PowerShell for Windows Admins

December 10, 2013  4:09 AM

Scripting Games countdown

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

The countdown to the 2014 Winter Scripting Games has started. The ideal way to brighten up the depths of winter.

This Games is for teams of least two. You can learn more by downloading and reading the players guide:


The games start January 2014 so don’t go looking for events just yet. Now would be a good time to look at the events from past games and get in some practice.

December 8, 2013  3:58 PM

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

On a Windows Server 2012 or 2012 R2 system you can install the ServerManager module and use the Get-WindowsFeature cmdlet to discover the installed features. They can be managed with Install-WindowsFeature and Uninstall-WindowsFeature .

These cmdlets don’t exist on Windows 8/8.1

However the Dism (Deployment Image Servicing and Management) module can help out. The Dism module is mainly concerned with managing wim files and virtual disks for deployment scenarios but it also contains these cmdlets:




To discover the installed features

Get-WindowsOptionalFeature -Online | Format-Table –AutoSize

The output looks like this

FeatureName                                                             State

———–                                                                      —–

Microsoft-Hyper-V-All                                           Enabled

Microsoft-Hyper-V-Tools-All                                Enabled

Microsoft-Hyper-V                                                  Enabled

Microsoft-Hyper-V-Management-Clients           Enabled

Microsoft-Hyper-V-Management-PowerShell    Enabled

Printing-Foundation-Features                               Enabled

Printing-Foundation-LPRPortMonitor                Disabled

Printing-Foundation-LPDPrintService                 Disabled

Printing-Foundation-InternetPrinting-Client     Enabled


For all of these cmdlets use –Online to access the local machine rather than an image.

Individual features can be enabled or disabled

Enable-WindowsOptionalFeature -FeatureName TelnetClient –Online

Disable-WindowsOptionalFeature -FeatureName TelnetClient –Online

Feature names are case sensitive.

December 8, 2013  8:20 AM

Transferring modules from Windows 8 or 8.1 to Windows 7

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Windows 7 shipped with PowerShell 2.0 installed.  Windows 8 brought PowerShell 3.0 and Windows 8.1 brings PowerShell 4.0.

Windows 8 and 8.1 also have a lot of modules installed. This extra functionality widens PowerShell reach immensely – the networking modules alone are a significant step forward.

When you install PowerShell 3.0 or 4.0 on Windows 7 you don’t most of the new modules. This has puzzled many people and I’m often asked how those Windows 8/8.1 modules can be made available on Windows 7.

The short answer is that you can’t.

The long answer is that you can’t because, for the most part, those modules are based on CIM (WMI) classes that were introduced in Windows 8 or 8.1. A lot of the system management functionality you see in modern Windows is based on CIM classes that then use the CDXML approach to create PowerShell modules.

Installing the new CIM classes on Windows 7 is not possible – so you can’t get the modules on which they are based.

If you want the new functionality you have to upgrade to Windows 8.1

December 6, 2013  9:45 AM

Future thoughts

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

I spent last night configuring a new Windows 8.1 device – finally retired my venerable HP laptop. One thing that struck me as I was working through the various installs was where my data was.  The last time I’d configured a new machine all of the data was held locally and I’d needed to copy the data onto the new machine. A cross over cable was used if I remember correctly.

This time the majority of my data is on my SkyDrive. Logging into Windows 8.1 with a Microsoft Live id means I get immediate access to SkyDrive content. SkyDrive is an integral part of Windows 8.1 rather than being an additional install.

The SkyDrive appeared. The configuration is good in that you can move the SkyDrive position on your local disk – open up the Location tab on the SkyDrive properties.

What did surprise me and start me thinking is that by default under Windows 8.1 SkyDrive data is not automatically downloaded to your local disk.  You get a stub file that when you click on it triggers the download of the contents. In previous versions as soon as you configured the SkyDrive app on your local machine it would start analysing your data and download.

Its easy enough to trigger a download for everything, or just some folders – right click the appropriate folder with your SkyDrive area on the local disk and select  Make available off-line.

This started me thinking – with SkyDrive defaulting to online content and Microsoft Office being able to save to SkyDrive – how long before all of our data is in the cloud. I wouldn’t be surprised to see future machines with much smaller disks than we assume are necessary today – enough to store the OS and applications. Though with web based Office applications available through Office 365 there could be a lot of people who only need a thin OS – sort of like a chrome book but that actually usable.

The only data you will store locally will be those files you are working on.

This change will require much better network support than we receive today. The broadband offerings in the UK are not up to supporting this approach and until there is consistent, fast broad band connectivity everywhere it will remain a pipe dream.

December 5, 2013  2:33 PM

CDXML–scripting creation

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

So far you’ve seen how to create CDXML files by hand – though you probably used cut and paste rather than typing everything from scratch.

