PMI Blue Papers

Change PowerShell Version used by Orchestrator

2021-11-10T22:01:00.000-05:00

System Center Orchestrator 2012 R2 limits the version of PowerShell available to runbooks to PowerShell Version 2.0. To leverage the capabilities of current PowerShell versions you can make the following registry change on each of the Orchestrator Runbook servers.

Change PowerShell Version used by Orchestrator

Force Orchestrator to utilize the highest installed version of PowerShell by setting the registry value below. This may impact the ability for other applications, or scripts which depend on lower .NET / PowerShell versions to execute properly.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework

DWord-Value OnlyUseLatestCLR = 1

Validation:

Create a Runbook with a "Run .Net Script" activity.

Configure the activity with the following details:

Language: PowerShell

SCRIPT1: $CLRversion = (get-host).version

$PSversion = $PSVersionTable.PSVersion

Another option:

If you're have a limited need to execute PowerShell in Orchestrator Runbooks, or are not able to use the procedure above, then try this. In the Run .NET Script activity, run your PowerShell code inside of a script block

$return = PowerShell { ###Add script here### }

Running PowerShell code inside a scriptblock is the same process used when executing PowerShell code in an SMA PowerShell Workflow based runbook.

Installing Remote Administration Tools

2016-03-08T20:21:00.000-05:00

When working with Configuration Manager, I find it useful to have some basic Windows Remote Administration Tools handy on the same system where you plan to run the Configuration Manager Console from. I like to ensure these are installed on each Site Server, however this may not be appropriate for all environments.

These Remote Administration Tools are NOT REQUIRED for System Center 2012 Configuration Manager servers.

From Server Manager, click on the Manage menu, then select Add Roles and Features.
Select the Role Based or feature-based installation option, then click Next.
Ensure the localhost (or the target servers where you intend to deploy these Roles and Features) is selected, and click Next.
Click on Features in the left pane. Scroll down to Remote Server Administration Tools and expand it. Then expand Role Administration Tools. Scroll down and select each of the following features:

Group Policy Management
Role Administration Tools
AD DS and AD LDS Tools

DNS Server Tools

File Services Tools

Network Policy and Access Services Tools
Click Next, then Install.

Windows Server 2012, System Center 2012 Configuration Manager

Installing Windows Software Update Services on Windows Server 2012

2016-03-07T20:21:00.000-05:00

On Windows Server 2012, Windows Server Update Services is installed as a Role, If you are not using Windows Server 2012, reference Appendix C – Guidance for Windows Server 2008 R2 OS.

From Server Manager, click on the Manage menu, then select Add Roles and Features.
Select the Role Based or feature-based installation option, then click Next.
Ensure the localhost is selected, and click Next.
In the Roles list, scroll to the bottom and select, Windows Server Update Services.
Click on Features in the left pane. Scroll down to Remote Server Administration Tools and expand it. Then expand Role Administration Tools. Scroll down and select Windows Server Update Services Tools. Click Next.
You will be prompted to select Role Services for WSUS. The WID Database and WSUS Services options should be selected
On the Content location slection screen, click the Store updates in the following location, check box to enable it. Then enter E:\WSUS\ (or an alternate path. Ensure this location is not your system drive, and contains enough storage for all downloaded updates). Click Next, then Install.

Windows Server Update Services, System Center 2012 Configuration Manager, Windows Server 2012

Installing the Microsoft Assessment and Deployment Kit (ADK) for Configuration Manager

2016-03-06T20:21:00.000-05:00

Download the Microsoft Assessment and Deployment Kit (ADK)

http://www.microsoft.com/en-us/download/details.aspx?id=30652

This process can be used to install Windows Deployment Services, as a standalone service, or as a pre-requisite for System Center 2012 Configuration Manager.

Execute adksetup.exe.
Enter %InstallPath%\Windows Kits\8.0\ (Where %InstallPath% is the desired installation directory.) in to the Install Path field. Click Next.
Select either Yes or No, when asked if you wish to Join the Customer Experience Improvement Program, then click Next.
Click Accept on the License Agreement screen. Click Next.
When prompted select the features you want to install. To meet Configuration Manager prerequisites, ensure the following are selected then click Install:

Deployment Tools
Windows Preinstallation Environment (Windows PE)
User State Migration Tool (USMT)
Windows Performance Toolkit
Windows Assessment Services
Microsoft SQL Server 2012 Express

ADK Features Required for System Center 2012 Configuration Manager

Once the installation completes, click the Close button

Installing Windows Software Update Services 3.0 SP2 (Windows Server 2008 R2)

2016-03-05T20:21:00.000-05:00

This process details the installation of Windows Software Update Services 3.0 SP2 on Windows Server 2008 R2, as it is needed for installations of System Center 2012 Configuration Manager.

Launch Server Manager and click Add Roles.
From the list of Roles to install, select Windows Server Update Services. Click Next
The Add Roles Wizard pop-up will indicate additional role services are required to be installed. Click the Add Required Role Services button.
Click Next through the next three dialog screens without making changes, then Install on the summary screen.
After Role installation, the Windows Server Update Services 3.0 SP2 Setup Wizard will launch. Click Next to begin.
Accept the Licence Agreement by clicking the I accept the terms of the License Agreement radio button, then click the Next button.
If you did not install Report Viewer, you’ll receive a warning message indicating it is a required component for the WSUS UI. (It can be installed any time and is not required for SCCM.) Click Next.
Specifiy a location to store update source files. (F:\WSUS) Click Next.
When prompted for a database to use, specify the name of the database server being used for SCCM. Click Next.
On the Web Site Selection screen, select the option, Create a Windows Server Update Services 3.0 SP2 Web Site. This will create a new web site in IIS with a port of 8530. Click Next.

Create WSUS Web Site
Review the settings provided for the WSUS install, and click Next.
Once the installation is complete, click Finish.

Once WSUS is installed the Configuration Wizard automatically launches. This configuration is performed by Configuration Manager, so you do not need to complete the configuration wizard now. Simply click Cancel or the close button to exit out of the wizard.

Windows Server 2008 R2, System Center 2012 R2 Configuration Manager, Windows Software Update Services

Add Roles & Features (Windows Server 2008 R2) for System Center 2012 R2 Configuration Manager

2016-03-04T20:21:00.000-05:00

The following PowerShell code will install the required Web Server Role with the appropriate services and additional required Windows Features.

Windows PowerShell

Import-Module ServerManager
Add-WindowsFeature NET-Framework,BITS,RDC,Web-ASP-Net,Web-ASP,Web-Windows-Auth,Web-WMI,Web-Metabase

Add Roles & Features for System Center 2012 R2 Configuration Manager

2016-03-03T02:10:00.005-05:00

The following PowerShell code will install the required Web Server Role with the appropriate services and additional required Windows Features.

