Jason Yoder, MCT

Case Sensitive PowerShell–Contains Comparison Operator

2012-02-01T08:00:00.000-05:00

In PowerShell, you can test to see if a variable or array contains a specific piece of data. Take the following example:

$Arr1 = "PowerShell","Rocks","The","Windows","World"

If I was interested in knows if this array contained the string “rocks”, I would execute this command:

$Arr1 -contains "rocks"

The response would be True. Notice that in the array, the data is spelled with a capitol letter. The query used a lower case letter. PowerShell has a case sensitive contains operator called ccontains. When the same query is executed, but this time with ccontains, the answer returned is False. If the query was changed to

$Arr1 -ccontains "Rocks"

Then the response would be True

Get the Access Control List entries on a resource using PowerShell

2012-01-30T08:00:00.000-05:00

PowerShell comes with the Get-ACL cmdlet that allows you to see who has security rights to a resource Below is the syntax:

(Get-ACL –Path path).Access

The path is a location (eg. C:\Logs) that you want to enumerate the ACL for. We first need to create the ACL object before we can view it. To do that, we encase part of this command in parenthesis. Once the command completes, we ask for the Access properties. Below is sample output.

FileSystemRights : FullControl
AccessControlType : Allow
IdentityReference : BUILTIN\Administrators
IsInherited : True
InheritanceFlags : None
PropagationFlags : None

FileSystemRights : 268435456
AccessControlType : Allow
IdentityReference : BUILTIN\Administrators
IsInherited : True
InheritanceFlags : ContainerInherit, ObjectInherit
PropagationFlags : InheritOnly

FileSystemRights : FullControl
AccessControlType : Allow
IdentityReference : NT AUTHORITY\SYSTEM
IsInherited : True
InheritanceFlags : None
PropagationFlags : None

FileSystemRights : 268435456
AccessControlType : Allow
IdentityReference : NT AUTHORITY\SYSTEM
IsInherited : True
InheritanceFlags : ContainerInherit, ObjectInherit
PropagationFlags : InheritOnly

FileSystemRights : Modify, Synchronize
AccessControlType : Allow
IdentityReference : NT AUTHORITY\Authenticated Users
IsInherited : True
InheritanceFlags : None
PropagationFlags : None

FileSystemRights : -536805376
AccessControlType : Allow
IdentityReference : NT AUTHORITY\Authenticated Users
IsInherited : True
InheritanceFlags : ContainerInherit, ObjectInherit
PropagationFlags : InheritOnly

FileSystemRights : ReadAndExecute, Synchronize
AccessControlType : Allow
IdentityReference : BUILTIN\Users
IsInherited : True
InheritanceFlags : None
PropagationFlags : None

FileSystemRights : -1610612736
AccessControlType : Allow
IdentityReference : BUILTIN\Users
IsInherited : True
InheritanceFlags : ContainerInherit, ObjectInherit
PropagationFlags : InheritOnly

How to get the members of a array, and not the members of the objects in the array in PowerShell

2012-01-27T08:00:00.000-05:00

Let’s start off by explaining the situation by creating an array.

$myArray = 1, 2, 3, 4

If I execute $myArray | Get-Member

I get the member information for the integer objects in the array:

TypeName: System.Int32

Name	MemberType	Definition
CompareTo	Method	int …
Equals	Method	bool …
GetHashCode	Method	int …
GetType	Method	type GetType …
GetTypeCode	Method	System.TypeCode GetTypeCode() …
ToString	Method	string …

However, If I execute $MyArray.count, I get a value of 4. Where did this count property come from? By looking at the members above, the count property is not listed. The Count property can from the object of the array, not the objects contained in the array. To see the members of the object array, type:

Get-Member -InputObject $MyArray

This will give you the members of the object of $MyArray. Below is a listing of what you will receive.

Name              MemberType
----              ----------
Count          AliasProperty
Address               Method
Clone                 Method
CopyTo                Method
Equals                Method
Get                   Method
GetEnumerator         Method
GetHashCode           Method
GetLength             Method
GetLongLength         Method
GetLowerBound         Method
GetType               Method
GetUpperBound         Method
GetValue              Method
Initialize            Method
Set                   Method
SetValue              Method
ToString              Method
IsFixedSize         Property
IsReadOnly          Property
IsSynchronized      Property
Length              Property
LongLength          Property
Rank                Property
SyncRoot            Property

You can see that there is an aliased property called Count. It is a alias for the Length property. Below is an excerpt from the Get-Member help file.

-InputObject <psobject>
Specifies the object whose members are retrieved.

Using the InputObject parameter is not the same as piping an object to Get-Member. The differences are as follows:

-- When you pipe a collection of objects to Get-Member, Get-Member gets the members of the individual objects in the collection, such as the properties of the integers in an array of integers.

-- When you use InputObject to submit a collection of objects, Get-Member gets the members of the collection, such as the properties of the array in an array of integers.

How to list the members of every Active Directory group with PowerShell

2012-01-25T08:00:00.000-05:00

The code will allow you to see every member of every group in Active Directory. The output is placed in in object so you can process it through the PowerShell pipeline.

# Import the Active Directory Module.

# You must have access to the Active Directory Module for # this code to work.

Import-Module ActiveDirectory -Cmdlet Get-ADGroup, Get-ADGroupMember

# Create an array to hold the objects as they are created.

$Objects = @()

# Store the objects of all groups in Active Directory.

$Groups = Get-ADGroup -filter *

# Loop through each group and enumerate the user objects # who are members of each group.

ForEach-Object ($G in $Groups)

{

# Enumerate each member object of the group

$Members = $G | Get-ADGroupMember

# Loop through each user object and add data

#to the output object.

ForEach-Object ($M in $Members)

{

# Create a new instance of an object.

$ObjectData = New-Object PSObject

# Add data to the object.

# The property of "Group" will be the "Name" property of the

# current group being interrogated.

$ObjectData | Add-Member NoteProperty -Name "Group" -Value $G.Name

# The property of "User" will be the "Name" property of the

# current user being interrogated.

$ObjectData | Add-Member NoteProperty -Name "User" -Value $M.Name

# The property of "GroupType" will be the "GroupCategory" property

# of the current group being interrogated.

$ObjectData | Add-Member NoteProperty -Name "GroupType" -Value $G.GroupCategory

# Add this instance to the object.

$Objects += $ObjectData

} # -- End: ForEach-Object ($M in $Members)

} # -- End: ForEach-Object ($G in $Groups)

# Send to object to the pipeline.

$Objects

How to list the group membership of a user with PowerShell

2012-01-23T08:00:00.000-05:00

Here is a nice example of a one liner.

(Get-ADUser –filter “Name –like ‘Adm*’” –Properties MemberOf).MemberOf

This will return the FQDN of the groups the user is a member of. The first portion need to execute first and that is why we placed it inside of parenthesis. We then had to specifically tell PowerShell to give us the MemberOf property. Once the first portion of the command completes, we have an object to work with. Now we just simply ask PowerShell to provide us with the MemberOf property.

Search a hard drive for image files and copy them to another client with PowerShell

2012-01-18T08:00:00.000-05:00

Here is another one of the student projects from Decembers PowerShell class. In this case, the student needed to examine the hard drive of a computer and discover certain image files. He then needed to copy those files to another computer and hold them in a folder who’s name contained the source clients name and a date stamp. This code is still rough as we identified a lot of conflict scenarios that could pop up, but it still works.

Function Copy-ImageFile
{
param (
    [switch]$ListFiles,
    $Destination = "C:\Users\Jason\Documents\Roman\Roman2"
)

$Images = Get-ChildItem -Recurse | where{$_.Extension -match "gif|jpg|jpeg|png"}  

If ($ListFiles-eq $True)
    {
    $Images
    }
Else
    {
        # Get the computer name.
        $ComputerName = gc env:ComputerName

        # Create the name of the folder to copy data to.
        [string]$FolderName = $ComputerName + ((Get-Date).Year).ToString() + `
            ((Get-Date).month).ToString() + ((Get-Date).Day).ToString()
        
        # Create new folder in Destingation.
        New-Item -type Directory -Path $Destination -Name $FolderName
        
        # Copy Image to the destination
        $Images | Copy-Item -Destination "$Destination\$FolderName" -Force
    }


} # End: Function Copy-ImageFiles

Copy-ImageFile

How to check for processes utilizing to much processor time in PowerShell

2012-01-17T09:27:00.001-05:00

I’m a bit behind in posting some of this code. This was one of the projects a student brought to class. He needed to know how to use PowerShell to monitor if any processes consumed more than 25% of the processor time. If so, he had a set of services that needed to be restarted. Below is the code to find out the current processor load with the process restarting code commented out.

The get-counter cmdlet gave us the ability to collect multiple samples so that a spike would not trigger the process restart. In the code below, we took two samples with 1 second between them. Yes, the variable $CurrentLoad is set with a very long one liner.

Function CheckProcess
{
Param (
$Threshold = 25
)
$CurrentLoad = ((get-counter -counter "\processor(_total)\% Processor time" -SampleInterval 1 -MaxSamples 2) |
ForEach {$_.CounterSamples} |
Select-Object -Property CookedValue |
ForEach {$_.CookedValue} |
Measure-Object -Average).Average
If ($CurrentLoad -gt $Threshold)
{
# Kill Processes
# EX: "Proc1", "Proc2", "Proc3" | Stop-Process
# Pause script to allow processes to stop
Start-Sleep 1
# To Restart Service
# EX: "Service" | Restart-Server
}
}
CheckProcess

How to let users see websites that do not have a rating

2011-12-12T07:00:00.000-05:00

Content advisor uses a rating system known as Recreational Software Advisory Council on the Internet ) RSACi to determine if the content in a web site is suitable to the user based on the users preferences. Below shows the rating levels:

Level	Language	Nudity	Sex	Violence
4	Explicit or crude language	Provocative frontal nudity	Explicit sexual activity	Wanton and gratuitous violence
3	Obscene gestures	Frontal nudity	Non-explicit sexual touching	Killing with blood and gore
2	Moderate expletives	Partial nudity	Clothed sexual touching	Killing
1	Mild expletives	Revealing attire	Passionate kissing	Fighting
0	Inoffensive slang	No nudity	No sexual acts	No violence

If content advisor is turned on and a website does not include a RSACi rating, that content is blocked. To override this, open the Internet Explorer’s Properties.

Click the Content tab.

Click Settings

In the Content Advisor window, click the General tab.

Check Users can see websites that have no rating and then click OK twice

How to control the installation of Add-Ons in Internet Explorer.

2011-12-09T08:00:00.000-05:00

For many organizations, controlling what can be added to clients help to reduce the Total Cost of Ownership (TCO) of a network. Controlling what extensions can be added to Internet Explorer is part of the TCO reduction effort by preventing the IT staff from support issues caused me non-approved Add-ons.

The first thing we need to do is to discover the GUID of an Add-On that we want to prevent from being installed. For this reason, you fist need to install it on a test client.

Once installed, open Internet Explorer.

Click Tools / Manage Add-ons.

Browser to the Add-on that you want to prevent the installation of.

Right mouse click the Add-on and select More Information.

Record the GUID ( curly braces as well ) and the Name.

Close the window.

Open a Group Policy that is scoped to the computers that your want to prevent add-ons from being installed.

Browse to Computer Configuration / Policies / Administrative Templates / Windows Components / Internet Explorer / Security Features / Add-on Management.

Enable the policy for Add-on List.

Click Show and enter the Name in the Value Name field and the Class ID/GUID in the Value field. Click OK when done.

Click OK again.

Enable the policy for Deny all add-ons unless specifically allowed in the Add-on List.

Now, only the Add-on that you listed can be installed once this GPO is applied to your clients.

Case sensitive “Contains” operator in PowerShell

2011-12-08T08:00:00.000-05:00

In PowerShell, we can use the –contains operator to determine if a string contains something that we care looking for. Here is an example:

$collection = "One","Two","Three"
$collection -contains "One"

In this example, True would be returned. In the next example, True would also be returned.

$collection -contains "one"

The difference is the ‘O’ is lower case. This may not serve your needs if case sensitivity is a requirement. The below code will prove a case sensitive test.

$collection -ccontains "one"

Now the result will be False.

How to Disable the clients from removing the IE Menu Bar with Group Policy.

2011-12-01T08:00:00.000-05:00

This is a simple fix utilizing Group Policy. Make sure you are doing this in a GPO that is properly scoped to the Users that you want affected by this policy.

In your GPO, browse to User Configuration \ Policy \ Administrative Templates \ Windows Components \ Internet Explorer \ Toolbars.
Enable the following policies:

Disable customizing browser toolbar buttons.
Disable customizing browser toolbars.

MCTExpert is now on the Android Market!

2011-11-29T09:06:00.000-05:00

Today MCTExpert is proud to announce our first step in the exciting world of mobile apps. After a month of research and development, our first demo app is on the Android Marketplace. “American Road Trip” was inspired by a game played with 12x12 inch cards on family road trips a long time ago with my brothers in the back seat of the car. This version is more dynamic.

This demo app served as our test bed for developing our first code library for the Android platform. It also allowed us to work on the procedures that are needed to get an application fro the design board to the Android Marketplace. I invite you to download this app and give your kids a video game that will keep their eyes more on the world around them.

Plans are on the table to take on more challenging projects as we continue to build our code library and bring some great ideas to the Android Market.

https://market.android.com/details?id=com.mctexpert.android.ishunt&feature=search_result#?t=W251bGwsMSwxLDEsImNvbS5tY3RleHBlcnQuYW5kcm9pZC5pc2h1bnQiXQ..

Prevent a specific type of device from installing on a client.

2011-11-28T07:00:00.000-05:00

This process can be completed in either local or Group Policy.

Plug in the device that you wish to restrict.

Open Device Manager and then open the properties of the device.

Click the Details tab.

From the Property drop down box, select Device class guid.

Record the Value.

Close Device Manager

Open either local policy or the GPO that you will use to manage this restriction.

Expand Computer Configuration / Administrative Templates / System / Device Installation /Device Installation Restrictions.

Double click Prevent installation of devices using drivers that match these device setup classes.

Click Enable and then click Show.

Enter the GUID you recorded earlier. Include both the open and close curly braces on each end of the GUID. Click OK.

Click OK. Close the policy editor.

Password Change prompt in Windows 7

2011-11-25T08:00:00.000-05:00

You can set the number of days in advanced that a user receives a warning about their password expiring using Group Policy.

You will find this setting at: Computer Configuration \ Windows Settings \ Security Settings \ Local Policies \ Security Options \ Interactive Logon: Prompt user to change password before expiration.

Just enable this policy and set the number of days that you want the warnings to begin. This will appear as a pop up balloon. If you are preventing balloon pop ups, the user will not receive notification.

If you do not want to enable balloon notifications, try the logon script located at this site. Make sure you test it before using it in a production environment.

What does the–b switch do in OSCDIMG command?

2011-11-24T08:00:00.000-05:00

In class, we used the OSCDIMG command to create a Windows PE image a question came about as to when the –b switch does. According to Microsoft, the –b option specifies the location of the El Torito boot sector file.
From Wikipedia, the El Torito Bootable CD Specification is an extension to the ISO 9660 CD-ROM specification. It is designed to allow a computer to boot from a CD-ROM. In short, this helps us create a bootable image.

Change the number of cached credentials

2011-11-23T08:00:00.000-05:00

Many years ago, Microsoft allowed users to logon to Windows clients utilized a set of cached credentials. These were credentials from a previous authentication with a domain controller. This allowed for two things.

1) The user could log on to a mobile computer without contacting a domain controller and,

2) The user could logon to the client before the network connection initialized. This gave the appearance of Windows booting faster. It is also why the hard drive is still going strong on the I/O operations after you log in.

By default, Windows 7 stores the last 10 logged on users credentials and Windows Server 2008 stores the previous 25. You can change these values to better suite your organizations needs.

Click Start.

Type Regedit and press Enter.

Browse to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Winlogon\

Change the value of CachedLogonCount to any value between 0 and 50.

Giving the value of zero will disable cached credentials. Any value above 50 will be treated as 50.

How to turn off Windows 7 System Restore with Group Policy

2011-11-22T08:00:00.000-05:00

Click Start / Administrative Tools/ Group Policy Management

Create or use an existing GPO that is scoped to the clients you want to make this change to.

Edit your GPO

Browse to Computer Configuration / Policies / Administrative Templates / System / System Restore

Double click Turn off Configuration.

Set this olicy to Enable and click OK.

Close the Group Policy Management Editor.

Scope the GPO to deploy the GPO to the target computers.

Remember, it may take a few reboots for the GPO to take effect.

How to prevent new USB devices from being installed on a client.

2011-11-21T07:00:00.000-05:00

In local (or Group) policy, expand Computer Configuration / Administrative Templates / System / Device Installation /Device Installation Restrictions.

Double click Prevent installation of Removable Devices.

Select Enable and click OK.

Close local (or Group) policy.

How to list all the WMI namespaces and their classes in PowerShell

2011-11-18T07:00:00.000-05:00

Get ready for a real long list, but here is how you do it.

Get-WMIObject –Namespace root –List Recurse
Simple, yet effective. Be prepared though. My Windows 7 Ultimate returned 4,608 classes.

Get-WMIObject –Namespace root –List Recurse | Get-Member
I receive 60251 classes. There is a lot of information in WMI.

How to Delete a DNS Zone

2011-11-17T08:00:00.000-05:00

When it is time to remove a DNS zone for a server, log on with an account that has local administrative rights to the server. We are going to delete a zone called Test.Contoso.com

Type the following line.

dnscmd nyc-dc1 /zonedelete test.contoso.com

Press Y to confirm the delete.