Its time to bring a bit of automation to creating CDXML files. The XML is fairly simple and you’re only changing a couple of values so you can do this:

function new-cdxml {


param (



[string]$namespace = ‘ROOT\cimv2′,

[string]$path = “C:\Scripts\Modules\Hardware”


$code = @”

<?xml version=’1.0′ encoding=’utf-8′?>

<PowerShellMetadata xmlns=’http://schemas.microsoft.com/cmdlets-over-objects/2009/11′>

<Class ClassName=’$namespace\$class’>




<GetCmdletParameters DefaultCmdletParameterSet=’DefaultSet’>






$file = Join-Path -Path $path -ChildPath “$class.cdxml”

Write-Verbose -Message $file

Set-Content -Path $file -Value $code


I saved this as NewCDXML.ps1. This will eventually become the basis of a CDXML file creation module. I set defaults on the namespace and the path – feel free to change them if required.

The function is run as:

new-cdxml -class Win32_DiskDrive -noun PhysicalDisk

which produces this CDXML file

<?xml version=’1.0′ encoding=’utf-8′?>

<PowerShellMetadata xmlns=’http://schemas.microsoft.com/cmdlets-over-objects/2009/11′>

<Class ClassName=’ROOT\cimv2\Win32_DiskDrive’>




<GetCmdletParameters DefaultCmdletParameterSet=’DefaultSet’>





The Hardware.psd1 file needs to be altered:

# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess

NestedModules = @(‘Win32_BIOS.cdxml’,





# Functions to export from this module

FunctionsToExport = @(‘Get-Bios’,




The module now looks like this:

£> Get-Command -Module Hardware

CommandType Name

———–             —-

Function            Get-Bios

Function             Get-ComputerSystem

Function            Get-PhysicalDisk

This makes creating additional components for your module much easier.

December 2, 2013  12:01 PM

CDXML: Add a cmdlet for computer system

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Continuing the creation of a Hardware investigation module – its a simple matter to add a cmdlet to retrieve the computer system data ie Win32_ComputerSystem

First create a CDXML file like this:

<?xml version=”1.0″ encoding=”utf-8″?>

<PowerShellMetadata xmlns=”http://schemas.microsoft.com/cmdlets-over-objects/2009/11″>

<Class ClassName=”ROOT\cimv2\Win32_ComputerSystem”>




<GetCmdletParameters DefaultCmdletParameterSet=”DefaultSet”>





The only difference from the Win32_BIOS.cdxml is the WMI class and the default noun

Save in your Hardware module folder as Win32_ComputerSystem.cdxml

Modify the hardware.psd1 file in two places –

NestedModules = @(‘Win32_BIOS.cdxml’,

‘Win32_ComputerSystem.cdxml’ )


FunctionsToExport = @(‘Get-Bios’,


Save the hardware.psd1 file.

Now when you open up PowerShell

£> Get-Command -Module Hardware

CommandType Name ModuleName

———– —- ———-

Function Get-Bios Hardware

Function Get-ComputerSystem Hardware

£> Get-ComputerSystem | Format-List

Domain : Manticore.org

Manufacturer : Microsoft Corporation

Model : Virtual Machine

Name : WIN81

PrimaryOwnerName : Richard

TotalPhysicalMemory : 1857605632

Note default display is a table.

For now we’ll keep adding investigative cmdlets to our module – though there are some methods on Win32_ComputerSystem we’ll be adding to our module later.

November 30, 2013  8:52 AM

CDXML: Module Manifest

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Last time we created a module using CDXML to wrap the Win32_Bios WMI class. This gave us a cmdlet – Get-Bios. As the intention is to create a number of modules that expose the WMI classes related to hardware we need a module manifest file (.psd1) to load them so that we can take advantage of module auto-loading in PowerShell 3 & 4

Remember – one WMI class per CDXML file and each CDXML file is treated as a module

I find the easiest way to create new manifest is run New-ModuleManifest and give it the full path to the psd1 file you want to create

New-ModuleManifest -Path C:\scripts\Modules\Hardware\Hardware.psd1 –PassThru

You can then open the file in ISE and edit to give this:

# Module manifest for module ‘Hardware’
# Generated by: richard
# Generated on: 30/11/2013


# Script module or binary module file associated with this manifest.
# RootModule = ”

# Version number of this module.
ModuleVersion = ‘1.0’

# ID used to uniquely identify this module
GUID = ‘55512ad7-c2aa-4678-818f-8f19b4f110dd’

# Author of this module
Author = ‘Richard’

# Company or vendor of this module
CompanyName = ‘Macdui’

# Copyright statement for this module
Copyright = ‘(c) 2013 Richard. All rights reserved.’

# Description of the functionality provided by this module
# Description = ”

# Minimum version of the Windows PowerShell engine required by this module
# PowerShellVersion = ”

# Name of the Windows PowerShell host required by this module
# PowerShellHostName = ”

# Minimum version of the Windows PowerShell host required by this module
# PowerShellHostVersion = ”

# Minimum version of Microsoft .NET Framework required by this module
# DotNetFrameworkVersion = ”

# Minimum version of the common language runtime (CLR) required by this module
# CLRVersion = ”

# Processor architecture (None, X86, Amd64) required by this module
# ProcessorArchitecture = ”

# Modules that must be imported into the global environment prior to importing this module
# RequiredModules = @()

# Assemblies that must be loaded prior to importing this module
# RequiredAssemblies = @()

# Script files (.ps1) that are run in the caller’s environment prior to importing this module.
# ScriptsToProcess = @()

# Type files (.ps1xml) to be loaded when importing this module
# TypesToProcess = @()

# Format files (.ps1xml) to be loaded when importing this module
# FormatsToProcess = @()

# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
NestedModules = @(‘Win32_BIOS.cdxml’)

