Tech Notes

port proxy

2018-10-03T15:12:00.000-06:00

netsh interface portproxy add v4tov4 listenport=22 connectport=22 connectaddress=192.168.110.51

netsh interface portproxy show v4tov4

netstat -ano

PS C:\Users\localuser> netstat -an | sls "22"

TCP 0.0.0.0:22 0.0.0.0:0 LISTENING
TCP 192.168.109.50:22 12.36.9.2:24773 ESTABLISHED
TCP 192.168.109.50:51554 192.168.110.51:22 ESTABLISHED

see connections

Microsoft Servers (2008R2/2012R2) Not Negotiating to TLS 1.0

2018-10-03T15:10:00.001-06:00

Testing a package that will run using .Net 4.0 or above. The software uses SSL to encrypt traffic between the nodes.

Certificates generated signed with a SHA 512 bit key.

As long as .Net 4.0 is installed, will attempt connection with TLS 1.2, does not find a matching cipher and steps down and connects using TSL 1.0. After .Net 4.5.1 is installed, it no longer steps down to TLS 1.0. In trace, you will see that there is a ClientHello followed by the server sending a TCP RST. At no time does it attempt to step down to TLS 1.0.

Get-ChildItem -Filter *.txt -Recurse

Multiple Versions of SQL Server Installed - Path to SqlPS module

2018-10-03T15:09:00.000-06:00

Issue with a powershell script that enabled the Always-On High Availability setting in SQL 2014. The server also had SQL 2012 (may have been upgraded) and so it had multiple versions of the same module installed in different directories. Import-module SqlPS loads the SQL 2012 version of the module.

You have to explicitly load the correct module by doing an import-module with the path to the module that you want.

Enable-SqlAlwaysOn would fail with cannot find SQLSERVER exception.

Find duplicate modules:

get-module -listAvailable -name SqlPs | format-table -property name, moduletype, path -group by name -auto

Launch Script or Process When a Computer Object is Created in Active Directory

2014-05-15T16:40:00.001-06:00

Good for firing off a script or process when a computer is added to a domain. Just fire off the script and let it run at start time. This is not done but just a start for others interested in doing something similar.


$timespan = New-Object System.TimeSpan(0, 0, 1)
$scope = New-Object System.Management.ManagementScope('\\domainname\root\directory\LDAP')
$query = New-Object System.Management.WQLEventQuery `
    ("__InstanceCreationEvent",$timespan, "TargetInstance ISA 'ds_computer'" )
$watcher = New-Object System.Management.ManagementEventWatcher($scope,$query)

$b = $watcher.WaitForNextEvent()

#view information about the computer object that was created.

$b.TargetInstance.DS_Name
$b.TargetInstance.DS_Samaccountname
$b.TargetInstance.DS_distinguishedName
$b.TargetInstance.DS_cn

#fire off powershell or script here using the information about the computer account.

#if you want to restart after running process just add in a while loop like this

do 
    {

$b = $watcher.WaitForNextEvent()
#view information about the computer object that was created.

        $b.TargetInstance.DS_Name
        $b.TargetInstance.DS_Samaccountname
        $b.TargetInstance.DS_distinguishedName
        $b.TargetInstance.DS_cn

        #launch script here
    } 
while (0 -eq 0)

Testing File Write to Remote Share with remote Domain Credential - no trust between local and remote host domains

2014-04-18T14:20:00.000-06:00

Add the following class in powershell at top of script or module. This wrapper class needs to be called only once in a script to make the class available to the powershell code. I set the error action preference to stop as I use try catch in scripts and have found it is more predictable behavior of catching non-terminating errors when setting this preference. This is not required .....

