geekpoet

Powershell script to check for pending reboots (specifically for WSUS / Automatic Updates pending reboots)

2010-06-16T09:13:00.000-07:00

I've been looking for a reliable way to determine if servers I've pushed patches to via WSUS (we use a manually-activated scheduled tasks to forcibly apply pending patches) have triggered a pending reboot. I did a quick google search and found a script by a gentleman named Moe Winnett over at http://www.techmumbojumblog.com/?p=375&cpage=1 that does 99% of what I needed. It didn't include the paths needed for WSUS/Automatic Updates pending reboots so I added that (and sent them the additions).

This is rough, and provided in case it helps anyone. It actually will be part of a larger management script at some point.

$Version = "wsus_rbquery.ps1 v10.6.14 Aaron Dodd"
$Usage = "Usage: wsus_rbquery.ps1 [servers], where [servers] is one or more servers to set up the tasks on (comma-separated if more than one) or a one-server-per line text file ending in .txt"
$Description = "Checks for pending reboots on target server(s)"

# Based on a script found at http://www.techmumbojumblog.com/?p=375&cpage=1

# Expects 1 or more (comma-delimited if more) servers
If (!$Args[0]) {
    Write-Host $Version
    Write-Host $Usage
    Write-Host $Description
    Exit
}

$Servers = $Args[0].ToLower()

If ($Servers.Contains(".txt")) {
    $Servers = gc $Servers 
} ElseIf ($Servers.Contains(",")) {
    $Servers = [regex]::Split($Servers,",")
}


function Get-PendingReboot {
    param([string]$computer)
 $hkey  = 'LocalMachine';
 $path_server = 'SOFTWARE\Microsoft\ServerManager';
    $path_wsus      = 'SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired';
 $path_control = 'SYSTEM\CurrentControlSet\Control';
 $path_session = join-path $path_control 'Session Manager';
 $path_name = join-path $path_control 'ComputerName';
 $path_name_old = join-path $path_name 'ActiveComputerName';
 $path_name_new = join-path $path_name 'ComputerName';

 $pending_rename = 'PendingFileRenameOperations';
 $pending_rename_2 = 'PendingFileRenameOperations2';
 $attempts = 'CurrentRebootAttempts';
 $computer_name = 'ComputerName';

 $num_attempts = 0;
 $name_old = $null;
 $name_new = $null;

 $reg= [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($hkey, $computer);

 $key_session = $reg.OpenSubKey($path_session);
 if ($key_session -ne $null) {
  $session_values = @($key_session.GetValueNames());
        $key_session.Close() | out-null;
 }

 $key_server = $reg.OpenSubKey($path_server);
 if ($key_server -ne $null) {
  $num_attempts = $key_server.GetValue($attempts);
  $key_server.Close() | out-null;
 }

 $key_name_old = $reg.OpenSubKey($path_name_old);
 if ($key_name_old -ne $null) {
  $name_old = $key_name_old.GetValue($computer_name);
  $key_name_old.Close() | out-null;

  $key_name_new = $reg.OpenSubKey($path_name_new);
  if ($key_name_new -ne $null) {
   $name_new = $key_name_new.GetValue($computer_name);
   $key_name_new.Close() | out-null;
  }
 }
    
    $key_wsus = $reg.OpenSubKey($path_wsus);
 if ($key_wsus -ne $null) {
  $wsus_values = @($key_wsus.GetValueNames());
        if ($wsus_values) { 
            $wsus_rbpending = $true 
        } else {
            $wsus_rbpending = $false
        }
  $key_wsus.Close() | out-null;
 }

 $reg.Close() | out-null;

 if ( `
        (($session_values -contains $pending_rename) -or ($session_values -contains $pending_rename_2)) `
 -or (($num_attempts -gt 0) -or ($name_old -ne $name_new)) `
    -or ($wsus_rbpending)) {
  return $true;
 }
 else {
  return $false;
 }
}

ForEach ($Server in $servers) {
    Write-Host $Server - (Get-PendingReboot $Server)
}

Importing Windows-based Outlook tasks into Mozilla Thunderbird/Lightning/Sunbird on OS X

2009-12-08T19:09:00.000-08:00

I usually track all work as Outlook tasks and keep work requests as the body/description of the task. Its not the best workflow, but its easy and allows for the mostly-email-based requests to be quickly tagged, given a reminder/due date, and tracked.

I decided to switch to Thunderbird for a variety of reasons, and the one thing I was really missing was how to get my tasks from Outlook into Thunderbird/Lightning. The calendars were no problem as I have Outlook using the GoogleSync app from Google to keep that calendar in sync. But tasks aren't supported that way.

However, after way too much digging and surfing and tinkering, I realized that since I'm using OS X, specifically Snow Leopard, and it supports Exchange sync, the answers were built into my OS.

To get my tasks from Outlook into Thunderbird I did the following:

I set up Apple's iCal to use our corporate Exchange2007 server for calendar and tasks
Once that was up, I went to the Finder and looked under my home folder, Library, Calendars
There were a couple of folders with long GUID names (long numbers/letters separated by dashes) ending in ".calendar". Expanding this showed a folder called "Events" which contained one .ics file for every task that was sync'd from Exchange
I copied all of these .ics files to a temporary folder
This step is optional, but I recommend it otherwise you're going to repeat the import steps for each .ics file: I then opened the terminal, changed to the folder with the .ics files, and typed "cat *.ics > merged.ics". This took each of the individual .ics files and made them into one.
In Thunderbird I went to the Calendar page, clicked "File / Import Calendar" and browsed to the "merged.ics" file above

This didn't preserve file attachments (which I didn't expect to be preserved) or categories, but everything else seems to be in tact.

I wish I knew of a more cross-platform solution, but since I use OS X this worked fine for me ;-)

Powershell script to change local administrator password across multiple computers

2009-10-10T22:44:00.000-07:00

Ok, this is yet another script for changing local administrator passwords across most Windows servers and desktops (works on Windows 2000, 2003, 2008, XP, and Vista). The difference here is in my quest to find one quickly, I stumbled across a bunch of VBScripts that are decent but overkill, so I ended up writing my own script that will:

Parse a list of server names

Verify the server is online

Only try to change the password if it is online

Tell me if it succeeded, failed, or skipped a down system

Fortunately, all of this is available in Powershell with little real effort. Below is a quick script to do all of the above. Before running it, be sure that:

The account you're running it under has administrative rights to each system. If you're spanning domains without trusts, you should use the "Stored Usernames and Passwords" control panel to add your credentials for each domain (specify the resource as *.domain.name, and use FQDN's in step 2).

You create a list of servers, one per line, called "serverlist.txt" in the same folder from which you run the script (you can change the filename and path by editing the script below).

You change the placeholders below to have the proper local admin username and new password (we have a GPO to rename the administrator account, so I don't assume "Administrator")

The script:

$erroractionpreference = "SilentlyContinue"
foreach ($Computer in get-content serverlist.txt) {
    $ServerName = $Computer.ToUpper()
    
    $ping = new-object System.Net.NetworkInformation.Ping
    $Reply = $ping.send($Computer)
    
    if($Reply.status -eq "success") {
        Write-Host "$ServerName is online"
        $Admin=[adsi]("WinNT://" + $Computer + "/--ADMINUSERNAMEHERE--, user")
        $Admin.PSBase.Invoke("SetPassword", "--NEWPASSWORDHERE--")
        
        # Verify password was just changed
        $PasswordAge = $Admin.PasswordAge        
        If($PasswordAge -ne $null) {            
            Write-Host "$ServerName password change SUCCEEDED"        
        } Else {
            Write-Host "$ServerName password change FAILED"        
        }
    } Else {
        Write-Host "$ServerName is not online - skipping"    
    }
}

LogParser Lizard on Windows Vista x64, 2003 x64, 2008 x64

2009-09-01T14:48:00.000-07:00

The insanely useful "LogParser Lizard" from LizardLabs is something I use daily to parse logs across our server farms (i.e. did that email from someluser@somecompany.com actually leave one of the dozen front end mail servers? Did we get any FTP error code 426's for the past week anywhere on the FTP server farm?). It's a front-end to Microsoft's LogParser.exe so it reads pretty much any log format used on Windows, plus some niceties like AD querying, SQL DB querying, and making pretty charts out of the results.

The issue is the server I run it from is Windows 2003 32-bit. When I tried to run it from our new management server, 2008 x64, or from any of the 64-bit 2003 servers, it would seem to start, then crash. I'd see the following error in the event log:

Faulting application log parser lizard.exe, version 1.0.0.0, stamp 48565da6, faulting module kernel32.dll, version 5.2.3790.4062, stamp 462643a7, debug? 0, fault address 0x000000000000dd10.

I've seen this before, actually, on our own code. Seems sometimes developers will write an app in a 32-bit environment but not explicitly set it to load 32-bit. This is generally ok since most .NET apps will run fine in 32-bit or 64-bit, but it seems LogParser Lizard includes a lot of freeware .dll's that are 32-bit only. As a result, even though the main .exe loads 64-bit, it tries to then load 32-bit only .dll's.

Fortunately this is easy to fix. If you don't already have it installed, install the Microsoft .NET 2.0 SDK. In it there's a tool called "corflags.exe" (no, there's no "e" in corflag). This is used to modify the header of a binary to set it to be explicitly 32-bit.

To do this, run:

corflags.exe c:\full\path\to\logparserlizard.exe /32BIT+

To undo it, run the same with /32BIT-

Then it runs fine :-)

A Script to fix Windows Update Services clients not appearing in the WSUS console

2009-04-27T20:27:00.000-07:00

After going through a bunch of patching solutions and being somewhat dissatisfied with most, I decided to give Microsoft's Windows Update Services another go. I hadn't used it since the 1.0 days and it was, well, rather 1.0 then.

WSUS 3.0 has a decent feature set, the two most desirable ones being a nice reporting system and the fact it's client is built into Windows (yes yes we can go back and forth on the merits or evil-ness of this fact, but its built in and therefore one less client I need to install...)

In our lab, this worked great. I have a setup where our load-balanced farms update and reboot several hours apart on saturdays, and our core boxes download but wait for manual updating. It was, in fact, one of the most flawless, hands-off setups I've worked with.