# Functions to export from this module
FunctionsToExport = @(‘Get-Bios’)

# Cmdlets to export from this module
CmdletsToExport = ‘*’

# Variables to export from this module
VariablesToExport = ‘*’

# Aliases to export from this module
AliasesToExport = ‘*’

# List of all modules packaged with this module
# ModuleList = @()

# List of all files packaged with this module
# FileList = @()

# Private data to pass to the module specified in RootModule/ModuleToProcess
# PrivateData = ”

# HelpInfo URI of this module
# HelpInfoURI = ”

# Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.
# DefaultCommandPrefix = ”


You can cut out the items you don’t need but I prefer to leave them as reminders of the commands.

Once the file is modified – save it back as Hardware.psd1

Start a new PowerShell console and your new module is available for use immediately.

This also means that you can add new CDXML files and test them independently of the module. Once you’re happy with the new functionality you add the appropriate lines to the module manifest.

November 30, 2013  6:48 AM


Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Its been stated many times that over 60% of the modules in PowerShell 3 & 4 are created using CDXML – objects-over-cmdlets.

This involves taking a WMI class and wrapping it in XML to create a PowerShell module. At this time many admins are running for the door but it really isn’t that difficult.

Most admins will have used the Win32_Bios class

£> Get-CimInstance -ClassName Win32_Bios

SMBIOSBIOSVersion : 090006
Manufacturer : American Megatrends Inc.
Name : BIOS Date: 05/23/12 17:15:53 Ver: 09.00.06
SerialNumber : 5518-5018-0990-2526-2313-2106-44
Version : VRTUAL – 5001223

View the code at


The verb is automatically set to GET.

I keep all my scripts in a folder called c:\scripts – this has subfolders by category. I also amend my module path in my PowerShell profile

$env:PSModulePath = “C:\Scripts\Modules;” + $env:PSModulePath

to add the \scripts\modules folder. This folder has all of the module I develop to keep them separate from the Microsoft modules.

I’m creating a module called Hardware that will contain a suite of CDXML files for accessing WMI classes related to hardware.

I saved the XML above to C:\Scripts\Modules\Hardware\Win32_BIOS.cdxml

For testing I change directory the C:\Scripts\Modules\Hardware folder and I can test my new module.

£> Import-Module .\Win32_BIOS.cdxml
£> Get-Command -Module Win32_BIOS

CommandType Name ModuleName
———– —- ———-
Function Get-Bios Win32_BIOS

Running Get-Bios produces:

£> get-bios

SMBIOSBIOSVersion : 090006
Manufacturer : American Megatrends Inc.
Name : BIOS Date: 05/23/12 17:15:53 Ver: 09.00.06
SerialNumber : 5518-5018-0990-2526-2313-2106-44
Version : VRTUAL – 5001223

Exactly the same as using Get-CimInstance.

You also get a set of free functionality (meaning you don’t have to do anything)

£> Get-Command Get-Bios -Syntax

Get-Bios [-CimSession ] [-ThrottleLimit ] [-AsJob] []

£> $sess = New-CimSession -ComputerName server02
£> Get-Bios -CimSession $sess

SMBIOSBIOSVersion : 6NET61WW (1.24 )
Manufacturer : LENOVO
Name : Ver 1.00PARTTBLX
SerialNumber : R81BG3K
Version : LENOVO – 1240
PSComputerName : server02

The properties displayed are controlled by the PowerShell formatting system as with most WMI classes. You can display all data:

Get-Bios | Format-List *

Next time we’ll create a module manifest file to enable module auto-loading

November 30, 2013  5:39 AM

Defender Module: Threat Catalog

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

You can see the threats that defender is testing against

Get-MpThreatCatalog | select SeverityID, ThreatName

You get a long list like this

5 TrojanDownloader:Win32/Agent.A
4 TrojanDownloader:Win32/Holistyc
2 Dialer:Win32/EPlugin
5 Backdoor:Win32/Fxsvc
2 Adware:Win32/Networkone

This is the important one:


You want this to return nothing i.e. no threats found

You can start a scan like this:

Start-MpScan -ScanType QuickScan

A progress bar will show how things are going – again if your machine is clean you won’t get a return

November 29, 2013  4:56 PM

Mac Address

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

No not where you go for a burger!

I saw a post on the forum about getting the MAC address fro remote machines. The original post was using a fixed filter on NetConnectionID which assumes that all of your machines are configured equally. I think a better approach is to gather all the data

function get-macaddress {
[string]$computername = $env:COMPUTERNAME
Get-WmiObject -Class Win32_NetworkAdapter -ComputerName $computername -Filter “NetConnectionID LIKE ‘%'” |
select PSComputerName, Description, NetConnectionID, MACAddress


The WMI filter ensures that only adapters with a NetConnectionID are returned.

Once you have the data you can ensure your machines are configured the same

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: