PowerShell on the crosseroads

Basic Network Configuration with Windows 8

Wed, 21 Mar 2012 20:02:00 -0400

With Windows Server “8”, you no longer have to use netsh to set IP addresses from the command-line. Thanks to the new NetTcpip module, you can do a whole lot more network configuration via PowerShell.

Here is a listing of cmdlets included in the NetTcpip module:

PS C:\> Get-Command -Module NetTcpip

Capability  Name                           ModuleName
----------  ----                           ----------
CIM         Get-NetIPAddress               NetTcpip
CIM         Get-NetIPInterface             NetTcpip
CIM         Get-NetIPv4Protocol            NetTcpip
CIM         Get-NetIPv6Protocol            NetTcpip
CIM         Get-NetNeighbor                NetTcpip
CIM         Get-NetOffloadGlobalSetting    NetTcpip
CIM         Get-NetPrefixPolicy            NetTcpip
CIM         Get-NetRoute                   NetTcpip
CIM         Get-NetTCPConnection           NetTcpip
CIM         Get-NetTCPSetting              NetTcpip
CIM         Get-NetTransportFilter         NetTcpip
CIM         Get-NetUDPEndpoint             NetTcpip
CIM         Get-NetUDPSetting              NetTcpip
CIM         New-NetIPAddress               NetTcpip
CIM         New-NetNeighbor                NetTcpip
CIM         New-NetPrefixPolicy            NetTcpip
CIM         New-NetRoute                   NetTcpip
CIM         New-NetTransportFilter         NetTcpip
CIM         Remove-NetIPAddress            NetTcpip
CIM         Remove-NetNeighbor             NetTcpip
CIM         Remove-NetPrefixPolicy         NetTcpip
CIM         Remove-NetRoute                NetTcpip
CIM         Remove-NetTransportFilter      NetTcpip
CIM         Set-NetIPAddress               NetTcpip
CIM         Set-NetIPInterface             NetTcpip
CIM         Set-NetIPv4Protocol            NetTcpip
CIM         Set-NetIPv6Protocol            NetTcpip
CIM         Set-NetNeighbor                NetTcpip
CIM         Set-NetOffloadGlobalSetting    NetTcpip
CIM         Set-NetPrefixPolicy            NetTcpip
CIM         Set-NetRoute                   NetTcpip
CIM         Set-NetTCPSetting              NetTcpip
CIM         Set-NetUDPSetting              NetTcpip

To view the IP addresses on a given interface, use Get-NetIpAddress:

PS C:\> Get-NetIPAddress -InterfaceIndex 17 | ft -AutoSize

ifIndex IPv4Address    IPv6Address                       PrefixLength SuffixOrigin Store
------- -----------    -----------                       ------------ ------------ -----
17                     fe80::901:6a7e:d676:2a88%17       64           Link         Active
17                     2001:470:8:1ee:901:6a7e:d676:2a88 64           Link         Active
17      169.254.42.136                                   16           Link         Active

As you can see, I only have an auto-configured IPv4 address on this particular interface. You can remove addresses with Remove-NetIPAddress, like so:

PS C:\> Get-NetIPAddress -InterfaceIndex 17 -AddressFamily IPv4 | Remove-NetIPAddress

Confirm
Are you sure you want to perform this action?

Performing operation "Remove" on Target "NetIPAddress -IPv4Address 192.168.2.3 -InterfaceIndex 17 -Store Active"
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): Y

To view route information, use Get-NetRoute:

PS C:\> Get-NetRoute -InterfaceIndex 17

ifIndex    RouteMetric     DestinationPrefix                        NextHop                      Store
-------    -----------     -----------------                        -------                      -----
17         1               0.0.0.0/0                                192.168.2.1                  Persistent
17         256             255.255.255.255/32                       0.0.0.0                      Active
17         256             224.0.0.0/4                              0.0.0.0                      Active
17         256             192.168.2.3/32                           0.0.0.0                      Active
17         1               0.0.0.0/0                                192.168.2.1                  Active
17         256             ff00::/8                                 ::                           Active
17         256             fe80::901:6a7e:d676:2a88/128             ::                           Active
17         256             fe80::/64                                ::                           Active
17         256             2001:470:8:1ee:901:6a7e:d676:2a88/128    ::                           Active
17         256             2001:470:8:1ee::/64                      ::                           Active
17         256             ::/0                                     fe80::20d:b9ff:fe15:e69d     Active    

PS C:\> Get-NetRoute -InterfaceIndex 17 -RouteMetric 1

ifIndex    RouteMetric     DestinationPrefix     NextHop         Store
-------    -----------     -----------------     -------         -----
17         1               0.0.0.0/0             192.168.2.1     Persistent
17         1               0.0.0.0/0             192.168.2.1     Active

…and to remove routes, use the appropriately-named Remove-NetRoute cmdlet:

PS C:\> Get-NetRoute -InterfaceIndex 17 -RouteMetric 1 | Remove-NetRoute

Confirm
Are you sure you want to perform this action?

Performing operation "Remove" on Target "NetRoute -DestinationPrefix 0.0.0.0/0 -InterfaceIndex 17 -NextHop 192.168.2.1
-Store Persistent"
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): Y

Confirm
Are you sure you want to perform this action?

Performing operation "Remove" on Target "NetRoute -DestinationPrefix 0.0.0.0/0 -InterfaceIndex 17 -NextHop 192.168.2.1
-Store Active"
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): Y

Finally, to assign a static IP address to an interface, use the New-NetIpAddress cmdlet.