$ErrorActionPreference = "Stop"

$WNetAddConnection2WrapperSource = @'
using System;
using System.Runtime.InteropServices;

namespace Win32Api {
    public enum ResourceScope {
        RESOURCE_CONNECTED = 1,
        RESOURCE_GLOBALNET,
        RESOURCE_REMEMBERED,
        RESOURCE_RECENT,
        RESOURCE_CONTEXT
    };

    public enum ResourceType {
        RESOURCETYPE_ANY,
        RESOURCETYPE_DISK,
        RESOURCETYPE_PRINT,
        RESOURCETYPE_RESERVED = 8
    };

    [Flags]
    public enum ResourceUsage {
        RESOURCEUSAGE_CONNECTABLE = 0x00000001,
        RESOURCEUSAGE_CONTAINER = 0x00000002,
        RESOURCEUSAGE_NOLOCALDEVICE = 0x00000004,
        RESOURCEUSAGE_SIBLING = 0x00000008,
        RESOURCEUSAGE_ATTACHED = 0x00000010,
        RESOURCEUSAGE_ALL = (RESOURCEUSAGE_CONNECTABLE | 
                             RESOURCEUSAGE_CONTAINER | RESOURCEUSAGE_ATTACHED),
    };

    public enum ResourceDisplayType {
        RESOURCEDISPLAYTYPE_GENERIC,
        RESOURCEDISPLAYTYPE_DOMAIN,
        RESOURCEDISPLAYTYPE_SERVER,
        RESOURCEDISPLAYTYPE_SHARE,
        RESOURCEDISPLAYTYPE_FILE,
        RESOURCEDISPLAYTYPE_GROUP,
        RESOURCEDISPLAYTYPE_NETWORK,
        RESOURCEDISPLAYTYPE_ROOT,
        RESOURCEDISPLAYTYPE_SHAREADMIN,
        RESOURCEDISPLAYTYPE_DIRECTORY,
        RESOURCEDISPLAYTYPE_TREE,
        RESOURCEDISPLAYTYPE_NDSCONTAINER
    };

    [StructLayout(LayoutKind.Sequential)]
    public class NetResource {
        public ResourceScope Scope;
        public ResourceType Type;
        public ResourceDisplayType DisplayType;
        public ResourceUsage Usage;
        public string LocalName;
        public string RemoteName;
        public string Comment;
        public string Provider;
    };

    [Flags]
    public enum AddConnectionOptions {
        CONNECT_UPDATE_PROFILE = 0x00000001,
        CONNECT_UPDATE_RECENT  = 0x00000002,
        CONNECT_TEMPORARY      = 0x00000004,
        CONNECT_INTERACTIVE    = 0x00000008,
        CONNECT_PROMPT         = 0x00000010,
        CONNECT_NEED_DRIVE     = 0x00000020,
        CONNECT_REFCOUNT       = 0x00000040,
        CONNECT_REDIRECT       = 0x00000080,
        CONNECT_LOCALDRIVE     = 0x00000100,
        CONNECT_CURRENT_MEDIA  = 0x00000200,
        CONNECT_DEFERRED       = 0x00000400,
        CONNECT_RESERVED       = unchecked((int)0xFF000000),
        CONNECT_COMMANDLINE    = 0x00000800,
        CONNECT_CMD_SAVECRED   = 0x00001000,
        CONNECT_CRED_RESET     = 0x00002000
    }
  
   public static class NativeMethods {
        [DllImport("mpr.dll",  EntryPoint="WNetAddConnection2",CharSet = CharSet.Ansi,SetLastError = true)]   
        public static extern int WNetAddConnection2(
            NetResource netResource, string password, 
            string username, AddConnectionOptions options);
       
        [DllImport("mpr.dll", EntryPoint="WNetCancelConnection2",CharSet = CharSet.Ansi,SetLastError = true)] 
        public static extern int WNetCancelConnection2(string name, int flags,
            bool force);
           
        //[DllImport("Kernel32.dll")]
        //public static extern uint GetLastError();
    }
}
'@


Add-Type -TypeDefinition $WNetAddConnection2WrapperSource

$authType = Add-Type -Name authUtils -MemberDefinition @"
      // http://msdn.microsoft.com/en-us/library/aa378184.aspx
      [DllImport("advapi32.dll", SetLastError = true)]
      public static extern bool LogonUser(string lpszUsername, string lpszDomain, string lpszPassword, int dwLogonType, int dwLogonProvider, ref IntPtr phToken);
     
      // http://msdn.microsoft.com/en-us/library/aa379317.aspx
      [DllImport("advapi32.dll", SetLastError=true)]
      public static extern bool RevertToSelf();
"@ -passthru

Now that you have the C# class wrapping native Win32 API calls, you can use this to connect to remote share (RPC) as a different credential.