However, this was in the lab. In the real world, I ran into several issues. If you google for "WSUS clients not registering" or "WSUS clients disappear" you'll see a myriad of issues, several of which I came across. I won't post them here but the one that really irked me was this:

In production we have several hundred machines, most of which all show up in the WSUS console just fine. However, a few dozen were not appearing. There seemed to be no real commonality between them. They were a mix of 32-bit 2003, 64-bit 2003, and 64-bit 2008, some the "R2" editions of each. MS's "clientdiag.exe" tool passed on all. All the MS troubleshooting steps also confirmed access to the WSUS server. The "WindowsUpdate.log" showed no errors beyond normal transient ones.

Turns out, after much digging, I stumbled across this registry key:

hklm\software\microsoft\windows\currentversion\windowsupdate\susclientid

This, it seems, was the commonality of the several dozen machines. Each set of machines having issues (32-bit 2003 boxes, 64-bot 2003 boxes, 2008 boxes) had the same value as each other of the same time. Some investigation revealed these servers were clones of each other. While the technician that built them ran NewSID or sysprep'd them, this key didn't change. As a result, they'd check in to WSUS and conflict.

Now, this was only one of several issues I found. It seems every so often I bring a new box into the WSUS system to find it not working right away. I wrote the following script which so far addresses all of the issues I've come across. It works on both 32-bit and 64-bit 2003 and 2008:

@echo off
::Version 9.4.26 Aaron Dodd

echo Stopping Windows Update Services
net stop wuauserv >NUL

echo Deleting existing WSUS registry keys
:: This deletes the WSUS keys managed by GPO
reg delete hklm\software\policies\microsoft\windows\windowsupdate /f >NUL

:: This deletes WSUS ID's that should be different but can be the same if windows was installed via an image
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v AccountDomainSid /f >NUL
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v PingID /f >NUL
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientId /f >NUL

echo Forcing policy update to restore registry keys
gpupdate /target:computer /force >NUL

echo Deleting existing local WSUS repository
del /s /q c:\windows\softwaredistribution >NUL
if exist c:\windows\syswow64 del /s /q c:\windows\syswow64\softwaredistribution >NUL

Echo Restarting BITS
net stop bits >NUL
net start bits >NUL

Echo Starting Windows Update Services
net stop wuauserv >NUL
net start wuauserv >NUL

Echo Forcing re-authorization to WSUS server and detection of patches
wuauclt /resetauthorization /detectnow >NUL

So far I haven't found a WSUS issue it hasn't fixed for me.

Note: this script does assume you're deploying WSUS settings via GPO. As a result, its safe to delete the entire policies...windowsupdate subkey because the GPO replaces it. Also, deleting "softwaredistribution" is safe because wuauserv ("Windows Update" service) recreates it.

The BITS part I'm not sure is necessary, but can't hurt ;-)

Also, yes, I'm stopping wuauserv again before starting it. It seems the GPO update sometimes starts it and since we just deleted the "softwaredistribution" folder, its necessary to stop/start the service again to rebuild it.

If you want to deploy this to many machines at once, I suggest using psexec.exe with the "-c" flag to copy this script and execute it on the target systems. I.e. save the script as "fix_wsus.cmd":

for %y in (svr1,svr2,svr3) do psexec.exe \\%y -c fix_wsus.cmd

See "for /?" for how to specify a text file of server names if you have a lot.

Simple means of syncing IIS7 settings in a webfarm

2009-03-30T11:21:00.000-07:00

Here's our issue:

We have dozens of IIS servers in our webfarms. Each webfarm handles specific sets of applications. All members of each webfarm are supposed to be identical.

With IIS6 this was really simple. We would:

Remove one node from the webfarm
Make IIS changes on one node
Robocopy the code to that node
Test against that node

If successful we would:

Bring that node back and take out a second node
robocopy code to that node
run "cscript c:\windows\system32\iiscnfg.vbs /copy /ts \\targetserver /tu domain\user /tp password" to sync the metabase to that second nodebring that node back into the webfarm
repeat for other nodes

This may sound like a lot of steps but I'm simply writing out what our script does for us automatically.

With IIS7, we could keep the same process if we installed the IIS6 metabase compatibility. But, I'm not one for holding onto the past without a really good reason and while this functionality seems like a good reason, I'd rather have a more supported method that uses today's functionality.

Microsoft's management for IIS7 is . . . interesting in my opinion. They make an excellent step towards scriptable management by putting everything in .xml files instead of binary metabase. You can read these settings in c:\windows\system32\inetsrv\config\ApplicationHost.config. The "interesting" part is that Microsoft for some reason decided to keep machine specific settings in this file (notably, the encryption keys). This means if you simply copy this applicationHost.config to a sister server, you'll find IIS won't even start.

Okay, so what about scripting? Well, Microsoft no longer includes iiscnfg.vbs (unless you include IIS6 compatability). They have the rather nice appcmd.exe tool, but it doesn't work against remote systems. They have the "Web Deployment Tool" but that requires re-packaging your application.

I decided instead we should standardize on as little customization as possible, so Web Deployment Tool is out unless our developers will be sending us packaged deployments (which I think is a terrible idea for a production webfarm as you lose control over your server to whatever development thinks are appropriate settings). Instead, we opted on a slight bastardization of Microsoft's official webfarm setup.

You'll want to read Microsoft's IIS7 Shared Configuration guide for more details, especially for the nice screen shots. We followed those with one exception: We are using a local folder for the "central UNC path" instead.

This gives us two advantages over Microsoft's shared configuration recommendation:

Immunity from issues with a UNC share (credentials changing, share going down, etc)
The ability to make changes to just one node for testing before synchronizing, or for troubleshooting

It was really the second advantage that made us go this route as a pre-flight test is required prior to making a change live.

Since all of our code goes to D:\applications\[appname] which we use Robocopy to sync to all sister nodes, we just created a "D:\applications\iis_settings" folder and set that as the shared configuration path. Now, when we robocopy our code, the IIS7 settings get immediately replicated to the sister nodes as well. Our original process is actually a step shorter.

Importing Apple Mail into KDE's KMail

2009-02-14T21:03:00.000-08:00

There's a ton of articles on teh interwebz on how to import mail into Apple's Mail.app from KDE's KMail, but I hadn't come across anything on doing the reverse.

It turns out this is insanely simple, just not obvious, especially since it wouldn't work the "official" way.

KMail has some wonderful importers, including one called "Import from OS X Mail". Being the painfully obvious choice, I fired up KMail, clicked "File / Import Messages", chose "Import from OS X Mail" and pointed it to my Mac's Library/Mail/Mailboxes folder. I tried the root level, the mailbox folder itself, then even the subfolder "messages" which contained the actual emails. It never actually worked.

If I ever care to figure out why, I might look into it more, but the following seems to be a foolproof and quick way.

In OS X's Mail.app you can right-click a mail folder and choose "Archive". This seems mis-named to me, since generally I consider "archiving" email to mean you're sending it to an archive and removing it from the folder. Really, this is more of a "backup". Anyway, I digress...

1. Right-click the folder you want to send to KMail
2. Choose "Archive"
3. Point it to a folder. This will create a subfolder with the name of this Mailbox, which will then contain all of the email in an MBOX file.
4. Open KMail
5. Choose "File / Import Messages", choose "Import MBox files"
6. Point it to the mbox file itself that Apple Mail saved.

Voila!

Mac OS X alternative to SnagIt

2008-10-29T18:23:00.001-07:00

I've been spoiled by an application for Windows called SnagIt. Its a really nice screen capture tool that lets you take screen grabs of portions of the screen, annotate them with arrows and boxes and text, then save or copy the result to the clipboard.

I wanted something similar for OS X. While I knew about "ctrl + command + shift + 4" to do screen captures of specific portions of the screen (replace "4" with "3" for the whole screen), what I didn't know is that starting with 10.5, Preview actually includes all the annotation features I need. Thanks LifeHacker for this article (excerpt below)

Mac OS X Leopard only: One of the built-in Mac utilities that got the most feature additions in Leopard—albeit pretty quietly—is Preview, the PDF and image viewer. We've already covered how you can do more with Preview in Leopard, but Mac OS X Hints points out another good one: image annotation. Add arrows and notes, or circle and outline areas of an image in Preview using the Annotation menu. (In Preview's View menu choose Customize Toolbar, then drag the Annotate menu onto the toolbar.) Then, when you're editing a non-PDF image in Preview, just select your annotation, and click and drag on the image itself. Handy, and no third-party software required.

So, now to get the same features for when I need to sent an annotated screenshot, I just:

use the "CTRL+COMMAND+SHIFT+4" combination to bring up the screen grab crosshairs (use can press "space" after to get a camera icon to do a grab of a whole window)
Select the portion I want to grab
Open the Preview application
Either do "File / New" or "COMMAND+N", which opens a new document with the contents of the clipboard
Annotate away!

removing duplicate files with under bash using fdupes and accounting for spaces

2008-10-10T17:44:00.000-07:00

Basically, I've been lazy. I've been trying to organize a file structure, been unhappy with it, copied it, tried again, been unhappy, copied . . . and ended up with about six copies of this folder each with various additions made to it at various subfolder levels that I need to account for.

Now, I could simply do a recursive find and look for duplicate file names, but the other part of my being lazy is a lot of files in various subfolders are named simply with the very imaginative format of the date I wrote the file. What I wanted was to compare md5 checksums to be sure they were truly identical.

While I use Windows at work and could whip of a powershell script to handle this on Windows, I run OS X for my personal machine.

I've tinkered with bash scripting before, enough to know that what I want to do should be doable in one line with the help of the great utility fdupes. (fdupes can be installed on OS X easily if you have MacPorts installed, simply call "sudo port install fdupes")

I whipped up the following and was proud of myself:

for i in $(fdupes -rf ./); do echo deleting: $i; rm $i; done

(of course the "rm" was done after making a backup ;-) )

What I noticed was this worked fine for all files except those with spaces in the name. I apparently some files that were saved with the first sentence as the filename, which the output of this command confirmed as:

deleting: some
deleting: file
deleting: with
deleting: spaces.txt

After some head scratching thinking about piping through awk or escaping out the spaces, I found this on a google result:

If you set IFS to $'\n' then it will only split on newlines, not spaces.

Could it be that simple? YES! My completed commands:

IFS=$'\n'
for i in $(fdupes -rf ./); do echo deleting: $i; rm $i; done

Manipulating remote services with Powershell 1.0

2008-10-09T12:19:00.000-07:00

I know Powershell 2.0 CTP2 includes remote support for the get/set-service cmdlet, but I cannot use beta code in production and needed a way to use Powershell to accomplish the same functions we use the Resource Kit "sc.exe" tool for now (start, stop, enable/disable).

After much googling, this turned out to be insanely simple, yet hard to find.

First, get the remote service using WMI:

$Svc = Get-WmiObject -Computer $Server win32_service -filter "name='$Service'"

Second, issue the appropriate control command:
To start a service:

$Result = $Svc.StartService()

To stop a service:

$Result = $Svc.StopService()

To disable a service:

$Result = $Svc.ChangeStartMode("Disabled")

To enable a service for manual:

$Result = $Svc.ChangeStartMode("Manual")

To enable a service for auto start:

$Result = $Svc.ChangeStartMode("Auto")

Third, check if the command worked; just look for $Result.ReturnValue. It should be "0" if it succeeded.:

$Result.ReturnValue

For reference, "5" means you tried to stop an already stopped service and "10" means you tried to start and already started service.

You can also check the current state by:

$Svc.State

And the current StartMode by:

$Svc.StartMode

I would also add in a step after calling "Get-WmiObject" to verify you actually connected to a service. There is no response if the service didn't exist, but you can simply check if $Svc is null or not:

If (!($Svc)) { #perform action }

If this wasn't fully helpful for you (i.e. you want to manipulate lots of services or many machines) I found the best google search term to be "powershell win32_service" from http://google.com/microsoft

HowTo Install Dell OpenManage 5.3 on Citrix XenServer 4.1 and have it listed in a central OpenManage Management System

2008-05-29T17:55:00.000-07:00

Update 10/3/2008: I have successfully followed these directions to install OpenManage 5.4 under XenServer 5.0.

A few months ago I posted an article on how to install Dell OpenManage on a Citrix XenServer. Since then I've been wanting to have the Xen servers appear in our central OpenManage Management System so we can get central alerting of hardware issues. I've discovered a few gotcha's along the way, and figured it'd be a good idea to post one consolidated how-to for anyone interested.

This article pulls heavily on vendor documentation, but let me stress that as of the posting of this how-to, neither Citrix nor Dell officially support running OpenManage on a XenServer.

For reference, here are the documents I've used:

Citrix's KnowledgeBase article on how to get IT Assistant, the client-side component also called "OpenManage Managed Node", also called "OpenManage Server Administrator", also known as "Dell OpenManage Server Administrator Managed Node". Seriously, different names names all depending on the readme, package file, or Dell's support site.
Dell's page from the 5.3 manual on configuring SNMP under Linux

And the software you'll need is:

Citrix XenServer 4.1
Dell OpenManage Management Station installed on a Windows server somewhere and properly configured/working, with your SNMP traps/destinations/communities configured for the IP range the XEN server is on.
Dell OpenManage Managed Node 5.3 for RedHat Enterprise

Okay, now lets begin. I suggest doing all of these changes on a test system first. At the end, I'd suggest consolidating all of the changed files and make a new .tar.gz file to deploy to your other servers.

Step 1: Modify the OpenManage installation package
Remember, this isn't an officially supported solution, so if you try to run the Server Administrator Managed Node installation right away, you'll get an error that it doesn't recognize Xen's linux distribution (CentOS, fyi).

Copy the tar.gz file to your Xen host. I use WinSCP for this.
Extract the tar.gz you downloaded to a temporary folder:
tar -xzf OM_5.3.0_ManNode_A00.tar.gz
Edit the file "setup.sh":
vi setup.sh
Change the lines 2972 and 2973 as follows:
2972: GBL_OS_TYPE=${GBL_OS_TYPE_UKNOWN}
2973: GBL_OS_TYPE_STRING="UKNOWN"
Become:
2972: GBL_OS_TYPE=${GBL_OS_TYPE_RHEL5}
2973: GBL_OS_TYPE_STRING="RHEL5"
Save the file

Step 2: Aquire "lockfile"
I noticed originally when running the "setup.sh" script, that as it tried to start the services the inventory service would fail with an error

Warning: The lockfile utility is not found in PATH or /usr/bin.
This utility prevents concurrent executions of setup.sh
which can lead to unexpected or invalid installation results.

Or with:

no lockfile in (/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin)
invcol Error: Cannot find utilities on the system to execute Inventory
Collector.
Make sure the following utilities are in the path: tar gzip tail rm mkdir
chmod ls basename wc lockfile stat

I figured the easiest way to get this file would be to run YUM, the CentOS repository system which Xen helpfully left in. This, of course, had its own set of issues. From my previous article on YUM under Xen, you may need to do the following. I'd suggest first testing if "lockfile" exists by typing "which lockfile". If you don't have "lockfile" installed, then proceed:

Xen is using CentOS for their host OS, but they disable the CentOS repository and enable what appears to be a non-existent/functional Xen repository. Whenever you try to use Yum, it throws an error that the repository checksum is invalid:
http://updates.xensource.com/XenServer/4.0.96/domain0/repodata/primary.xml.gz: [Errno -1] Metadata file does not match checksum
Trying other mirror.
Error: failure: repodata/primary.xml.gz from xensource: [Errno 256] No more mirrors to try.
To resolve this temporarily, and only on my test system, I edited /etc/yum.repos.d/XenSource.repo and changed the following line:
enabled=1
to:
enabled=0
I then edited /etc/yum/repos.d/CentOS-Base.repo and changed the following line under the top "[base]" section
enabled=0
to:
enabled=1

"yum whatprovides lockfile" now returned a bunch of results. It seems "lockfile" is part of the postfix package. To get this file I:
ran "yum install postfix"
copied "/usr/bin/lockfile" to a temporary location
ran "yum remove postfix"
copied "lockfile" back to "/usr/bin/lockfile"
Now starting the services ("/opt/dell/srvadmin/omil/supportscripts/srvadmin-services.sh restart") no longer shows an error and I can see the inventory in the GUI

Step 3: Configure SNMP
This can actually be fairly complex depending on your SNMP setup in your environment. I'm going to assume you're doing a simple configuration here, where you have two communities set up in your OpenManage Management System for this IP range: "MY_READ" and "MY_WRITE" configured for read and write access, respectively. In this case, just copy in what I have below, after making a backup of the original.

If you want an explanation of the options and conventions used below, try "man snmpd.conf", Google "snmpd.conf", or read Dell's page from the 5.3 manual on configuring SNMP under Linux. If you get stuck, feel free to leave a comment here and I'll help you as best I can.

Rename the original snmpd.conf file:
mv /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.orig
Copy the following into a new /etc/snmp/snmpd.conf file, changing the "MY" strings to your own:

# Map users to community strings
# sec.name source community
com2sec U_ReadOnly default MY_READ
com2sec U_ReadWrite default MY_WRITE

# Map users to groups
# groupName securityModel securityName
group G_ReadOnly any U_ReadOnly
group G_ReadWrite any U_ReadWrite

# create view
# name incl/excl subtree mask(optional)
view all included .1

# grant rights to the above views
# group context sec.model sec.level prefix read write notif
access G_ReadOnly "" any noauth exact all none none
access G_ReadWrite "" any noauth exact all all none

# Set trap destination
trapsink my.openmanage.server MY_MANAGEMENT

# Allow localhost access
rocommunity MY_READ 127.0.0.1
rwcommunity MY_WRITE 127.0.0.1

# Allow remote hosts access
rocommunity MY_READ my.openmanage.server
rwcommunity MY_WRITE my.openmanage.server

# Below has been left in from the default snmpd.conf file:
syslocation Unknown (edit /etc/snmp/snmpd.conf)
syscontact Root (configure /etc/snmp/snmp.local.conf)

# Added for support of bcm5820 cards.
pass .1.3.6.1.4.1.4413.4.1 /usr/bin/ucd5820stat

# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
smuxpeer .1.3.6.1.4.1.674.10892.1

Now, restart SNMP by typing:
service snmpd restart

Step 4: Modify IPTABLES
XenServer contains a firewall that needs to be modified before OpenManage can see this node.

Below are my modifications to the iptables file. You only really need the lines for UDP 161 and UDP 162. The TCP 1311 is if you choose to install the "Web Administration Console", which I don't because it takes up 100M of RAM.

Make a backup copy of the current iptables file, just in case:
cp /etc/sysconfig/iptables /etc/sysconfig/iptables.orig
Edit the file as below, adding in the BOLD lines in the same place. This is important as the order of the file determines what is allowed. If you simply append these lines to the end, traffic will be blocked:

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 161 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 162 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 1311 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 694 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

Now, restart iptables by typing:
service iptables restart

Step 5: Install OpenManage
Finally :)

Change to the directory where you extracted "setup.sh"
Execute the setup script:
./setup.sh
You'll be prompted with a screen asking you which options to select. I generally only install 1,3,4,5. Option 2, "Server Administrator Web Server" will consume at least 100M of the XenServer RAM so I usually leave it off. After you selected your options, press "i" to install
Follow the prompts checking for errors. I usually take all the defaults from here
When prompted, go ahead and start the services. Watch for errors

Thats it!

Now go to your OpenManage Management System console and initiate a "Discovery and Inventory" of the IP range for this XenServer. It should show up.

For reference, you can stop/start the OpenManage services by running:
/opt/dell/srvadmin/omil/supportscripts/srvadmin-services.sh stop
/opt/dell/srvadmin/omil/supportscripts/srvadmin-services.sh start

And you can uninstall it by running:
/opt/dell/srvadmin/omil/supportscripts/srvadmin-uninstall.sh

Step 6 (optional): Repackage all of this as a new tar.gz
I did the following to ease deployment, as this is a lot of steps.

I copied the snmpd.conf, iptables, and lockfile to my extracted "openmanage" folder:
cp /etc/snmp/snmpd.conf /root/openmanage/
cp /etc/sysconfig/iptables /root/openmanage/
cp /usr/bin/lockfile /root/openmanage/
I wrote a wrapper for setup.sh to make the above changes for me prior to running setup.sh. The contents of the wrapper script are below.
After creating the wrapper script, I made sure it was executable:
chmod +x /root/openmanage/setup_wrapper.sh
I made a new tarball of all of this:
cd /root
tar -czf modified_om_5.3_mannode.tar.gz openmanage/

Pay attention, there's a space between "gz" and "openmanage/"

My wrapper script:

#!/bin/sh
# version 8.5.20 Aaron Dodd
# back up existing config files
cp /etc/sysconfig/iptables /etc/sysconfig/iptables.orig
cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.orig

#copy in new config files
cp iptables /etc/sysconfig/iptables
cp snmpd.conf /etc/snmp/snmpd.conf

cp lockfile /usr/bin/lockfile

# restart affected daemons
service snmpd restart
service iptables restart

./setup.sh

Importing / Exporting filters in Thunderbird 2.0, copying filters between folders

2008-05-08T07:10:00.000-07:00

Thunderbird 2.0 has an annoying limitation of only being able to specify rules for folder roots and cannot apply these rules to other sets of folders. That would be less annoying if Thunderbird offered a way to move or copy rules between folder roots.

For example, I use IMAP to speak to our corporate Exchange server. I have a set of rules configured there. I also have "Local Folders" which contains my "Archive" folder, where I put all the IMAP emails I want to keep.

Sometimes I add a filter to the IMAP folders that I want to then process retroactively against my archive (i.e. to add a certain tag to be picked up in the Save Searches folders I have). Using just the Thunderbird interface I'd have to manually recreate this rule.

There are a few extensions on addons.mozilla.org for exporting and importing rules. I haven't had any success with these. I get errors that the folder doesn't exist or such.

You can fairly easily copy rules between folders by editing the underlying rules file. To do this:

Find out your root folder locations. For each of the sets of folders you want to copy rules between, right-click the folder in Thunderbird and choose "Properties".
Remember the location listed under "Local Directory".
Close Thunderbird. If Thunderbird is open, any changes you make to the rules file appear to get overwritten as soon as you open the Filters window again
Navigate to the locations from step 2.
In each is a file called "msgFilterRules.dat". This is a plain text file. Make a backup copy, then open the original in your favorite text editor
There is no explicit delimeters between rules, but for me a rule seems to always start with the line "name=" and end with the line "condition=". Just copy that block from one msgFilterRules.dat" file to the other.
Launch Thunderbird and you should now see that rule in the Filters window.

Issue with Dell OpenManage 5.3 inventory under Xen Server 4.1

2008-05-08T06:51:00.000-07:00

I wrote in this article how to install Dell OpenManage 5.3 on a Xen 4.1 Host. However, I noticed that when logging into the test systems' GUI that I wasn't seeing an inventory of hardware. Performing the installation again, I noticed a few errors I didn't see originally.

When first running setup.sh, there is a brief display of the following error:

Warning: The lockfile utility is not found in PATH or /usr/bin.
This utility prevents concurrent executions of setup.sh
which can lead to unexpected or invalid installation results.

This appeared again when starting the services

To resolve this, I decided to install lockfile via YUM. The problem is, YUM seems broken by default in 4.1.

Xen is using CentOS for their host OS, but they disable the CentOS repository and enable what appears to be a non-existent/functional Xen repository. Whenever you try to use Yum, it throws an error that the repository checksum is invalid:

http://updates.xensource.com/XenServer/4.0.96/domain0/repodata/primary.xml.gz: [Errno -1] Metadata file does not match checksum
Trying other mirror.
Error: failure: repodata/primary.xml.gz from xensource: [Errno 256] No more mirrors to try.

To resolve this temporarily, and only on my test system, I edited /etc/yum.repos.d/XenSource.repo and changed the following line:

enabled=1

to:

enabled=0

I then edited /etc/yum/repos.d/CentOS-Base.repo and changed the following line under the top "[base]" section

enabled=0

to:

enabled=1

"yum whatprovides lockfile" now returned a bunch of results. It seems "lockfile" is part of the postfix package. To get this file I:

ran "yum install postfix"
copied "/usr/bin/lockfile" to a temporary location
ran "yum remove postfix"
copied "lockfile" back to "/usr/bin/lockfile"

Now starting the services ("/opt/dell/srvadmin/omil/supportscripts/srvadmin-services.sh restart") no longer shows an error and I can see the inventory in the GUI

To avoid this cumbersome process on our other Xen hosts I make a new tar.gz of the extracted and modified OpenManage installation which included this file, which I make sure to copy to /usr/bin prior to running "setup.sh" above.

Using LDAP in Thunderbird 2.0 to query Microsoft Exchange for addresses

2008-05-07T08:19:00.001-07:00

I've recently switched from Outlook to Thunderbird/Lightening for my email and calendaring needs. I use IMAP to talk to our Exchange server, but was missing being able to querying the global address book.

Thunderbird supports LDAP, but it took some digging around to get this to work right. Here's what I did.

In Thunderbird, I clicked "Go" and choose "Address Book"
I clicked "New" and "LDAP Directory"
In the "Directory Server Properties" window that appears, on the "General" tab I gave the "Name" a meaningful value (in this case, our Exchange server).
In the "Hostname" field I entered the FQDN of our Exchange server (i.e. mail.mycompany.com)
For Base DN, since I know we're not doing anything fancy I entered in "DC=mycompany,DC=com" since I know that's our AD root DN.
For "Port Number" enter 3268. I was a little confused at first as I could telnet to our Exchange server over both LDAP and LDAP/SSL ports. But, Thunderbird couldn't seem to query them. But after googling Exchange and LDAP, apparently Exchange doesn't use the standard LDAP ports, it uses 3268.
For "Bind DN" simply enter your username in domain\username format.

Seems obvious in retrospect but I figured I'd post it in case anyone else needed help.

Manual "P2V" migration of a Windows server into a XEN VM instance

2008-05-04T16:50:00.000-07:00

Xen doesn't officially offer a P2V solution for migrating existing physical Windows instances into XEN VMs. Their answer is a link to two vendors that offer XEN support for their P2V products. Both companies, however, charge a few hundred bucks per-migration, which makes it a bit expensive for the one-off migrations here and there (in both vendors' defense, the P2V functions aren't the main purpose of their products). I've used the following steps to perform migrations of Dell-based Windows 2003 Server instances into XEN virtual machines simply using NTBackup, without having to purchase any "P2V" tools/licenses.

These steps basically mimic how one can recover a Windows server onto new hardware after a failure, with some extra precautions taken to avoid interrupting the existing physical instance until it's ready to be replaced.

The steps:

From the original server, I perform an NTBACKUP-based backup of the system state and the harddrives to a file share on the network.
On the XEN host I provision a new machine of the same OS type and SP level as the physical machine to be moved. For example: if I'm moving a multi-CPU Windows 2003 Standard 32-bit server with Service Pack2, I provision a VM with Windows 2003 Standard 32-bit with Service Pack2 and multiple VCPUs. (Note: the HAL of the VM must match the original server's, so if you're migrating a single, non-hyperthreaded CPU machine, provision the VM with only one VCPU).
This new VM must have the same drive layouts as the original server. I.e. if I have the OS on "C:" and the applications on "D:" and the CDROM mapped to "Z:" on the original server, I do the same on this VM. The only exception can be to create additional VM disk images that don't exist on the original server as long as they're mounted on a drive letters not used on the original server. I create "E:" for temporary space for below as I want the .BKF file local for the restore.
On the new VM I copy the following files off the C drive to the "E:" local disk:

c:\boot.ini
c:\windows\repair

I copy in the .BKF file created in step 1 to the new VM's "E:" disk as I want to disconnect the NIC before restoring.
In the XEN console, I switch the VM's NIC to a non-used network so that it won't be able to talk to our network or domain controllers. This is to avoid interrupting the physical machine's functionality until I'm done, as the VM will take its SID, domain credentials, and possibly IP address.
On the new VM I run NTBACKUP and choose "Restore".
Under "Tools / Options" I choose the "Restore" tab and click the radio button "Always replace the file on my computer", as otherwise NTBACKUP will skip any existing newer files.
I then restore the local harddrives and system state from the backup
BEFORE REBOOTING I copy the boot.ini and windows\repair folders back in from the copies made in step 4 above
I run the Xen Tools installer to install XEN's PV, NIC, and SCSI drivers
I reboot. Sometimes at this point I get a blue-screen saying helpfully "An error has occurred." If this happens I reboot into safe mode and:

Go into the device manager
Delete the existing SCSI card (do this even if it shows up as a Citrix XEN SCSI card)
Install Xen Tools again
Reboot

When the machine comes up, I verify all the settings match the live server's. If they do, I then:

Turn off the physical instance
In the Xen console, switch the NIC to be on the proper network, allowing it to talk to our domain controller
I assign it the same IP address as the physical server, if appropriate
I reboot and allow it to log into the domain

If there are any failures logging into the domain, its most likely because the physical computer reset its security channel between the time the backup was made and the time the VM replaced the phyiscal server. This can usually be fixed by typing the following commands, or demoting the machine to a workgroup server and then re-joining it to the domain:

```
NLTEST /SC_RESET:
```

netdom reset Destination computer /domain:domain_name usero:admin_user /passwordo:admin_user_password

Note: these commands require the Windows Support Tools to have been installed. You can find them on the Windows install CD.

There have been a few instances where I've wanted to clone a physical machine but not actually replace it with the VM. This has been mostly in cases where I wasn't100% sure how the physical machine is set up or functions (inheriting old applications) but need to start the migration process. The modifications to this procedure below allow me to have the new VM running in tandem with the old physical so that testing can be done to verify functionality.

To keep the physical running in tandem with the VM, before starting the process above, place a copy of NewSid from Microsoft on the VM. Then, instead of step 13 above, do the following:

While the VM is still off the network, demote it from a domain member to a workgroup machine
Reboot
Run NewSid and as part of running it, change the name to something unique
Reboot
Give the VM a new IP address, different than the physical
Now you can bring the server onto the network and join it to the domain under the new name, IP, and SID

Powershell script to report on all IIS servers in our domain

2008-04-30T13:52:00.000-07:00

There are many scripts out there to query IIS via WMI or ADSI and enumerate the settings and report on them. However, we back up all of our server's code to a central share every night, which includes grabbing the IIS metabase.xml file, so I decided to avoid yet another call to the remote servers (and having to deal with possible authentication / connection / etc issues) and instead use Powershell's ability to read XML files to parse each of these and report on the servers' IIS settings.

This is actually two separate scripts. One is "ReportMetabase.ps1" which does the actual parsing of the metabase file. You call it as "ReportMetabase.ps1 [full\path\to\metabase.xml] [report.csv]" and it will generate a CSV of all websites, virtual folders, and their associated application pools, webroots, application names, serverbindings, and metabase IDs.

The second script is "ProcessMetabases.ps1" which will, based on the settings of its .config file, step through a directory tree and for each match of "metabase.xml", invoke "ReportMetabase.ps1" and capture its results into a compiled CSV of all systems.

One thing I added into this after making it is the ability to specify a list of server renames. Apparently, when you rename a server, the IIS Metabase keeps the "ServerComment" field with the old server's name. I discovered this after suddenly seeing servers I thought we decommissioned years ago show up on the report...

While I run this against a copy of all of our code, you can easily run this against a local server's metabase.xml even while IIS is running. It simply reads in the metabase.xml, doesn't actually open or lock the file, and does not even attempt to open it for writing.

Pre-Requisites:

Windows 2003 (not tested on 2000 or 2008) and IIS 6.0
Powershell 1.0
A copy of all metabase.xml files in your environment and access to read them, OR, run ReportMetabase.ps1 against the local metabase of a machine.

What this script does:

ProcesMetabases.ps1 reads in its .config file to determine what directory tree to traverse, what to use as a temporary folder, and where to save the file report.
ProcesMetabase.ps1 then traverses a directory tree and calls ReportMetabase.ps1 with the location to the Metabase.xml and a temp.csv file name. Each iteration it adds the contents of temp.csv to a compiled list to be saved after all Metabase.xml files have been read
ReportMetabase.ps1 reads in its .config file to determine a list of server renames to apply, and a list of virtual directories or websites to exclude from the report
ReportMetabase.ps1 then imports the specified Metabase.xml and loops through each Website and VirtualDirectory key, saving each value to a custom object
The custom object is then exported to the specified csv file.

Script Files:

ReportMetabase_8.4.21.zip (contains ProcessMetabases.ps1 and ReportMetabase.ps1)

Steps:

Download the zipfile
Extract it to a target folder
Modify both .config files to contain the proper values
Either call ReportMetabase.ps1 against a local server, or ProcessMetabases.ps1 against a directory tree of metabase.xml files.

For reference, here are the scripts:

ProcessMetabases.ps1:

$Version="v8.4.21 Aaron Dodd"
$Description="Wrapper for ReportMetabases.ps1"

#------------------------------------------------------------------------------
# Settings / Variables
#------------------------------------------------------------------------------
If (Test-Path "ProcessMetabases.config") {
   $cfg=[xml](get-content "ProcessMetabases.config")
} Else {
   Write-Host "!! ERROR !! - Config file not found"
   Write-Host "A file with the same name as this script, ending in .config, must exist in the same directory as this script."
   exit
}

$StateManagementRoot=$cfg.configuration.StateManagementRoot.name
$FinalReport=$cfg.configuration.FinalReport.name
$TempDir=$cfg.configuration.TempFolder.name
$TempReport=$TempDir + "\temp.csv"

#------------------------------------------------------------------------------

#------------------------------------------------------------------------------
# Process metabase files
#------------------------------------------------------------------------------
$Metabases=Get-ChildItem -path $StateManagementRoot -recurse -include Metabase.xml | select fullname

ForEach ($Metabase in $Metabases) {
 ./ReportMetabase.ps1 $Metabase.FullName $TempReport
 $TempCsv += Import-Csv $TempReport
}
$TempCsv | Export-Csv $FinalReport -notype
#------------------------------------------------------------------------------

ReportMetabases.ps1:

$Version="v8.4.21 Aaron Dodd"
$Description="Processes a metabase.xml file and reports all websites and various important settings"
$Usage="ReportOnMetabase.ps1 [path\to\metabase.xml] [report.csv]"


#==============================================================================
# Verify we received arguments
#------------------------------------------------------------------------------
If ($args.count -lt 2) {
   Write-Host $Version
   Write-Host $Description
   Write-Host $Usage
   exit
}
#==============================================================================
# Settings / Variables
#------------------------------------------------------------------------------
# Import config file
If (Test-Path "ReportMetabase.config") {
   $cfg=[xml](get-content "ReportMetabase.config")
} Else {
   Write-Host "!! ERROR !! - Config file not found"
   Write-Host "A file with the same name as this script, ending in .config, must exist in the same directory as this script."
   exit
}

# Object to hold the contents of the metabase file
$mb=[xml](get-content $args[0])

# Report to save
$ReportFile=$args[1]

# Hash table of metabase location # and ServerComment values from IIsWebServer keys
# Used to map virtual directories and other settings to their root websites by name
$LocationCommentMapping = @{}
$LocationBindingMapping = @{}

#------------------------------------------------------------------------------
# Array of virtual directories to ignore
#------------------------------------------------------------------------------
# These would be the 5th element of the metabase "location" key, i.e.:
# /LM/W3SVC/#/ROOT/VirtualDirectory
$VirtualDirectoryIgnoreList = New-Object System.Collections.ArrayList
ForEach ($key in $cfg.configuration.Exclusions.VirtualDirectory.add) {
   $VirtualDirectoryIgnoreList.add($key.name) > $Null
}
#------------------------------------------------------------------------------

#------------------------------------------------------------------------------
# Array of websites to ignore
#------------------------------------------------------------------------------
# This would be the value of the metabase "ServerComment" key
$WebSiteIgnoreList = New-Object System.Collections.ArrayList
ForEach ($key in $cfg.configuration.Exclusions.WebSite.add) {
   $WebSiteIgnoreList.add($key.name) > $Null
}
#------------------------------------------------------------------------------

#------------------------------------------------------------------------------
# Array of metabase IDs to ingore
#------------------------------------------------------------------------------
# These would be the 3rd element of the metabase "location" key, i.e.:
# /LM/W3SVC/3
$LocationIndexIgnoreList = New-Object System.Collections.ArrayList
ForEach ($key in $cfg.configuration.Exclusions.LocationIndex.add) {
   $LocationIndexIgnoreList.add($key.name) > $Null
}
#------------------------------------------------------------------------------

#------------------------------------------------------------------------------
# Hash table of server renames
#------------------------------------------------------------------------------
# We take the setting from the metabase for what the servername is. However,
# if a server is renamed, the metabase retains the original name. This is hash
# table of known renames, to replace
$ServerRenames = @{}
ForEach ($key in $cfg.configuration.ServerRenames.add) {
   $ServerRenames.add($key.key,$key.value)
}
#------------------------------------------------------------------------------

#------------------------------------------------------------------------------
# Disconnected Recordset to hold all our info before writing to disk
#------------------------------------------------------------------------------
$adVarChar = 200        # field type to be set to variant in recordset
$adFldIsNullable = 32   # to make recordset field nullable
$MaxCharacters = 255    # max size of field

$MBRecordSet = New-Object -com "ADOR.RecordSet"
$MBRecordSet.Fields.Append("Location", $adVarChar, $MaxCharacters, $adFldIsNullable)
$MBRecordSet.Fields.Append("Name", $adVarChar, $MaxCharacters, $adFldIsNullable)
$MBRecordSet.Fields.Append("Path", $adVarChar, $MaxCharacters, $adFldIsNullable)
$MBRecordSet.Fields.Append("ServerBindings", $adVarChar, $MaxCharacters, $adFldIsNullable)
$MBRecordSet.Fields.Append("AppPoolId", $adVarChar, $MaxCharacters, $adFldIsNullable)
$MBRecordSet.Fields.Append("AppRoot", $adVarChar, $MaxCharacters, $adFldIsNullable)
$MBRecordSet.Open()
#------------------------------------------------------------------------------

#------------------------------------------------------------------------------
# Objects containing the metabase settings we'll query
#------------------------------------------------------------------------------
$WebSites = $mb.configuration.MBProperty.IIsWebServer | select ServerComment,ServerBindings,AppPoolId,Location
$WebVDirs = $mb.configuration.MBProperty.IIsWebVirtualDir | select AppFriendlyName,Path,AppPoolId,Location,AppRoot
#------------------------------------------------------------------------------

#==============================================================================
# Process Metabase
#------------------------------------------------------------------------------
# Determine ServerName
#------------------------------------------------------------------------------
If (!$mb.configuration.MBProperty.IIsWebService.ServerComment) {
   $WebServerName = "[UNKNOWN]"
} Else {
   $WebServerName = $mb.configuration.MBProperty.IIsWebService.ServerComment
}
If ($ServerRenames.ContainsKey($WebServerName)) {
   $WebServerName = $ServerRenames.Get_Item($WebServerName)
}
#------------------------------------------------------------------------------

#------------------------------------------------------------------------------
# Process the "IIsWebServer" key first to enumerate all root websites
#------------------------------------------------------------------------------
ForEach ($Site in $WebSites) {
   # Site.Location is /LM/W3SVC/number.  We want the "number"
   $ThisLocationIndex = $Site.Location.Split('/')[3]

   # Proceed if this isn't a website location index to ignore
   If ($LocationIndexIgnoreList -notcontains $ThisLocationIndex) {
       # Populate the recordset
       $MBRecordSet.AddNew()
       $MBRecordSet.Fields.Item("Location") = $Site.Location
       $MBRecordSet.Fields.Item("Name") = $Site.ServerComment
       $MBRecordSet.Fields.Item("AppRoot") = $Site.ServerComment
      
       # Multiple bindings are separated by linebreaks and tabs. Lets convert to semi-colon
       $TempBindings = [regex]::Replace($Site.ServerBindings,"`n",";");
       $TempBindings = [regex]::Replace($TempBindings,"`t","");
      $MBRecordSet.Fields.Item("ServerBindings") = $TempBindings
      
       # Populate hash tables
       $LocationBindingMapping.Add($ThisLocationIndex,$TempBindings)
       $LocationCommentMapping.Add($ThisLocationIndex,$Site.ServerComment)
   }
}
#------------------------------------------------------------------------------

#------------------------------------------------------------------------------
# Process the "IIsWebVirtualDir" key to enumerate all VDirs and root settings
#------------------------------------------------------------------------------
ForEach ($Site in $WebVDirs) {
   # Site.Location is /LM/W3SVC/number/AppRoot/AppName
   $ThisLocationIndex = $Site.Location.Split('/')[3]
   $ThisAppName = $Site.Location.Split('/')[5]
  
      
   # Proceed if this isn't a website location index to ignore
   If ($LocationIndexIgnoreList -notcontains $ThisLocationIndex) {
       # If there is no AppPoolId, it's the DefaultAppPool
       If (!$Site.AppPoolId) {
           $ThisAppPool="DefaultAppPool"
       } Else {
           $ThisAppPool=$Site.AppPoolId
       }

       If (!$ThisAppName) {
           # Process /LM/W3SVC/#/ROOT sites, but not /ROOT/Vdir
           # This updates existing root site properties from Bindings above
           $MBRecordSet.MoveFirst();
           do {
               $MbLocationIndex = $MBRecordSet.Fields.Item("Location").Value.Split('/')[3]
               If ($MbLocationIndex -eq $ThisLocationIndex) {
                   $MBRecordSet.Fields.Item("Path") = $Site.Path
                   $MBRecordSet.Fields.Item("AppPoolId") = $ThisAppPool
              
                   $MBRecordSet.Update()
               }
               $MBRecordSet.MoveNext()
           } until ($MBRecordSet.EOF)
      
       } Else {
           # Process /LM/W3SVC/#/ROOT/Vdir sites
           $ThisAppRoot = $LocationCommentMapping.Get_Item($ThisLocationIndex)
           $ThisBinding = $LocationBindingMapping.Get_Item($ThisLocationIndex)

           $MBRecordSet.AddNew()
           $MBRecordSet.Fields.Item("Location") = $Site.Location
           $MBRecordSet.Fields.Item("Path") = $Site.Path
           $MBRecordSet.Fields.Item("Name") = $ThisAppName
           $MBRecordSet.Fields.Item("AppRoot") = $ThisAppRoot
           $MBRecordSet.Fields.Item("ServerBindings") = $ThisBinding
           $MBRecordSet.Fields.Item("AppPoolId") = $ThisAppPool
       }
   }
}
#------------------------------------------------------------------------------
#==============================================================================
# Save the report
#------------------------------------------------------------------------------
# Start the CSV file, adding the headers
"IIS Website Name,Application Name,Server,Path,AppPoolId,ServerBindings,MetabaseLocationID" | out-file $ReportFile


# Loop through recordset and output results to CSV
$MBRecordSet.Sort = "AppRoot ASC"
$MBRecordSet.MoveFirst();
do {
   $ThisLocationIndex = $MBRecordSet.Fields.Item("Location").Value.Split('/')[3]
   $ThisWebSite = $MBRecordSet.Fields.Item("AppRoot").Value
   $ThisVirtualDir = $MBRecordSet.Fields.Item("Name").Value

   # Make sure we're not outputting items listed in the IgnoreList arrays
   If (
       $WebSiteIgnoreList -notcontains $ThisWebSite -and
       $VirtualDirectoryIgnoreList -notcontains $ThisVirtualDir -and
       $LocationIndexIgnoreList -notcontains $ThisLocationIndex
      ) {

       $Output = $MBRecordSet.Fields.Item("AppRoot").Value.ToLower() + ","
       $Output += $MBRecordSet.Fields.Item("Name").Value.ToLower() + ","
       $Output += $WebServerName.ToLower() + ","
       $Output += $MBRecordSet.Fields.Item("Path").Value.ToLower() + ","
       $Output += $MBRecordSet.Fields.Item("AppPoolId").Value.ToLower() + ","
       $Output += $MBRecordSet.Fields.Item("ServerBindings").Value.ToLower() + ","
       $Output += $MBRecordSet.Fields.Item("Location").Value.ToLower()
       $Output | out-file -append $ReportFile
   }
   $MBRecordSet.MoveNext()
} until ($MBRecordSet.EOF)
#==============================================================================

Powershell script to monitor MSMQ queues

2008-04-30T13:23:00.000-07:00

Part of one of the products I support communicates with other products via Microsoft Message Queues (MSMQ). While we can monitor all of the various servers' CPU, memory, disk, network, etc for performance issues, one of the best determining factors is to see if a queue has suddenly grown. Since all queues should be either near zero or at a steady amount of messages depending on the time of day, any queue that shows an upward trend or sudden spike usually means there is an issue somewhere.

I usually run this at peak times of the day with a polling interval of ten seconds, whereas our monitoring system polls once every few minutes. This allows me to quickly see trends that may need attention. I also run it after performing maintenance just to verify the traffic patterns.

This script will not only query and display the most populated queues, but will also keep a count of the previous seven iterations to show an upward or downward trend. See below:
(Queue names were changed post-screenshot, sorry for the sloppiness)

Pre-Requisites:

Windows 2003 (not tested on 2000 or 2008)
Powershell 1.0
Rights to perform perfmon queries against the MSMQ server
Rights to enumerate the messages in all of the MSMQ queues
This has only been tested against "Private Queues"

What this script does:

It reads in its .config files to determine the MSMQ server to contact, the important queues (if any) to flag, the top number of queues to poll, and the polling interval
It then connects to the target server and queries for the largest X queues (defined in the config file)
It steps through each queue and if its name matches an "important queue" it flags it with an asterisk
Assigns the queue's name and count to a custom object
Prints the custom object in table form
On the next iteration, it sets the previous values to the custom object's "PriorN" column, keeping the previous 7 total.

Script files:

QueryQueues_8.4.28.zip

Steps:

Download the code
Extract it to a target folder
Edit the .config file to set the proper values
Execute it

For reference, here is the script code:

$Version="v8.4.28 Aaron Dodd"
$Description="Query MSMQ server for top X queues"

#------------------------------------------------------------------------------
# Settings / Variables
#------------------------------------------------------------------------------

$cfg=[xml](get-content QueryQueues.config)

$Computer = $cfg.configuration.QueueServer.name
$ImportantQueues = $cfg.configuration.ImportantQueues
$MaxQueues = $cfg.configuration.MaxQueues.value
$PollInterval = $cfg.configuration.PollInterval.value

# Hashes to store the values (queuename, messagescount)
$Current=@{}  
$Previous1=@{}
$Previous2=@{}
$Previous3=@{}
$Previous4=@{}
$Previous5=@{}
$Previous6=@{}
$Previous7=@{}

# Make an array of important queues
$ImpQueues=@()
ForEach ($Queue in $ImportantQueues.Queue) {
  $ImpQueues+=$Queue.name
}
#------------------------------------------------------------------------------

#------------------------------------------------------------------------------
# Continously poll the MSMQ server, report results
#------------------------------------------------------------------------------
For () {

  clear

  $Queues= Get-WmiObject Win32_PerfFormattedData_MSMQ_MSMQQueue -computer $computer | Sort-Object -property "MessagesinQueue" -descending | Select-Object -first $MaxQueues

  # Update the historical queue hashes, clear the current hash
  $Previous7=$Previous6
  $Previous6=$Previous5
  $Previous5=$Previous4
  $Previous4=$Previous3
  $Previous3=$Previous2
  $Previous2=$Previous1
  $Previous1=$Current
  $Current=@{}  

  # Repeat for "important queues"

  #Collection to store the object of values to report on
  $ColReport = @()

  ForEach ($Queue in $Queues) {
      $QueueName = $Queue.Name.Split('\')[2]
      # If the $QueueName is an "important" queue, we'll prepend it with "* " for readability
      If ($ImpQueues -contains $QueueName) {$QueueName = "* " + $QueueName}
      $Current.Add($QueueName,$Queue.MessagesInQueue)
  }
  ForEach ($Entry in $Current.GetEnumerator()) {
      $Name = $Entry.Name
      $Curr = $Entry.Value
    
      If ($Previous1.ContainsKey($Name)) {
          $Prior1 = $Previous1.Get_Item($Name)
      } Else {
          $Prior1 = "-"
      }
      If ($Previous2.ContainsKey($Name)) {
          $Prior2 = $Previous2.Get_Item($Name)
      } Else {
          $Prior2 = "-"
      }
      If ($Previous3.ContainsKey($Name)) {
          $Prior3 = $Previous3.Get_Item($Name)
      } Else {
          $Prior3 = "-"
      }
      If ($Previous4.ContainsKey($Name)) {
          $Prior4 = $Previous4.Get_Item($Name)
      } Else {
          $Prior4 = "-"
      }
      If ($Previous5.ContainsKey($Name)) {
          $Prior5 = $Previous5.Get_Item($Name)
      } Else {
          $Prior5 = "-"
      }
      If ($Previous6.ContainsKey($Name)) {
          $Prior6 = $Previous6.Get_Item($Name)
      } Else {
          $Prior6 = "-"
      }
      If ($Previous7.ContainsKey($Name)) {
          $Prior7 = $Previous7.Get_Item($Name)
      } Else {
          $Prior7 = "-"
      }

      $ObjReport = New-Object System.Object
      $ObjReport | Add-Member -type NoteProperty -name Queue -value $Name
      $ObjReport | Add-Member -type NoteProperty -name Curr -value $Curr
      $ObjReport | Add-Member -type NoteProperty -name Prior1 -value $Prior1
      $ObjReport | Add-Member -type NoteProperty -name Prior2 -value $Prior2
      $ObjReport | Add-Member -type NoteProperty -name Prior3 -value $Prior3
      $ObjReport | Add-Member -type NoteProperty -name Prior4 -value $Prior4
      $ObjReport | Add-Member -type NoteProperty -name Prior5 -value $Prior5
      $ObjReport | Add-Member -type NoteProperty -name Prior6 -value $Prior6
      $ObjReport | Add-Member -type NoteProperty -name Prior7 -value $Prior7
      $ColReport += $ObjReport
    
  }

  $ColReport | Sort-Object Curr -descending | Format-Table -auto

  $timestamp = Get-Date
  Write-Host Last Updated: $timestamp
  Start-Sleep -seconds $PollInterval
}
#------------------------------------------------------------------------------

Future enhancements:

If someone can help me out with how, I'd like to have the "important queues" show up with a different background color instead of simply renaming it to prepend an asterisk
I'd love to incorporate the ability to press a key to force a new loop instead of having to wait the polling interval, for times when I want to quickly see queue changes

Powershell script to report on all scheduled tasks in our domain

2008-04-30T12:40:00.000-07:00

One of the annoying things about Windows management is that you cannot centrally manage scheduled tasks across your environment. You're either spending a lot of money on a third party system to do this for you, or your trying to script this.

I'll skip going into a rant about what I think of most of the available task management products out there (yes, package management and gui automation are nice, but I really just want to manage the native Windows Scheduled Tasks, not replace it). I had previously played with WINAT and command line scripts to utilize AT.EXE. Neither were sufficient as they both worked with the old-style NT4 tasks, which meant you couldn't see them via Scheduled Tasks nor could you run them under their own identities.

Windows 2000 introduced a method to query Scheduled Task info via WMI but there was no way to actually set the information.

By pure accident I found "schtasks.exe", the exact utility I'd been looking for. With SCHTASKS.EXE you can query, create, delete, start, stop, etc any scheduled task on any server you have administrative rights, both locally and remotely. Whats even nicer is SCHTASKS.EXE supports exporting query results in .CSV format.

Below is a script that will take a list of servers and generate a master CSV of all of their tasks info.

For more information on using SCHTASKS.EXE, just run "SCHTASKS.EXE /?" from the command line.

Pre-Requisites:

Windows 2003 (not tested on 2000 or 2008)
Powershell 1.0

What this script does:

Reads in values from a .config file for where to find a CSV file of server names, where to save the report, and what to use as its temp folder
Loops through the specified list of servers and calls SCHTASKS against it with the option to save a verbose .csv file of all task info
After each loop interation, reads the temporary .csv file into a CSV object of all prior iterations
After all servers are queried, it saves the final compiled report

Script files:

QueryScheduledTasks_8.4.28.zip

Steps:

Download the code
Extract it wherever you like
Modify the .config file to update the values
Modify the servers.csv file to have the names of the servers to query

For reference, here is the script code:

$Version="v8.4.28 Aaron Dodd"
$Description="Generate CSV of scheduled tasks in the environment"

#------------------------------------------------------------------------------
# Settings / Variables
#------------------------------------------------------------------------------
If (Test-Path "QueryScheduledTasks.config") {
$cfg=[xml](get-content "QueryScheduledTasks.config")
} Else {
Write-Host "!! ERROR !! - Config file not found"
Write-Host "A file with the same name as this script, ending in .config, must exist in the same directory as this script."
exit
}

$ServerList = Import-Csv $cfg.configuration.ServerList.name
$FinalReport=$cfg.configuration.FinalReport.name
$TempDir=$cfg.configuration.TempFolder.name
$TempReport=$TempDir + "\temp.csv"
$ErrorActionPreference=$cfg.configuration.ErrorAction.value
#------------------------------------------------------------------------------


#------------------------------------------------------------------------------
# Process tasks
#------------------------------------------------------------------------------
ForEach ($Server in $ServerList) {
schtasks /QUERY /S $Server.Name /FO CSV /V > $TempReport
$TempCsv += Import-Csv $TempReport
}
Remove-Item $TempReport
$TempCsv | Export-Csv $FinalReport -notype
#------------------------------------------------------------------------------

CMD Script to automate subversion backups

2008-04-11T12:58:00.001-07:00

This is nothing fancy, just a .cmd script to back up my production Subversion repository on a nightly basis. There are some good ones via Google results but none that really fit my needs (too complex or too simple).

Pre-Requisites:

Windows 2003 (not tested on 2000 or 2008)
Subversion installed locally (tools and repository) with the \bin folder in the path

What this script does:

If I call it with "FULL" it will:

delete all previous subversion dumps
create a new dump, using deltas, named "FULL_REV-#_YYYY-MM-DD.svndump" where # is the current revision number

If I call it with "INC" it will:

create a new dump incremental from the previous revision number, named "INC_REV-#_YYYY-MM-DD.svndump"

Store the revision number of the last successful dump, and then perform the next incremental off that instead of assuming just N-1 (in case previous night's job failed)
Utilize the "ERR_FLAG" to send errors to our monitoring system.

Script Files:

You can download the script here: svn_dump_8.4.11.rar

Steps:

Download the code
Extract it anywhere you want to run it
Modify the file to replace the values of "RepoPath" and "DumpPath" with the proper locations for your environment
Execute either as "svn_dump INC" or "svn_dump FULL" (see above for what each does).

For reference, here's the script code:

@ECHO OFF
SETLOCAL
SET VERSION=v8.4.11 Aaron Dodd
SET USAGE=svn_dump.cmd [FULL -or- INC]

:: Settings
::===========================================================================

SET RepoPath=D:\state_management\repository
SET DumpPath=D:\state_management\repository_dumps

:: Date/Time formatting
::---------------------
FOR /F "Tokens=2" %%I in ( " %date% " ) Do Set StrDate=%%I
FOR /F "Tokens=1 delims=/ " %%M in ( " %StrDate% " ) Do Set Month=%%M
FOR /F "Tokens=2 delims=/ " %%D in ( " %StrDate% " ) Do Set Day=%%D
FOR /F "Tokens=3 delims=/ " %%L in ( " %StrDate% " ) Do Set Year=%%L
FOR /F "Tokens=1 delims=. " %%I in ( " %time% " ) Do Set StrTime=%%I
FOR /F "Tokens=1 delims=: " %%H in ( " %StrTime% " ) Do Set Hour=%%H
FOR /F "Tokens=2 delims=: " %%M in ( " %StrTime% " ) Do Set Minute=%%M
FOR /F "Tokens=3 delims=: " %%S in ( " %StrTime% " ) Do Set Second=%%S

:: Process Arguments
::------------------
IF '%1' == '' GOTO USAGE

IF "%1" EQU "FULL" SET DumpType=FULL
IF "%1" EQU "full" SET DumpType=FULL
IF "%1" EQU "INC" SET DumpType=INC
IF "%1" EQU "inc" SET DumpType=INC

IF '%DumpType%' == '' GOTO USAGE

:: Verify Dependencies
IF NOT EXIST "%RepoPath%" CALL :ERROR_PATH REPOSITORY
IF NOT EXIST "%DumpPath%" CALL :ERROR_PATH DUMP

SVNADMIN 2> NUL
IF %ErrorLevel% EQU 9009 CALL :ERROR_DEP SVNADMIN

SVNLOOK 2> NUL
IF %ErrorLevel% EQU 9009 CALL :ERROR_DEP SVNLOOK


:: MAIN
::===========================================================================
::Determine latest subversion revision number
::-------------------------------------------
FOR /F %%Y IN ('SVNLOOK youngest "%RepoPath%"') DO SET RepoVer=%%Y
SET /A RepoPriorVer=%RepoVer% - 1 >NUL

SET DumpFile=%DumpPath%\%DumpType%_REV-%RepoVer%_%Year%-%Month%-%Day%.svndump

:: Clean up old svn dumps
::-----------------------
IF "%DumpType%" EQU "FULL" DEL /Q "%DumpPath%\*.svndump" >NUL

:: Perform backup
::---------------
IF "%DumpType%" EQU "FULL" SVNADMIN dump "%RepoPath%" --deltas > %DumpFile%
IF "%DumpType%" EQU "INC" SVNADMIN dump "%RepoPath%" -r %RepoPriorVer%:%RepoVer% --incremental > %DumpFile%

GOTO END

:: Subroutines
::===========================================================================
:USAGE
ECHO %VERSION%
ECHO %USAGE%
ECHO Edit this script to change where the repository path is, and where to save the dump
GOTO END

:ERROR_DEP
ECHO !!ERROR!! - Dependency not found
IF "%1" EQU "SVNADMIN" ECHO svnadmin.exe cannot be found.
IF "%1" EQU "SVNLOOK" ECHO svnlook.exe cannot be found.
ECHO Verify Subversion is installed and the \bin folder is in the system-wide PATH environment variable.
SET ERR_FLAG=1
GOTO END

:ERROR_PATH
ECHO !!ERROR!!
IF "%1" EQU "REPOSITORY" ECHO Cannot find %RepoPath%
IF "%1" EQU "DUMP" ECHO Cannot find %DumpPath%
SET ERR_FLAG=1
GOTO END

:END

ENDLOCAL

Quick and dirty way to mass update Windows 2003 DNS entries

2008-04-10T13:04:00.000-07:00

I recently came across an issue where I wanted to add in a few hundred DNS entries into our Windows 2003 DNS server. I wanted to script this, as I have no intention of do a mass update manually and I want to re-use this in the future.

Most of the Google results I find say the easiest methods are to either convert the DNS zone to "standard primary" from "active directory integrated" and then manually editing the resulting text file created, or to use a script by Dean Wells called "dnsdump.cmd"

The problem with converting a domain to standard is, aside from being a convoluted hack, I'm updating our core AD dns zone, which obviously cannot be changed to standard without causing issues.

The problem with "dnsdump.cmd" is it requires being run from the DNS server itself and is more focused on migrating DNS information than simple updates like this.

I found VBScript examples using WMI, but in true VBScript fashion, while it works it takes 20 lines of script to do one line's worth of work.

Reading through the source code of dnsdump.cmd, I realized it was calling "dnscmd.exe", which is one of the Windows Server support tools. After installing the support tools (from "SUPPORT\TOOLS" on my Windows Server 2003 CD-ROM) I had this very nice utility. You can get its syntax by just running it from the command line. Below is a solution to my problem that only requires a text file and one call to dnscmd.exe to complete (well, I guess technically many calls, as this is a "for" loop, but you know what I mean ;-) )

My solution:

Create a text file that only contains two space-separated values: the server name and the IP address. For this example its called "addresses.txt".
Call dnscmd as follows:

for /f "tokens=1,2" %a in (addresses.txt) do dnscmd.exe dnsserver.mydomain.com /RecordAdd mydomain.com %a A %b

Simple and sweet :)

Note: you need to be an admin of "dnsserver.mydomain.com" as specified above. Also, for PTR records, you need to change "A" to "PTR". Just look at the output of "dnscmd.exe" by itself for help. Also, "dnscmd.exe /EnumZones" is useful for getting the exact spelling to use for the "mydomain.com" portion above.

Update: to answer a question posed to me: "tokens=1,2" tells the "for" operator to return the first and second values of the delimited line in "addresses.txt". By default, spaces are a delimiter, so if the text file contains "server1.mydomain.com 1.2.3.4" then %a is "server1.mydomain.com" and %b is "1.2.3.4". You can actually use any delimiter (like a comma) and then specify such as:

for /f "tokens=1,2 delims=," %a ....

Type "for /?" from a command prompt for more details.

Update2: A nice article on dnscmd.exe is here: Scripting DNS

How to install Dell OpenManage 5.3.0 on a XEN host

2008-03-13T09:04:00.000-07:00

We're beginning to deploy XenServer at work as our virtualization platform. One thing that detracted from Xen during our comparison with VMWare was that VMWare and Dell worked together to get OpenManage supported on ESX.

As of the moment, Xen doesn't officially support running OpenManage on Xen, although they will shortly offer official support.

To get OpenManage working now, albeit in an unsupported fashion, I was helpfully sent the following KB article from XEN (which somehow I didn't see when searching their forums). My only changes to the guide are:

I used OM_5.3.0_ManNode_A00.tar.gz instead of 5.2.0
I used the XenServer 4.1 beta
The line numbers in "setup.sh" for OpenManage 5.3.0 that needs to be changed are 2972 and 2973
It is not necessary under the 4.1 beta (and probably higher) to run the "yum install" command as a newer version of the referenced .rpm file is already installed
EDIT 2008-05-08:

Some steps may need to be taken after install to resolve OM being unable to poll for inventory. See this article for details.
For production systems I've been skipping the installation of setup.sh's item #2, "Server Administrator Web Server". The web GUI seems to take an additional 100-120M of memory when installed. Leaving this out only increases the Xen host footprint by a few megs.

Dell OpenManage 5.3.0 can be downloaded from here.
Xen's original article can be found here. A copy/paste of it is below:

Using Dell OpenManage on a XenServer Host
Author: Christoph Berlin, Created on: Nov 13, 2007 12:13 PM

Summary
Dell OpenManage is a management software suitethat allows you to monitor and manage physical Dell servers. Thissoftware package is available for RedHat Enterprise Linux 4.
TheXenServer Host runs Xen on a bare-bones CentOS Linux operating system,which is very similar to RedHat Enterprise Linux 4. It should thereforebe feasible to install OpenManage on a XenServer Host and manage it aswith any other Linux server.
This document shows you how to install Dell OpenManage on a XenServer Host.
Note: Using OpenManage on a XenServer Host is an unsupported configuration. Dell does not support installing the Dell OpenManage management software on CentOS. XenSource does not support installing any additional packagaes on the XenServer Host.
Procedure
Download the Dell OpenManage Server Administrator Managed Node software package for RedHat Enterprise Linux 5. You will find a selection of packages on the Dell support homepage.
Copy the tar.gz file to your XenServer Host.
Extract the tar.gz file by using the command
# tar -xzf yourfilename.tar.gz
Normally this setup script would fail because the CentOS operating system is not identical RedHat Enterprise Linux 4, but you can edit the script so that it will run on CentOS as well, as follows:
First, change the permissions of the file:
# chmod +w setup.sh

Then, edit the file:
# vi setup.sh

Then, go to line 2976 and change the lines
# Set default values for return variables.
GBL_OS_TYPE=${GBL_OS_TYPE_UKNOWN}
GBL_OS_TYPE_STRING="UKNOWN"

to
# Set default values for return variables.
GBL_OS_TYPE=${GBL_OS_TYPE_RHEL5}
GBL_OS_TYPE_STRING="RHEL5"

Save changes and close the file.

Install the package compat-libstdc++-296-2.96-138.i386.rpm on the XenServer Host:
# yum install compat-libstdc++-296-2.96-138.i386.rpm

Start the Dell OpenManage installation by using the command:
# ./setup.sh

Follow the instructions on the screen and finish the installation.
After installation finishes successfully, you have to change your firewall settings to allow communication through the ports that OpenManage uses, as follows:
Edit the firewall file:
# vi /etc/sysconfig/iptables

Add the following lines:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 1311 -j ACCEPT

Save and close the file.

Restart the firewall service:
# service iptables restart

Now should be able to connect to the Dell OpenManage web interface of your server. Point your browser to https://yourserver:1311/ and login with your root user and password.
Tested with: OM_5.2.0_ManNode_A00.tar.gz

Powershell method for testing for NULL

2008-03-12T13:21:00.000-07:00

I guess this is obvious, but I was looking for means of evaluating whether or not a variable was null by trying:

If ($Varable -eq NUL) {some action}

Which of course caused an error. VBScript has the IsNull(value) function, but there I could find no results googling for a similar one in PowerShell.

It turns out, this is much simpler than I was making it out to be:

To see if a variable is null, simply check:

If (!$Variable) {some action}

Conversely, to verify if the variable has any value:

If ($Variable) {some action}

*sigh* sometimes the simple answers take the longest to find ;-)

Powershell equivalent of "Right()"

2007-11-30T11:28:00.000-08:00

In VBScript, there is the the Right() function used to return the right-most X characters of a string.

After googling, I couldn't find a clear example of doing this in Powershell. Microsoft has a page on VBscript equivalents in Powershell, but their Right() page didn't give exactly what I wanted.

My delimma:
I have a Powershell script performing a nightly commit of our production servers' code shares to an SVN repository. One of the scripts calls "svn status", which returns the status of all files in the working folder as compared to the repository:

!______D:\Path\to\some\file

Where the first 6 characters are status codes, there's 1 space, then the file path (I replaced spaces with _ above for readability). What I need for performing an "svn add" or "svn delete" is just the file path. So, I needed to somehow get all EXCEPT the first 7 characters of the output into a variable.

To do this, I ended up using the .SubString() function. This is called with two arguments: the number of characters to remove, and the number of characters to return. To remove the first 7 characters, I specify "7" and then the length of the string minus 7:

$FileName = $SvnStatusLine.SubString(7,$SvnStatusLine.Length - 7)

Conversely, if you wanted to remove the LAST 7 characters, just reverse the position of the arguments.

Update:
Thanks to a knowledgeable commenter for this slicker alternative:

/\/\o\/\/ said...

in this case you might consider using remove :

$s = "!______D:\Path\to\some\file"
$s.Remove(0,7)

D:\Path\to\some\file

Greetings /\/\o\/\/

Where were you a few days ago ;-) Thanks!

Using the BITS ISAPI filter on Windows 2003 64-bit with Enable32bitAppOnWin64 enabled

2007-11-13T07:07:00.001-08:00

A problem I ran into the other day was this:

We're slowly migrating from 32-bit Windows to 64-bit Windows. To prepare, we're rolling out 2003 Standard edition, 64-bit. Since our applications are still compiled 32-bit until we migrate off .NET 1.1, we have set IIS 6 to run 32-bit application pools by running:

cscript %SystemDrive%\inetpub\AdminScripts\adsutil.vbs set w3svc/AppPools/Enable32bitAppOnWin64 1

and restarting IIS.

All seemed well. Mapping .NET 1.1 (which only runs in 32-bit mode) worked fine:

%SYSTEMROOT%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe -i

However, any attempt to surf our BITS-enabled IIS site resulted in error code 500. Disabling IE's unhelpful "Friendly Error Messages" showed me the message "Module Not Found".

So, I ran filemon to see what files were in use as I tried to hit the website. What I noticed was w3wp.exe, one of the worker processes of IIS6, was trying to open "c:\windows\SysWOW64\bitssrv.dll" (the BITS ISAPI dll). To confirm my settings, the "BITS Webserver Extensions" setting in my IIS6 "Webserver Extensions" pane indeed pointed to "c:\windows\system32\bitssrv.dll". In the website properties, we have a script-mapping to direct all requests to the ISAPI dll, and it too pointed to "c:\windows\system32\bitssrv.dll"

Since we set IIS to use 32-bit application pools, Windows is "helpfully" translating calls for the system folder (oddly named "system32" on Windows 64-bit) to the 32-bit system folder, named SysWOW64 (does anyone know why they didn't just leave "system32" as the 32-bit folder and make a new one "system64"?).

You can actually see this in action by running a 32-bit file manager (like TotalCommander) and see that attempts to surf c:\windows\system32 show different results between 32-bit and 64-bit apps.

This struck me as odd because there is no bitssrv.dll in the SysWOW64 folder, only in the system32 folder (meaning there is no 32-bit BITS dll, just a 64-bit one). To be sure, I looked on the Windows Server 2003 x64 CD, SP1 CD, and SP2 CD for a 32-bit version of the BITS dll. Apparently, there is no 32-bit version of the ISAPI filter for a 64-bit OS.

I copied the bitssrv.dll from a 32-bit Windows 2003 server to this server's "C:\Windows\SysWOW64\" folder and restarted IIS. Voila, BITS functioned properly.

I assume this is all by design, but it was annoying to discover. What's even more annoying is that I'll need to manually update this file for any BITS-related security patches.

Powershell script to create custom "compmgmt.msc" shortcuts

2007-10-03T08:08:00.000-07:00

I have several hundred servers I manage. I like to keep a folder on my "Quick Launch" bar called "Computers" with custom shortcuts to "compmgmt.msc" contained within, broken down by environment.

This script is possible because of a feature of MMC: you can call "services.msc" or "compmgmt.msc" or probably all of them with the switch "/computer:computername" to connect to a remote computer immediately instead of having to right-click and choose "connect" once launched.

Prerequisites:

PowerShell 1.0 installed (which requires .NET Framework 2.0)
Windows XP or Server 2003 (not tested on 2000)

What this script does:

It creates subfolders organized as specified in a comma-delimited file to create the shortcuts in, so I can have one for each environment we have (QA, Staging, Production, etc)
It deletes existing shortcut files within the folder structure before creating new ones. Note, however, I do not delete all shortcut files. If you remove an entry from the CSV file, it will remain unless you delete the subfolders manually.

Script files

You can download everything mentioned in this article by clicking here: CreateMMC_7.10.3.rar
Note: the above archive contains an example shortcut hard-coded based on my computer. You'll want to edit it or create a new one.

Steps:

Create a folder to contain the shortcuts. We'll use "MMC" here
Within "MMC" create a folder called "_script"
Within "MMC\_script" create the following:

A comma-delimited file called "list.csv" with the following column headings: "ServerName", "IP", "Directory" (first row should read: "ServerName,IP,Directory" if using a text-editor). For each row, fill in the proper values for each server. "IP" can be either the IP address or FQDN. "Directory" refers to the subfolder of "MMC" that will be created to hold the shortcut for this server.
A text file called "CreateMMC.ps1" with the following:

$List = Import-CSV LIST.CSV
$sh = new-object -com "WScript.Shell"
$TargetPath = "%SystemRoot%\system32\compmgmt.msc"

ForEach($Entry in $List) {
# Prepend the destination directory info
$Dir = "..\" + $Entry.Directory

# Create new folder
New-Item -Path $Dir -ItemType Directory -Force

# Build the file name and properties
$FileName = $Dir + "\" + $Entry.ServerName + ".lnk"
$Arguments = "/computer:" + $Entry.IP

# Remove the old file
Remove-Item $FileName -Force

# Create shortcut
$shortcut = $sh.CreateShortcut($FileName)
$shortcut.TargetPath = $TargetPath
$shortcut.Arguments = $Arguments
$shortcut.Save()

}

Create a shortcut of the script and save it under "MMC" taking care that the "Start In" folder is still "MMC\_script". This is necessary if you want to just be able to click the file and have it create / update your shortcut files. Otherwise, PowerShell will complain about not finding the script and I prefer to not hardcode paths within the script.

Double-click the shortcut within "MMC" and see how it works!

Note, you may have to enable script execution. Powershell by default does not automatically execute scripts. Microsoft, being overly paranoid after .vbs files being used as trojan and virus entry points, set the default execution policy for Powershell scripts to "deny". To enable scripts, you'll need to either sign the scripts with a trusted certificate or, as I do, just enable script execution:
"PS c:\Set-ExecutionPolicy Unrestricted"