http://technet.microsoft.com/en-us/library/hh831568.aspx

Now can we do anything similar with PowerShell.

Get-Service doesn’t do anything to help BUT the Win32_Service class has a ProcessID property that we can use

Get-CimInstance -ClassName Win32_Service |             
sort ProcessID -Descending |            
foreach {            
  $proc = Get-Process -Id $_.ProcessID            
  $_ | Add-Member -MemberType NoteProperty -Name ProcessName -Value $($proc.ProcessName) -PassThru            
} |            
Format-Table DisplayName, ProcessName -GroupBy ProcessId

I’ve used Get-CimInstance in this example because of the CIM cmdlets are new to PowerShell v3. For a PowerShell v2 install use Get-WmiObject

Get-WmiObject -Class Win32_Service |             
sort ProcessID -Descending |            
foreach {            
  $proc = Get-Process -Id $_.ProcessID            
  $_ | Add-Member -MemberType NoteProperty -Name ProcessName -Value $($proc.ProcessName) -PassThru            
} |            
Format-Table DisplayName, ProcessName -GroupBy ProcessId

The WMI objects are piped through sort & into foreach where we add the process name. In both cases I’ve used Get-Process – either Get-CIMInstance or Get-WmiObject using the Win32_Process class could be used instead.

Format-table is used with GroupBy to produce a nicely formatted report. This information is important because it shows the services that are related to a particular process and the impact if that process fails..

Get-WmiObject Win32_AutochkSetting

The useful output is

Caption          :
Description      :
SettingID        : Microsoft Windows 7 Ultimate |C:\Windows|\Device\Harddisk0\Partition2
UserInputDelay   : 10

Be careful with the documentation because it states that SettingID holds the date and time of installation! 

I’ve made the output a bit easier to understand

$acs = Get-WmiObject -Class Win32_AutochkSetting             
$setting = $acs.SettingID -split "\|"            
New-Object -TypeName PSObject -Property @{            
  OS = $setting[0]            
  Path = $setting[1]            
  Disk = $setting[2]            
  'Delay(s)' = $acs.UserInputDelay            
}

This piece of VBScript is borrowed from the Windows 2000 scripting guide

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colSettings = objWMIService.ExecQuery _
("SELECT * FROM Win32_OperatingSystem")
For Each objOperatingSystem in colSettings
Wscript.Echo "OS Name: " & objOperatingSystem.Name
Wscript.Echo "Version: " & objOperatingSystem.Version
Wscript.Echo "Service Pack: " & _
objOperatingSystem.ServicePackMajorVersion _
& "." & objOperatingSystem.ServicePackMinorVersion
Wscript.Echo "OS Manufacturer: " & objOperatingSystem.Manufacturer
Wscript.Echo "Windows Directory: " & _
objOperatingSystem.WindowsDirectory
Wscript.Echo "Locale: " & objOperatingSystem.Locale
Wscript.Echo "Available Physical Memory: " & _
objOperatingSystem.FreePhysicalMemory
Wscript.Echo "Total Virtual Memory: " & _
objOperatingSystem.TotalVirtualMemorySize
Wscript.Echo "Available Virtual Memory: " & _
objOperatingSystem.FreeVirtualMemory
Wscript.Echo "OS Name: " & objOperatingSystem.SizeStoredInPagingFiles
Next

It uses the Win32_OperatingSystem class to display information about the computers OS. As you can see the bulk of the script is concerned with formatting. Note the error in the script regarding OS Name

What often happens is that this will be translated directly, line by line, into PowerShell – which gives us something like this

$strComputer = "."            
            
$colSettings = Get-WmiObject -Query "SELECT * FROM Win32_OperatingSystem" -ComputerName $strComputer            
foreach ($objOperatingSystem in $colSettings){            
 Write-Host "OS Name: "  $objOperatingSystem.Name            
 Write-Host "Version: "  $objOperatingSystem.Version            
 Write-Host "Service Pack: "  $objOperatingSystem.ServicePackMajorVersion "." $objOperatingSystem.ServicePackMinorVersion            
 Write-Host "OS Manufacturer: "  $objOperatingSystem.Manufacturer            
 Write-Host "Windows Directory: "  $objOperatingSystem.WindowsDirectory            
 Write-Host "Locale: "  $objOperatingSystem.Locale            
 Write-Host "Available Physical Memory: "  $objOperatingSystem.FreePhysicalMemory            
 Write-Host "Total Virtual Memory: "  $objOperatingSystem.TotalVirtualMemorySize            
 Write-Host "Available Virtual Memory: " $objOperatingSystem.FreeVirtualMemory            
}

This is less code but still seems like a lot of work

lets put it into PowerShell as if we had written it from scratch

$strComputer = "."            
            