Windows PowerShell

Import-Module ServerManager
Add-WindowsFeature NET-Framework-Core,BITS,RDC,Web-ASP-Net,Web-ASP,Web-Windows-Auth,Web-WMI,Web-Metabase

You may require additional Roles or Features depending on your environment. If you already have a system deployed with the required Roles and Features, you can Install Windows Roles and Features Using a Template Server.

Graphical Interface

If you chose to manually install the required Roles and Features:

On Windows Server 2012, from Server Manager, click the Manage link, then select Add Roles and Features.
On the Installation Type section of the Wizard, select the Role-based or feature-based installation option.
Proceed through the Wizard, following the prompts to install the appropriate Roles and Features to the desired server(s).

Ensure all of the following are installed and enabled:

Web Server (IIS) role should be installed with the following list of role services:

Static Content
Default Document
Directory Browsing
HTTP Errors
HTTP Redirection
ASP.NET
.NET Extensibility
ISAPI Extensions
ISAPI Filters
HTTP Logging
Logging Tools
Request Monitor
Tracing
Windows Authentication
Request Filtering
Static Content Compression
Dynamic Content Compression
IIS Management Console
IIS 6 Metabase Compatibility
IIS 6 WMI compatibility

Installing Additional Windows Roles & Features:

Background Intelligent Transfer Service (BITS)
Remote Differential Compression
Web Server (IIS) Tools
BITS Server Extensions Tools
Windows Server Update Services
Network Policy Server

If you are not using Windows Server 2012, reference Appendix C – Guidance for Windows Server 2008 R2 OS - Add Roles & Features (Windows Server 2008 R2).

System Center 2012 R2 Configuration Manager, Windows Server 2012 R2, Windows Server 2012

Service Manager Reports: Incident Dataset Sample

2015-12-08T00:43:00.001-05:00

Service Manager Reports: Incident Dataset Sample

The T-SQL query below returns a basic set of properties to generate a report of Incidents. It was written in a basic format to demostrate how to pull the required incident information, from the multiple DWDataMart Views.

As the WorkItemDimvw is used as the base of the SELECT statement, the values selected could be easily modified to return information from Problems, Incidents, Activies, and Change Requests.

File Name: SMIncidents.rsd

Created By: England, Matthew D.

Modified: 20151122:0440

Description: Returns Incident properties and related property values. This query is intended to be used by SSRS as a Shared Cached Dataset.

SELECT

/* Entity Properties */

EntityDimvw.LastModified AS [Modified],

/* WorkItem Properties */

WorkItemDimvw.Id AS [Id],

WorkItemDimvw.IsDeleted AS [Archived],

/* Incident Properties */

IncidentDimvw.Title AS [Title],

IncidentDimvw.CreatedDate AS [Created],

IncidentDimvw.ResolvedDate AS [Resolved],

IncidentDimvw.ClosedDate AS [Closed],

IncidentDimvw.FirstResponseDate AS [First Response],

IncidentDimvw.FirstAssignedDate AS [First Assigned],

IncidentDimvw.Priority AS [Priority],

IncidentDimvw.Description AS [Description],

IncidentDimvw.IsParent AS [Is Parent],

IncidentDimvw.Major_Incident AS [Major Incident],

/* Look Up Values */

[Classification] = IncidentClassificationvw.IncidentClassificationValue,

[Source] = IncidentSourcevw.IncidentSourceValue,

[Impact] = IncidentImpactvw.IncidentImpactValue,

[Urgency] = IncidentUrgencyvw.IncidentUrgencyValue,

[Support Group] = IncidentTierQueuesvw.IncidentTierQueuesValue,

[Status] = IncidentStatusvw.IncidentStatusValue,

[Resolution Category] = IncidentResolutionCategoryvw.IncidentResolutionCategoryValue,

/* User Fields */

[Assigned To] = AssignedToUser.DisplayName,

[Affected User] = AffectedUser.DisplayName,

[Affected User Company] = AffectedUser.Company,

[Created By] = CreatedByUser.DisplayName,

[Primary Owner] = PrimaryOwner.DisplayName,

[Resolved By] = ResolvedByUser.DisplayName

FROM WorkItemDimvw

INNER JOIN EntityDimvw

ON WorkItemDimvw.EntityDimKey = EntityDimvw.EntityDimKey

INNER JOIN IncidentDimvw

ON IncidentDimvw.EntityDimKey = WorkItemDimvw.EntityDimKey

/* Joins for Lookup Values */

LEFT OUTER JOIN IncidentClassificationvw

ON IncidentDimvw.Classification_IncidentClassificationId = IncidentClassificationvw.IncidentClassificationId

LEFT OUTER JOIN IncidentSourcevw

ON IncidentDimvw.Source_IncidentSourceId = IncidentSourcevw.IncidentSourceId

LEFT OUTER JOIN IncidentImpactvw

ON IncidentDimvw.Impact_IncidentImpactId = IncidentImpactvw.IncidentImpactId

LEFT OUTER JOIN IncidentUrgencyvw

ON IncidentDimvw.Urgency_IncidentUrgencyId = IncidentUrgencyvw.IncidentUrgencyId

LEFT OUTER JOIN IncidentTierQueuesvw

ON IncidentDimvw.TierQueue_IncidentTierQueuesId = IncidentTierQueuesvw.IncidentTierQueuesId

LEFT OUTER JOIN IncidentStatusvw

ON IncidentDimvw.Status_IncidentStatusId = IncidentStatusvw.IncidentStatusId

LEFT OUTER JOIN IncidentResolutionCategoryvw

ON IncidentDimvw.ResolutionCategory_IncidentResolutionCategoryId = IncidentResolutionCategoryvw.IncidentResolutionCategoryId

/* Joins for User Relationships */

Left Outer Join dbo.WorkItemAssignedToUserFactvw

ON WorkItemDimvw.WorkItemDimKey = WorkItemAssignedToUserFactvw.WorkItemDimKey

And WorkItemAssignedToUserFactvw.DeletedDate IS NULL

Left Outer Join dbo.UserDimvw AssignedToUser

ON WorkItemAssignedToUserFactvw.WorkItemAssignedToUser_UserDimKey = AssignedToUser.UserDimKey

Left Outer Join dbo.WorkItemAffectedUserFactvw

ON WorkItemAffectedUserFactvw.WorkItemDimKey = WorkItemDimvw.WorkItemDimKey

And WorkItemAffectedUserFactvw.DeletedDate IS NULL

Left Outer Join dbo.UserDimvw AffectedUser

ON WorkItemAffectedUserFactvw.WorkItemAffectedUser_UserDimKey = AffectedUser.UserDimKey

Left Outer Join dbo.WorkItemCreatedByUserFactvw

ON WorkItemCreatedByUserFactvw.WorkItemDimKey = WorkItemDimvw.WorkItemDimKey

And WorkItemCreatedByUserFactvw.DeletedDate IS NULL

Left Outer Join dbo.UserDimvw CreatedByUser

ON WorkItemCreatedByUserFactvw.WorkItemCreatedByUser_UserDimKey = CreatedByUser.UserDimKey

Left Outer Join IncidentHasPrimaryOwnerFactvw

ON IncidentHasPrimaryOwnerFactvw.IncidentDimKey = IncidentDimvw.IncidentDimKey

AND IncidentHasPrimaryOwnerFactvw.DeletedDate IS NULL

Left Outer Join dbo.UserDimvw PrimaryOwner

ON IncidentHasPrimaryOwnerFactvw.IncidentPrimaryOwner_UserDimKey = PrimaryOwner.UserDimKey

Left Outer Join dbo.IncidentResolvedByUserFactvw

ON IncidentResolvedByUserFactvw.IncidentDimKey = IncidentDimvw.IncidentDimKey

AND IncidentResolvedByUserFactvw.DeletedDate IS NULL

Left Outer Join dbo.UserDimvw ResolvedByUser

ON IncidentResolvedByUserFactvw.TroubleTicketResolvedByUser_UserDimKey = ResolvedByUser.UserDimKey

/* Where Clause Requires Parameters Defined in Report, or in TSQL depending on execution method.*/

WHERE IncidentDimvw.CreatedDate BETWEEN @StartDate AND @EndDate

Question: Placing Service Manager Management Servers in Maintenance Mode

2015-10-24T03:00:00.000-04:00

Question:

Can the Service Manager servers be put into Maintenance Mode or should they be excluded since they run the same back end as SCOM?

Answer:

While System Center Service Manager uses the some of the same code as previous Operations Manager versions, the functionality they provide and how that code is used, has nothing to do with SCOM itself. Service Manager is mainly leveraging the workflow engine for processing data and communicating with the databases. As far as SCOM Maintenance Mode is concerned, these are just Managed Agents like any other server because Maintenance Mode is processed on the SCOM Management Servers.

For a bit of background:

There are two primary issues with a SCOM Management Server being in Maintenance Mode.

Once a Management Server is in Maintenance Mode, it cannot take itself out of Maintenance Mode.
A SCOM Management Server in Maintenance Mode will no longer process jobs/rules/sql stored procedures, or accept communications from agents, so all monitoring for every server it manages comes to a screeching halt. (In SCOM 2007, for the RMS, this meant the entire Management Group would be unmonitored, even if other Management Servers were still online.)

This was a major issue in SCOM 2007, however much of this has been resolved in 2012. Microsoft worked hard to make SCOM 2012 more scalable, and resilient. The achilles of SCOM 2007, was the Root Management Server. To get rid of that single point of failure in SCOM, Microsoft redesigned the Management Configuration Service, so that if a Management Server is unavailable its workflows will be moved to a different Management Server the Management Server Resource Pool.

That’s the catch… you have to be running more than one Management Server in the Management Server Resource Pool, or you will not see any benefit, because there is no place for the Management Configuration Service to move these functions too. In 2012, Management Servers can go in and out of Maintenance Mode, as long as there is always at least one Management Server in the All Management Servers Resource Pool to continue the work.

Maintenance Mode, is actually a SCOM Rule targeted at the Resource Pool. Because Service Manager Managment Servers, are not part of the Management Servers Resource Pool, (actually they’re not even part of the same Management Group), do not run SCOM Workflows, are not responsible for putting themselves in to or out of maintenance mode, and process no information from other agents, there is no issue using Maintenance Mode for these systems.

Mail Enable all Groups in a Specified OU

2015-04-22T08:21:00.000-04:00

Mail Enable all Active Directory Groups in a Specified OU

I wrote up the following script to support a System Center 2012 R2 Service Manager deployment. A series of Security Groups were used to support user roles and workflows within Service Manager, however these groups were not originally mail enabled. Luckily, all of the groups resided in the same OU, called "Service Manager", so mail enabling the lot was pretty simple.

The following can be executed from the Exchange Shell.

Make sure you modify the SearchBase and Domain names to match your environment.

# Mail Enable all Groups in the Specified OU, ensuring SMTP Address matches the DisplayName, excluding any spaces.
$Groups = Get-ADGroup -SearchBase "OU=Service Manager Groups,OU=TenIT,DC=TenIT,DC=us" -Filer *

ForEach ($Group in $Groups)
{
    Enable-DistributionGroup -Identity $Group.DistinguishedName -PrimarySMTP (($Group.DisplayName -replace '\s+', "") + '@tenit.us')

}

Modify the following:

"OU=Service Manager Groups,OU=TenIT,DC=TenIT,DC=us"
'@tenit.us'

Using the "-WhatIf" parameter with the Import-SCManagementPack cmdlet

2015-04-15T08:21:00.000-04:00

Using the "-WhatIf" parameter with the Import-SCManagementPack cmdlet

In short... don't do this.

PS> Import-SCManagementPack -Fullname "\\networkshare\managementpack.mpb" -WhatIf

If you run Get-Help Import SCManagementPack -Detailed, and scroll down toward the bottom a bit, you'll see the description for this parameter:

"-WhatIf [<SwitchParameter>]
Describes what would happen if you executed the command without actually executing the command."

Oops! Somebody got that one wrong. Go ahead and try it. Then go ahead and run the Get-SCManagementPack cmdlet

PS> Get-SCManagementPack -DisplayName "managementpack"

That's right! The management pack was installed. On this cmdlet, using Service Manager 2012 R2, the WhatIf paramerter will not prevent execution of the command as it is suppose to.

Realistically, in this situation, there's likely no harm done. The Management Pack, which at some point, you planned to Import, has been imported. If you were using this to ensure you typed the file path correctly, try using Test-Path instead.

PS> $ManagementPack = "\\networkshare\managementpack.mpb"
PS> If (Test-Path ("$ManagementPack"))
{Import-SCManagementPack "$ManagementPack"}

Bulk Import of Service Manager Management Packs

Yes. It's a bit more typing, but how many Management Packs do you plan on importing? More than one? Try wrapping this in a ForEach loop. You can find all of the *.MPB files located in a specific directory, then import each one.

PS> $BasePath = "\\networkshare\"
PS> $MPList = Get-ChildItem $BasePath -Recurse -Name "*mpb"

PS> foreach ($MP in $MPList) {
PS> $ManagementPack = $BasePath + $MP
PS> If (Test-Path ("$ManagementPack"))
{Import-SCManagementPack "$ManagementPack"}
}

Replace the $BasePath with the location where your MP's are located. Ensure the last backslash is included in this string.

This script will search for any MPB files located in the specified directory and sub-directories, then import them in to SCSM.

Please be aware, this script will not look for any dependencies. If you have a specific order in which certain management packs should be applied, you will want to deal with those outside of this script.

And there you have it! How to turn a one sentence post warning about a non-functional -WhatIf parameter in to a full page post.

Please let me know if you found this information helpful, if you find any inaccuracies or have questions.

Service Manager 2012 Exchange Web Service DLL Versions

2015-04-08T08:21:00.000-04:00

Service Manager 2012 Exchange Web Service DLL Versions

Service Manager Exchange Connector

If you've worked with System Center much, then you're already aware of the nuances surrounding product and file versions. Implementing the Exchange Connector for Service Manager, is just one more instances where incorrect file versions can cause you to spend absurd amounts of time troubleshooting errors.

Here are the correct DLL versions to use for Service Manager 2012:

Service Manager 2012 SP1 - Microsoft.Exchange.WebServices.dll version 14.3.32.0 - (API v 1.2.0)
Service Manager 2012 R2 - Microsoft.Exchange.WebServices.dll version 14.3.67.1 - (API v1.2.1)

As of the time of this post, the latest Exchange Web Services API released is version 2.2. Do not try to install the latest version.

Install Windows Roles and Features Using a Template Server

2015-04-01T08:21:00.000-04:00

Install Windows Roles and Features Using a "Template" Server

If you've ever found yourself referencing an existing server build's installed windows features to deploy a new system with the same or similar build, then this will be a time saver for you.

The following PowerShell code can be run on the local system. It will need WinRM access to the source machine.

PS> $SourceMachine = "MyComputer"
PS> Get-WindowsFeature -ComputerName $SourceMachine | Where {$_.Installed -eq "Installed"} | Install-WindowsFeature

Now that you have this morsel, you can play with it to help automate your build process further. For example, the Install-WindowsFeature cmdlet also supports the -ComputerName parameter, and accepts arrays, so you could, for example, deploy the identical set of Windows Features to all 4, 8 or 16+ cluster nodes simply by suppliing the comma separated list of computer names, such as:

PS> Install-WindowsFeature {FEATURE} -Computer "targetA","targetB"

How did you use this script? Post a comment and let us know.

Service Manager: Using the AD Connector's AD Group Import option to add CI's

2015-03-25T20:21:00.000-04:00

Service Manager: Using the AD Connector's AD Group Import option to add CI's

A very efficient way to create CI's in service manager is to use AD Groups. When you select an AD Group to import using an AD Connector, then select the option to "Automatically add users of AD Groups imported by this connector", you can easily control which users are pulled in to Service Manager, without the processing overhead of using a complex query.How you then populate this AD group is up to you. Perhaps you have a user provisioning system, Orchestrator, or plan to use PowerShell to script it.

There is a catch, but it's a very small one. SCSM will only import group members if the selected AD Group scope is set to Universal. When a Global or Local scope type is set, SCSM will sync the connector without errors, but will not enumerate the AD Group membership or create CIs for its members.

While ultimately, you will still need to define some criteria for inclusion of members in this AD Group, you can gain substantially more control over what your AD Connector imports using this technique. Probably the best part however, is that you can modify your inclusion criteria at any time without ever needing to re-create the AD Connector.

Locating SCSM/SCOM Management Group Names

2015-01-09T17:03:00.001-05:00

Like Operations Manager, Service Manager, and the Data Warehouse have unique Management Group Names, however these are not displayed within the Service Manager console. To locate them, you'll need to either query the SQL Database(s), or find the value for the Server Management Groups key stored in the Registry.

Here's how you can find the Server Name in the registry using Powershell.

Windows PowerShell:

PS> Get-ChildItem "hklm:\Software\Microsoft\Microsoft Operations Manager\3.0\Server Management Groups"

Name Property
---- --------
SMMG01 IsServer : 1
UseActiveDirectory : 0
AcceptIncomingConnections : 1
Port : 5273
RequireAuthentication : 1
RequireEncryption : 1
RequireValidation : 1
Request Compression : 1
PS >

Protect OU's from Accidental Deletion

2015-01-09T15:07:00.000-05:00

Protect OU's from Accidental Deletion

The Active Directory Directory Services Best Practices Analyzer checks to ensure all OU's have the Protect Against Accidental Deletion flag checked. If one is not, a the Severity level will increase to Warning.

USA RingCentral Fax - 30-Day Free Trial

If you received this warning, and didn't just ignore it, then you likly opened up Active Directory Users and Computers, expanded your OU Hierarchy sat back and sighed after seeing what in some organizations could amount to hundreds of OU's.

Enter the quick fix.

To see how many unprotected OU's you have in your Active Directory domain, simply run;

PS> $UnprotectedOU = Get-ADOrganizationalUnit -Filter 'Name -like "*"' -Properties ProtectedFromAccidentalDeletion |Where {$_.ProtectedFromAccidentalDeletion -eq $False}
PS> $UnprotectedOU.COUNT
3

To ensure all OU's in your domain have the Protected From Accidental Deletion flag set, you can execute the following:

PS> Get-ADOrganizationalUnit -Filter 'Name -like "*"' -Properties ProtectedFromAccidentalDeletion |Where {$_.ProtectedFromAccidentalDeletion -eq $False} | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $True

If you would prefer to unprotect all of your OU's just flip the $True and $False values in the above code.

Now when we run the original script again, we'll see that all OU's are now protected.

PS> $UnprotectedOU = Get-ADOrganizationalUnit -Filter 'Name -like "*"' -Properties ProtectedFro
mAccidentalDeletion |Where {$_.ProtectedFromAccidentalDeletion -eq $False}
PS> $UnprotectedOU.COUNT
0

You can now re-run AD DS BPA.

PowerShell: GPO Report & Backup Scripts

2014-03-12T03:00:00.000-04:00

PowerShell: GPO Report & Backup Scripts

Regularly I'm faced with the need to document Group Policies in place on a domain. Luckily, Microsoft makes it pretty easy to do this using PowerShell as shown below.

Generate a Single Report of All Domain GPO's

PS> Get-GPOReport -All -Domain $Domain -ReportType HTML -Path $Directory

While the Get-GPOReport cmdlet with the -All switch, works well, opening the report it creates can be problematic. Because the browser needs to load the entire report containing every GPO setting in the domain in to memory before it can be viewed, you may find yourself waiting... and waiting for the report to render, only to have IE crash.

To work around this problem the script below will create a dated directory in My Documents, then generate a single HTML based report for each GPO located within the specified domain.

Generate a separate report for each GPO in a Domain

# Create individual report for each GPO in a domain.

$Today = Get-Date -UFormat "%Y%m%d"
$Profile = $env:USERPROFILE
$Directory = $Profile + "\Documents\GPOReports_" + $Today
$Domain = Write-Host "FQDN"

if (Test-Path -Path $Directory)
{
    Write-Host -ForegroundColor Red "Directory Exists. Existing reports in the directory may be overwritten if GPO's have the same name."
}
else
{
    Write-Host "Directory Not Found"
    New-Item -ItemType Directory -Path $Directory
}

Import-Module GroupPolicy

$GPOList = Get-GPO -All -Domain $Domain
ForEach ($Id in $GPOList)
{
    $GUID = $Id.Id
    $DisplayName = $Id.DisplayName
    Get-GPOReport -GUID $GUID -ReportType HTML -Path $Directory\$DisplayName.html
}

As you can see, the script above isn't very complicated. If you skip down to the secton after Import-Module GroupPolicy, we're quering for a list of GPO's then saving that to a PowerShell object.

Next, we loop through the new GPOList object, and run the Get-GPOReport cmdlet, for each of the GPO's in the GPOList object we created. All the rest is really just window dressing.

Cmdlet to Backup All GPO's

Backup-GPO -All -Domain "domain.com" -Path "\\server\share"

Function to Generate an HTML Report of each Domain GPO, and optionally, Backup each GPO at the same time.

Expanding on this a little further, I decided there are times when I might want to also backup each GPO at the same time the report is generated.
The script below, generates a single report for each GPO in a domain, then immediately creates a backup of each GPO. The script can be scheduled to run daily. Each day it will generate a new directory for reports and backups using the days date in a YYYYMMDD format.

Function fn-GPOSave
{
<#
.Synopsis
Function used to backup and generate HTML based reports of each GPO in a domain.
.Description
The primary intent of this to create an individual report of all GPO's in the domain to be used 
for a variety of documentation purposes. The function was created because generating a single
report containing all GPO objects in a large domain environment, would result in issues being
able to open and view the report.

As an added benefit, the script will optionally backup each GPO after generating a report. This
ensures your GPO's are both documented and protected.

The reports & backup files are stored in a directory, created by the script if it yet exists.
Any contents of the directory will be overwritten when the script runs, so only one report/backup
can be created per Path per day. The date is appended to the "Reports_", and "Backup_" directories.
  BP140031201
CREATED BY: England, Matthew (http://pmibluepapers.blogspot.com/2014/03/BP14031201.html)

.Example
fn-GPOSave -Domain "myaddomain.com" -Path "\\fileshare.myaddomain.com\share" -BackupDesired $True
This example will generate an HTML report of each GPO and save it to 
"\\fileshare.myaddomina.com\share\GPOReports_$Today\". It will then create a backup of each GPO saving it to
the same share in a directory called GPOBackups_$Today\, where $Today represents todays date.
.Parameter Domain
This parameter is required and is positional. (Position 1)
The fully qualified domain name for the domain containing the desired GPO's should be entered, as in the examples.
.Parameter Path
This parameter is optional, and is positional. (Position 2)
If no path is specified, the default value of "My Documents" is used, for the user running the script.
.Parameter BackupDesired
This parameter is optional, and is positional. (Position 3)
This is a Bool value. You can enter $TRUE or 1, if you desire backups.
If you only want to generate HTML reports, supply a value of $FALSE or 0.
If no option is specified, then no backups are run, and only reports will be generated.
#>

    [CmdletBinding()]
    Param(
        [Parameter(Mandatory=$True,Position=1)]
        [string]$Domain,
        [Parameter(Mandatory=$False,Position=2)]
        [string]$Path = $env:USERPROFILE+"\Documents",
        [Parameter(Mandatory=$False,Position=3)]
        [bool]$BackupDesired = $False
    )


$Today = Get-Date -UFormat "%Y%m%d"
$ReportPath = $Path + "\GPOReports_" + $Today


if (Test-Path -Path $ReportPath)
{
    Write-Host -ForegroundColor Red "Directory Exists. Existing reports in the directory may be overwritten if GPO's have the same name."
}
else
{
    Write-Host "Directory Not Found"
    New-Item -ItemType Directory -Path $ReportPath
}

Import-Module GroupPolicy

$GPOList = Get-GPO -All -Domain $Domain
ForEach ($Id in $GPOList)
{
    $GUID = $Id.Id
    $DisplayName = $Id.DisplayName
    Get-GPOReport -GUID $GUID -ReportType HTML -Path $ReportPath\$DisplayName.html

}

##### GPO BACKUP SECTION

if ($BackupDesired)
{
    $BackupPath = $Path + "\GPOBackups_" + $Today
    if (Test-Path -Path $BackupPath)
    {
        Write-Host -ForegroundColor Red "Directory Exists. Existing reports in the directory may be overwritten if GPO's have the same name."
    }
    else
    {
        Write-Host "Directory Not Found"
        New-Item -ItemType Directory -Path $BackupPath
    }

    ForEach ($Id in $GPOList)
    {
        $GUID = $Id.Id
        Backup-GPO -GUID $GUID -Path $BackupPath
    }
}
}

After Thoughts

As I mentioned, my original goal here was simply to document, the GPO's, using the GPO-Report cmdlet. Because adding backup came later, it's not ideal, but still it gets the job done.
Once I was finished writing this script, I immediately began to think of how it could be improved by ensuring the Backup & Report names are easily associated with each other. As I learn more, I may come back and update this script, or post a link to an updated version.

I'd love to hear your feedback. Perhaps I can try to incorporate some of your ideas.

Configuration of Active Directory System Management Container

2014-03-07T03:00:00.000-05:00

Configuration of Active Directory System Management Container

If you've made the decision to integrate System Center Configuration Manager with Active Directory, then you will need to follow the steps below in order to create a container with permissions to allow the SCCM Site Servers to be published to AD.

Procedure

Create a Universal Security Group called “ConfigMgr Site Servers” in the AD domain.
The name of the container really isn't important, but it should be identifiable.

SCCM Site Server Universal Security Group
Launch ADSI Edit (adsiedit.msc).
Expand the Default Naming Context, and Fully Qualified Domain till CN=System is visible in the navigation pane.
Right click on CN=System and select New, then Object from the context menu.
From the Create Object dialog, select “container” from the Class list, then click Next.
In the Value text box, type the name for the container, “System Management”, then click Next & Finish.
Right click on the newly created System Management container and click Properties from the context menu.
In the Properties dialog box, click the Security tab, then click Advanced.
On the Permissions tab, click the Add button and type ConfigMgr Site Servers, to add permissions to the group, “ConfigMgr Site Servers” created in Step 1. Click OK.

"ConfigMgr Site Server" Container Permissions
On the Permissions Entry dialog, ensure Apply to is set to “This object and all descendant objects” then click Full Control = Allow, then OK, OK and OK to apply the permission changes and exit all the dialogs.

Check and Apply for Hotfix KB2552033 (Windows Server 2008 R2)

2014-03-05T10:00:00.000-05:00

Check and Apply for Hotfix KB2552033
(Windows Server 2008 R2)

If installing an SCCM 2012 Site Server on Windows Server 2008 R2, ensure that Microsoft hotfix KB2552033 is installed. The following PowerShell code can check for the hotfix.

PS > Get-Hotfix –id KB2552033

If it is missing, visit http://support.microsoft.com/kb/2552033 to obtain details about the hotfix and download the installer.

Once downloaded, extract the ZIP file, and execute the Windows Update Stand Alone Installer. You will be prompted if you want to install the hotfix for Windows (KB2552033) Click Yes, then Restart Now.

Re-run the PowerShell cmdlet above to verify the hotfix was successfully applied.

Extending the AD Schema for SCCM 2012

2014-03-01T03:00:00.000-05:00

Extending the Active Directory Schema for System Center Configuraiton Manager 2012

Extending the Active Directory Schema is optional and may be performed at any time. Below are the step by step instructions for two simple methods to apply the schema extenstions.

Method 1: Using ExtADSch.exe
Method 2: Using LDIFDE

SCCM 2012 - AD Schema Extension Attributes & Classes

Schema extensions for SCCM 2012 have not changed from the previous version. If you are upgrading from System Center Configuration Manager 2007, and the Active Directory Schema was already extended, you do not need to make any additional schema changes to support SCCM 2012.

If you are unsure what schema extensions have been made to Active Directory, you can optionally, utilize the Schema extension report script to discover what schema extensions have been applied.

Optional: Schema Extension Report: http://gallery.technet.microsoft.com/scriptcenter/PowerShell-Active-4ffedca4

!!! IMPORTANT: Schema extensions are a forest wide configuration, which is irreversible. Before implementing any Active Directory Schema Extension it should be tested for conflicts against the existing schema. Refer to: http://technet.microsoft.com/en-us/library/testing-for-active-directory-schema-extension-conflicts(WS.10).aspx

!!! IMPORTANT: Before extending the Schema using ExtAdSch.exe or LDIF, ensure you perform a backup which includes the System State of the Domain Controller holding the Schema Master FSMO role. It is also important that you know the Directory Services Restore Mode (DSRM) password to allow for an authoritative restore of Active Directory if needed.

!!! IMPORTANT: In large Active Directory forests, schema extensions can result in substantial increases in replication traffic. Ensure you understand the risks and impact of the proposed schema modifications before deploying in a production environment.

Method 1: Using ExtADSch.exe

Log in to the Active Directory Schema Master with a Schema Admin account.
Launch a Command Prompt window as Administrator.
From the command line, navigate to the \SMSSETUP\BIN\x64\ directory on where your installation media is located.
Execute EXTADSCH.exe.
Open C:\extadsch.log and review for any errors.

Figure 1 - Run ExtADSch.exe

Figure 2 - Verify ExtADSch.log for Success

Method 2: Using LDIFDE

The LDIFDE command line utility provides greater visibility & customization of schema changes. The LDIF configuration file can be located at: .\SMSSETUP\BIN\X64\ConfigMgr_ad_schema.ldf

Copy the ConfigMgr_ad_schema.ldf file to a directory on the Schema Master.
Open the new copy of ConfigMgr_ad_schema.ldf using Notepad, and replace all instances of “DC=x” with your root domain.
Log in to the Active Directory Schema Master with a Schema Admin account.
Launch a Command Prompt window as Administrator.
Run, “ldifde –i –f ConfigMgr_ad_schema.ldf –v –j <location to store log file>”
After the process completes, review the log file created in step 5 to verify the schema was successfully extended.

Quick Install of Domain Services on Server 2012 Core Installation

2014-02-28T03:55:00.002-05:00

Windows 2012 Server Core Install - Domain Controller

Please click the +1 button if you find this post helpful.

After Windows Server 2012 Core Install & Initial Configuration.

Run Forest Prep - If first 2012 Domain Controller

Load the Windows Server 2012 disc, and run adprep.exe from the /Support directory.

>adprep.exe /forestprep

It's a good idea to perform a quick health check beforehand. If your Infrastructure & Doman Naming Master roles can not be located, you may need to take additional action before proceeding.

Install Domain Services

In this example, I'm installing DNS and Active Directory as part of the same process. For some environments it may be desirable to pre-install and configure DNS

PS> Add-WindowsFeature DNS, AD-Domain-Services -IncludeManagementTools

If you are installing on a Core Installation, you do not need to use the -IncludeManagementTools option. This installs the GUI Management Tools. For AD-Domain-Services it Includes:

Active Directory Administrative Center
Active Directory Domains and Trusts
Active Directory Sites and Services
Active Directory Users and Computers
ADSI Edit
Group Policy Management

PS> Install-ADDSDomainController -DomainName ad.domain.com -InstallDNS:$True -Credential(Get-Credential)

>>>>>>Enter Domain Admin User Credentials <<<<<<

SafeModeAdministrationPassword: ***********

ConfirmSafeModeAdministrationPassword: ***********

The target server will be configured as a domain controller and restarted when this operation is compelte.

Do you want to continue with this operation?

[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help

(default is "Y"): Y

Topics: Windows Server 2012, Core Installation, Command Line, CLI, PowerShell, Po$h, NETDOM, SCONFIG, 70-410

Easily Check your FSMO Role Holders

2014-02-28T03:41:00.001-05:00

Easily Check your FSMO Role Holders

In my experience the quickest way to check on which domain controllers your FSMO roles are hosted on is by using PowerShell. Without getting too elaborate and trying to create any sort of fancy report, there's just two simple cmdlets you need to know, and they're pretty easy to remember.

To run these commands you need to have the Active Directory module installed.

Get-ADForest

PS > Import-Module ActiveDirectory
PS > Get-ADForest tenit.us |FT SchemaMaster,DomainNamingMaster

SchemaMaster DomainNamingMaster

------------ ------------------
dc02.tenit.us dc01.tenit.us

Save $10 on the new Quicken 2015 Home & Business + Free Shipping!

Get-ADDomain

Since there is a PDC Emulator, Infrastructure Master and RID Master located in each domain, you'll use the Get-ADDomain cmdlet, to see which servers hold those FSMO roles.

PS > Get-ADDomain tenit.us |FT PDCEmulator,InfrastructureMaster,RIDMaster

PDCEmulator InfrastructureMaster RIDMaster

----------- -------------------- ---------

dc01.tenit.us dc01.tenit.us dc01.tenit.us

So you can see how this can be useful in a small environment. You don't have to try to remember NTDSUTIL commands, or launch Sites & Services and Active Directory Users & Computers.

PowerShell, Windows, Active Directory, Administration

SCCM 2012 - AD Schema Extension Attributes & Classes

2014-02-28T02:37:00.000-05:00

Active Directory Schema Extension Attributes & Classes

System Center 2012 Configuration Manager

The following attributes and classes are added to Active Directory Domain Services, when the schema is extended to support System Center 2012 Configuration Manager using either ADSchExt.exe or ConfigMgr_ad_schema.ldf.

Attributes

cn=mS-SMS-Assignment-Site-Code
cn=mS-SMS-Capabilities
cn=MS-SMS-Default-MP
cn=mS-SMS-Device-Management-Point
cn=mS-SMS-Health-State
cn=MS-SMS-MP-Address
cn=MS-SMS-MP-Name
cn=MS-SMS-Ranged-IP-High
cn=MS-SMS-Ranged-IP-Low
cn=MS-SMS-Roaming-Boundaries
cn=MS-SMS-Site-Boundaries
cn=MS-SMS-Site-Code
cn=mS-SMS-Source-Forest
cn=mS-SMS-Version

Classes

cn=MS-SMS-Management-Point
cn=MS-SMS-Roaming-Boundary-Range
cn=MS-SMS-Server-Locator-Point
cn=MS-SMS-Site

Applies To: System Center Configuration Manager 2012, System Center Configuration Manager 2007

PowerShell Function to Get Inactive Active Directory Users

2014-02-18T20:54:00.003-05:00

PowerShell Function to Get Inactive Active Directory Users

For those of us familiar with most security compliance audits, one of the tasks we're well versed in is checking for users who have not logged in within a specified period of time, and either reporting on, or disabling those users (or both). In an effort at automating both of those, I began writing a script to discover inactive users in Active Directory, create a report listing them, which can be sent to administrators, but also, taking steps to auto-re-mediate the security risk but notifying each user before automatically disabling their account.

