PowerShell Remoting خاصية من أهم الخواص اللي تميز بيها PowerShell عن غيره من الـ Shells التقليدية. زي ما قولت قبل كده ان خاصية الـ Remoting بتوفر إمكانية تشغيل وتنفيذ أوامر PowerShell او ما يعرف بـ cmdlets على أي جهاز كمبيوتر داخل الـ network بشرط ان يكون PowerShell موجود (Installed) على الكمبيوتر ده.

على الرغم من أن PowerShell Remoting خاصية أكتر من ممتازة، لا يمكن إستخدامها في أي Workgroup environment أو peer-to-peer (P2P) network. يمكن إستخدامها فقط في Domain-Environment أو AD-Environment لأسباب أمنية (Security).

دلوقتي في Windows 7 بقي ممكن إستخدام خاصية الـ Remoting في أي workgroup أو Peer-to-Peer.

ملحوظة: قبل ما أبدء في الشرح يفترض ان يكون عندك 2 كمبيوتر (A,B) عليهم Windows 7  و Windows PowerShell v2 و التأكد من الـ 2 كمبيوتر في نفس الـ IP Add. range، على سبيل المثال الـ IP Address لكمبيوتر A هيكون 192.168.1.10 والـ IP Address لكمبيوتر B هيكون 192.168.1.20.

دلوقتي هنحاول أن احنا نفتح Remote Session من كمبيوتر A إلي كمبيوتر B عن طريق إستخدام أمر Enter-PSSession:

Enter-PSSession 192.168.1.20

هنلاقي أن PowerShell Console طلع Error بيقول ان في مشكلة في الـ WinRM. الموضوع ببساطة ان الـ Remoting بيعتمد على حاجة اسمها Windows Remote Management المسئولة عن إستقبال اي Remote Connection، سبب الـ Error هو ان الـ WinRM Service مقفولة على الـ Windows عشان هي Secure by default لأسباب أمنية.

الخطوة الأولي: تشغيل WinRM على كمبيوتر A و B

لتشغيل WinRM هنستخدم أمر  Set-WSManQuickConfig ، قبل متستخدم الأمر تأكد من:

•  ان ليك Administrative Privileges.
•  أنك عايز تشغل WinRM وقادر علي تأمين جهازك وشبكتك وده عشان الأمر ده بيعمل الآتي:
•  بيتأكد أن WinRM شغالة ولا مش شغالة بيشغلها.
•  بيغير الـ Start mode للـ WinRM Service ويبقي Automatic.
•  بيقوم بإنشاء Listner لإستقبال أي request من أي IP Address. دائما اي request بيتم عن طريق HTTP Protocol.
•  بيعمل Firewall Exception rule للـ WinRM Service عشان يتأكد ان الـFirewall مش هيقفل اي traffic يخص الـ WS-Management.

بمجرد كتابة الأمر Set-WSManQuickConfig و الضغط على Enter لتنفيذه، هتظهرلك رسالة توضح الـ 4 نقاط اللي اتكلمنا عليها

بعد التأكد من تنفيذ الأمر على كمبيوتر A و كمبيوتر B. هنحاول مرة تانية ان نفتح Remote Session من A إلي B عن طريق أمر Enter-PSSession. لكن هيظهر Error تاني بس السبب مختلف المرة دي. أول مرة كان سبب الـError هو ان الـWinRM Service مش شغالة. المرة سبب الـError هو ان الWinRM بترفض (Reject) أي request غير مُأمن بالـ Kerberos او على الأقل يكون بيستخدم نفس الـ Security mechanism أو ان الكمبيوتر اللي بيرسل الـrequest مش موجود في الـtrusted list في الكمبيوتر اللي بيستقبل، و بما أننا  بنستخدم Windows 7 على كمبيوتر A و B يبقي بنستخدم نفس الـ Security mechanism ،يبقي لنا ان الكمبيوتر مش موجود في الـ trusted list. والهدف منها هو التأكد من أن الكمبيوتر المحددة فقط هي المسموح لها بإستخدام خاصية الـ Remoting وليس أي كمبيوتر أخر.

قبل إضافة كمبيوتر B إلي الـ trusted list في كمبيوتر A.

هنستخدم أمر Test-WSMan عشان نتأكد ان على الأقل كمبيوتر A وكمبيوتر B قادرين على فتح Remote Sessions بينهم بغض النظر عن قبول او رفض الـ requests.

Test-WSMan 192.168.1.20

الخطوة الثانية: إضافة كمبيوتر A و B إلي الـ TrustedHosts list

الخطوة رقم 2 هي ان احنا هنعرف الـ WinRM على كل كمبيوتر على الكمبيوتر التاني عشان يسمح بإستقبال أي request لفتح اي remote session عن طريق إضافة الكمبيوتر في الـ trustedhosts list. على سبيل المثال عشان نسمح لكمبيوتر B ان يبعت request إلي كمبيوتر A يبقي لازم نُضيف الـ IP Address لكمبيوتر B في الـtrustedhosts list لكمبيوتر A. ويمكن كتابة “ * ” بدلاً من الـIP Address وفي هذه الحالة سيقوم الـWinRM بإستقبال اي Request من اي كمبيوتر وده بيكون عن طريق الأمر ده:

Set-Item WSMan:\localhost\client\trustedhosts * –force

الخطوة الثالثة: جرب و إستمتع…!!! :)

بعد تنفيذ الخطوة رقم 2 أصبحت خاصية  الـ remoting جاهزة للإستخدام.

Enter-PSSession 192.168.1.20

بعد لحظات من الضغط على Enter لتنفيذ الأمر (الفترة اللي بيفتح فيها الـremote session) هيظهر الـ PS prompt لكمبيوتر B. دلوقتي تقدر تنفذ اي cmdlet على كمبيوتر B من خلال كمبيوتر A عن طريق PowerShell Remoting.

يمكن إستخدام أمر Exit-PSSession عشان تقفل الـRemote Session.

Standardmässig gibt die PowerShell beim dir-Befehl (bzw. Get-ChildItem für Directories) Dateigrössen ohne irgendwelche Zifferngruppierung aus, d.h. ohne Tausendertrennzeichen, welche Dateigrössen jenseits von einigen Megabytes überhaupt erst lesbar machen. Das ist für ein sonst so modernes System eigentlich sehr erstaunlich; das konnte MS-DOS wahrscheinlich schon vor 20 Jahren schon besser!

Eine Abklärung in dieser Sache, welche ich diese Woche gemacht habe, ergab zum Glück das Resultat, dass Abhilfe möglich und sogar recht einfach ist, wenn man weiss wie.

Dieser Artikel in einem Blog namens FatBeard’s Adventures in PowerShell zeigt sehr schön die Grundzüge des Prinzips: Wenn Get-ChildItem seine Objekte der Klasse System.IO.FileInfo zu einer textuellen, kolonnenorientierten Darstellung wandelt, entnimmt es die Informationen, wie genau zu formattieren sei, einem XML-File namens FileSystem.Format.ps1xml in der $PSHOME Directory.

Man kann von einem solchen .ps1xml File eine Kopie erstellen, an dieser Änderungen vornehmen, und dann der PowerShell mit Hilfe des Update-FormatData-Kommandos und dessen Option -prependPath mitteilen, dass die Kopie zuerst zu konsultieren sei. (Am besten nimmt man eine entsprechende Zeile in seine $PROFILE Datei auf.)

Es ist relativ einfach, in besagtem File betreffend Filesystem-Klassen folgenden XML-Abschnitt zu lokalisieren, der für die fragliche Kolonne mit den Filegrössen zuständig ist:

<TableColumnItem>
   <PropertyName>Length</PropertyName>
</TableColumnItem>

… und ihn zu ersetzen durch den folgenden:

<TableColumnItem>
   <ScriptBlock>
      [String]::Format("{0:N0}",$_.Length)
   </ScriptBlock>
</TableColumnItem>

Die Kolonne von jetzt 10 Zeichen, die dann für die verbesserte Darstellung nicht mehr reichen, zu verbreitern auf z.B. 15 Zeichen, ist ebenfalls schnell gemacht.

Wer will, kann natürlich noch weiter gehen, etwas mehr programmieren im SkriptBlock und grosse Zahlen in Einheiten von KB, MB und GB ausgeben. Mir persönlich genügen Dateigrössen hübsch mit Tausendertrennzeichen vorerst. Sehen wir in ein paar Jahren weiter, wenn das Zeitalter der Gigabytes, in dem wir uns heute befinden, abgelöst wird durch das Zeitalter der Terabytes.

It requires some work but it worth it if you have lots of machines to setup.  Click here to study.

I’m working on a server inventory project, and as part of that project, I need to add a field “Monitored” – this field will show either SCOM, Nimbus, No, or N/A.

N/A will mean the server has an exception to monitoring. These servers are in a text file called NonmonitoredServers.txt:

Server098
PRDServer198:PRDServer598
TestServer011:TestServer055

The “:” indicates a range of servers – All servers from PRDServer198 through PRDServer598, TestServer011 through TestServer055 and Server098 have an exception to monitoring.

The length of the server name, before the numeric part varies, so I can’t just do a $server.SubString(9) and expect to strip off only alphabetic characters. So, I do this:

Below powershell helps to pull out all the  secondary email address for the given set of users

Get-Content C:\users.txt|Get-Mailbox | foreach {
for ($i=$_.EmailAddresses.Count;$i -ge 0; $i–)
{
$_.EmailAddresses[$i].ProxyAddressString

if ($_.EmailAddresses[$i].ProxyAddressString  -like “smtp:*” )
{
$_.EmailAddresses.RemoveAt($i)
}

}
$_|set-mailbox
}

Up to version 1.3, we used to have one cmdlet for computer accounts (namely Get-QADComputer) – now we have 6:

• Get-QADComputer
• New-QADComputer
• Set-QADComputer
• Enable-QADComputer
• Disable-QADComputer
• Reset-QADComputer

You can kind of guess what they do by their names, but let’s quickly go through them one by one and give a few quick examples.

• Get-QADComputer

Retrieves AD computer account objects based on the criteria you specify. E.g. (anyone still running Vista? )

Get-QADComputer spb* -OSName 'Windows Vista*' | Format-Table Name, ManagedBy

• New-QADComputer

Creates new computer account in AD (does not join the actual computer though) and sets the attributes you specify:

New-QADComputer -Name 'LAB-SRV3' -SamAccountName 'LAB-SRV3' -ParentContainer 'CN=Computers,DC=lab,DC=local' -Location 'AMS/HQ/Building A'

• Set-QADComputer

Modifies AD computer account properties (can work in bulk when you pipe Get-QADComputer output into this one).

Set-QADComputer 'quest.local/computers/Comp4' -ManagedBy 'QUEST\DSotnikov'

or

Get-QADComputer spb* | Set-QADComputer -Location 'St. Petersburg'

• Enable-QADComputer
• Disable-QADComputer

Enable or disable one or multiple computer accounts:

Enable-QADComputer 'CN=LAB-SRV1,CN=Computers,DC=dom,DC=local'

or

Get-QADComputer -SearchRoot 'dom.local/labComputers' | Disable-QADComputer

• Reset-QADComputer

Reset a computer account in Active Directory. When resetting a computer account, you reset the secure channel between the computer that uses that account to join the domain and a domain controller in the domain.Resetting a computer account breaks that computer’s connection to the domain and requires it to rejoin the domain.

Reset-QADComputer 'CN=LAB-SRV1,CN=Computers,DC=dom,DC=local'

More information can be found in AD cmdlets online reference and PDF guide. Download the new AD cmdlets now and let us know what you think by posting to the AD PowerShell discussion forum!

Source

Today, in VMM, you can open the Administrator Console and click on the Jobs view to see all the Jobs in VMM. When you select an individual job, you can click on the “Change Tracking” tab and view any changes that were recorded in VMM as part of this job.

In this post, i will show you how to do this in PowerShell since it is not as intuitive. Basically, audit trail records that are placed in the change tracking tab are not cached on the client computer by default. the only way to surface them in powershell is to individually invoke the get-job commandlet and pass it the Job parameter while asking for the FULL job to be downloaded. the following powershell script does exactly that and displayed the audit trail records for all jobs in the system.

#get all jobs in the system
$jobs = get-job -all
foreach ($job in $jobs)
{

#get the details including the audit records for each single job in VMM
$singlejob = get-job -job $job -full
$auditrecordsexist = $singlejob | select AreAuditRecordsAvailable
if ($auditrecordsexist)
{

#if any audit records exist, print them out
foreach ($record in $singlejob.AuditRecords)
{
$record
$prev = $record.Previous
$newr = $record.New
$prev
$newr
}
}
}

This script leverages Powershell to automate the sending of a custom email message using Outlook. Simply modify the ‘NewMail.Subject’, ‘NewMail.To’ and ‘NewMail.Body’ values that I’ve used, to adapt it for your purposes. Remember to save this script with the required ‘*.ps1′ extension or it will not work!

‘@
$olMailItem = 0
$olApp = new-object -comobject Outlook.application
$NewMail = $olApp.CreateItem($olMailItem)
$NewMail.Subject = “Testing”
$NewMail.To = “Brian Bernard”
$NewMail.Body = “Verbum sat sapienti.” `
$NewMail.Send()

Here is a Powershell script that I wrote that can automatically delete email messages from Outlook. It will delete any email in your Inbox that matches the From value specified in the Items.Restrict variable, so modify this to your desired Display Name to have it work for you. Remember to save this script with the required ‘*.ps1′ extension or it will not work!

‘@
$olFolderInbox = 6
$o = new-object -comobject Outlook.application
$n = $o.GetNamespace(“MAPI”)
$f = $n.GetDefaultFolder($olFolderInbox)
$Items = $f.Items
$FilteredItems = $Items.Restrict(“[From] = ‘Sanaa Lathan’”)
for ($i = $FilteredItems.Count; $i -gt 0; $i–) {
$FilteredItems.Item($i).Delete()
}

دي الــ Sessions اللي كانت بتتكلم على Windows PowerShell في مؤتمر PDC السنوي.

Building Your Administration GUI over Windows PowerShell

Windows PowerShell: An Automation Toolbox for Building Solutions That Span Small Businesses, Enterprises, and Cloud Services

We all now know that SharePoint 2010 is resource intensive, especially intensive with its ram usage.

I originally installed full blown SharePoint 2010 on my laptop (which has 4gb of ram) only to see most of that ram being used up and none left for visual studio to run.

I would recommend anyone who wants to install it on their workstation that only has 4gb of ram to install SharePoint Foundation instead which needs much less ram and will be fine for simple SharePoint 2010 dev or just playing around.

After I had installed it on my workstation I went on a search of some powershell scripts that I could use to stop SharePoint’s services when its not in use and start them up when needed.

It turns out Emmanuel Bergerat had created some and posted them on his blog, see here –

http://blogs.msdn.com/emberger/archive/2009/11/16/stop-and-go-with-sharepoint-2010-on-your-workstation.aspx

Thanks Emmanuel!

I have modified these scripts to work with SharePoint Foundation instead of full SharePoint Server 2010.

You can find the scripts on my SkyDrive – link at the bottom of the post.

To get them to work you will need to open them and edit the line –

‘MSSQL$SHAREPOINT’,"SQLWriter",’SQLAgent$SHAREPOINT’ | ForEach-Object

You need to change the name of the SQL Service (in my case MSSQL$SHAREPOINT) to the name matching yours. This name will depend on what your SQL instance is called, if you install SharePoint ‘standalone’ then it will most likely be the same as mine.

Run the scripts in the following order –

1. ‘Manual.ps1’ – Sets services to manual startup (Only need to run this once)

2. ‘Start.ps1’ – Starts SQL & SharePoint Foundation services

3. ‘Stop.ps1’ – Stops SQL & SharePoint Foundation services

Hope this helps!

Link: SharePoint Foundation Powershell Scripts

Gregg has recently got stuck into the world of PowerShell – he has posted his first impressions and some good training video links on his blog so take a look here.

Sending email throught command had multiple steps,  now Exchagne 2007 SP2 which works on Powershell V2 has introduced a new cmdlet Send-Mailmessage. Sending email with Send-MailEssage is just single line command Below is the example of the same

Send-MailMessage –From Krishna.k@domain.com –To Rajesh@domain.com –Subject “Send-MailMessage Test” –Body “Send-MailMessage Test”  -Attachments “c:\Attachment.txt” –SmtpServer Hubserver.domain

Powershell check can pull all the Exchange Services status runing on the exchange 2007 Servers

$Exchserver = “<Servername>”
$ExchServices = (gwmi -computer $Exchserver -query “select * from win32_service where Name like ‘MSExchange%’ or Name like ‘IIS%’ or Name like ‘SMTP%’ or Name like ‘POP%’ or Name like ‘W3SVC%’”)
$Services = @()
Foreach ($Service in $ExchServices){
$Service.Caption
$Service.Startname
$Service.StartMode
$Service.State
}

If you have not used Quests AD Cmdlets your missing out on a real treat . Head over to Dmitry’s blog for more information . You will not be disappointed.

http://dmitrysotnikov.wordpress.com/2009/11/25/ad-cmdlets-1-3-rtmed/

They are free and feature rich

Chris

Aufgeschreckt durch diesen Artikel: http://blogs.technet.com/filecab/archive/2009/11/25/windows-7-disk-defragmenter-user-interface-overview.aspx, hat sich folgendes ergeben.

Obwohl ja Windows 7 offiziell den Trim Befehl bei SSD Festplatten unterstützt http://blogs.msdn.com/e7/archive/2009/05/05/support-and-q-a-for-solid-state-drives-and.aspx, ist die Sache wie immer nicht so einfach.

Denn eine SSD muss von Windows 7 erstmal als SSD erkannt werden, sonst wird sie wie eine schnelle Festplatte behandelt. Mit allen Konsequenzen! Z. B. auch eines unnötigen Defragmentierungslauf, der nicht nur die Lebensdauer der SSD verkürzt sondern auch noch gleichzeitig unnötig die Akkulaufzeit eines Notebook oder Netbooks reduziert.

Angeblich soll der Befehl

fsutil behavior query DisableDeleteNotify

0 liefern, wenn der Trim Befehl aktiv ist, oder auch nicht. Durch zum jetzigen Zeitpunkt immer noch nicht verfügbare offizielle Information von Microsoft hat mal wieder Google die Meinungsführerschaft übernommen, so das reih auf und reih ab darüber Spekuliert wird. http://www.hardwareluxx.de/community/showthread.php?t=615540. Witzig auch dieser Forumseintrag: http://social.technet.microsoft.com/Forums/en-US/w7itprohardware/thread/d06e1cb5-d518-447e-b3d6-db2d580899cb. Ein Microsoft-Mitarbeiter verweist auf den obigen Blogeintrag, aber meines Erachtens stimmt da was nicht, denn auch bei einer normalen Festplatte kommt bei DisableDeleteNotify 0 als Ergebnis.

Aber jetzt zu meinem eigentlichen Problem die Defragmentierung. Wie stelle ich zuerst mal fest, ob der Defragmentierungsdienst läuft? Tja liebe Freunde der GUI, Pech gehabt. Seit Windows Vista gibt es so viele Anwendungs- und Dienstprotokolle, dass man Tage mit verbringen kann den richtigen Dienst zu finden. Auch die Möglichkeit Filter zu setzen ist nicht so der schnelle Bringer.

Aber als neuer bekennender Fan von Powershell, erledigen wir die Sache kurz mal damit:

Get-EventLog System | Sort-Object TimeGenerated | Where-Object {$_.Message –like "*defrag*"} | fl

Dieser Befehl gibt die neuesten Einträge als letztes aus. Nun weiß man also wann in der Richtung das letzte mal was passiert ist.

Da getreu dem Motto von Windows 7 mit den Triggered Events nur das laufen soll, was benötigt wird, läuft der Defragmentierungsdienst auch nicht immer.

Um nun das Defragmentieren zu Unterbinden, sucht man in der Aufgabenplanung den Defrag-Eintrag. Man hat nun die Option den Eintrag komplett zu löschen, zu deaktivieren oder beim Aufruf von Defrag.EXE mit dem Parameter /E eine Ausnahme für das betreffende Laufwerk anzugeben. Wie es einem beliebt.

Bleibt noch die Frage, ob an Defrag noch weitere Dinge kleben, die durch die Ausnahme nun nicht mehr funktionieren, mal sehen.

Inspiriert durch einen Vortrag von Dr. Tobias Weltner auf einer Microsoft Veranstaltung in Karlsruhe, hatte ich die Gelegenheit mir die neuen Möglichkeiten des Remoting in Powershell 2.0 anzusehen.

Als ich nun meine ersten Gehversuche in Powershell machte, brauchte ich Spieldaten. Da bietet sich natürlich die Eventlog an.

Als erstes wurde

Get-Eventlog System

ausgeführt. Dieser Befehl listet nun alle Eventlog Einträge auf. Das kann dann schon mal dauern…

Schnell war klar da muss ein Filter her. Also mal kurz gegooglet:

http://www.google.de/search?q=powershell+get-eventlog+filter

Zu Tage kam Ralf Schnells Blogeintrag: http://blogs.technet.com/ralfschnell/archive/2009/08/12/abfrage-von-eventlog-eintr-gen-mit-powershell.aspx

Dort war die Rede vom where-Object mit Bedingung.

Da hab ich dann gleich mal gelernt, dass man sich nicht auf die Spaltenüberschriften verlassen kann, denn die werden einfach gekürzt! So ist z. B. bei Aufruf von

Get-EventLog System –Newest 1

bei der Zeitausgabe als Überschrift Time zu lesen. Aber man kann mit Time nachher nichts anfangen, denn es steckt eigentlich TimeGenerated dahinter.

<KleineSpitze>
So weit so gut, aber das was Herr Schnell nun versucht und in einem Kommentar auf Powershell V1 bzw. V2 oder XP, Vista oder Windows 7 Unzulänglichkeiten zu schieben versucht, hätte ich von vielen erwartet aber nicht von einem Microsoft Mitarbeiter der MCP, MCSE, MCSA, MCT und ITIL Service Manager zertifiziert ist. So macht man seine eigenen Produkte schlecht!
</KleineSpitze>

Um nun also die Daten korrekt verarbeiten zu können muss man also den Typ von TimeGenerated rausfinden. Diesen bekommt man schön durch

Get-EventLog System –newest 1 | Get-Member

aufgelistet. Falls es mal zuviele werden sollten, kann man gezielt nach einem suchen:

Get-EventLog System –newest 1 | Get-Member | Where-Object {$_.Name –like "time*"}

Dort ist nun bei Definition die Rede von System.DateTime. Da Powershell auf dem .Net-Framework aufsetzt und alles ja Objekte sind, hat man von da ausgehend alle Möglichkeiten: http://msdn.microsoft.com/en-us/library/system.datetime.aspx

Man kann nun also durch

Get-EventLog System | Where-Object {$_.TimeGenerated.Month –eq 11 –and $_.TimeGenerated.Year –eq 2009}

alle Eventlog-Einträge aus dem November 2009 anzeigen lassen.

Quite often, I see questions like “Why is my Get-Recipient command so slow?”, with a syntax like:

You would think that would work lickity split, because there is only 1 result, me.

Ah, not so fast, grasshopper.  We are doing client side filtering – all recipients are returned by the Get-Recipient call, and THEN we pass those objects to the Where-Object.

On my Exchange 2007 system, this takes over a minute to return my information in $user1

So, I did some research, and read about –Filters and doing server side filtering:

http://blogs.technet.com/evand/archive/2007/02/19/filterable-properties-in-exchange-2007-rtm.aspx and http://technet.microsoft.com/en-us/library/bb738155.aspx

Modifying my script to use the –Filter produces results in less than 1 second:

I suggest that you check for the –Filter parameter for any cmdlet that you use, and learn its syntax!

Late last week we released to the web the latest version (1.3) of our free Active Directory cmdlets (also known as QAD-cmdlets, widely used by tens of thousands admins and compatible with more or less any version of Active Directory or ADAM/ADLDS).

You can read more about the cmdlets in this PDF guide, or online reference.

This is a significant update with some 14 new cmdlets, 24 new parameters, 43 enhanced ones, and a few bugs fixed (not that we had any really )

Detailed What’s New information can be found on page 19 of the PDF guide and in my upcoming blog posts. Download the new AD cmdlets now and let us know what you think by posting to the AD PowerShell discussion forum!

Recently I’ve had to create 100+ distribution lists at the same time. Each with a different owner. Rather than create each individual one at a time, I figured I’d throw together a quick Powershell script. It’s a very simple script for those who’re used to scripting languages but it’s my first without help and it just plain works. So I’m happy with it. Note however, you will need the Active Directory PowerPack to create DLs. We are running Exchange 2007 at my work so I also needed Microsoft Exchange Server 2007 SP1 Management Pack to create email enabled DLs.

$file = Import-Csv r:\Test.csv
foreach ($entry in $file) {
$null = New-DistributionGroup -name $entry.name -SamAccountName $entry.SamAccountName -type Distribution -ManagedBy $entry.owner -OrganizationalUnit $entry.Location
Set-QADGroup -Identity $entry.Name -Description ("Owner: " + $entry.owner)
Add-ADPermission -Identity $entry.Name -User $entry.owner -AccessRights "WriteProperty" -ExtendedRights "Self-Membership" -Properties Member -InheritanceType None
}

The greatest thing about Powershell is the logic just makes sense. In line 3, “-name $entry.name” calls to the CSV column named appropriately name. This corresponds directly to Display Name. SamAccountName corresponds to Pre-Windows 2000 name. The rest are self explanatory. See an example of the CSV below.

Time to learn some more basics.  In our last tutorial we looked at some of the special variables given to us within Powershell, but now it’s time to discuss how user variables work.  Let’s start off simply.

$var1 = ‘blahblahblah’

echo $var1

By using the $ before the word var1 we’ve created a variable.  Using the equal sign we are able to set this variable to the string ‘blahblahblahblah’.  Powershell is a very dynamic language in that it allows you to create and assign variables without casting them to a data type.  This can be a double-edged sword so it’s a good idea to understand how this can cause problems.  Take the following for example:

$var1 = 5

$var2 = “blah”

echo ($var1 + $var2)

Here we are trying to use a number (it’s a number because there are no quotes) and a string (it’s a string because it has quotes) with the + operator.  If they were both strings this would concatenate them.  If they were both Int32 they would add them together.  Because they are different we get an error that “blah” cannot be converted to Int32.  Powershell is extremely flexible with its data types.  Since the .net implementation of the Int32 class and the string class have Converto() functions the script will attempt to automatically convert the variable to the type expected by the operation.  In the above example the first variable is an Int32 so it assumes you are trying to add another number to this one.  If we reverse this and start with the string and use the + sign the compiler sees the first variable as a string and expects to concatenate.  Since an Int32 can easily be converted to a string reversing the operation works without failure:

$var1 = 5

$var2 = “blah”

echo ($var2 + $var1)

You can also call a conversion through the .Net methods available to the data type.  For example returning to our original problem code you can successfully do the following to ensure that the Int32 is interpreted as a string:

$var1 = 5

$var2 = “blah”

echo ($var1.tostring() + $var2)

Another way to get around this problem is to explicitly cast the variable to what you want it to be.  This is done with [] brackets before the variable:

[string]$var1 = 5

$var2 = “blah”

echo ($var1 + $var2)

Before we end this portion of the tutorial it’s important to discuss one more item, interpolation.  Powershell uses the same methods for interpolation that Perl uses.  If it’s in a double quote it will be interpolated.  If it’s in a single quote it is a string literal.  In both cases it is a string, but it’s how the string handles variables inside its quotes that makes them different.  The following illustrates this:

$var1 = ‘blahblahblah’

echo “This is what my variable is set to: $var1″

echo ‘This will not work: $var1′

We have now learned the basics of what Perl calls a scalar variable.  In the next tutorial we will discuss arrays.

I had a need to get distribution group members for a specific group. Most people seem to install the free “ActiveRoles Management Shell for Active Directory” from Quest Software when they are facing a task such as this.

With the Quest “ActiveRoles Management Shell”, you can do this like “Get-QadGroupMember <group name>–Indirect”

I’m kind of contrary, and so I wanted to do the same thing with the Exchange Management Shell that came with our Exchange 2007 installation. So, I created the script shown here. Save it as get-exgrouprecurse.ps1.

Run it as:

get-exgrouprecurse -group <group name>

or get-exgrouprecurse <group name>

Here is how you would restore a mailbox after the Store has been mounted. It would restore into someone else account under the ‘restore’  folder:

My past couple of posts have looked at PowerShell ISE and described a few aspects of the Script and Command panes, with a brief mention of the Output pane.

Now I’d like to address some noteworthy aspects of the Output pane.

One of the natural habits I have developed when working with PowerShell is to run Start-Transcript before I get into any new work. The transcription feature has been a part of PowerShell since version 1.0. Having a transcript of the commands I’ve typed as well as the output from the shell can be used in auditing, peer review and training, documentation, and script development. It’s almost hard to imagine using transcripts – the same would be true of history. In fact, if I have forgotten to run Start-Transcript before I get into script development, as often happens with the realization that what the previous few commands have done would be even better in a script, and with prototyping, my quick remedy is to run Start-Transcript and then immediately follow-up with a good dose of Get-History. That way everything I’ve done recently is in the transcript, well at least the commands but not the output.

I panicked when I first found out that the PowerShell ISE console host does not support transcription! If you type Start-Transcript in PowerShell ISE, you get an error to this effect. Then I took a deep breath and it dawned on me: I’m in an integrated scripting environment. It’s not quite the same, but has it’s own form of power.

Consider the following sequence.

<Ctrl>+N    – creates a new script document tab

<Ctrl>+<Shift>+O    – navigates to the Output pane

<Ctrl>+A    – selects all of the commands and output in the Output pane

<Ctrl>+C    – copies the whole Output pane contents

<Ctrl>+I    – navigates to the Script pane

<Ctrl>+V    – pastes the Output pane contents into the Script pane

<Ctrl>+S    – initiates saving the output

Remember: nOacivs (or Oacnvs, etc.) It just rolls off the fingertips after you’ve done it many times. But what does this sequence do? Because the Output pane contains each Command that has been typed during this PowerShell ISE session and the resulting output, it’s quite similar to the transcript output, although not automatic. But this kind of taking some commands and output from the session is up-front and explicit. It’s not as hidden in the background, thereby it’s more clear what needs to be done in separating the wheat from the chaff. You can carefully choose what parts of the recent interactive sequence you want for one or more scripts.

Then, once you’ve culled together parts of scripts in this way, the real fun begins, and PowerShell ISE is there to support you – the debugging of scripts. We’ll come back and revisit PowerShell ISE later to discuss that story.

Related Course

Automating Windows Server 2008 Administration with Windows Powershell (M6434)

Remember that weird Windows IT Pro contest in which they put PowerGUI against gmail, iTunes, and a thousand other free and open source products?

Well, the funniest part is – thanks to your support – we won the silver award in that huge category!

Here’s what the magazine had to say (and with which I happily agree!):

“There are a lot of PowerShell scripting and GUI tools on the market these days, but PowerGUI remains one of the best, and it’s free!” —Jeff James, editor in chief, Windows IT Pro

And my congratulations to 14 other product teams from Quest winning in multiple other categories – great job by everyone and a reminder of the comprehensiveness of the product set we have here:

In Windows It Pro’s Community Choice Awards:

• Gold for Authentication Services (Best Interoperability Product),
• Silver for Group Policy Manager/GPOAdmin^® (Best Active Directory and Group Policy Product),
• Bronze for ChangeAuditor^® (Best Auditing and Compliance Product).

Quest’s database management solutions received SQL Server Magazine Editors’ Best Awards recognition in two categories:

• Best Backup & Recovery (SQL Server) Product: LiteSpeed^® for SQL Server (Gold)
• Best Development SQL Server Tool: Toad^® for SQL Server (Gold)

Quest also was recognized by the editors at Windows IT Pro in the following categories:

• Best Free or Open Source IT Tool: PowerGUI^™ (Silver)
• Best Auditing & Compliance Product: ChangeAuditor^® (Silver)
• Best Interoperability Product: Authentication Services (Bronze)
• Best Systems Management Product: GPOAdmin^® (Bronze)

Quest’s Windows management products also received nods from the readers of Redmond and SQL Server Magazine. In the Redmond Readers’ Choice Awards:

• Quest Migration Manager received both the “ISV Winner” and “Preferred Product” in the Best Migration Product category.
• Quest Defender was recognized as a “Preferred Product” in the Best Smart Card/Biometric/Two-Factor Authentication System category.

SQL Server Magazine and Windows IT Pro’s Community Choice Awards named:

• Site Administrator for SharePoint the gold award winner for Best SharePoint Product.

SQL Server Magazine’s Community Choice Awards gave:

• Quest’s Foglight^® Performance Analysis for SQL Server the silver for Best Database Monitoring and Performance Products, and
• Spotlight^® on SQL Server Enterprise was named a “Preferred Product” by Redmond Readers’ Choice Awards.