Get-WmiObject -Class Win32_OperatingSystem -ComputerName $strComputer |            
select Name, Version, ServicePackMajorVersion, ServicePackMinorVersion,            
Manufacturer, WindowsDirectory, Locale, FreePhysicalMemory,             
TotalVirtualMemorySize, FreeVirtualMemory

Now that is much easier. Quicker to code and easier to understand.

By all means use VBscripts as references for using WMI classes (I do) but re-write into PowerShell its much, much easier.

This isn’t a contradiction of my previous post as I advocated leaving legacy VBScript alone until you needed to  modify it

net time /querysntp

which displays the name of the Network Time Protocol (NTP) server currently configured for the local computer or the one specified in ComputerName.

Unfortunately /querysntp  has been deprecated in later versions of Windows.

In a domain we normally configure client and server machines to use the domain time synchronisation hierarchy rather than an external time source (the exception to this is the PDC emulator FSMO role holder in the root domain which is the top of hierarchy and synchronises externally)

Our test then should be to see if we are using a domain time synchronisation source or external. This information is held in the registry.

We need to look in HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\parameters.

The Type property tells us if we are using domain synchronisation (NT5DS) or and external server (NTP). The server( s ) are held in the NTPserver property.

We can amend our basic data function to read these registry keys

function get-basicdata{             
[CmdletBinding()]             
param (             
   [string]$computer="localhost"             
)             
BEGIN{}#begin             
PROCESS{            
            
Write-Verbose "Get Operating System"            
$os = Get-WmiObject -Class Win32_OperatingSystem -ComputerName $computer            
            
Write-Verbose "Get Computer System"            
$comp = Get-WmiObject -Class Win32_ComputerSystem -ComputerName $computer            
            
Write-Verbose "Get IP Address"            
$ip = Test-Connection -ComputerName $computer -Count 1            
            
Write-Verbose "Read registry entry"            
$HKLM = 2147483650 #HKEY_LOCAL_MACHINE            
            
$reg = [wmiclass]"\\$computer\root\default:StdRegprov"            
$key = "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\rdp-tcp"            
$value = "MinEncryptionLevel"            
$minlvl = $reg.GetDwordValue($HKLM, $key, $value)  ## REG_DWORD            
            
Write-Verbose "Create Object"            
$obj = New-Object -TypeName PSObject            
$obj |            
Add-Member -MemberType NoteProperty -Name OperatingSystem -Value $($os.Caption) -PassThru |            
Add-Member -MemberType NoteProperty -Name ServicePack    -Value $($os.CSDVersion) -PassThru |            
Add-Member -MemberType NoteProperty -Name Version       -Value $($os.Version) -PassThru |            
Add-Member -MemberType NoteProperty -Name Domain       -Value $($comp.Domain) -PassThru |            
Add-Member -MemberType NoteProperty -Name Name       -Value $($comp.Name) -PassThru |            
Add-Member -MemberType NoteProperty -Name IPv4Address -Value $($ip.IPV4Address.IPAddressToString) -PassThru |            
Add-Member -MemberType NoteProperty -Name MinEncrypt -Value $($minlvl.uValue)            
            
Write-Verbose "Read registry time entry"            
            
$key = "SYSTEM\CurrentControlSet\Services\W32Time\Parameters"            
            
$value = "Type"            
$type = $reg.GetStringValue($HKLM, $key, $value)  ## REG_SZ            
            
$value1 = "NtpServer"            
$NTPserver = $reg.GetStringValue($HKLM, $key, $value1)  ## REG_SZ            
            
switch ($type.svalue){            
 "NTP"  { $obj |            
          Add-Member -MemberType NoteProperty -Name TimeType -Value "External Server" -PassThru |            
          Add-Member -MemberType NoteProperty -Name TimeServer -Value $($NTPServer.svalue)            
         }            
 "NT5DS" { $obj |            
           Add-Member -MemberType NoteProperty -Name TimeType -Value "Domain" -PassThru |            
           Add-Member -MemberType NoteProperty -Name TimeServer -Value ""            
         }            
}            
            
$obj            
            
}#process             
END{}#end            
            
}

A switch statement is used to test the value of Type and the appropriate data is add to the object.

As before use

get-basicdata        

to generate output to screen or something like this

   get-basicdata | out-file basicdata.txt   

to create an output file

The batch file retrieves service information using

wmic service where state="Running" get DisplayName, Caption

Direct PowerShell translation is this.

Get-WmiObject -Class Win32_Service -Filter "State=’Running’" | Select DisplayName, Caption

Couple of problems:

1. DisplayName and Caption tend to show the same output
2. What about services that aren’t running? A major problem could be resolved if you realised a service that should be running has stopped.

Lets change the WMI to

Get-WmiObject -Class Win32_Service | sort State | Select State, Name, Caption

When we create our function we can add a switch to restrict output to just running services if required

function get-servicestate{             
[CmdletBinding()]             
param (             
   [string]$computer="localhost",            
   [switch]$running             
)             
BEGIN{}#begin             
PROCESS{            
            
Write-Verbose "Get Services"            
$services = Get-WmiObject -Class Win32_Service -ComputerName $computer            
            
if ($running){            
  $services | where{$_.State -eq "Running"} | Select Name, Caption            
}            
else {            
  $services | sort State | Select State, Name, Caption            
}            
            
}#process             
END{}#end            
            
}

By fetching all of the service information we allow ourselves the ability to easily modify the output if requirements change

I decide to convert the batch file to PowerShell.  The first part uses a number of basic Windows commands to generate data. This function supplies exactly the same functionality

function get-basicdata{             
[CmdletBinding()]             
param (             
   [string]$computer="localhost"             
)             
BEGIN{}#begin             
PROCESS{            
            
Write-Verbose "Get Operating System"            
$os = Get-WmiObject -Class Win32_OperatingSystem -ComputerName $computer            
            
Write-Verbose "Get Computer System"            
$comp = Get-WmiObject -Class Win32_ComputerSystem -ComputerName $computer            
            
Write-Verbose "Get IP Address"            
$ip = Test-Connection -ComputerName $computer -Count 1            
            
Write-Verbose "Read registry entry"            
$HKLM = 2147483650 #HKEY_LOCAL_MACHINE            
            
$reg = [wmiclass]"\\$computer\root\default:StdRegprov"            
$key = "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\rdp-tcp"            
$value = "MinEncryptionLevel"            
$minlvl = $reg.GetDwordValue($HKLM, $key, $value)  ## REG_DWORD            
            
Write-Verbose "Create Object"            
$obj = New-Object -TypeName PSObject            
$obj |            
Add-Member -MemberType NoteProperty -Name OperatingSystem -Value $($os.Caption) -PassThru |            
Add-Member -MemberType NoteProperty -Name ServicePack    -Value $($os.CSDVersion) -PassThru |            
Add-Member -MemberType NoteProperty -Name Version       -Value $($os.Version) -PassThru |            
Add-Member -MemberType NoteProperty -Name Domain       -Value $($comp.Domain) -PassThru |            
Add-Member -MemberType NoteProperty -Name Name       -Value $($comp.Name) -PassThru |            
Add-Member -MemberType NoteProperty -Name IPv4Address -Value $($ip.IPV4Address.IPAddressToString) -PassThru |            
Add-Member -MemberType NoteProperty -Name MinEncrypt -Value $($minlvl.uValue)            
            
$obj            
            
}#process             
END{}#end            
            
}

All we do is make a few calls to WMI classes and we get the results into an object as shown.

To produce a file use

The contents look like this

OperatingSystem : Microsoft Windows 7 Ultimate

ServicePack     : Service Pack 1

MinEncrypt      : 2

That covers the basic data.  Need to look at services and TCP ports next

ComputerName     : RSLAPTOP01
EventIdentifier  : 19
InsertionStrings : {Security Update for Microsoft .NET Framework 4 on  Windows XP, Windows Server     2003, Windows Vista, Windows 7, Windows Server 2008, {ac2a295d-228e-4941-8568-ff131f842920}, 105}

Logfile          : System
Message          : Installation Successful: Windows successfully installed the following update: Security Update for Mi                 crosoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008 x86 (KB2446708)

This is fairly typical in that it shows something that has changed and could therefore affect system reliability. Which logs are involved.  On my system

PS> Get-WmiObject Win32_ReliabilityRecords | select Logfile -Unique

Logfile
——-
System
Application

As we are talking about event logs they have to have a source

PS> Get-WmiObject Win32_ReliabilityRecords | select SourceName -Unique

SourceName
———-
Microsoft-Windows-WindowsUpdateClient
Application Error
MsiInstaller
Microsoft-Windows-UserPnp
Application Hang
Application-Addon-Event-Provider
EventLog

If we want to see the events related to a particular source then we can do this

PS> Get-WmiObject -Class Win32_ReliabilityRecords -Filter "SourceName=’Application Hang’" | Format-Table TimeGenerated, ProductName, Message –wrap –AutoSize

What we really need is a function to wrap the choices so we just choose parameters. Thats what we’ll do next

We have seen how to discover the available restore points.  What about creating one.

We need to use [wmiclass] to create a new instance of the SystemRestore class. We can then use the CreateRestorePoint method with the description we’ve input as a parameter. The other paarmeters define it as an application install and begin system change respectively. This are generic enough to be left as is.  They can be made parameters if required