Because there's a number of steps to this script, many of which can easily be re-purposed for other scripts, I decided to advance my PowerShell scripting knowledge and begin to write functions to perform each task. Contained below is the function representing the first task, gather the required information.

Function Description

This function performs a couple of very simple tasks.

Queries Active Directory for any user accounts which have not been logged in to within a specified period of time.
Creates an XML Template, if dose not yet exist.
Populates an XML file containing the UserName, LastLogonDate, E-mail Address, and Expiration Date of each account meeting the criteria for being inactive.

This function only populates the report data. It doesn't update any information in Active Directory, or take any other actions. This information can then be used later to send notifications, and automatically disable accounts.

Function fn_Get-InactiveADUsers
{
<#
.Synopsis
This function returns inactive users in Active Directory.
.Description
This function searches the Active Directory domain or OU tree specified to locate
any users who have not logged in within a specified period of time. (Default is 6
months.) This information is then written to an XML file to be used for reporting.
CREATED BY: England, Matthew (http://pmibluepapers.blogspot.com/2014/02/BP14021801.html)
.Example
fn_Get-InactiveADUsers -OU 'OU=Users,DC=domain,DC=domain,DC=com' -MaxAgeMonths 6 -XMLOutDirectory 'C:\Temp'
Example shows calling function using parameter names.
.Example
fn_Get-InactiveADUsers 'OU=Users,DC=domain,DC=domain,DC=com' 6 'C:\Temp'
Example shows calling function using positional parameters.
.Example
fn_Get-InactiveADUsers -OU 'OU=Users,DC=domain,DC=domain,DC=com'
Example uses default values.
.Parameter OU
This is the Distinguished Name (DN) of the OU you wish to limit the scope of 
the query to.
This is a required parameter. There is no default value.
.Parameter MaxAgeMonths
The number of months since the user last logged in to the account.
Default is 6 Months.
.Parameter XMLOutDirectory
Used to specifiy the output directory.
Default to the users My Documents folder.

#>
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory=$True,Position=1)]
        [string]$OU,

        [Parameter(Mandatory=$False,Position=2)]
        [string]$MaxAgeMonths = 6,

        [Parameter(Mandatory=$False,Position=3)]
        [string]$XMLOutDirectory = $env:USERPROFILE + "\Documents"
    )

    Set-Location $XMLOutDirectory
    #Load Required Modules
    Import-Module ActiveDirectory
    
    $EvalDate = (Get-Date).AddMonths(-$MaxAgeMonths)
    $TitleDate = Get-Date -UFormat "%Y%m%d"

    # ACTIVE DIRECTORY QUERY 
    $ary_InactiveADUsers = Get-ADUser -Filter {
        (ObjectClass -eq "user") -and 
        (Enabled -eq 'True') -and 
        (Name -notlike '*svc*') -and
        (PasswordNeverExpires -eq 'False') -and
        (LastLogonDate -lt $EvalDate)
        } -SearchBase $OU -Properties "LastLogonDate","AccountExpirationDate"
    
    $Domain = Get-ADDomain
    
    # CREATE XML TEMPLATE
    if (Test-Path "$XMLOutDirectory\IADUTemplate.xml")
    {
    Write-Verbose "Required XML Template Found..."
    }
    else
    {
    Write-Verbose "Required XML template not found..." 
    Write-Verbose "Creating XML Template..."
    $xml_InactiveADUsers = @'
<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" href="IADUReport.xsl" ?>
<InactiveADUsers>
<ReportDate></ReportDate>
<Domain></Domain>
<User>
<SamAccountName></SamAccountName>
<LastLogonDate></LastLogonDate>
<mail></mail>
<givenName></givenName>
<AccountExpirationDate></AccountExpirationDate>
<DisabledDate></DisabledDate>
</User>
</InactiveADUsers>
'@

    $xml_InactiveADUsers | Out-File "$XMLOutDirectory\IADUTemplate.xml" -Encoding UTF8
    Write-Verbose "Required XML template InactiveADUsers.xml has been created."
    }
    # Create XML file for use by other functions. (Properties= UserName, LastLogonDate, ExpireDate)
    $xml = New-Object xml
    Write-Verbose "Loading XML Template..."
    $xml.Load("$XMLOutDirectory\IADUTemplate.xml")
    $xml.InactiveADUsers | ForEach-Object {$_.ReportDate = (Get-Date).toString()}
    $xml.InactiveADUsers | ForEach-Object {$_.Domain = $Domain.DNSRoot.toString()}
    
    $newxmlItem = (@($xml.InactiveADUsers.user)[0]).Clone()
    $ary_InactiveADUsers | ForEach-Object {
        $newxmlItem = $newxmlItem.clone()
        $newxmlItem.SamAccountName = $_.SamAccountName.toString()
        $newxmlItem.LastLogonDate = $_.LastLogonDate.toString()
        #Need to add error checking to ensure mail attribute is not null before it can be saved to XML.
        $newxmlItem.mail = $_.SamAccountName + ("@domain.com").toString()
        $newxmlItem.givenName = $_.givenName.toString()
        $newxmlItem.AccountExpirationDate = if ($_.AccountExpirationDate) 
            {Write-Verbose "AccountExpirationDate set on account. Using AccountExpirationDate..."
            $_.AccountExpirationDate.toString()
            } 
            Else 
            {Write-Verbose "No AccountExpirationDate set on account..."
            "None"
            }
        $xml.InactiveADUsers.AppendChild($newxmlItem) >$null  
     }

    # Remove null objects from xml file.    
    $xml.InactiveADUsers.user |
        Where-Object {$_.saMAccountName -eq ""} |
        ForEach-Object {[void]$xml.InactiveADUsers.RemoveChild($_) }
  
        
    $xml.Save("$XMLOutDirectory\InactiveADUsers$TitleDate.xml")
    Write-Host -ForegroundColor Green "Saved InactiveADUsers$TitleDate.xml to $XMLOutDirectory."
    Remove-Module ActiveDirectory
    Write-Host -ForegroundColor Green "Operation Complete!"
    Write-Host -ForegroundColor Green "Users Reported as Inactive are listed below and can be found in the report:$XMLOutDirectory\InactiveADUsers$TitleDate.xml "
    #Invoke-Item $XMLOutDirectory\InactiveADUsers$TitleDate.xml
    #return $ary_InactiveADUsers |Format-Table -Property Name,LastLogonDate,SamAccountName 
}

fn_Get-InactiveADUsers

Foot Notes:

Function currently lacks error handling. Ensure no null values exist. Null values can not be saved to an XML element as a string.
ln 104 - The string entered for $newxmlItem.mail should be modified to meet your needs. Either modify the "domain.com" string or use $_.mail.toString()
Verify the Active Directory Query filter meets your needs, and returns the expected items.
$MaxAgeMonths is in Months not Days. AD Queries for accounts not logged in in past # months. If you need to be more granular, this can be changed to days.
Content of XML template IADUTemplate.xml file is not verified. If the file exists, it will not be over written, however if the content structure is not correct, load or modify errors may result.