PS C:\> New-NetIPAddress -InterfaceIndex 17 -IPv4Address 192.168.2.3 -DefaultGateway 192.168.2.1 -AddressFamily IPv4

Store             : Active
IPv4Address       : 192.168.2.3
IPv6Address       :
InterfaceIndex    : 17
InterfaceAlias    : NicTeam
AddressFamily     : IPv4
Type              : Unicast
PrefixLength      : 32
PrefixOrigin      : Manual
SuffixOrigin      : Manual
AddressState      : Tentative
ValidLifetime     : Infinite ([TimeSpan]::MaxValue)
PreferredLifetime : Infinite ([TimeSpan]::MaxValue)
SkipAsSource      : False

Store             : Persistent
IPv4Address       : 192.168.2.3
IPv6Address       :
InterfaceIndex    : 17
InterfaceAlias    : NicTeam
AddressFamily     : IPv4
Type              : Unicast
PrefixLength      : 32
PrefixOrigin      : Manual
SuffixOrigin      : Manual
AddressState      : Invalid
ValidLifetime     : Infinite ([TimeSpan]::MaxValue)
PreferredLifetime : Infinite ([TimeSpan]::MaxValue)
SkipAsSource      : False

When you assign a static IP address to an interface and set the default gateway, it also inserts a default route into the routing table (as it should). (This is why I removed the default route earlier; to show this behavior.)

PS C:\> Get-NetRoute -InterfaceIndex 17 

ifIndex    RouteMetric     DestinationPrefix      NextHop         Store
-------    -----------     -----------------      -------         -----
17         256             0.0.0.0/0              192.168.2.1     Persistent
17         256             255.255.255.255/32     0.0.0.0         Active
17         256             224.0.0.0/4            0.0.0.0         Active
17         256             192.168.2.3/32         0.0.0.0         Active
17         256             0.0.0.0/0              192.168.2.1     Active
[...]

NIC Teaming with Windows 8

Mon, 19 Mar 2012 22:38:00 -0400

It’s pretty easy to create a NIC team with Windows Server “8”. If you have tried with previous versions of Windows you know that third-party software was required. Now, it’s just a cmdlet away.

Have a look a the new NetLbfo module:

PS C:\Users\Administrator> Get-Command -Module NetLbfo

Capability  Name                       ModuleName
----------  ----                       ----------
CIM         Add-NetLbfoTeamMember      NetLbfo
CIM         Add-NetLbfoTeamNic         NetLbfo
CIM         Get-NetLbfoTeam            NetLbfo
CIM         Get-NetLbfoTeamMember      NetLbfo
CIM         Get-NetLbfoTeamNic         NetLbfo
CIM         New-NetLbfoTeam            NetLbfo
CIM         Remove-NetLbfoTeam         NetLbfo
CIM         Remove-NetLbfoTeamMember   NetLbfo
CIM         Remove-NetLbfoTeamNic      NetLbfo
CIM         Rename-NetLbfoTeam         NetLbfo
CIM         Set-NetLbfoTeam            NetLbfo
CIM         Set-NetLbfoTeamMember      NetLbfo
CIM         Set-NetLbfoTeamNic         NetLbfo

Using the (also-new) Get-NetIPInterface cmdlet, find the interfaces that you want to team…

PS C:\Users\Administrator> Get-NetIPInterface

ifIndex ifAlias                        AddressFamily ConnectionState NlMtu(Bytes)   InterfaceMetric Dhcp     Store
------- -------                        ------------- --------------- ------------   --------------- ----     -----
24      Teredo Tunneling Pseudo-Int... IPv6          Disconnected    1280           50              Enabled  Persistent
23      isatap.crosse.org              IPv6          Disconnected    1280           50              Enabled  Persistent
13      Wired Ethernet Connection 2    IPv6          Disconnected    1500           10              Enabled  Persistent
12      Wired Ethernet Connection      IPv6          Disconnected    1500           10              Enabled  Persistent
10      Local Area Connection* 9       IPv6          Disconnected    0              0               Enabled  Persistent
13      Wired Ethernet Connection 2    IPv6          Connected       1500           10              Enabled  Active
12      Wired Ethernet Connection      IPv6          Connected       1500           10              Enabled  Active
24      Teredo Tunneling Pseudo-Int... IPv6          Connected       1280           50              Disabled Active
23      isatap.crosse.org              IPv6          Disconnected    1280           50              Disabled Active
1       Loopback Pseudo-Interface 1    IPv6          Connected       4294967295     50              Disabled Active
13      Wired Ethernet Connection 2    IPv4          Disconnected    1500           10              Enabled  Persistent
12      Wired Ethernet Connection      IPv4          Disconnected    1500           10              Enabled  Persistent
10      Local Area Connection* 9       IPv4          Disconnected    0              0               Enabled  Persistent
13      Wired Ethernet Connection 2    IPv4          Connected       1500           10              Enabled  Active
12      Wired Ethernet Connection      IPv4          Connected       1500           10              Enabled  Active
1       Loopback Pseudo-Interface 1    IPv4          Connected       4294967295     50              Disabled Active

…and then use the New-NetLbfoTeam cmdlet to create the team. I’m using this server for Hyper-V, hence choosing that for the load-balancing algorithm.

PS C:\Users\Administrator> New-NetLbfoTeam -Name "NicTeam" -TeamMembers `
>> "Wired Ethernet*" -TeamNicName "NicTeam" -TeamingMode SwitchIndependent `
>> -LoadBalancingAlgorithm HyperVPort

Confirm
Are you sure you want to perform this action?

