes that 

  information to output.

.PARAMETER gpoReport

  A report generated by Get-GPOReport -reportType XML.

.PARAMETER namespaceMgr

  If no namespace manager is assigned to this value, the default    namespaces for group 

  policy XML reports are used.

.PARAMETER extensionName

  The name of the group policy extension that you wish to find in the reports.

  Valid names I am currently aware of:

    Security,Public Key,Registry,Remote Installation,Internet Explorer Maintenance,

    Software Installation,Scripts,Folder Redirection,Printers,Windows Firewall,

    Software Restriction,Drive Maps,Shortcuts,Folders,Files,Windows Registry,

    Environment Variables,WLanSvc Networks,Folder Options,Start Menu,

    Deployed Printer Connections Policy,Ini Files

.EXAMPLE

  Get-GPOReport -All -ReportType XML | Get-CGPOReportExtension Data -ExtensionName "Drive Maps"

.INPUTS

  [System.XML.XMLDocument]

.OUTPUTS

  [System.Management.Automation.PSCustomObject]

.NOTES

  Todo.

.FUNCTIONALITY

  Todo.

 #>

  #region cmdletbinding

  [CmdletBinding()]

  #endregion

  #region parameters

  param

  (

    [parameter(

      Mandatory=$true,

      ValueFromPipeline=$true

      )]

    [Xml.XmlDocument]

    $gpoReport,

    [parameter(

      Mandatory=$false

      )]

    [Xml.XmlNamespaceManager]

    $namespaceMgr,

    [parameter(

      Mandatory=$true

      )]

    [String]

    $extensionName

  )

  #endregion

  process

  {

   # Build a namespace manager if we don't have one

  if (-not $namespaceMgr)

  {

   # Create a namespace manager from our navigator object's nametable

   $namespaceMgr = New-Object System.Xml.XmlNamespaceManager $gpoReport.CreateNavigator().NameTable

   $namespaceMgr.AddNamespace( "e", "http://www.microsoft.com/GroupPolicy/Settings" )

  }

    # We're going to cheat and use Posh's dotted notation to get the GPO name

    # there is only one GPO node (it's the root), and only one Name element

    $GPOName = $gpoReport.GPO.Name

    # Gather the Extensions that match the our queryCSE

    $extensions = $gpoReport.selectnodes("/e:GPO//e:ExtensionData[e:Name = '$extensionName']/e:Extension", $namespaceMgr)

    foreach ($extension in $extensions)

    {

      # Init the extension specific namespace variable

      $extensionNamespaceName = $null

      $extensionNamespaceURI  = $null

     # We need the Extension child element of this ExtensionData element

     # and have to extract the specific namespaces assigned for Extension

     # by the 'Get-GPOReport' cmdlet

     $eNavigator = $extension.CreateNavigator()

     $eNamespace = $eNavigator.GetNamespacesInScope('All')

     foreach ($key in $eNamespace.keys)

     {

       # The namespace assignments we're looking for are always named 'q1', 'q2', ... 'q99'

       # If there's more than a hundred, someone needs to start splitting up their GPOs, :)

       if ($key -match '^q\d{1,2}$')

       {

        # Now we have the namespace assignment that is valid to query this element

        $gpoExtInfo = New-Object PSObject -Property @{

                  GPOName    = $GPOName

                  fullReport   = $gpoReport

                  extensionData  = $extension

                  extensionNamespaceName  = $key

                  extensionNamespaceURI   = $eNamespace.$key

                  }

       }

      }

      Write-Output $gpoExtInfo

    }

  }

}

Export-ModuleMember Get-CGPOReportExtensionData