Running the Function

There's several examples in the help comments of the function.

fn_Get-InactiveADUsers -OU 'OU=Users,DC=domain,DC=domain,DC=com' -MaxAgeMonths 6 -XMLOutDirectory 'C:\Temp'

It's important to realize, that I'm using the Active Directory module, so you need to run this on a machine which has that module installed.

Because neither the Domain or Credentials are being passed to the Get-ADUser cmdlet, ensure you're logged in to a machine joined to the domain you want to query, using credentials with appropriate permissions.

The function can be scoped to a specific OU using the -OU parameter allowing for testing or exclusion of specific accounts falling outside of the specified OU. Only one OU can be specified.

Writing XML

One question I received from a peer, was regarding how I created the XML file used for the reporting.

I opted to use XML instead of a Text, HTML, or CSV file because of it's versatility. XML can easily be consumed by web sites, including SharePoint, Excel, PowerShell and many other applications.This enables anyone to consume the data this function extracts, in a manner best suited to their needs. (It's also a first for me, so I was able to gain a considerable amount of experience with this area of PowerShell, as well as with XML in general.) The caveat here, is that you will need a separate XSL stylesheet to make the report data readable. (That's for a follow up post.)

When researching methods for writing & modifying XML data from PowerShell I had a number of options. The first was to use .NET XML objects, however, for my needs, that seemed a little too complex.

The next was to use the PowerShell ConvertTo-Xml cmdlet. While it's an extremely simple way to create XML content which can easily be reused within PowerShell, it resulted in an XML file which was a bit bloated, containing elements and property information which I didn't need. Also because of the sensitive nature of user accounts, I wanted to control exactly what was stored in a clear text file.

The script will create the necessary XML template, so there is no need to create or stage files to support the script.

Naming Conventions

You'll notice that I have deviated from the standard cmdlet naming convention for my functions a bit. Each function I've created for this script begins with "fn_". Because there's a number of similarly named functions, I wanted to ensure there was no confusion between the functions I've written and those which may already exist.

As I mentioned, this is my first PowerShell script using functions, and reading, writing, and modifying XML. I'd love to hear your questions and feedback. Stay tuned for some follow on functions, which will use the information from this script to:

Notify Users of Account Status
Update/Disable the Account
Delete the Users Network Share.

PowerShell Script: Backup File Check & Removal

2013-07-05T14:51:00.002-04:00

PowerShell Script: Backup File Check & Removal

Please click the +1 button if you find this post helpful.

Recently a client with a rather large set of databases started having some issues maintaining sufficient disk space, which was causing backups to fail. Not wanting to spend money on SQL specific agents for their backup system, SQL jobs were created to backup to disk, where they would be picked up by the backup server and written off to tape.

The problem is the process of reviewing the log files, ensuring backups were written to tape, then clearing the disk based backups was a manual process requiring significant time on a daily basis. Also, whenever this process was skipped drive space would fill up, and backups would be missed, resulting in the inability to meet specific RPO's.

While it's not the prettiest solution, the PowerShell script below was written to loop through the directory where the backup files reside, then for each file found in the directory, search the tape backup log file for the file name, date and indication of a "sent" status. If these conditions were met, the file could be deleted. The script below, takes input for the Backup Directory Path, Log File, Location to save a transaction log, Date.

Since management wasn't very trusting of automation scripts, the action taken on any file needed to be easiliy turnned on or off. Line 44, 45, and 46 can be commented out to prevent any files from being deleted, but output will still indicate matches found on screen and in the log file.

USA RingCentral Office - Your complete all-inclusive phone system. Try RingCentral free for 30 days.

Because of how this script was written, it can be fairly easily modified to search for a variety of entries in a log file, take customized actions, and limit or expand the scope of the search.

################################################################
################################################################
###
###  TITLE:   Backup File Checker
###  AUTHOR:  England, Matthew D.
###  DATE:    20130705
###  DESCRIPTION:
###           Check's log file identified for inidcaton of
###           backup file sent successfully to tape. Creates
###           report indicating transaction then removes
###           associated backup files on disk.
###
################################################################
################################################################
Set-StrictMode -Version latest

$path = Read-Host "Enter PATH to Backup Files. End line with backslash \"
$files = Get-Childitem $path #*.bak #<<<-uncomment extension to limit to a specific file type such as bak or trn.
$logs = Read-Host "Enter PATH and FILENAME of TSM Log File dsmsched.log"
$actionlog = (Read-Host "Enter PATH for Log File") + "BackupRollAction.log"
$ReviewDate = Get-Date ((Get-Date).AddDays((Read-Host "Enter how many days from today to use as the date for log checking. Ex: -1 = Yesterday"))) -Format MM/dd/yyyy # Requests user input to specify log review date
$Status = "Sent"
$Operator = Read-Host "Enter UserID"

Function Get-BackupRollAction
{
  # LOOP THROUGH DIRECTORY OF BACKUP FILES
  Foreach ($file In $files)
  {
    # LOOP THROUGH EACH LINE OF LOG FILE TO LOCATE MATCH ON DATE, FILE AND STATUS
    ForEach ($line In $logs)
    {
      $logentry = Get-Content $logs |Select-String -Pattern $ReviewDate| Select-String -Pattern $file |Select-String -Pattern $Status
      If ($logentry -cmatch $file)
      {
      # WRITE ALL MATCHING FILES TO LOG AND DISPLAY ON SCREEN.
      "FOUND :  $path$file  in log $logs :" | Out-File $actionlog -Append
      Write-Host "FOUND :  $path$file  in log $logs :" -ForegroundColor Yellow
      #TAKE ACTION ON MATCHED FILES. DELETE TO CLEAR DRIVE SPACE
      #THE FOLLOWING THREE LINES MAY BE COMMENTED OUT IF NO DELETE ACTION IS TO BE TAKEN ON A FILE
      Remove-Item $path$file
      "DELETED :  $path$file  in log $logs : By Operator $Operator" | Out-File $actionlog -Append
      Write-Host "Deleted: $path$file" -ForegroundColor Red
      }
      
    }
  }
}

################################################################
################################################################

If you have questions, or suggestions for modification of this script, please post a comment.