How to sort an object with one property descending and another property ascending with PowerShell?

2011-11-16T07:00:00.000-05:00

I’ll admit, I did not come up with the answer to this one. I pulled it from the help file for Sort-Object It was a good question though.

get-service | sort-object -property @{Expression="Status";Descending=$true}, @{Expression="DisplayName";Descending=$false}

The above command is all on the same line.

First we used Get-Service to get some objects to work with. We then piped it to Sort-Object and we used the –Property parameter to tell PowerShell what values we are interested in sorting.

Next we switch to creating a hash table to specify that we first want to sort the Status property in descending order. We do this by setting the Descending flag to Boolean True In PowerShell Boolean true is $true and Boolean false is $false. We the specify the next value that we want to sort by which is DisplayName and we set the Descending flag to Boolean $false.

The end result is a list of all running processes that is sorted in descending order by status and then ascending order by DisplayName.

Windows 8 app History

2011-11-15T07:00:00.000-05:00

Note: Information provided from Windows 8 Developer Preview

Windows 8 has a new tab in the task manager called App History. This tab allows you to monitor the usage of Metro app.

With Windows 8 being designed for a more mobile workforce, I can see this tab being very useful. You can identify how much CPU time but more importantly, how much network bandwidth is being consumed. With our more mobile society, one network hogging app and really degrade the users experience.

Windows 7 Installation does not see my hard drive.

2011-11-14T07:00:00.000-05:00

It is possible that on some very advanced systems, the Windows 7 installer may not have the drivers for your hard drive. Follow this simple set of instructions to load your drivers into Windows 7 during installation.

Boot from the Installation DVD.

Choose your language and click Next.

Click Install Now.

Check I accept the license agreement and click Next.

Click Custom.

Click Load Driver.

Browse to the media that contains your drivers. Once loaded, you may need to click Refresh to see your hard drive.

List all properties of a user object with PowerShell

2011-11-11T07:00:00.000-05:00

Enumerating a user account’s properties in PowerShell using the command get-ADUser – Filter ‘name –like “username”’ only gets you a small subset of the data.

If you want to see it all, try this:

get-aduser –filter ‘name –like “username”’ –Properties *

You will see all the attributes of the user object.

How to join a client to a domain via command line

2011-11-10T07:00:00.000-05:00

Windows 7/2008 R2 have a feature that allows you to join a client to the domain without actually having access to the client. It is called Offline Domain Join. This process involves creating a file on the domain controller and then using that file on the client to join it to the domain. Let’s take a look at how to make that happen.

We are going to perform this on the server. The idea is to join a client, NYC-CL1 to the domain in an Organizational Unit called Clients The default container for joining clients to the domain is Computers, but this exercise will allow you to join the client to the OU that you want the computer object to be stored in.

On the Domain Controller, click Start.

Type CMD.

Right click the CMD.exe that appears in the search list and then click Run as Administrator.

Type djoin /provision /domain contoso.com /machine nyc-cl1 /savefile nyc-cl1_File /MachineOU “OU=Clients,DC=contoso,dc=com”

Once this is done, we can see the computer object has been created in the Clients OU.

You now need to copy that file to the machine to be joined.

On the client computer, open an elevated command prompt as you did earlier on the server.

Make sure the nyc-cl1_File is accessable in the file structure where you are typing this command line.

Type djoin /requestODJ /loadfile NYC-CL1_File /windowspath %SystemRoot% /localos

You should see a message similar to the one below.

Reboot the client.

Below is Microsoft's information on some of the switches used in this demo.

/provision	Creates a computer account in AD DS.
/domain	Specifies the name of the domain to join.
/machine	Specifies the name of the computer that you want to join to the domain
/savefile	Saves provisioning data to a file.
/machineou	Specifies the name of the organizational unit (OU) in which you want the computer account to be created. By default, the computer account is created in the Computers container.
/requestodj	Requests an offline domain join at the next start.
/Loadfile	Specifies the output from a previous provisioning command.
/windowspath	Specifies the path to the Windows directory of the offline image. If you are using the/localos parameter, specify %systemroot% or %windir% as the value of the/windowspath parameter.
/localos	Targets the local operating system installation, instead of an offline image, with the domain join information. If you use this parameter, the value that you specify for/windowspath should be %systemroot% or %windir%. Run this parameter only on a destination computer that you want to join to the domain. This parameter is blocked from being run on a domain controller. Because this parameter injects the blob data into the locally running operating system image, you must restart the computer to complete the domain join operation, as you must also do for an online domain join.