PowerShell for Windows Admins


January 28, 2012  10:20 AM

Active Directory and WMI

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

A lot of the Active Directory related functionality has been removed from WMI but  there is a little bit left in the root\MicrosoftActiveDirectory namespace.

This is on a Windows 2008 R2 domain controller – I don’t know if this is available on down level versions of Windows.

Get-WmiObject -Namespace root\MicrosoftActiveDirectory -List | where {$_.Name -notlike "__*"}

 

ReplicationProvider1
MSAD_ReplPendingOp
Microsoft_TrustProvider
Microsoft_DomainTrustStatus
Microsoft_LocalDomainInfo
MSAD_NamingContext
MSAD_ReplCursor
MSAD_DomainController
MSAD_ReplNeighbor

The mixture of naming conventions doesn’t help but lets start looking at some domain information

Get-WmiObject -Namespace root\MicrosoftActiveDirectory -Class Microsoft_LocalDomainInfo

 

The following properties of interest are returned

DCname           : SERVER02
DNSname          : Manticore.org
FlatName         : MANTICORE
SID              : S-1-5-21-3881460461-1879668979-35955009
TreeName         : Manticore.org

 

We can also get a quick replication test

 

Get-WmiObject -Namespace root\MicrosoftActiveDirectory -Class MSAD_DomainController |
select CommonName, DistinguishedName, IsAdvertisingToLocator, IsGC, IsNextRIDPoolAvailable,
IsRegisteredInDNS, IsSysVolReady, NTDsaGUID, PercentOfRIDsLeft, SiteName,
@{N="OldestQueuedAddition"; E={$_.ConvertToDateTime($_.TimeOfOldestReplAdd)} },
@{N="OldestQueuedDeletion"; E={$_.ConvertToDateTime($_.TimeOfOldestReplDel)} },
@{N="OldestQueuedModification"; E={$_.ConvertToDateTime($_.TimeOfOldestReplMod)} },
@{N="OldestQueuedReplicationSync"; E={$_.ConvertToDateTime($_.TimeOfOldestReplSync)} },
@{N="OldestQueuedReplicationUpdate"; E={$_.ConvertToDateTime($_.TimeOfOldestReplUpdRefs)} }

 

CommonName                    : SERVER02
DistinguishedName             : CN=NTDS Settings,CN=SERVER02,CN=Servers,CN=Site1,CN=Sites,CN=Configuration,DC=Manticore,DC=org
IsAdvertisingToLocator        : True
IsGC                          : True
IsNextRIDPoolAvailable        : False
IsRegisteredInDNS             : True
IsSysVolReady                 : True
NTDsaGUID                     : baba1150-8a6a-41ac-9889-4b69268d3f7c
PercentOfRIDsLeft             : 91
SiteName                      : Site1
OldestQueuedAddition          : 01/01/1601 00:00:00
OldestQueuedDeletion          : 01/01/1601 00:00:00
OldestQueuedModification      : 01/01/1601 00:00:00
OldestQueuedReplicationSync   : 01/01/1601 00:00:00
OldestQueuedReplicationUpdate : 01/01/1601 00:00:00

 

The 1601 dates mean nothing is queued

January 27, 2012  2:10 PM

PowerShell Deep Dive 2012

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

The 2012 PowerShell Deep Dive has been announced  – April 29 – May 2 in San Diego.

http://blogs.msdn.com/b/powershell/archive/2012/01/27/it-s-time-for-another-powershell-deep-dive.aspx

 

This time PowerShell is a full track so expect more of your favourite stuff.  Hope to see you there.


January 26, 2012  4:09 PM

Integer sizes

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

 

If you’ve used PowerShell for any time you will be away of [int] meaning integer. One common use is in functions to define a parameter’s data type

function test1 {
param (
  [int]$a,
  [int]$b
)
$a * $b
}

We can use this function

PS> test1 -a 10 -b 6
60

OK simple stuff but what if we do this

PS> test1 -a 2147483648 -b 17
test1 : Cannot process argument transformation on parameter ‘a’. Cannot convert
value "2147483648" to type "System.Int32". Error: "Value was either too large
or too small for an Int32."
At line:1 char:9
+ test1 -a <<<<  2147483648 -b 17
    + CategoryInfo          : InvalidData: (:) [test1], ParameterBindin…mati
   onException
    + FullyQualifiedErrorId : ParameterArgumentTransformationError,test1