Creates Team:'NicTeam' with TeamNic:'NicTeam'; Members:'Wired Ethernet Connection 2'; 'Wired Ethernet Connection';
TeamingMode:'SwitchIndependent'; LoadBalancingAlgorithm:'HyperVPort'
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): Y

Name                   : NicTeam
Members                : {Wired Ethernet Connection 2, Wired Ethernet Connection}
TeamNics               : NicTeam
TeamingMode            : SwitchIndependent
LoadBalancingAlgorithm : HyperVPort
Status                 : Down

When I ran Get-NetLbfoTeam immediately after creating the team, it took a minute or so before the Status went from Down to Up:

PS C:\Users\Administrator> Get-NetLbfoTeam NicTeam

Name                   : NicTeam
Members                : {Wired Ethernet Connection 2, Wired Ethernet Connection}
TeamNics               : NicTeam
TeamingMode            : SwitchIndependent
LoadBalancingAlgorithm : HyperVPort
Status                 : Degraded

[time passes]

PS C:\Users\Administrator> Get-NetLbfoTeam

Name                   : NicTeam
Members                : {Wired Ethernet Connection 2, Wired Ethernet Connection}
TeamNics               : NicTeam
TeamingMode            : SwitchIndependent
LoadBalancingAlgorithm : HyperVPort
Status                 : Up

And that’s pretty much it!

Using PowerShell to Remotely Query WMI

Fri, 17 Apr 2009 16:59:00 -0400

In one of the Desktop Management meetings here at the University, the question arose as to how we could more accurately judge how many machines we could remotely manage. Many of the desktops had gone through a successful, but fairly invasive migration process to get them into the domain, and as such things usually happen, there are a few that are a bit…“wonky”. SMS works fine for these desktops, but since the SMS client on the desktop requests a package (i.e., pulls) from the server, successful package installation isn’t a good indicator of remote manageability (via scripting, etc.). There were also many other things we wanted to know–how many had IPSec functioning properly (used to secure remote administration traffic) being one of them. So, I decided to pull together a script that could be run against our desktop fleet to determine just how many machines were “healthy”, from a remote-manageability standpoint.

The script follows a pretty simple pattern: Can I ping the machine? If so, can I connect to the remote WMI provider? If so, finally query for and return some (user-configurable) data. The ping test starts it all off; if I can’t ping the machine, there’s no point in trying to do anything else. This also verifies that IPSec is working, since all traffic between our management server and the desktops uses IPSec–even ICMP.

The second test (can I connect via WMI?) verifies that the management server can get to the RPC endpoint mapper service (TCP port 135) and can successfully connect to the high port on which epmap tells us the WMI provider is listening. If this works it will return pretty quickly; if it doesn’t, the script has to wait something like 45 seconds for the attempted connection to time out (if anyone knows how to impose a shorter timeout in PowerShell, I’m all-ears). Once the script determines that WMI is open to us, it will begin querying the remote computer for the requested data.

Speaking of “requested data”, the script must be provided an XML file containing the data we want returned (see below for an example). One of the neat things about PowerShell is that it can take an XML file and dynamically build an object based on it (the DOM and all that). I used this to make the script self-contained, with only the attributes file needing to be modified if we wanted alternate data.

The script returns an object that contains all the requested values as Properties of the object. I can take this output and pipe it to, say, Export-Csv or Export-Clixml for better presentation in a spreadsheet or whatever.

To download the script, click here. From this point on, I’ll go through the script and explain the relevant bits, starting with line 38 (the first part is just licensing, etc.)

The first part is the param statement, followed by a BEGIN block. The param statement specifies what parameters and switches the script should expect. (Note below that if you don’t provide the script with the -AttributesFile parameter it will try to find a file called “Attributes.xml” in the current directory and use that.) The BEGIN block is where you can put code that should only be executed once for the entire pipeline, at the beginning before any pipeline data is processed.

param($Computer="", $AttributesFile="Attributes.xml", [switch]$v, $inputObject=$Null)

BEGIN { # This section executes before the pipeline.

    # This has something to do with pipelining.  
    # Let's call it "magic voodoo" for now.
    if ($inputObject) {
        Write-Output $inputObject | &($MyInvocation.InvocationName) -AttributesFile $AttributesFile
        break
    }

I feel I have to explain the “magic voodoo”, but I can’t explain it any better than the guy I stole it from, so check out this blog about what it all means.

The following section tries to find the Quest ActiveRoles Management Snapin. (You’ll need this in order for the script to function, as some data is gathered from AD about each computer object.) I think the comments below speak for themselves.

# Check to ensure that the Quest snapin has been registered.
# Iterate through all the loaded snapins, searching for the Quest snapin.
foreach ($snapin in (Get-PSSnapin | Sort-Object -Property Name)) {
    if ($snapin.name.ToUpper() -eq "QUEST.ACTIVEROLES.ADMANAGEMENT") {
    # Done, we have the extension and it's loaded.
    $questLoaded = $True
    break
    }
}
if (!($questLoaded)) {
    # The Quest snapin was not loaded, so see if the 
    # extension is at least registered with the system.
    foreach ($snapin in (Get-PSSnapin -registered | Sort-Object -Property Name)) {
        if ($snapin.name.ToUpper() -eq "QUEST.ACTIVEROLES.ADMANAGEMENT") {
            # Found the snapin; add it to the environment.
            trap { continue }
            Add-PSSnapin Quest.ActiveRoles.ADManagement
            Write-Host "Quest Active Directory Management Extensions found and added to this session."
            $questLoaded = $True
            break
        }
    }
}

if (!($questLoaded)) {
    # The Quest snapin is not installed on this system.
    # Print an error and bail.
    Write-Error -Category NotInstalled `
    -RecommendedAction "Install Quest Active Directory Management Extensions" `
    -Message "Quest Active Directory Management Extensions are not installed.  Please install the Extensions and re-run this command."
    continue
}

Next some variables are set up, and the script ensures that it can find an attributes file, and that it is valid XML. If it can, then it’s time to start processing the pipeline.

# Create the $ping object just once for the entire pipeline, so it can be reused.
$ping = New-Object
System.Net.NetworkInformation.Ping
    
    # See if an Attributes file was specified.  If not, bail.
    if ( !($AttributesFile) -or !(Test-Path $AttributesFile) ) {
        Write-Host "No Attributes file specified, or path does not exist: $AttributesFile"
        # Commented out so that we fall through to the PROCESS block and print the usage 
        # information there.
        #continue
    } else {
        # If we got here, then the Attributes file exists.  Try to load it.
        [xml]$attrFile = Get-Content -Path $AttributesFile
        if (!($attrFile)) {
            # Oops, either the file specified wasn't an XML file, or there was
            # an error in the file somewhere.  Bail.
            Write-Host "Error in $AttributesFile"
            continue
        }
    }
    
    # If we made it this far, start chucking stuff down the pipeline into the PROCESS block.
} # end 'BEGIN'

Like the comment says, the PROCESS block is executed for each object on the pipeline. This is where the real work happens, unless no data was passed in; if not, the script prints a usage statement and dies.

PROCESS {   # This section executes for each object in the pipeline.
    
    # Did we get data, either from the pipeline or explicitly on the command line?
    # If not, print out some (arguably "useful") help.
    if ( (!($_) -and !($Computer)) -or (!($AttributesFile)) ) {
        @"
        
USAGE:  ps_GetInfo [-v] -Computer <Computer> [-AttributesFile <Attributes.xml>]
Retrieve information from a remote computer.

Example: ps_GetInfo -Computer "$Env:ComputerName" -AttributesFile .\Attributes.xml

-v                  Verbose.  Writes the current computer name to the console.
                    Useful to monitor the progress of a pipeline operation.

-Computer           The computer to which you want to connect.

-AttributesFile     An XML file containing the attributes to retrieve.
                    If not specified, look for a file called "Attributes.xml"
                    in the current directory.

"@

        return
    }
    
    # If we got data via the pipeline, assign it to a named variable 
    # to make things easier to read.
    if ($_) { $Computer = $_ }

This part uses Quest’s tools to try to find the computer object in Active Directory.

# Try to find the computer in AD.  I guess this isn't really needed,
# but it's one more validation that the computer exists.
if ($Computer.GetType().Name -eq "ArsComputerObject") {
    # A Computer Object was passed; set an interim variable to the ArsComputerObject.
    $objComputer = $Computer
} elseif ($Computer.GetType().Name -eq "String") {
    # A bare string was passed.  Turn it into an ArsComputerObject and
    # find it in Active Directory, then return the DnsName.
    $objComputer = Get-QADComputer -Name $Computer
    if (!($objComputer)) {
        # The computer account wasn't found in AD.  Bail on this object.
        Write-Host "$Computer is not in Active Directory."
        return
    }
} else {
    # We have no idea what this object is.  Bail.
    Write-Host "$Computer is not an ArsComputerObject or a String."
    return
}

Here, I create a new object to hold all the (hopefully) returned data. Again, the comments should speak for themselves.

# Construct a new generic object to represent the Computer and use 
# Add-Member to add some generic properties to the object.
$Computer = New-Object PSObject
$Computer = Add-Member -PassThru -InputObject $Computer NoteProperty Name $objComputer.DnsName
# This property specifies whether the computer was able to be pinged.
Add-Member -InputObject $Computer NoteProperty Pingable $False
# This property specifies whether the script could connect to WMI on the remote computer.
Add-Member -InputObject $Computer NoteProperty ConnectViaWmi $False
# This property records the ModifcationDate (WhenChanged) property from the AD object.
# Useful to decide how stale the computer object is.
Add-Member -InputObject $Computer NoteProperty ADModificationDate $objComputer.ModificationDate

# Iterate over the WMI Classes and Properties specified in the Attributes file and 
# add properties to the $Computer object corresponding to the various
# attributes in the Attributes file.
foreach ($class in $attrFile.Attributes.Wmi.Classes.Class) {
    foreach ($property in $class.Property) {
        # Make sure to Trim() off any random whitespace from the XML file.
        Add-Member -InputObject $Computer NoteProperty $property.Trim() $null
    }
}

# Iterate over the files specified in the Attributes file and
# add properties to the $Computer object.
foreach ($file in $attrFile.Attributes.Files.File) {
    # Trim() off any random whitespace from the XML file.
    $propName = $file.Name.Trim()
    Add-Member -InputObject $Computer NoteProperty $propName $null
}

Try to ping the target computer. This uses the .NET Class System.Net.NetworkInformation.Ping . (Dynamic typing is great, but sometimes I like strongly-typed objects, I guess.)

# Since System.Net.NetworkInformation.Ping.Send() will generate
# a nasty exception if the ping fails, and since it's a .NET object
# (and doesn't implement the "-ErrorAction" parameter), 
# suppress printing exceptions for this call.
$ErrorActionPreference = "SilentlyContinue"
$reply = $null
# Ping the computer to see if it is alive.
[System.Net.NetworkInformation.PingReply]$reply = $ping.Send($Computer.Name)
$ErrorActionPreference = "Continue"

# The following logic test uses the .NET Enumeration 
# instead of a string match, just in case.
if ($reply.Status -eq [System.Net.NetworkInformation.IPStatus]::Success ) {
    # The computer is pingable, so note that and do some more stuff.
    $Computer.Pingable = $True

Here’s the workhorse section: verify that we can connect to WMI, and then for each attribute specified in the file, query the remote computer for it and save it in our computer object.

    # Clear the $wmi variable.
    $wmi = $null
    
    # Iterate through all WMI classes and get the various attributes
    # specified in the Attributes.xml file.
    foreach ($class in $attrFile.Attributes.Wmi.Classes.Class) {
        $wmi = Get-WmiObject -ComputerName $Computer.Name -ErrorAction SilentlyContinue $class.Name
        
        if ($wmi) {
            # We were able to connect to WMI.  Note this and continue.
            $Computer.ConnectViaWmi = $True
            
            # This actually retrieves the requested properties 
            # from the specified WMI class and sets the relevant
            # property on the $Computer object.
            foreach ($property in $class.Property) {
                # Get the value of the property, trimming off any whitespace
                # that may have made it into the XML file.
                $property = $property.Trim()
                
                # On the off-chance that this Property is of the type CimType.DateTime,
                # convert it to a more friendly string.
                if ($wmi.PSBase.Properties["$property"].Type -eq [System.Management.CimType]::DateTime) {
                    # Retrieve the property, convert it, and save it.
                    $Computer.$property = $wmi.ConvertToDateTime($wmi.$property)
                } else {
                    # Retrieve the property and save it.
                    $Computer.$property = $wmi.$property
                } # end if
            } # end foreach ($property)
        } # end if ($wmi)
    } # end foreach ($class)

This next section retrieves file information, also via WMI.

        # Since getting file information is a WMI call, only attempt it 
        # if the initial connection to WMI was successful.
        if ($wmi) {
            # Iterate over all of the files specified in the Attributes file 
            # and record the relevant information.
            foreach ($f in $attrFile.Attributes.Files.File) {
                # Just like above, construct the basename for the property name
                $baseName = $f.Name.Trim()
                # The WMI call wants escaped backslashes.
                $file = $baseName.Replace("\", "\\")
                
                # Retrieve the file's metadata from WMI (hopefully).
                $fObj = Get-WmiObject -ComputerName $Computer.Name -Class CIM_Datafile -Filter "Name=`'$file`'" -ErrorAction SilentlyContinue
                
                # If the file was found...
                if ($fObj) {
                    # ...and it has a version number...
                    if ($fObj.Version) {
                        # ...write that to the $Computer object...
                        $Computer.$baseName = $fObj.Version
                    } else {
                        # ...or else just record the fact that it was found.
                        $Computer.$baseName = $True
                    }
                } else {
                    # The file wasn't found, so set the property to false.
                    $Computer.$baseName = $False
                } # end if
            } # end foreach ($f)
        } # end if ($wmi)
    } # end if (Pingable)
    
    # We're done with this computer, so output it to pass it on down the pipeline.
    Write-Output $Computer}

The pipeline is now over, and the last section is the END block…which is not needed here, so it’s empty.

    END {   # This section executes only once, after the pipeline.
        # Of course, there's not much we need to do here.
    } # end 'END'
} # end function

And with that, we’re done with the script. Now, on to the attributes file and what it should look like:

<Attributes>
<Wmi>
    <Classes>
        <Class Name="Win32_OperatingSystem">
            <Property>
            LastBootUpTime
            </Property>
            <Property>
            ServicePackMajorVersion
            </Property>
            <Property>
            ServicePackMinorVersion
            </Property>
        </Class>
        <Class Name="Win32_ComputerSystem">
            <Property>
            UserName
            </Property>
        </Class>
        <Class Name="Win32_BIOS">
            <Property>
            SerialNumber
            </Property>
        </Class>
    </Classes>
</Wmi>
<Files>
    <File Name="C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll"/>
    <File Name="C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.dll"/>
</Files>
</Attributes>

Hopefully this is easy enough to understand: the <Class Name="..."> sections describe which WMI class to query, and the <Property/> sections within each <Class> section describe the various properties to retrieve. The <Files/> section describes which files to check. Note that the script only checks for the existence of the file and will return the version number, if it has one. If I get around to it, I’d like to update the script to also check files for a specific version number (which is why the <File/> tags have Version values).

The output of this script looks something like this:

PS C:\> .\ps_GetInfo.ps1 -Computer "my_computer"


Name                                                        : my_computer.fqdn
Pingable                                                    : True
ConnectViaWmi                                               : True
ADModificationDate                                          : 4/20/2009 6:33:34 PM
LastBootUpTime                                              : 4/16/2009 5:16:37 PM
ServicePackMajorVersion                                     : 0
ServicePackMinorVersion                                     : 0
UserName                                                    : DOMAIN\wrightst
SerialNumber                                                : [DellServiceTagHere]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll : 9.1.0.163
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.dll       : False

Granted, it probably would look better if I didn’t have to abstract some of the more important parts, but that’s what you get. If you wanted to run this command against an entire OU, you can use the Quest extensions to do something like this:

PS C:\> Get-QADComputer -SearchRoot my.domain.local/My/Search/Root | 
>> .\ps_GetInfo -AttributesFile .\Attributes.xml

PS C:\> Get-QADComputer -SearchRoot my.domain.local/My/Search/Root | 
>> .\ps_GetInfo -v -AttributesFile .\Attributes.xml | Export-Csv output.csv

The first line will output the results from processing each computer object just like above. For better-looking output, pipe the command through Export-Csv like the last line, and produce a nice report. (The ‘-v’ switch in the second command line will output the name of the computer the script is currently working on; without it there is no visible sign that the script is working, since all output is being piped to the Export-Csv cmdlet.)

I know there are a few minor bugs with this script (currently you have to query for a file–even if it’s just a nonexistent file–or else the script complains loudly), but I just finished running it against a few thousand computers with no errors, so it still works pretty well. ;-) If you see something that could be done better or easier, or if this helps you in your environment, please let me know!

"OALGen is running on the wrong CCR cluster node"

Thu, 16 Apr 2009 16:57:00 -0400

Sometimes I just have to wonder.

It seems that the Microsoft Exchange Team thought that you’d always want one Exchange Server 2007 CCR node to be the active, “primary” node, and the other node would always be the passive, “secondary” node. This isn’t exactly a problem, per se, except that there may be times when you want (or need) to make the “secondary” node the active one for an extended period of time. Still, not a problem, right? Sure…except when the System Attendant goes to regenerate the offline address book(s). At that point, you’ll get a nasty warning in the Application event log, EventID 9395: “OALGen is running on the wrong CCR cluster node”.

But wait, you say: “I thought CCR was a clustering technology, and as such it wouldn’t matter which node was active?” Me, too, but apparently this isn’t quite the case. Reading Microsoft’s Technet article about the issue reveals this:

This Warning event indicates that the Microsoft Exchange System Attendant service is running on an active cluster continuous replication (CCR) node, but the HKLM\System\CurrentControlSet\Services\MSExchangeSA\Parameters\{ClusterMailboxServerName}\EnableOabGenOnThisNode registry value is not set to this node name.

Awesome.

So, it looks like either your active node always needs to be the primary node (see this blog for more information), or the key mentioned above needs to always be set to whatever the active node is at the time. My solution was to create a script that will set the EnableOabGenOnThisNode value to the currently active node and have Task Scheduler on each node run it when specific events (MSExchange Cluster 1028 and 1029) are seen in the Application event log. (Note that this is a feature of Task Scheduler in Windows Server 2008.)

The script is pretty short, and doesn’t require any modification–if it is run on a CCR node, it will automatically discover the CMS Name and the currently active node, and set the registry value appropriately. All errors and other output are logged to the Application event log with the source of EnableOabGen, so if you use a monitoring solution like Zenoss (my choice), MOM/SCOM, etc., you can have it pick up the events from the event log.

I apologize for the long lines in advance. Also, I may not always remember to update this post with the “latest” version of the script, but you can always pull the latest version here. (Also note that this script used to be called ps_enableoabgenonthisnode.ps1, but I decided to change the name to make it fit the Verb-Noun pattern, like all good PowerShell scripts should :-) .)

################################################################################
# 
# NAME  : ps_EnableOabGenOnThisNode.ps1
# AUTHOR: Seth Wright , James Madison University
# DATE  : 4/14/2009
# 
# DESCRIPTION:  This script sets the 'EnableOabGenOnThisNode' registry key on 
#               a CCR node member to the active node in the cluster.
#               Reference http://technet.microsoft.com/en-us/library/bb266910.aspx
#               for more information.
#
#
# Redistribution and use in source and binary forms, with or without           
# modification, are permitted provided that the following conditions are met:  
#
#  1. Redistributions of source code must retain the above copyright notice,   
#     this list of conditions and the following disclaimer.                    
#  2. Redistributions in binary form must reproduce the above copyright        
#     notice, this list of conditions and the following disclaimer in the      
#     documentation and/or other materials provided with the distribution.     
# 
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ANY   
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED    
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE       
# DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY   
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES   
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND  
# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT   
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF     
# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.            
# 
################################################################################

$CurrentNode = Get-Content Env:ComputerName
$Log = $null

# Set up a new Event Source for the script, if it doesn't already exist.
if (![System.Diagnostics.EventLog]::sourceExists("EnableOabGen")) {
    $Log = [System.Diagnostics.EventLog]::CreateEventSource("EnableOabGen", "Application")
}

# Get the Application event log into the $Log variable.
$Log = New-Object System.Diagnostics.EventLog("Application", ".")
$Log.Source = "EnableOabGen"

$error.Clear()
$CMSName = Get-MailboxServer | where { $_.RedundantMachines -eq $CurrentNode }

if (!($CMSName) -or !([String]::IsNullOrEmpty($error[0]))) {
    # The CMSName couldn't be determined.  Either the script doesn't have
    # network access, or the computer is not part of a CCR cluster, or something
    # else is broke.  Log the error and bail.
    $Log.writeEntry("Could not determine the CMSName: $($error[0])", [System.Diagnostics.EventLogEntryType]::Error, 404)
    return
}

# Find the active node of the CMS.
# First, get a list of all nodes in the CMS.
$error.Clear()
$OperationalMachines = (Get-ClusteredMailboxServerStatus -Identity $CMSName).OperationalMachines

if (!($OperationalMachines) -or !([String]::IsNullOrEmpty($error[0]))) {
    # Couldn't determine the active node.  Something's not right, so don't try
    # to do anything else.  Log the error and bail.
    $Log.writeEntry("Could not determine OperationalMachines: $($error[0])", [System.Diagnostics.EventLogEntryType]::Error, 404)
    return
}

# $pattern is the regex pattern to use to look for node marked as 
# <Active...> in the OperationalMachines array.
$activePattern = "^(?<activenode>.*)\s+<Active.*"

# Perform the regex match.  $match is a throw-away variable.
$match = $OperationalMachines | where { $_ -match $activePattern }

if (!($matches.activenode)) {
    # No regex matches were found.
    $Log.writeEntry("Cannot determine the Active Node of CMS $CMSName", [System.Diagnostics.EventLogEntryType]::Error, 404)
    return
}

# A regex match was found for the Active Node.
$ActiveNode = $matches.activenode

# This is the base registry key
$baseKey = 'HKLM:\SYSTEM\CurrentControlSet\Services\MSExchangeSA\Parameters\' + $CMSName.Name
# Get the registry value "EnableOabGenOnThisNode" and check it against what it should be.
$result = (Get-ItemProperty -Path $baseKey).EnableOabGenOnThisNode
if ($result -notlike $ActiveNode) {
    # The value is wrong, so set it to the currently-active node.
    Set-ItemProperty -Path $baseKey -Name "EnableOabGenOnThisNode" -Value "$ActiveNode"
    
    $result = $null
    # Get the new value.  There could probably be a check that the key was
    # properly set, but I'm just trying to set it once.
    $result = (Get-ItemProperty -Path $baseKey).EnableOabGenOnThisNode
    
    # Log the change.
    $Log.writeEntry("The registry value `"EnableOabGenOnThisNode`" on $CurrentNode has been set to $result", [System.Diagnostics.EventLogEntryType]::Warning, 200)
}

This might be over-complicating matters; I haven’t decided yet. Either way, it works with Server 2008’s Task Scheduler. Speaking of, here’s the task’s XML export.

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
    <Date>2009-04-14T17:52:21.2602543</Date>
    <Description>
        This script sets the 'EnableOabGenOnThisNode' registry key
        on a CCR node member to the active node in the cluster.
        Reference
        http://technet.microsoft.com/en-us/library/bb266910.aspx for
        more information.
    </Description>
</RegistrationInfo>
<Triggers>
    <EventTrigger>
    <Enabled>true</Enabled>
    <Subscription><QueryList><Query Id="0" Path="Application"><Select Path="Application">*[System[Provider[@Name='MSExchange Cluster'] and EventID=1028]]</Select></Query></QueryList></Subscription>
    <Delay>PT15M</Delay>
    </EventTrigger>
    <EventTrigger>
    <Enabled>true</Enabled>
    <Subscription><QueryList><Query Id="0" Path="Application"><Select Path="Application">*[System[Provider[@Name='MSExchange Cluster'] and EventID=1029]]</Select></Query></QueryList></Subscription>
    <Delay>PT15M</Delay>
    </EventTrigger>
</Triggers>
<Principals>
    <Principal id="Author">
    <LogonType>Password</LogonType>
    <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
</Principals>
<Settings>
    <IdleSettings>
    <Duration>PT10M</Duration>
    <WaitTimeout>PT1H</WaitTimeout>
    <StopOnIdleEnd>true</StopOnIdleEnd>
    <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <MultipleInstancesPolicy>Queue</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>true</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>P3D</ExecutionTimeLimit>
    <Priority>7</Priority>
</Settings>
<Actions Context="Author">
    <Exec>
    <Command>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Command>
    <Arguments>-PSConsoleFile "D:\Program Files\Microsoft\Exchange Server\bin\exshell.psc1" D:\Scripts\Enable-OabGenOnThisNode.ps1</Arguments>
    </Exec>
</Actions>
</Task>

You’ll want to change the path to the script (look for D:\Scripts\Enable-OabGenOnThisNode.ps1 on line 49) either by editing the XML file or doing it after you import the task. Also, make sure you change the path to the Exchange console file (D:\Program Files\Microsoft\Exchange Server\bin\exshell.psc1 in the XML, also line 49) to wherever you installed Exchange. And finally, have the task run as a privileged user (probably an account with local Administrator rights in order to modify the registry) and select “Run whether user is logged on or not” on the General tab. Put the script and that task on both nodes, and any time the CMSName is moved onto or off of either node, they’ll update the registry value a minute later.

Since this is a work in progress, I may update this post with new versions of the script. If (or when) I do, I’ll make a note of what changes have been made.

EDIT 21-Jul-2010: General housekeeping, no real changes.

A Couple of PowerShell Scripts

Tue, 16 Sep 2008 16:07:00 -0400

So I went to a PowerShell training class we brought here on campus a while back. Going into a class like that already holding some general knowledge of scripting and programming, as well as specific knowledge of PowerShell (rudimentary, but still), means that by lunch-time on the first day I was bored, bored, bored. However, since I was basically getting three or four full days to play with PowerShell, I decided to play. These three little scripts are what came out of that play-time… :-)

All three of the following scripts are really very basic; nothing ground-breaking here. Hopefully as I progress in my PowerShell abilities I can provide better examples of scripts I have created to make my job easier.

The main thing to know about the scripts is that they just insert a function into the environment. To use them you must first execute the script, then call the function. In this way you can have the scripts execute in your Microsoft.PowerShell_profile.ps1 file, and then the functions will be available in the environment without having to execute the actual script. (EDIT: You’ll note that even I don’t use these scripts anymore; I never updated them and the GNU versions work just fine. I’m leaving this post here only for historical purposes.)

ps_head.ps1

The first script is called ps_head.ps1 and in all reality is just a tiny little function. It implements the most basic function of the Unix head command: it returns the first few lines of a file. The syntax is:

ps_head [-lines] <file>

Here’s the script:

if (Test-Path function:ps_head) { Remove-Item function:ps_head }
# head file -lines
function global:ps_head($path,$lines="-10") {
    if ($lines.GetType().Name -eq "String" ) {
        $lines = $lines.trim("-")
    }
    if ($path -ne $Null) {
        if (Test-Path $path) {
        Get-Content -path $path -totalCount $lines
        }
    }
}
Write-Host "Added ps_head to global functions." -Fore White

ps_tail.ps1

Next in line is ps_tail.ps1 which, as you can probably guess, does the same thing as the Unix tail command. Syntax is the same as above:

ps_tail [-lines] <file>

if (Test-Path function:ps_tail) { Remove-Item function:ps_tail }

# ps_tail file -lines
function global:ps_tail {
    param ($path, $lines="-10", [switch] $f)

    if ($lines.GetType().Name -eq "String" ) {
        $lines = [string]$lines.trim("-")
    }
    if ($path -ne $Null) {
        if (Test-Path $path) {
            $content = Get-Content -path $path
            for($i=$content.length - $lines; $i -le $content.length; $i++) {
                $content[$i]
            }
        }
    }
}

Write-Host "Added ps_tail to global functions." -Fore White

ps_grep.ps1

The third and final script for this post is ps_grep.ps1. It implements a couple of grep’s command-line options; namely, -c and -i. The syntax is:

ps_grep [-c] [-i] pattern <file>

(Each command-line switch needs to be provided separately; currently you’re not able to run them all together, as in “grep -cRi pattern *.*”. I might work on that. [EDIT: clearly, I didn’t, and won’t.])

Something to note is that ps_grep will loop through all of an object’s properties in search of the supplied regex pattern and not just the Name property, etc. Also, if you use the function in a pipeline and pattern is a simple string (i.e., not a regular expression), the match will always be case-insensitive. When I have a bit of time I’ll try to figure that one out.

if (Test-Path function:ps_grep) { Remove-Item function:ps_grep }

function global:ps_grep([switch] $c, [switch] $i, $pattern, $file="", $inputObject=$Null) {
    BEGIN {
        # This section executes before the pipeline.
        # $count will contain the number of matches found.
        $count = 0

        if ($inputObject) {
            $inputObject
        }
    } # end 'begin'

    PROCESS {
        # This section executes for each object in the pipeline.

        # Did we get a filename?  If so we're operating on a file, not stdout.
        if ($file -ne "") {

            # Is the filename a valid file?
            if (Test-Path $file) {

                # Grep the file for $pattern, if we were given $pattern.
                if($pattern) {
                    if (!$i) {
                        # User has specified as case-sensitive match.
                        $case = "-CaseSensitive"
                    }
                    $command = "Select-String $case -pattern $pattern -InputObject (Get-Item $file)"
                    foreach ($match in Invoke-Expression($command)) {
                        if (!$c) {
                            # only output lines if -c was not specified.
                            Write-Host $match
                        }
                        # Increment our count.
                        $count++
                    }
                } # end 'if ($pattern)'
            } # end 'if (test-path)'
            else {
                # The filename passed does not exist.  Die.
                Write-Host "File does not exist."
            } # end 'else'
        } # end 'if ($file...)'

        # Didn't get a filename, so we're operating on stdout.
        elseif($pattern) {
            # Save the pipelined object into an internal var to avoid confusion below.
            $obj = $_

            # Loop through $obj's properties and look for $pattern
            foreach ($prop in ($obj | Get-Member -MemberType Properties) ) {
                if($obj.($prop.name.ToString()) -match $pattern) {
                    if (!$c) {
                        # Found a match, output the result to stdout.
                        Write-Output $obj | ($MyInvocation.InvocationName) -inputObject $_
                    }

                    # Increment our count.
                    $count++

                    # No reason to keep searching this property.
                    break
                } # end 'if ($obj...)'
            } # end 'foreach'
        } # end 'elseif'
    } # end 'process'

    END {
        # If '-c' was specified on the command line, output the total count.
        if ($c) {
            Write-Host $count
        } # end 'if ($c)'
    } # end 'end{}'
} # end function

Write-Host "Added ps_grep to global functions." -Fore White

If you have any ideas, let me know how I can improve these little functions.

My Personal PowerShell Profile

Mon, 15 Sep 2008 17:09:00 -0400

I’ve seen a lot of people post their personal PowerShell profile scripts online for others to peruse, so I figured I’d do the same. You can also view the most current copy in my Git repository.

As is usually the case with things like this, this script is a work-in-progress. As such, I will try to edit this entry any time I make a modification to it.

LAST EDIT 27-May-2010: Edited this post because there are some things I just don’t do anymore, and updated the script yet again. If you’re looking for the latest-and-greatest, I would check the Git repo, because I have a habit of not updating this post.

################################################################################
# 
# $Id: Microsoft.PowerShell_profile.ps1 196 2010-05-28 01:59:30Z seth $
# 
# DESCRIPTION:  PowerShell personal profile.
#
# Copyright (c) 2009 Seth Wright (wrightst@jmu.edu)
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
################################################################################

# Add any other paths to search for scripts here.
$ExtraScriptPaths = "~/PowerShellScripts"

Write-Host -Fore Cyan ($MyInvocation.MyCommand).Definition
Write-Host

# Add all registered snapins.
foreach ($Snapin in ( Get-PSSnapin -registered )) {
    Add-PSSnapin $Snapin
    Write-Host "Added Snapin " -NoNewLine
    Write-Host $Snapin.Name -Fore Green
}


# Loop through the PowerShellScripts folder and execute all .ps1 files.
foreach ($ScriptFolder in $ExtraScriptPaths) {
    if (Test-Path $ScriptFolder) {
        $ScriptFolder = Resolve-Path $ScriptFolder
        Write-Host "Executing scripts found in $ScriptFolder..."
        foreach ( $script in (dir -Recurse $ScriptFolder | where { $_.Name -like "*.ps1" }) ) {
            Write-Host "Executing " -NoNewLine
            Write-Host $script.Name -Fore Red
            &($script.FullName)
        }
    } else {
        Write-Warning "Script Path `"$ScriptFolder`" does not exist."
    }
}


# Allow Unix-like functionality with the 'cd' command.
# First, remove the default "cd" alias
if (Test-Path Alias:\cd) { Remove-Item Alias:\cd }
function cd($path=$(Get-Item Env:UserProfile).Value) {
    if ($path) {
        Set-Location $path
    }
}

function prompt {
    $host.UI.RawUI.WindowTitle = "PowerShell: $pwd"
    Write-Host "PS" -NoNewLine -fore DarkGreen
    Write-Host (" " + $(get-location) + ">" + $(if ($nestedpromptlevel -ge 1) { ">>" }) ) -Fore DarkCyan -NoNewLine
    return " "
}

# Other aliases because I'm lazy.
function  npr   { notepad.exe $profile }

# Blank line before initial prompt.
Write-Host ""

# Remove any transient variables from the environment.
If (Test-Path Variable:\Snapin) { Remove-Variable Snapin }
If (Test-Path Variable:\script) { Remove-Variable script }
If (Test-Path Variable:\ExtraScriptPaths) { Remove-Variable ExtraScriptPaths }
If (Test-Path Variable:\ScriptFolder) { Remove-Variable ScriptFolder }

Send me an email or comment or whatnot if you have any questions, or if you have any suggestions for improvements!