In this case, you cannot impersonate another user locally and connect to the remote share because you are on a server in an untrusted domain. You can use a domain credential in the remote server to connect to the share though, which is how this process works.

function Check-Folder() {
[CmdletBinding()]
    Param ([Parameter(Position=1,Mandatory=$true, ValueFromPipelineByPropertyName=$true,HelpMessage="Object with Folder properties to check")] 
           [Alias("u")] [PSObject]$folderProps)
    Process {
            try{
               
                $netresource = New-Object Win32Api.NetResource
                $netresource.Type = [Win32Api.ResourceType]::RESOURCETYPE_DISK
                $netresource.RemoteName = $([System.IO.Path]::GetPathRoot($folderProps.testFile))
                #$opts = [Win32Api.AddConnectionOptions]::CONNECT_INTERACTIVE
                #Use this option will not prompt user for credentials if fails during attempt.

                #If you want to prompt if fails, use INTERACTIVE
                $opts = [Win32Api.AddConnectionOptions]::CONNECT_TEMPORARY
                $ret = [Win32Api.NativeMethods]::WNetAddConnection2($netResource,$folderProps.password,$folderProps.Domain + "\" + $folderProps.User, $opts)
                if($ret)
                {
                    throw (new-object System.ComponentModel.Win32Exception($ret))
                }
                #Open file connection
                $writer = [System.IO.File]::Open($folderProps.testFile,[System.IO.FileMode]::Create)
                $writer.Close() 
                [System.IO.File]::Delete($folderProps.testFile)
                $ret = [Win32Api.NativeMethods]::WNetCancelConnection2($netresource.RemoteName, $null, $true)
                if($ret)
                {
                    throw (new-object System.ComponentModel.Win32Exception($ret))
                }
            } catch {
                throw "Failed accessing share" +  $folderProps.testFile + ": Exception: $($_)"
            }
    }
}

Now you have the function to call, create the object the function expects as input.

$folder = New-Object PSObject -Property @{
                        testFile      =    '\\share\folder\path\test\tempfilename.txt'
                        user         =    'remote domain user account'
                        password =    'remote domain user password'
                        domain    =   'remote domain'
                    }

Now call the function in Powershell:

Check-Folder $folder

The process will map a temporary connection, if it can, with the provided credential and attempt to create a file at the location (you provide a file name using testfile property). The process will not release write file handle, it is written and deleted. If successful you are good, if not, you will get an exception returned.

vCAC - Java and odata4j with self-signed cert

2013-12-05T16:50:00.000-07:00

Notes so I can remember how to configure the ClientBehavior to work with self signed certs using the odat4j consumer:

Builder builder = ODataJerseyConsumer.newBuilder("https://vcacserver.domain.com/repository/data/ManagementModelEntities.svc/");
        builder.setClientBehaviors(AllowSelfSignedCertsBehavior.allowSelfSignedCerts());
        ODataJerseyConsumer c = builder.build();
        List list = c.getEntities("VirtualMachineTemplates").execute().toList();
        ArrayList listUI = new ArrayList();
        for(OEntity category : list) {
                listUI.add(String.format("%s - %s", category.getProperty("VirtualMachineTemplateID").getValue().toString(), category.getProperty("CPUCount").getValue().toString()));
          }

Powershell - Get Distinct Modulenames for Powershell version 4

2013-10-24T12:51:00.001-06:00

Just get distinct modules available in the current powershell session (Server 2012 R2). There are a lot more modules available in the PS version 4.

get-command -all | sort-object modulename -unique | Select-object modulename
get-command | where {$_.modulename -eq "DISM"} | sort-object commandtype,name

Powershell - Compare Files Between Two Servers

2012-07-02T18:24:00.001-06:00

I know there are a lot of ways to do this, but here is another one. Switch to a directory and run the following command on a working and non working server. As is, this is comparing .dll files. The results can easily be compared using windiff or similar utility to make sure all the versions of the files line up:

gci . -filter *.dll -Recurse -force | select FullName,CreationTime,length,{$_.VersionInfo.FileVersion},{$_.VersionInfo.ProductVersion} | sort FullName | export-csv c:\temp\FileVersions.csv

IIS 7.5 cloning - Machine Keys

2012-02-24T20:57:00.000-07:00

Ran into an issue on Server 2008 R2 / IIS 7.5. After cloning a server, the IIS Admin service would not start and we were no longer able to set application pool identities to a domain account. You can save a local account as the app pool identity but not a domain account. Turns out to be a well known and discussed issue with how Microsoft secures information in config files with unique machine keys. One of the way the process locates the key is by using the machine GUID. Following sysprep, this GUID changes and you get a new key. If you have anything encrypted with old key, it is no longer accessible. This is most likely why IIS supports sysprep now (IIS version 7.5) but not if you have identities that are encrypted in config files. This method allows you to get around this but is not as secure as every server will have the same key following sysprep. This code "repairs" the machine keys by renaming the old key with the new GUID. This was thrown together quickly, I will clean this up when I get a chance but this works for now.

The application pools or the portion before the underscore is an identifier for the app pool it appears. That portion may change or you may have more than is represented here. You can change that to meet your needs.

#Variables
$regGUIDPath = "HKLM:\SOFTWARE\Microsoft\Cryptography"
$regGuidName = "MachineGuid"
$machineKeyFolder = "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys"
$key1 = "c2319c42033a5ca7f44e731bfd3fa2b5_"
#$key2 = "7a436fe806e483969f48a894af2fe9a1_"
$key2 = "76944fb33636aeddb9590521c2e8815a_"

#Get Current GUID
$machGUID = (Get-ItemProperty -Path $regGUIDPath -Name $regGuidName).MachineGuid

#Rename new one if it was created. If IIS starts and there is no key, it will create a new one with new GUID
if(test-path $machineKeyFolder\$key1$machGUID){
ren "$machineKeyFolder\$key1$machGUID" "$key1$machGUID.OLD"
}

if(test-path $machineKeyFolder\$key2$machGUID){
ren "$machineKeyFolder\$key2$machGUID" "$key2$machGUID.OLD"
}
#Now find the oldest key and rename it using the new machine GUID
$files = Get-ChildItem ("$machineKeyFolder\*.*") -include ("$key1*") | sort-object -property ($_.CreationTime)

foreach ($file in $files)
{
$fileName = $file.Name
if (!$fileName.EndsWith($machGUID))
{
cp "$machineKeyFolder\$fileName" "$machineKeyFolder\$fileName.OLD"
ren "$machineKeyFolder\$fileName" "$key1$machGUID"
break

}
}

$files = Get-ChildItem ("$machineKeyFolder\*.*") -include ("$key2*") | sort-object -property ($_.CreationTime)

}
}

Restart-Computer - Do Not Have Privilege Exception

2012-02-17T22:02:00.002-07:00

Running Powershell version 2 on Server 2008 R2. Simply run Restart-Computer and get an exception stating that the user does not have enough privilege to execute command. Turns out Powershell is running in .Net 4 runtime. Run the following command:

[Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory()

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\

If the version is not v2 but v4. Create a powershell.exe.config file in the powershell directory and add the following text:

Restart powershell and it should work. Now to figure out why that happened in the first place.

UPDATE: Turns out a software vendor had set an environment variable called COMPLUS_Version in the installer. If this is set, it overrides normal assembly binding logic and forces all .net applications to run in that version of .net. This should only be used for development or testing, not production environments.

set COMPLUS_Version = v3.5

Powershell Uninstall Software Function

2011-12-20T09:34:00.003-07:00

Simple function to uninstall an application on a Windows Server.  This has been tested on Server 2008 R2.  You can pass the name of the application and it will attempt to uninstall as the user you are logged on as.  You can pass in credentials and it will attempt to use those to uninstall the application.  If it cannot find the application it will not throw an exception.  If something fails, it will throw an exception back to the calling code.

I wrote this after initially using the Win32_Product WMI class and the installer function.  However, that class is slow which I could live with.  The fact that it checks every installed application and potentially attempts to reconfigure the applications seemed like a bad idea.  This obviously does not use that class.



 Function uninstall-application(){

[CmdletBinding()]

Param ([Parameter(Position=1,Mandatory=$true, ValueFromPipelineByPropertyName=$true,HelpMessage="Application Name to be uninstalled")] [Alias("a")] [string]$appName,

[Parameter(Position=2,Mandatory=$false, ValueFromPipelineByPropertyName=$true,HelpMessage="If run as different user, pass a user name into the script")] [Alias("u")] [string]$userid,

[Parameter(Position=3,Mandatory=$false, ValueFromPipelineByPropertyName=$true,HelpMessage="The password for the user.")] [Alias("p")] [string]$pwd)

Process {

$Error.Clear()

try {





#expecting to be run in PS x64

$86 = "HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall"

$64 = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall"

[int]$ExitCode



#Check for 32 bit version of the app

$appKey = Get-ChildItem -Path $86 | Where-Object -FilterScript { $_.GetValue("DisplayName") -ieq "$appName" -And $_.GetValue("UninstallString") -ne $null }



#didn't find 32 bit version - check for 64 bit version

if ($appKey -isnot [Microsoft.Win32.RegistryKey])

{  

$appKey = Get-ChildItem -Path $64 | Where-Object -FilterScript { $_.GetValue("DisplayName") -ieq "$appName" -And $_.GetValue("UninstallString") -ne $null}



}

#Write-Host $appKey.gettype()

if ($appKey -is [Microsoft.Win32.RegistryKey]) # If it is a system.object or something else this will fail.

{

#Write-Host $appKey.gettype()

$UninstallString = $appKey.GetValue("UninstallString")

#Write-Host $UninstallString

} else { #The application was not found.

Write-Host "The application $appName was not found so no uninstallation was performed."

}

#check to make sure this is an MSI based application so we don't get unexpected behavior

if ($UninstallString.StartsWith("msiexec.exe","CurrentCultureIgnoreCase"))

{

$Arguments = @()

$Arguments += "/Q"

$Arguments += "/X"

$Arguments += $UninstallString.substring($UninstallString.indexof("{"),$UninstallString.Length - $UninstallString.indexof("{"))

if ($userid -and $pwd){

$secpasswd = ConvertTo-SecureString $pwd -AsPlainText -Force

$credential = New-Object System.Management.Automation.PsCredential($userid,$secpasswd)         

$ExitCode = (Start-Process -FilePath "msiexec.exe" -ArgumentList $Arguments -Credential $credential -Wait -Passthru).ExitCode

}

$ExitCode = (Start-Process -FilePath "msiexec.exe" -ArgumentList $Arguments -Wait -Passthru).ExitCode

if ($ExitCode -ne 0)

{

throw "The MSI failed to get uninstalled.  MSIEXEC.exe returned an exit code of $ExitCode."

} 

}



}catch [Exception] {

$EMsg = Write-Host 
"Failed in WinUtils::uninstall-application : " + $_.Exception 

throw

}

}

}



measure-command {uninstall-application -a "simpleInstall"}

Powershell Remoting using SSL

2011-10-23T20:33:00.001-06:00

Quick and dirty guide to using ssl to create remote powershell session. First you need a certificate and private key to secure session with. Run the following command to create a certificate. Bing makecert.exe utility which is part of the Windows SDK. It is easier for a newbie to create certs using this than openssl tools. This will create a cert and private key and put it in the store Local Machine -> Personal. Search online on the command for more details. The key/cert is that it will work as a server certificate.

makecert -r -pe -n "CN=computer.company.com" -e "12/31/2020" -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localmachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12

Now you have a certificate and private key. Run the following command to create an https listener for Windows Powershell. You can get the thumbprint by looking at the properties of the cert.

winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="computer.company.com";CertificateThumbprint="e5b45f100166fdfedab674ed6fb887dbafd99391"}

Now connect and start the automation from a remote system:
$pso = new-pssessionoption -SkipCNCheck -SkipCACheck
$sess = new-pssession -ConnectionUri https://computer.company.com:5986 -SessionOption $pso -credential company\awesomeAdmin
Enter-PSSEssion $sess

#Run Commands to fully automate what I do . . . . .

Remove-PSSession *

Server 2008 R2 MSMQ Issues

2011-08-26T21:39:00.000-06:00

MSMQ has changed a little when using with Active Directory in Server 2008 R2. When you install the Active Directory feature, the service installs using the network service account and attempts to use the computer account in AD to create the objects in sites and services of AD for public queues. Default security does not allow that account to create those objects. You can assign domain computers the create/delete/read to Servers folder in Sites and Services OR create a group, assign permissions to that group and add that computer account to that group prior to installing the feature. You can run the following script to view permissions on that folder if you know the site the server is in prior to installing or just view permissions in sites and services. We use this script to validate permissions prior to automating our MSMQ installations. If permissions, install, else alert.

 [string] $OU = "cn=Servers,cn=AlabamaSite,cn=Sites"

$ConfigurationNC = ([ADSI]"LDAP://RootDSE").configurationNamingContext

$LDAP = "LDAP://" + $OU

$SiteDN = ([ADSI]"$LDAP,$ConfigurationNC")

$sd = $SiteDN.psbase.get_objectSecurity().getAccessRules($true,$false,[System.Security.Principal.NTAccount])

$sd

Powershell - Not so elegant way to output Privileges via Powershell

2011-08-22T20:31:00.000-06:00

Ghetto way to output privileges using Powershell. Useful when troubleshooting things like group policy, scripts or any other sources that may change privileges from what they should be. May generate a hash from this and automate a quick hash difference to monitor changes to privileges on systems.

#Variables
$computername= $env:COMPUTERNAME
$tempdir = "c:\temp"
$file = "$tempdir\privs.txt"
[string] $readableNames
$outHash = @{}

##### Generate report with just USER_RIGHTS ######
$process = [diagnostics.process]::Start("secedit.exe", "/export /areas USER_RIGHTS /cfg $file")
$process.WaitForExit()
$in = get-content $file

# start check of local userrights
foreach ($line in $in) {
if ($line.StartsWith("Se")) {
$privilege = $line.substring(0,$line.IndexOf("=") - 1)
$sids = $line.substring($line.IndexOf("=") + 1,$line.Length - ($line.IndexOf("=") + 1))
$sids = $sids.Trim() -split ","
$readableNames = ""

foreach ($str in $sids){
Write-Host $str
if ($str.StartsWith("*S-")) {
$str = $str.substring(1) # For some reason, secedit appends a * to the SID like *S-1-5-32-544, this just strips the first character
$sid = new-object System.Security.Principal.SecurityIdentifier($str)
$readableName = $sid.Translate([System.Security.Principal.NTAccount])
$readableNames = $readableNames + $readableName.Value + ","
} else {
$readableName = $str
$readableNames = $readableNames + $readableName + ","
}

}
$outHash.Add($privilege,$readableNames.substring(0,($readableNames.Length - 1))) #output edited version
}
}
$outHash

Simple Script to Rotate Log Files Without Backup or Zip

2011-08-18T21:44:00.000-06:00

Haven't used this script in awhile but in the interest of sharing, hope someone may get something out of this. I will post another one that is more mature that can archive older content. This is vbscript, new stuff is powershell.

sFileName = "Junk.txt" 'logfile to archive

sPath = "C:\Temp\Telalert\log\"

sLogFile = sPath & sFileName

iInt = 5 'days to keep logs

count = 1

'Create Objects

Set oFso = CreateObject("Scripting.FileSystemObject")

Set oWshshell = CreateObject("Wscript.Shell")



'Main

On Error resume next

If (oFso.FileExists(sLogFile)) Then

 sRenameFile = sPath & Replace(Date(), "/", "-") & sFileName

 If (oFso.FileExists(sRenameFile)) Then

  Do While oFso.FileExists(sRenameFile) 

   sRenameFile = sPath & Replace(Date(), "/", "-") & "-" & count & "-"& sFileName

   count = count + 1

  Loop

 End If

oFso.MoveFile sLogFile,sRenameFile

If Error <> 0 Then

  oWshshell.LogEvent 1,"LogRotator.vbs: Error renaming "&sLogFile&".  Exiting"

  CloseSession

End If

Set fils = oFso.GetFolder(sPath).Files

For Each fil In fils

 sfile = fil.name

 If InStr(1,sfile,sFileName) then

  If IsDate(Left(sfile,10)) then

   sDate = CDate(Left(sfile,10))

   days = DateDiff("d",sDate,date())

   If days >= iInt then

    oFso.DeleteFile sPath & sfile

    If Error <> 0 then

     oWshshell.LogEvent 1,"LogRotator.vbs: Error deleting "&Path&sfile&".  Exiting"  

    end If

   end if

  end if

 end if  

Next

Else

 oWshshell.LogEvent 1,"LogRotator.vbs: Logfile " & sLogFile & " does not exist.  Exiting"

 CloseSession

End If

oWshshell.LogEvent 0,"LogRotator.vbs: Logfile " & sLogFile & " has been archived as " & _

sRenameFile & ".  Exiting"

CloseSession 

'------------------------------------------------------------------------

Sub CloseSession

On Error Resume Next

 Set oFSO = Nothing

 Set oWshshell = Nothing

 Set objReg = Nothing

 hInput.Close

 hOutput.Close

 hErr.Close

 WScript.Quit

End Sub

Simple vbscript for Monitoring Web Site Availability

2011-08-17T21:34:00.000-06:00

Simple vbscript that was used for quite awhile to monitor a troublesome web site and restart IIS on failure. This was running as a scheduled task on Windows Server 2003 for a long time but not tested on newer server versions. Just replace strsearch variable with valid HTML returned from the page you configure. It will create and log to the same directory the script is executing from. Hope this helps someone looking for a quick temporary solution.

On Error Resume Next

Set objFSO = Wscript.CreateObject("Scripting.FileSystemObject")

Set objWinHttp = Wscript.CreateObject("WinHttp.WinHttpRequest.5")

Set objShell = WScript.CreateObject("WScript.Shell")

scriptname = WScript.ScriptFullName

'get path to script

path = Left(scriptname, InStrRev(scriptname, "\"))

Set Output = objFSO.OpenTextFile(path & "WebAvailability.log",8,true)



objWinHttp.Open "GET", "http://www.website.com/testpage.aspx" , false

objWinHttp.Send

If err <> 0 then

 output.writeline "Error" & "," & Now

 objShell.LogEvent 1, "Site encountered following error: The web server is not responding to request"

 Wscript.quit

End If

return = objWinHttp.ResponseText

strSearch = "Successful - This is text returned from the web page when successful"

intPos = inStr(return,strSearch) 

If intPos = 0 then

 output.writeline "Error" & "," & Now

 output.writeline return

 objShell.LogEvent 1, "website encountered following error:" & vbCrLf & return

 output.writeline "Restarting IIS," & Now

 objShell.run "iisreset /restart"

Else

 output.writeline "Successful" & "," & Now

End if



Set objFSO = Nothing

Set objWinHttp = Nothing

Set objShell = Nothing

Powershell - Quick Way to delete all event log entries

2011-08-15T14:06:00.001-06:00

The native clear-eventlog method in Powershell v2 does not work with all the event logs. We run this on templates before we package them for sysprep to clean up the logs. This method deletes them all, and there are quite a few in Server 2008 R2.:

$logs = @()
$logs = get-winevent -ListLog *
foreach ($log in $logs){ [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($log.LogName)}

Nice little Function so you can FTP using binary mode

2011-08-11T18:52:00.002-06:00

##Purpose of this function is to FTP file. If you want to specify binary you can't use simple WebClient method
function ftpfile{ param([string]$filename,[string]$port=21,[string]$user,[string]$pass,[string]$ftpUri)


    #Write-output $filename
    #Write-output $port
    #Write-output $user
    #Write-output $pass
    #Write-output $ftpUri

    $fileContent = [System.IO.File]::ReadAllBytes($fileName)
    $req = [System.Net.FtpWebRequest]::create($ftpUri)
    $req.Method = [System.Net.WebRequestMethods+Ftp]::UploadFile
    $req.Credentials = New-Object System.net.NetworkCredential($user,$pass)
    $req.UseBinary = $true
    $req.ContentLength = $fileContent.Length
    $requestStream = $req.GetRequestStream()
    $requestStream.Write($fileContent,0, $fileContent.Length)
    $requestStream.Close()
}

Powershell - Add domain account to local Administrators group when authenticated with local account

2011-07-06T21:12:00.005-06:00

I thought you may need to authenticate to the domain to add a domain account to the local group but you just need to provide it in a string formatted like below. When I was looking at samples, they all showed logging on via LDAP to browse the directory. If you know what the account is, authentication isn't needed.

$user = "WinNT://domain.local.pri/service.account"
$group = New-Object System.DirectoryServices.DirectoryEntry("WinNT://./Administrators")
$group.PSBase.Invoke("Add",$user)