Oh

Integers come in a number of different sizes – denoted by the number of bits that are used to store the number – 16, 32 and 64 respectively.  The standard [int] is a 32bit integer (4 bytes)

We can see the maximum and minimum numbers that can be stored in these data types using the MaxValue and MinValue properties

"`n16 bit integer"
"$([int16]::MinValue) to $([int16]::MaxValue)"

"`n32 bit integer"
"$([int32]::MinValue) to $([int32]::MaxValue)"

"`n32 bit integer alternative"
"$([int]::MinValue) to $([int]::MaxValue)"

"`n64 bit integer"
"$([int64]::MinValue) to $([int64]::MaxValue)"

 

which gives these results

16 bit integer
-32768 to 32767

32 bit integer
-2147483648 to 2147483647

32 bit integer alternative
-2147483648 to 2147483647

64 bit integer
-9223372036854775808 to 9223372036854775807

 

So 2147483648 is one bigger than the maximum value storable in 32 bit integer. We could use a 64bit integer or we can use an unsigned integer. This only contains positive values

"`nunsigned 16 bit integer"
"$([uint16]::MinValue) to $([uint16]::MaxValue)"

"`nunsigned 32 bit integer"
"$([uint32]::MinValue) to $([uint32]::MaxValue)"

"`nunsigned 64 bit integer"
"$([uint64]::MinValue) to $([uint64]::MaxValue)"

 

unsigned 16 bit integer
0 to 65535

unsigned 32 bit integer
0 to 4294967295

unsigned 64 bit integer
0 to 18446744073709551615

Which should you use?  Use int64 if likely to have negative values and possibly uint32 if definitely only positive values


January 24, 2012  4:34 PM

Remoting between PowerShell v3 CTP 2 and PowerShell v2

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

One of the questions on tonight’s Live Meeting concerned the compatibility between remoting on PowerShell v2 and PowerShell v3 CTP 2

The difference is that v3 uses a WSMAN 3.0 stack but v2 uses 2.0

I used two machines:

  • Windows 2008 R2 SP 1 with PowerShell v2
  • Windows 7 SP1 with PowerShell v3 CTP 2

 

on each machine I ensured remoting was enabled then ran

$s = New-PSSession –ComputerName <other computer name>
Invoke-Command -Session $s -ScriptBlock {get-service}

 

it worked in both cases

Looks like in this case you can remote both ways


January 24, 2012  4:07 PM

Recording–UK PowerShell group January 2012

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

The recording of tonight’s meeting together with the slides and demo scripts are available from

https://skydrive.live.com/?cid=43cfa46a74cf3e96#cid=43CFA46A74CF3E96&id=43CFA46A74CF3E96%212469&sc=documents

 

download the zip file from the 2012 January PowerShell v3 CTP2 overview folder

 

Enjoy


January 23, 2012  1:24 PM

Get-CimClass

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Get-CimClass is used to dig into the information available within a WMI class.

At its most basic level we get a set of information like this

PS> Get-CimClass -ClassName Win32_OperatingSystem | fl *

ClassName           : Win32_OperatingSystem
SuperClassName      : CIM_OperatingSystem
CimSuperClassName   : CIM_OperatingSystem
SuperClass          : Microsoft.Management.Infrastructure.CimClass
CimSuperClass       : Microsoft.Management.Infrastructure.CimClass
Namespace           : ROOT/cimv2
Properties          : {Caption, Description, InstallDate, Name…}
CimClassProperties  : {Caption, Description, InstallDate, Name…}
Qualifiers          : {Locale, UUID, dynamic, provider…}
CimClassQualifiers  : {Locale, UUID, dynamic, provider…}
Methods             : {Reboot, Shutdown, Win32Shutdown, Win32ShutdownTracker…}
CimClassMethods     : {Reboot, Shutdown, Win32Shutdown, Win32ShutdownTracker…}
CimSystemProperties : Microsoft.Management.Infrastructure.CimSystemProperties

 

We get a few parameters to work with

PS> Get-Help Get-CimClass

NAME
    Get-CimClass

SYNTAX
    Get-CimClass [[-ClassName] <string>] [[-Namespace] <string>] [-OperationTimeoutSec <UInt32>] [-ComputerName
    <string[]>] [-MethodName <string>] [-PropertyName <string>] [-QualifierName <string>]  [<CommonParameters>]

    Get-CimClass [[-ClassName] <string>] [[-Namespace] <string>] [-OperationTimeoutSec <UInt32>] -CimSession
    <CimSession[]> [-MethodName <string>] [-PropertyName <string>] [-QualifierName <string>]  [<CommonParameters>]

 

Want to know which WMI classes have a method called create

PS> Get-CimClass -MethodName Create

   NameSpace: ROOT/cimv2

ClassName                 Methods              Properties
———                 ——-              ———-
Win32_ShadowStorage       {Create}             {AllocatedSpace, DiffVolume, MaxSpace, UsedSpace…}
Win32_ScheduledJob        {Create, Delete}     {Caption, Description, InstallDate, Name…}
Win32_DfsNode             {Create}             {Caption, Description, InstallDate, Name…}
Win32_BaseService         {StartService, St… {Caption, Description, InstallDate, Name…}
Win32_SystemDriver        {StartService, St… {Caption, Description, InstallDate, Name…}
Win32_Service             {StartService, St… {Caption, Description, InstallDate, Name…}
Win32_TerminalService     {StartService, St… {Caption, Description, InstallDate, Name…}
Win32_Share               {Create, SetShare… {Caption, Description, InstallDate, Name…}
Win32_ClusterShare        {Create, SetShare… {Caption, Description, InstallDate, Name…}
Win32_ShadowCopy          {Create, Revert}     {Caption, Description, InstallDate, Name…}
Win32_Process             {Create, Terminat… {Caption, Description, InstallDate, Name…}

 

or a property called Size

PS> Get-CimClass -PropertyName Size

   NameSpace: ROOT/cimv2

ClassName
———
Win32_DiskDrive
Win32_CDROMDrive
CIM_LogicalDisk
Win32_LogicalDisk
Win32_MappedLogicalDisk
Win32_DiskPartition
Win32_PrintJob

We can dig deeper into a class

Get-CimClass -ClassName Win32_OperatingSystem | select -ExpandProperty Properties

provides an output like this for every property

Name               : CSName
Value              :
CimType            : String
Flags              : Property, ReadOnly, NullValue
Qualifiers         : {CIM_Key, MaxLen, Propagated, read}
ReferenceClassName :

 

Likewise methods

Get-CimClass -ClassName Win32_OperatingSystem | select -ExpandProperty Methods

 

or if you want detail on a particular method

PS> Get-CimClass -ClassName Win32_OperatingSystem | select -ExpandProperty Methods | where name -eq SetDateTime | fl *

Name       : SetDateTime
ReturnType : UInt32
Parameters : {LocalDateTime}
Qualifiers : {Implemented, Privileges, ValueMap}

 

And no thats not a typo on the where statement – its a new PowerShell v3 feature I’ll cover another day

Get-CimClass -ClassName Win32_OperatingSystem  | select -ExpandProperty Qualifiers

and

Get-CimClass -ClassName Win32_OperatingSystem  | select -ExpandProperty CimSystemProperties | fl *

do what you would expect

Finding the key property for a class is a useful exercise

Get-CimClass -ClassName Win32_Process | select -ExpandProperty Properties | where {$_.Qualifiers -like "*key*"}

returns a number of properties – some are like this

Name               : CreationClassName
Value              :
CimType            : String
Flags              : Property, ReadOnly, NullValue
Qualifiers         : {CIM_Key, MaxLen, read}
ReferenceClassName :

 

and have the CIM_Key qualifier but the one we are really interested in is this one

Name               : Handle
Value              :
CimType            : String
Flags              : Property, Key, ReadOnly, NullValue
Qualifiers         : {key, MaxLen, read}
ReferenceClassName :

 

Lots of useful information to be gained from this cmdlet. Don’t leave home to explore WMI without it.


January 22, 2012  7:58 AM

January meeting reminder

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Just a quick reminder that on Tuesday 24 January the UK PowerShell Group presents a Live Meeting looking at PowerShell v3 CTP2

 

Details from here

http://msmvps.com/blogs/richardsiddaway/archive/2012/01/02/uk-powershell-group-january-2012.aspx


January 21, 2012  7:28 AM

SMART disk failure data

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

We can access the SMART disk failure data using

Get-WmiObject -Namespace root\wmi -Class MSStorageDriver_FailurePredictData

 

The important properties are:

Active           : True
InstanceName     : IDE\DiskST9250320AS_____________________________HP07____\5&b0fd174&0&1.0.0_0
Length           : 512
VendorSpecific   : {10, 0, 1, 15…}

 

The data we want is in the VendorSpecific property. On my system its an array of 512 numbers – not very useful but we can (hopefully) decode this

function get-diskstatus {            
[CmdletBinding()]            
param (            
 [string]$computername = $env:COMPUTERNAME            
)            
            
$items = "Unknown1","Unknown2", "Attribute", "Status", "Unknown3", "Value", "Worst", "Raw1", "Raw2", "Unknown4","Unknown5","Unknown6"            
            
$data = Get-WmiObject -Namespace root\wmi -Class MSStorageDriver_FailurePredictData -ComputerName $computername             
            
#$data | select InstanceName, Active            
            
$values = $data.VendorSpecific            
$flb =  $values.Count - ($values.Count % 12) -1            
            
for ($i = 0; $i -le $flb-11; $i += 12  ){            
            
$obj = New-Object -TypeName PSObject            
            
for($j = 0; $j -le 11; $j++) {             
$obj | Add-Member -MemberType Noteproperty -Name $($items[$j]) -Value $($values[$i + $j])            
}            
$obj            
}            
}            

 

We can use this as

get-diskstatus | ft * –a

 

I only have a single disk in my system so this works – I’ll need to modify the function to deal with multiple disks

 

But this is what I get back

 

Unknown1 Unknown2 Attribute Status Unknown3 Value Worst Raw1 Raw2 Unknown4 Unknown5 Unknown6

——– ——– ——— —— ——– —– —– —- —- ——– ——– ——–

      10        0         1     15        0   114    99   62  168       88        4        0

       0        0         3      2        0    99    99    0    0        0        0        0

       0        0         4     51        0    99    99   95    5        0        0        0

       0        0         5     51        0   100   100   17    0        0        0        0

       0        0         7     15        0    81    60  227   94      126        8        0

       0        0         9     50        0    90    90  132   34        0        0        0

       0        0        10     19        0   100   100    0    0        0        0        0

       0        0        12     51        0    99    99  248    4        0        0        0

       0        0       184     51        0   100   100    0    0        0        0        0

       0        0       187     50        0   100   100    0    0        0        0        0

       0        0       188     50        0   100    99   11    0        0        0        0

       0        0       189     58        0   100   100    0    0        0        0        0

       0        0       190     34        0    56    51   44    0       20       45        0

       0        0       191     50        0   100   100   54    0        0        0        0

       0        0       192     50        0   100   100    0    0        0        0        0

       0        0       193     50        0    96    96  166   34        0        0        0

       0        0       194     34        0    44    49   44    0        0        0       16

       0        0       195     26        0    51    49   62  168       88        4        0

       0        0       196     51        0   100   100   17    0        0        0        0

       0        0       197     18        0   100   100    0    0        0        0        0

       0        0       198     16        0   100   100    0    0        0        0        0

       0        0       199     62        0   200   200    0    0        0        0        0

       0        0       254     50        0   100   100    0    0        0        0        0

       0        0         0      0        0     0     0    0    0        0        0        0

       0        0         0      0        0     0     0    0    0        0        0        0

       0        0         0      0        0     0     0    0    0        0        0        0

       0        0         0      0        0     0     0    0    0        0        0        0

       0        0         0      0        0     0     0    0    0        0        0        0

       0        0         0      0        0     0     0    0    0        0        0        0

       0        0         0      0        0     0     0    0    0        0        0        0

       0        0         0      0      200     2     0  115    3        0        1        0

       2       92         3      0        0     0     0    0    0        0        0        0

       0        0         0      0        0     0     0    0    4        1        1        1

       1        1         1      1        1     0     0    0    0        0        0        0

       0        1         0      0        0     0     0    0    0        0        0        0

      54        0         0      0       33   186   100  101  238       28        0        0

       0        0         0      0        1     0   189    1  172      221      133      205

      35        0         0      0      154    12   230  180  219        1        0        0

       0        0         0      0        0   187    32    0    0        0        0        0

       0        0         0      0      105    36     0    0    0        0        0        0

       0        0         0      0        0     0     0    0    0        0        0        0

       0        0         0      0        0     0     0    0    0        0        0        0

 

Next job is to decode some of this information


January 20, 2012  2:58 PM

SMART disks

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

A question on the forum about using WMI to work with SMART disks got my digging into the subject.  SMART disks – http://en.wikipedia.org/wiki/S.M.A.R.T – detect and report on disk problems (hopefully) before they cause a catastrophe. While vendors’ implementations vary there are some things we can access.

The WMI classes are in the root\wmi namespace

PS> Get-WmiObject -Namespace root\wmi -List MSStorageDriver_Failure* | select Name

Name
—-
MSStorageDriver_FailurePredictEvent
MSStorageDriver_FailurePredictFunction
MSStorageDriver_FailurePredictData
MSStorageDriver_FailurePredictThresholds
MSStorageDriver_FailurePredictStatus

 

The most immediate concern is – what is the status of our disks

function test-diskstatus {            
[CmdletBinding()]            
param (            
 [string]$computername = $env:COMPUTERNAME            
)            
            
Get-WmiObject -Namespace root\wmi -Class MSStorageDriver_FailurePredictStatus -ComputerName $computername |            
select InstanceName, Active, PredictFailure, Reason            
            
}

The InstanceName is long so the best display is list

PS> test-diskstatus | fl


InstanceName   : IDE\DiskST9250320AS_____________________________HP07____\5&b0fd174&0&1.0.0_0

Active         : True

PredictFailure : False

Reason         : 0

 

The PredictFailure is the the important property & we worry when it is true!


January 18, 2012  1:54 PM

WMI associations through CIM cmdlets

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

The CIM cmdlets that introduced in PowerShell v3 give us a different API for working with WMI. We can still work with associations just in a slightly different way.

 

NOTE – this done on a different machine to the previous one so the adapters are different

 

We get the instances of a WMI class like this

Get-CimInstance -ClassName Win32_NetworkAdapter

 

we can filter to a specific instance

Get-CimInstance -ClassName Win32_NetworkAdapter -Filter "DeviceId=7"

 

if we put that in a variable

$nic = Get-CimInstance -ClassName Win32_NetworkAdapter -Filter "DeviceId=7"

 

then we can see all of the associated classes like this

Get-CimAssociatedInstance -CimInstance $nic

 

You might think that we would do this to get a specific associated class

Get-CimAssociatedInstance -CimInstance $nic -Association Win32_NetworkAdapterConfiguration

 

Nope – we don’t just to be different.

We need to back track a minute. When two classes are linked there is normally a linking class (reference) the shows the links. We can see this by running

Get-CimClass -ClassName *NetworkAdapter*

which shows a class Win32_NetworkAdapterSetting

so if we try

PS> Get-CimInstance -ClassName Win32_NetworkAdapterSetting

Element                                                     Setting
——-                                                     ——-
Win32_NetworkAdapter (DeviceID = "0")                       Win32_NetworkAdapterConfiguration (Index = 0)
Win32_NetworkAdapter (DeviceID = "1")                       Win32_NetworkAdapterConfiguration (Index = 1)
Win32_NetworkAdapter (DeviceID = "2")                       Win32_NetworkAdapterConfiguration (Index = 2)
Win32_NetworkAdapter (DeviceID = "3")                       Win32_NetworkAdapterConfiguration (Index = 3)
Win32_NetworkAdapter (DeviceID = "4")                       Win32_NetworkAdapterConfiguration (Index = 4)
Win32_NetworkAdapter (DeviceID = "5")                       Win32_NetworkAdapterConfiguration (Index = 5)
Win32_NetworkAdapter (DeviceID = "6")                       Win32_NetworkAdapterConfiguration (Index = 6)
Win32_NetworkAdapter (DeviceID = "7")                       Win32_NetworkAdapterConfiguration (Index = 7)
Win32_NetworkAdapter (DeviceID = "8")                       Win32_NetworkAdapterConfiguration (Index = 8)
Win32_NetworkAdapter (DeviceID = "9")                       Win32_NetworkAdapterConfiguration (Index = 9)
Win32_NetworkAdapter (DeviceID = "10")                      Win32_NetworkAdapterConfiguration (Index = 10)
Win32_NetworkAdapter (DeviceID = "11")                      Win32_NetworkAdapterConfiguration (Index = 11)
Win32_NetworkAdapter (DeviceID = "12")                      Win32_NetworkAdapterConfiguration (Index = 12)

 

Which is cool – we can see the links

A quicker way to discover this linking class is to do

Get-CimClass -ClassName *NetworkAdapter* -Qualifier "Association"

Now how do we use this link

Get-CimAssociatedInstance -CimInstance $nic -Association Win32_NetworkAdapterSetting

ServiceName      DHCPEnabled      Index       Description
———–      ———–      —–       ———–
netvsc           False            7           Microsoft Virtual Machine Bus …

 

which we know from the output above is the correct link

Same answer as WMI using a WQL query or GetRelated – just a different route


Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: