Business and Information Technology Tangents » Powershell Tangents

System Center Configuration manager (SCCM) 2007 R3 – Device Discovery Issue / Health Check script

brentblawat — Wed, 18 Apr 2012 21:42:59 +0000

By: Brenton Blawat

A large hospital recently had been experiencing issues with their SCCM Server replication and SCCM Remote Console. Initially, they started to notice slow package replication which quickly expanded to the following list:

SCCM 2007 Remote Console Loading Slowly
SCCM 2007 Remote Console Not Connecting to Remote Clients
SCCM 2007 Packages Taking Hours for Replication
SCCM 2007 ‘My’ Computer freezing on server / drive not accessible
SCCM 2007 Explorer Crashes on Central Server / Cannot View Inboxes\Auth\

SCCM Configuration

The hospital, with over 12,000 computers, hosted a central server and two primary child sites (as shown above). These servers are all Windows Server 2008 R2 servers and had been running functionally since February of 2012. Site_101 and Site_102 were both configured to replicate their record sets to the central server.

Please note that there is an additional WDS deployment server which is not shown in the above image as it is irrelevant to this discussion.

SCCM issue: Device Discovery Records build-up

After a bit of research, it was determined that the issues above had to do with the configuration of the Discovery Methods. Site_100, Site_101, and Site_102 were configured to perform full Active Directory System Discoveries (DDR Record Generation) every 5 minutes (relevant to their respective AD hierarchy).

In the hospital’s case, the (DDR) records were being created by the two children sites and pushed up to the Central Server. The Central Server had to #1 process its own device discovery records, #2 process Site_101 and Site_102 discovery records. The Central Server could not process the DDRs as fast as they were being generated. Subsequently, the directory started to fill up with old device discovery information. By the time the device discovery record issue was discovered, the %drive%\Program Files (x86)\Microsoft Configuration Manager\inboxes\auth\ddm.box\ inbox had almost 22.1 million device discovery records.

The build up of files had the following effects on the server:

Disk Contention – Files were being written and deleted (delete is a disk write as well!) causing the disk queue to be in the upwards of 200 operations. This simply crippled the use of that RAID drive which affected all SCCM components rendering the Central Server useless.
Windows Indexing Issues – Due to the mere number of files (22.1 million), in addition to keeping track of those being added / removed, the indexing service could not keep up with the operations of the server. This was the cause of Windows Explorer to hanging and crashing as it was attempting to index the files.

The Resolution

To resolve the issue, the server was restarted in safe mode and the ddm.box was renamed to ddm.box.old. The files in ddm.box.old should have been deleted at that point, however, due to the number of files, it would have extended the outage. To return operations of the SCCM Central server, the server was restarted and the deletion was done outside of safe mode.

After the reboot completed, the Discovery Methods were immediately adjusted to the following:

Central Server Site_100 Device Discovery was turned OFF – The Central Server was purposed for only reporting and configuration of packages. The child will provide the device discovery records to the Central Server.
Site_101 Reconfigured – The full device discovery methods of the respective active directory OUs were adjusted to once a day at 12:00am (outside of the backup window). Delta discoveries have been enabled for every 30 minutes.
Site_102 Reconfigured – The full device discovery methods of the respective active directory OUs were adjusted to once a day at 11:00pm (outside of the backup window). Delta discoveries have been enabled for every 30 minutes.

To delete the files in the ddm.box.old directory the following was performed:

Disable AV Scanning of Inboxes- Symantec Endpoint Protection was scanning all files on the server. A directory exclusion of %drive%\Program Files (x86)\Microsoft Configuration Manager\inboxes\ was created to optimize operations on the server (and help with the deletion process)
Batch Deletion of Files– Unfortunately, Windows Explorer could not delete the files from the directory. Even when indexing is turned off, it will index the files prior to deletion.
- Created a new .bat file changing the directory to %drive%\Program Files (x86)\Microsoft Configuration Manager\inboxes\auth\ddm.box\
- Issued the following command del *.* /f/s
- This command took 5 days to execute.
Defragmentation of the drive – After the deletion, the SCCM drive had 28% fragmentation and a disk defragmentation was run.

Preventing and Monitoring the Issue

In order to monitor further file backups on the server, a new PowerShell script was created to monitor files. The script can be found here: PowerShell Script – SCCM 2007 Health Check

This script is designed to run in two modes:

Morning General Health Status – To report warning level and critical level errors.
Hourly Health Check – To report only critical level errors.

This script is used along with Task Scheduler which executes these programs on intervals. Please note that it was determined that if the file level for the hospital’s environment that anything over 20,000 files constitutes a critical error OR if a service is not running as expected.

PowerShell Script – SCCM 2007 Health Check

brentblawat — Wed, 18 Apr 2012 21:34:41 +0000

By: Brenton Blawat

System Center Configuration Manager 2007 is an extremely powerful tool that, when configured correctly, will provide deployment and reporting capabilities for your organization. As explored in a previous article (located here), there are situations where a health check is helpful to ensure stability of the SCCM 2007 servers.

The below PowerShell Script was designed to perform two operations:

Morning Report – To run as a scheduled task in the morning and email a distribution group (or individual email) if anything is potentially going wrong. (Warning Level to Critical Levels).
Hourly Status Check – To run as a scheduled task every hour and email a distribution group (or individual email) if anything is Critically wrong. (Critical Level Only).

The script performs the following at a high level:

Loads the SCCM.XML File
Determines from the SCCM.XML file where SCCM is installed.
Using the SCCM.XML File, reads through the unique ID’s under the ‘filecheck’ and determines the file count for those directories.
Using the SCCM.XML File, reads through the unique ID’s under the ‘servicecheck’ and determines the startup state, and running state of the services required for SCCM.
Sends an email to the specified address with any warning or critical messages.

To run the script and Email Warning AND Critical Messages:

(What we use every 7am in the morning)

powershell.exe directory\sccm_health.ps1 –reporttype “MorningReport”

To run the script and Email Critical Messages:

(What we use every hour at the top of every hour)

powershell.exe directory\sccm_health.ps1

To send all results regardless of report type:

Modify SCCM_Health.ps1 line 18 to be if (-not $debug) { $debug = 1 }

Alternatively you can run:

powershell.exe directory\sccm_health.ps1 –debug 1

PowerShell Code SCCM 2007 Health Check

Download Code

   1:  ###############################################

   2:  ## SCCM 2007 R3 HEALTH CHECK

   3:  ##

   4:  ## By: Brenton Blawat

   5:  ## Website Reference: Http://www.bittangents.com

   6:  ##

   7:  ##

   8:  ## Please note that sccm.xml needs to be in the same directory as this script.

   9:  ##

  10:  ## Please also note that `r`n means "return -- new line" for the email formatting.

  11:  ##

  12:  ###############################################

13:

  14:  # Take any input triggers as the report type MorningReport

  15:  param($reporttype,$debug)

16:

  17:  #To Turn On Debugging Level Emails Change From 0 to 1 or use the above trigger

  18:  if (-not $debug) { $debug = 0 }

19:

  20:  # If the report does not contain the following triggers, only output the debugging level and/or on Critical Issues.

  21:  if ($reporttype -notcontains "MorningReport") {

  22:      $reporttype = ""

  23:  }

24:

  25:  #Get Computer Name For Email Generation

  26:  $CmpName = [System.Net.DNS]::GetHostName()

27:

  28:  #Function to create a new email

  29:  function send-email { param($emailFrom,$emailTo,$subject,$body)

  30:      #Specify the Server Name

  31:      $smtpServer = "Your.Fully.Qualified.Email.Server"

  32:      #Setup the Email Connection Object

  33:      $smtp = new-object Net.Mail.SmtpClient($smtpServer)

  34:      #Send the Email as Specified

  35:      $smtp.Send($emailFrom, $emailTo, $subject, $body)

  36:  }

37:

  38:  # This function will count the files in the directories specified in the XML document.

  39:  Function get-filecount { param($inbox, $directory)

  40:      # Generate the count of the child item.

  41:      $count = (Get-Childitem $directory).count

42:

  43:      # If the Count is less than 1000 AND

  44:      # If the script is being run as a MorningReport or in debug mode Return Informational.

  45:      If ($count -lt 1000) { if ($reporttype -eq "MorningReport" -or $debug -eq "1") { return "Informational: $inbox File Count is: $Count `r`n" } }

  46:      # If the count is greater than 1000

  47:      If ($count -gt 1000) {

  48:          # If the count is greater than 10000 Return a Critical Message

  49:          If ($count -gt 10000) {

  50:              return "***** CRITICAL *****: $inbox File Count is: $Count `r`n"

  51:          }

  52:          #if it is less than 10000, Return a Warning Message

  53:          Else { if ($reporttype -eq "MorningReport" -or $debug -eq "1") { return "***** WARNING *****: $inbox File Count is: $Count `r`n"  } }

  54:      }

  55:  }

56:

  57:  # This Function Will Get the Service Status of a service on a computer. It will determine what the startup type

  58:  # is and what the current status of the service is.

  59:  function get-servicestatus { param($name,$service,$health)

60:

  61:      #Create the Result Array Variable

  62:      $serviceresult = @()

63:

  64:      # Query the Service Startup Mode of the local computer

  65:      $servicestart = Get-WmiObject -Query "Select StartMode From Win32_Service Where Name='$service'" -ErrorVariable Err -ErrorAction SilentlyContinue

66:

  67:      #if there is an error -- report it here -- This is useful if RPC is not functional or the service is not responding

  68:      if ($err) {

  69:          $serviceresult += "***** CRITICAL *****: Error Getting Service Start Information: $err `r`n"

  70:          [string]$servicemode = "(Cannot Determine Start Mode)"

  71:      }

  72:      #This will ensure that the service startup type IS what is specified in the SCCM File. If not -- Throw an error.

  73:      if (-not $servicestart) {

  74:          $serviceresult += "***** CRITICAL *****: Error Getting Service Start Information: $err `r`n"

  75:          [string]$servicemode = "(Cannot Determine Start Mode)"

  76:      }

  77:      # If it is functional, Return the start mode.

  78:      Else { [string]$servicemode = $servicestart.startmode }

79:

  80:      # This query will get the current running state of the service.

  81:      $service = get-service -name $service -ErrorVariable Err -ErrorAction SilentlyContinue

  82:      # This is the error handling. If the service is not responding -- it will report the error here.

  83:      if ($err) {

  84:          $serviceresult += "***** CRITICAL *****: Error Getting Service Status Information: $err `r`n"

  85:          [string]$service = "(Cannot Determine Service Running Status)"

  86:      }

  87:      # If it is functional, Return the running mode.

  88:      Else { [string]$servicestatus = $service.status }

89:

90:

91:

  92:      # If the XML File Reads Started/Automatic for the Service to be Healthy Proceed with the following

  93:      if ($health -eq "Started/Automatic") {

  94:          # Is the current State Set to Auto as expected? If not -- throw Exception

  95:          if ($servicemode -notmatch "Auto") {

  96:              $serviceresult += "***** CRITICAL *****: $Name Service Start Mode Set to: $servicemode and Expecting to be $health `r`n"

  97:          }

  98:          #Report Healthy for MorningReport and Debug.

  99:          else {

 100:              if ($reporttype -eq "MorningReport" -or $debug -eq "1") { $serviceresult += "Informational: $Name Service Start Mode Set to: $servicemode `r`n" }

 101:          }

 102:          ### Phase 2 ###

 103:          # Is the service currently running as expected? If Not -- throw Exception

 104:          if ($servicestatus -notmatch "Running") {

 105:              $serviceresult += "***** CRITICAL *****: $Name Service Running Status is currently: $servicemode and Expecting to be $health `r`n"

 106:          }

 107:          #Report Healthy for MorningReport and Debug.

 108:          else {

 109:              if ($reporttype -eq "MorningReport" -or $debug -eq "1") { $serviceresult += "Informational: $Name Service Running Status is currently: $servicestatus `r`n" }

 110:          }

 111:      }

 112:

 113:      #If the XML File Reads Manual Startup for Service to be Healthy Proceed with the following

 114:      if ($health -eq "Manual") {

 115:              # If the service is not set to manual -- throw exception.

 116:              if ($servicemode -notmatch "Manual") {

 117:                  $serviceresult += "***** CRITICAL *****: $Name Service Start Mode Set to: $servicemode and Expecting to be $health `r`n"

 118:              }

 119:              #Report Healthy for MorningReport and Debug.

 120:              else {

 121:                  if ($reporttype -eq "MorningReport" -or $debug -eq "1") { $serviceresult += "Informational: $Name Service Start Mode Set to: $servicemode `r`n" }

 122:              }

 123:      }

 124:

 125:      #If the XML File Reads Disabled Startup for Service to be Healthy Proceed with the following

 126:      if ($health -eq "Disabled") {

 127:          # If the service is not set to disabled -- throw exception.

 128:          if ($servicemode -notmatch "Disabled") {

 129:              $serviceresult += "***** CRITICAL *****: $Name Service Start Mode Set to: $servicemode and Expecting to be $health `r`n"

 130:          }

 131:          #Report Healthy for MorningReport and Debug.

 132:          else {

 133:              if ($reporttype -eq "MorningReport" -or $debug -eq "1") { $serviceresult += "Informational: $Name Service Start Mode Set to: $servicemode `r`n" }

 134:          }

 135:      }

 136:      return $serviceresult

 137:  }

 138:

 139:  # This function will read the XML data

 140:  function Get-XMLData { param($XMLExtract,$XMLvar)

 141:

 142:      #Result Variable

 143:      $dataresult = @()

 144:

 145:      # Get the content from the sccm.xml file

 146:      $xml = [xml] (get-content "sccm.xml")

 147:

 148:      # Start the DOT Notation Loop for the data specified to extract

 149:      ForEach($node in $xml.GetElementsByTagName("$xmlextract")) {

 150:          $id = $node.Id

 151:          ForEach($item in $node) {

 152:              #Grab the SCCM Path Data if Requested

 153:              if ($xmlextract -eq "SCCMPATH") {

 154:                  $xmlpath = $item.objloc

 155:                  return $xmlpath

 156:              }

 157:              # Start the File Check Process if Requested

 158:              if ($xmlextract -eq "filecheck") {

 159:                  $xmlname = $item.name

 160:                  $xmldirpath = $installdir + $item.objloc

 161:                  $dataresult += get-filecount $xmlname $xmldirpath

 162:

 163:              }

 164:              # Start the Service Check Process if Requested

 165:              if ($xmlextract -eq "servicecheck") {

 166:                  $xmlname = $item.name

 167:                  $xmlservice = $item.service

 168:                  $xmlhealth = $item.healthy

 169:                  $dataresult += get-servicestatus $xmlname $xmlservice $xmlhealth

 170:

 171:              }

 172:          }

 173:      }

 174:  #Return Results

 175:  return $dataresult

 176:  }

 177:

 178:  #Create the Report Variable and header

 179:  $report = @()

 180:

 181:  #Header to Email

 182:  $report += "------------------------------------------`r`n"

 183:  $report += "-------------SCCM HEALTH CHECK------------`r`n"

 184:  $report += "------------------------------------------`r`n"

 185:

 186:  $report += "`r`n"

 187:

 188:  #Get the Installation Directory From XML File

 189:  $installdir = Get-XMLData SCCMPATH

 190:

 191:  #Header to Email

 192:  $report += "`r`n"

 193:  $report += "-------------SCCM HEALTH CHECK [File Check]------------`r`n"

 194:  $report += "`r`n"

 195:

 196:  # Execute the File Check Process and store in the report variable

 197:  $report += Get-XMLData filecheck

 198:

 199:  $report += "`r`n"

 200:  $report += "-------------SCCM HEALTH CHECK [Services Check]------------`r`n"

 201:  $report += "`r`n"

 202:

 203:  # Execute the Service Check Process and Store the report in variable

 204:  $report += Get-XMLData servicecheck

 205:

 206:  # If the report contains a warning or critical item, Send Email.

 207:  if ($report -MATCH "WARNING" -OR $report -MATCH "CRITICAL") {

 208:

 209:    #Send A New Email. Format: new-email From To Subject Body

 210:    $cpuemail = $CmpName + "@yourcompanynamehere.com"

 211:    send-email $cpuemail "YourDistributionGroupGoesHere@YourCompanyNameHere.com" "$CmpName Health Summary Report (Errors Detected)" $report

 212:  }

 213:

 214:  # List out Report for Visual Effect

 215:  $report

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, “Courier New”, courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }

XML File: SCCM.XML Explained

Without explaining how to setup and use XML Files – this section will explain how to add and remove objects to the XML File.

The above graphic depicts the formatting of the location where SCCM is installed. This is valuable in the case that different servers have different installation paths. This should only contain ONE VALUE. Enter the location of SCCM 2007.

The above graphic depicts the formatting of the location of the directories which the PowerShell script will count files. This path is relevant to the SCCMPATH + Object Location. The above example would be interpreted as:

“d:\Program Files (x86)\Microsoft Configuration manager\Inboxes\auth\dataldr.box”

The ‘name’ field is only as a short name that will be included in the email. Anything you put in this field will help the person receiving the email to quickly determine what is the problematic directory location.

* Object location should NOT start or end with ‘\’.

* Do not forget to increment the ‘id’ with every new line. Duplicate ids will result in an error.

The above graphic depicts the formatting of the services that should be checked during the health check. Anything you put in this field will help the person receiving the email to quickly determine what is the problematic service.

The ‘service’ field is the Service name under service.msc. These can be the name of the service, but often are different.

The ‘Healthy’ field is the state the service should be in. There are three states that are approved by this script: Started/Automatic; Manual; Disabled. To ensure proper operations, ensure that the healthy state is one of these three.

XML File: SCCM.XML Contents

Download Code

   1:  "1.0"?>

2:

3:

   4:    "0" objloc="D:\Program Files (x86)\">

5:

   6:    " name="Dataldr.box" objloc="Microsoft Configuration Manager\inboxes\auth\dataldr.box">

   7:    " name="Dataldr.box\Process" objloc="Microsoft Configuration Manager\inboxes\auth\dataldr.box\process">

   8:    " name="Dataldr.box\BADMIFS" objloc="Microsoft Configuration Manager\inboxes\auth\dataldr.box\BADMIFS">

   9:    " name="Dataldr.box\bad" objloc="Microsoft Configuration Manager\inboxes\auth\dataldr.box\bad">

  10:    " name="Dataldr.box\Retry" objloc="Microsoft Configuration Manager\inboxes\auth\dataldr.box\retry">

11:

  12:    " name="Ddm.box" objloc="Microsoft Configuration Manager\inboxes\auth\ddm.box">

  13:    " name="Ddm.box\Bad" objloc="Microsoft Configuration Manager\inboxes\auth\ddm.box\bad">

  14:    " name="Ddm.box\BAD_DDRS" objloc="Microsoft Configuration Manager\inboxes\auth\ddm.box\BAD_DDRS">

  15:    " name="Ddm.box\regreq" objloc="Microsoft Configuration Manager\inboxes\auth\ddm.box\regreq">

16:

  17:    " name="sinv.box" objloc="Microsoft Configuration Manager\inboxes\auth\sinv.box">

  18:    " name="sinv.box\bad" objloc="Microsoft Configuration Manager\inboxes\auth\sinv.box\bad">

  19:    " name="sinv.box\Orphans" objloc="Microsoft Configuration Manager\inboxes\auth\sinv.box\Orphans">

  20:    " name="sinv.box\Retry" objloc="Microsoft Configuration Manager\inboxes\auth\sinv.box\Retry">

21:

  22:    " name="statesys.box" objloc="Microsoft Configuration Manager\inboxes\auth\statesys.box">

  23:    " name="statesys.box\corrupt" objloc="Microsoft Configuration Manager\inboxes\auth\statesys.box\corrupt">

  24:    " name="statesys.box\incoming" objloc="Microsoft Configuration Manager\inboxes\auth\statesys.box\incoming">

  25:    " name="statesys.box\outgoing" objloc="Microsoft Configuration Manager\inboxes\auth\statesys.box\outgoing">

  26:    " name="statesys.box\process" objloc="Microsoft Configuration Manager\inboxes\auth\statesys.box\process">

27:

  28:    " name="SMS Executive" service="SMS_EXECUTIVE" healthy="Started/Automatic">

  29:    " name="SMS Site Backup" service="SMS_SITE_BACKUP" healthy="Manual">

  30:    " name="SMS Site Component Manager" service="SMS_SITE_COMPONENT_MANAGER" healthy="Started/Automatic">

  31:    " name="SMS Site SQL Backup" service="SMS_SITE_SQL_BACKUP" healthy="Started/Automatic">

  32:    " name="SMS Site VSS Writer" service="SMS_SITE_VSS_WRITER" healthy="Started/Automatic">

33:

  34:    " name="SQL Server (MSSQLSERVER)" service="MSSQLSERVER" healthy="Started/Automatic">

  35:    " name="SQL Server Agent (MSSQLSERVER)" service="SQLSERVERAGENT" healthy="Started/Automatic">

  36:    " name="SQL Server Browser" service="SQLBrowser" healthy="Disabled">

  37:    " name="SQL Server Reporting Services (MSSQLSERVER)" service="ReportServer" healthy="Started/Automatic">

  38:    " name="SQL Server VSS Writer" service="SQLWriter" healthy="Started/Automatic">

39:

  40:    " name="Volume Shadow Copy" service="VSS" healthy="Manual">

41:

42:

Happy Coding!

PowerShell queryService–Wait for a Dependency Starting Service

brentblawat — Fri, 03 Jun 2011 01:13:42 +0000

By: Brenton Blawat

There have been several occasions while scripting in PowerShell that the script is dependent on a specific service in the running state. A good example is the need to wait for the WMI Service to startup prior to making a WMI call, or SQL Server where when you restart the services, you have to wait for the services to be in a running state before you can execute commands.

The following function solves this issue. It also displays the proper implementation of a PowerShell wait timer to wait for a service to become operational before continuing in the script.

PowerShell Code Waiting for Service

Download Code

   1: # This Function Will Query A Dependancy Service and wait until the timer expires OR for the service to start.

   2: function QueryService { param($Service,$timer1)

   3:     $success = ""

   4:     write-host "Waiting on $Service Service..."

5:

   6:     # Create a for loop to INC a timer Every Second

   7:     for ($b=1; $b -lt $timer1; $b++) {

   8:             $servicestat = get-service $Service

   9:             $status = $servicestat.status

  10:             $b2 = $timer1 - $b

11:

  12:             # Determine the Percent Complete for the seconds.

  13:             $percent = $b * (100 / $timer1)

14:

  15:             # Display the progress on the Screen

  16:             Write-Progress -Activity "Waiting on $Service Service..." -PercentComplete $percent -CurrentOperation "$b2 Seconds Remaining" -Status "Current WMI Status: $status"

17:

  18:             # Determine if the Process is Running. If not, reloop. If so exit loop.

  19:             if ($status -eq "Running") {

  20:                 write-host "$Service Service Started Successfully: $status in $b Seconds"

  21:                 [int]$b = $timer1

  22:                     $success = "yes"

23:

  24:                 # Tells the Loop to Stop Incrementing as the Service is running

  25:                 Write-Progress -Activity "Completed" -Status "Current $Service Status: $status in $b Seconds" -Completed

26:

  27:             }

28:

  29:         # Start-Sleep is available for the write-progress. Its value is in seconds.

  30:         start-sleep 1

31:

  32:     }

  33:     # The script will now stop as the above loop has meet its time criteria and the success is not set to yes.time has expired.

  34:     if ($success -ne "yes") {

  35:         write-host "ERROR in Script: $Service Service Did Not Start In $timer1 Seconds. Status: $status"

  36:         # Stop the Script

  37:        BREAK

  38:     }

  39: }

40:

  41: # The service must be the actual executible name, not the friendly name

  42: # The Below Examples are Querying SQL Services for startup waiting 120 seconds for a timeout.

  43: QueryService "SQLServerAgent" "120"

  44: QueryService "MSSQLSERVER" "120"

The implementation of the QueryService is pretty straight forward. The syntax is

QueryServices “EXENAME” “TIMEOUT_IN_SECONDS”

The exe name is what is found in the Services Management Console listed under the "Service Name”. Using the “Display Name” will not work with this function.

Please note: If a service is running, there will be approximately a second delay in the script while the system is verifying if the service is running. This is a small sacrifice for error handling in the instance that the service may not be running.

Happy Coding!

Powershell Import-GPO : The Data Is Invalid Fixed

brentblawat — Tue, 20 Apr 2010 20:05:51 +0000

By: Brenton Blawat

This article is to aid those who are receiving the “Data is Invalid” error message in Powershell on Windows Server 2008 R2. This issue occurs while trying to import policies from one domain into their a different domain using a migration table. This issue has to do with the migration table editor referring to the “Pre-Windows 2000 Username” to migrate users instead of their Standard Username.

Syntax of Command Used for Error:

Import-GPO –BackupID {GUIDGOESHERE} –TargetName “Default_AccountingPolicy” –path “c:\scriptloc\” –MigrationTable “C:\scriptloc\DefaultMig.migtable” –CreateIfNeeded | Out-Null

Error:

“ Import-GPO : The Data is invalid. (Exception from HRESULT: 0x8007000D) “

Solution:

The issue has to do with creating Users and User Groups without the ‘SAMACCOUNTNAME’ field while coding with Powershell. Windows Server 2008 R2 generates a unique Pre-2000 username starting with ‘$’ and a series of numbers following. When using the ‘-migrationtable’ trigger, it causes import-gpo cmdlet to validate the “destination users” PRIOR to importing the group policy. If it cannot resolve the User or User group, it will cause the ‘’HRESULT error’.

The following lines were added to the Powershell Script for creating a User Group, which corrected this issue:

   1: # Where $objworker was the AD method and $ADobjname was the name of the user / group

   2: $objworker.put("sAMAccountName", "$ADobjname")

   3: $objworker.SetInfo()

Depending on your network, the fix can be done in two ways:

Ensure the “Pre-Windows 2000 name” is the same as the “Standard Windows Name”
Correct the Migration Table to Use the Pre-Windows 2000 Names for the ‘Destination’

Simple fix – just wish that the error would be more like “Errors in Migration Table”. The error message of “The Data Is Invalid “ is useless in my opinion.

Happy Coding!

PowerShell Script: Encrypting / Decrypting A String – Function Encrypt-String

brentblawat — Sat, 20 Mar 2010 15:40:26 +0000

By: Brenton Blawat

The encryption and decryption of strings is essential when creating an enterprise product that has clear text passwords. This function displays how to encrypt and decrypt a string using Powershell using Richard’s code located at http://poshcode.org/116. While I found his code very useful, he didn’t explain the syntax and is why I am reposting this with the proper information.

I also decided to make this into an endless loop for an administrator to use to encrypt multiple passwords in a row. I found this to be useful as I never had to encrypt just one password.

Important for your security!!

In order to ensure your application is safe from an attacker be certain to perform each of the following:

1. Change the $salt variable and $init variables. These variables should be at least 8 characters long but should be changed or your application is subject to a brute force attack if someone determines you are using my code!

   1: function Encrypt-String($String, $Passphrase, $salt="SaltCrypto", $init="IV_Password", [switch]$arrayOutput)

2. Change the Passphrase that is passed into the function. I suggest a 12-18 character Passphrase to prevent the above brute force attack.

   1: $encrypted = Encrypt-String $string "MyStrongPassword"

3. Be sure to pass the right Passphrase into the function for decryption. If you pass the wrong key into the function, you will not get the correct password returned from the function.

Function for Encrypting / Decrypting A String in PowerShell

Download PS1 Here

   1: #################

   2: # Powershell Allows The Loading of .NET Assemblies

   3: # Load the Security assembly to use with this script

   4: #################

   5: [Reflection.Assembly]::LoadWithPartialName("System.Security")

6:

   7: #################

   8: # This function is to Encrypt A String.

   9: # $string is the string to encrypt, $passphrase is a second security "password" that has to be passed to decrypt.

  10: # $salt is used during the generation of the crypto password to prevent password guessing.

  11: # $init is used to compute the crypto hash -- a checksum of the encryption

  12: #################

  13: function Encrypt-String($String, $Passphrase, $salt="SaltCrypto", $init="IV_Password", [switch]$arrayOutput)

  14: {

  15:     # Create a COM Object for RijndaelManaged Cryptography

  16:     $r = new-Object System.Security.Cryptography.RijndaelManaged

  17:     # Convert the Passphrase to UTF8 Bytes

  18:     $pass = [Text.Encoding]::UTF8.GetBytes($Passphrase)

  19:     # Convert the Salt to UTF Bytes

  20:     $salt = [Text.Encoding]::UTF8.GetBytes($salt)

21:

  22:     # Create the Encryption Key using the passphrase, salt and SHA1 algorithm at 256 bits

  23:     $r.Key = (new-Object Security.Cryptography.PasswordDeriveBytes $pass, $salt, "SHA1", 5).GetBytes(32) #256/8

  24:     # Create the Intersecting Vector Cryptology Hash with the init

  25:     $r.IV = (new-Object Security.Cryptography.SHA1Managed).ComputeHash( [Text.Encoding]::UTF8.GetBytes($init) )[0..15]

26:

  27:     # Starts the New Encryption using the Key and IV

  28:     $c = $r.CreateEncryptor()

  29:     # Creates a MemoryStream to do the encryption in

  30:     $ms = new-Object IO.MemoryStream

  31:     # Creates the new Cryptology Stream --> Outputs to $MS or Memory Stream

  32:     $cs = new-Object Security.Cryptography.CryptoStream $ms,$c,"Write"

  33:     # Starts the new Cryptology Stream

  34:     $sw = new-Object IO.StreamWriter $cs

  35:     # Writes the string in the Cryptology Stream

  36:     $sw.Write($String)

  37:     # Stops the stream writer

  38:     $sw.Close()

  39:     # Stops the Cryptology Stream

  40:     $cs.Close()

  41:     # Stops writing to Memory

  42:     $ms.Close()

  43:     # Clears the IV and HASH from memory to prevent memory read attacks

  44:     $r.Clear()

  45:     # Takes the MemoryStream and puts it to an array

  46:     [byte[]]$result = $ms.ToArray()

  47:     # Converts the array from Base 64 to a string and returns

  48:     return [Convert]::ToBase64String($result)

  49: }

50:

  51: function Decrypt-String($Encrypted, $Passphrase, $salt="SaltCrypto", $init="IV_Password")

  52: {

  53:     # If the value in the Encrypted is a string, convert it to Base64

  54:     if($Encrypted -is [string]){

  55:         $Encrypted = [Convert]::FromBase64String($Encrypted)

  56:        }

57:

  58:     # Create a COM Object for RijndaelManaged Cryptography

  59:     $r = new-Object System.Security.Cryptography.RijndaelManaged

  60:     # Convert the Passphrase to UTF8 Bytes

  61:     $pass = [Text.Encoding]::UTF8.GetBytes($Passphrase)

  62:     # Convert the Salt to UTF Bytes

  63:     $salt = [Text.Encoding]::UTF8.GetBytes($salt)

64:

  65:     # Create the Encryption Key using the passphrase, salt and SHA1 algorithm at 256 bits

  66:     $r.Key = (new-Object Security.Cryptography.PasswordDeriveBytes $pass, $salt, "SHA1", 5).GetBytes(32) #256/8

  67:     # Create the Intersecting Vector Cryptology Hash with the init

  68:     $r.IV = (new-Object Security.Cryptography.SHA1Managed).ComputeHash( [Text.Encoding]::UTF8.GetBytes($init) )[0..15]

69:

70:

  71:     # Create a new Decryptor

  72:     $d = $r.CreateDecryptor()

  73:     # Create a New memory stream with the encrypted value.

  74:     $ms = new-Object IO.MemoryStream @(,$Encrypted)

  75:     # Read the new memory stream and read it in the cryptology stream

  76:     $cs = new-Object Security.Cryptography.CryptoStream $ms,$d,"Read"

  77:     # Read the new decrypted stream

  78:     $sr = new-Object IO.StreamReader $cs

  79:     # Return from the function the stream

  80:     Write-Output $sr.ReadToEnd()

  81:     # Stops the stream

  82:     $sr.Close()

  83:     # Stops the crypology stream

  84:     $cs.Close()

  85:     # Stops the memory stream

  86:     $ms.Close()

  87:     # Clears the RijndaelManaged Cryptology IV and Key

  88:     $r.Clear()

  89: }

90:

  91: # This clears the screen of the output from the loading of the assembly.

  92: cls

93:

  94: # $me will never = 1, so It will run indefinately

  95: $me = 0

  96:     write-host "To End This Application, Close the Window"

  97:     Write-host ""

  98: do

  99: {

 100:     # Prompt the user for the password

 101:     $string = read-host "Please Enter User Password"

 102:     # Encrypt the string and store it into the $encrypted variable

 103:     $encrypted = Encrypt-String $string "MyStrongPassword"

 104:     # Write result to the screen

 105:     write-host "Encrypted Password is: $encrypted"

 106:     write-host ""

 107:

 108:     write-host "Testing Decryption of Password..."

 109:

 110:     # Decrypts the string and stores the decrypted value in $decrypted

 111:     $decrypted = Decrypt-String $encrypted "MyStrongPassword"

 112:     # Writes the decrpted value to the screen

 113:     write-host "Decrypted Password is: $decrypted"

 114:     write-host ""

 115: }

 116:

 117: while ($me -ne 1)

To use this Function:

Start > Run > Type powershell.exe –noexit c:\location\EncryptDecryptString.ps1

** When you are done close the window.

Function for Encrypting Username and Passwords in PowerShell

Download PS1 Here

You will notice that I changed the Passphrase for both the username and the password. This is not necessary, however, it adds another layer of security. Try not to encrypt everything with the same passphrase. If one item gets compromised, everything encrypted under that passphrase is compromised.

   1: #################

   2: # Powershell Allows The Loading of .NET Assemblies

   3: # Load the Security assembly to use with this script

   4: #################

   5: [Reflection.Assembly]::LoadWithPartialName("System.Security")

6:

   7: #################

   8: # This function is to Encrypt A String.

   9: # $string is the string to encrypt, $passphrase is a second security "password" that has to be passed to decrypt.

  10: # $salt is used during the generation of the crypto password to prevent password guessing.

  11: # $init is used to compute the crypto hash -- a checksum of the encryption

  12: #################

  13: function Encrypt-String($String, $Passphrase, $salt="SaltCrypto", $init="IV_Password", [switch]$arrayOutput)

  14: {

  15:     # Create a COM Object for RijndaelManaged Cryptography

  16:     $r = new-Object System.Security.Cryptography.RijndaelManaged

  17:     # Convert the Passphrase to UTF8 Bytes

  18:     $pass = [Text.Encoding]::UTF8.GetBytes($Passphrase)

  19:     # Convert the Salt to UTF Bytes

  20:     $salt = [Text.Encoding]::UTF8.GetBytes($salt)

21:

  22:     # Create the Encryption Key using the passphrase, salt and SHA1 algorithm at 256 bits

  23:     $r.Key = (new-Object Security.Cryptography.PasswordDeriveBytes $pass, $salt, "SHA1", 5).GetBytes(32) #256/8

  24:     # Create the Intersecting Vector Cryptology Hash with the init

  25:     $r.IV = (new-Object Security.Cryptography.SHA1Managed).ComputeHash( [Text.Encoding]::UTF8.GetBytes($init) )[0..15]

26:

  27:     # Starts the New Encryption using the Key and IV

  28:     $c = $r.CreateEncryptor()

  29:     # Creates a MemoryStream to do the encryption in

  30:     $ms = new-Object IO.MemoryStream

  31:     # Creates the new Cryptology Stream --> Outputs to $MS or Memory Stream

  32:     $cs = new-Object Security.Cryptography.CryptoStream $ms,$c,"Write"

  33:     # Starts the new Cryptology Stream

  34:     $sw = new-Object IO.StreamWriter $cs

  35:     # Writes the string in the Cryptology Stream

  36:     $sw.Write($String)

  37:     # Stops the stream writer

  38:     $sw.Close()

  39:     # Stops the Cryptology Stream

  40:     $cs.Close()

  41:     # Stops writing to Memory

  42:     $ms.Close()

  43:     # Clears the IV and HASH from memory to prevent memory read attacks

  44:     $r.Clear()

  45:     # Takes the MemoryStream and puts it to an array

  46:     [byte[]]$result = $ms.ToArray()

  47:     # Converts the array from Base 64 to a string and returns

  48:     return [Convert]::ToBase64String($result)

  49: }

50:

  51: function Decrypt-String($Encrypted, $Passphrase, $salt="SaltCrypto", $init="IV_Password")

  52: {

  53:     # If the value in the Encrypted is a string, convert it to Base64

  54:     if($Encrypted -is [string]){

  55:         $Encrypted = [Convert]::FromBase64String($Encrypted)

  56:        }

57:

  58:     # Create a COM Object for RijndaelManaged Cryptography

  59:     $r = new-Object System.Security.Cryptography.RijndaelManaged

  60:     # Convert the Passphrase to UTF8 Bytes

  61:     $pass = [Text.Encoding]::UTF8.GetBytes($Passphrase)

  62:     # Convert the Salt to UTF Bytes

  63:     $salt = [Text.Encoding]::UTF8.GetBytes($salt)

64:

  65:     # Create the Encryption Key using the passphrase, salt and SHA1 algorithm at 256 bits

  66:     $r.Key = (new-Object Security.Cryptography.PasswordDeriveBytes $pass, $salt, "SHA1", 5).GetBytes(32) #256/8

  67:     # Create the Intersecting Vector Cryptology Hash with the init

  68:     $r.IV = (new-Object Security.Cryptography.SHA1Managed).ComputeHash( [Text.Encoding]::UTF8.GetBytes($init) )[0..15]

69:

70:

  71:     # Create a new Decryptor

  72:     $d = $r.CreateDecryptor()

  73:     # Create a New memory stream with the encrypted value.

  74:     $ms = new-Object IO.MemoryStream @(,$Encrypted)

  75:     # Read the new memory stream and read it in the cryptology stream

  76:     $cs = new-Object Security.Cryptography.CryptoStream $ms,$d,"Read"

  77:     # Read the new decrypted stream

  78:     $sr = new-Object IO.StreamReader $cs

  79:     # Return from the function the stream

  80:     Write-Output $sr.ReadToEnd()

  81:     # Stops the stream

  82:     $sr.Close()

  83:     # Stops the crypology stream

  84:     $cs.Close()

  85:     # Stops the memory stream

  86:     $ms.Close()

  87:     # Clears the RijndaelManaged Cryptology IV and Key

  88:     $r.Clear()

  89: }

90:

  91: # This clears the screen of the output from the loading of the assembly.

  92: cls

93:

  94: # $me will never = 1, so It will run indefinately

  95: $me = 0

  96:     write-host "To End This Application, Close the Window"

  97:     Write-host ""

  98: do

  99: {

 100:     # Prompt the user for the password

 101:

 102:     $ustring = read-host "(Case Sensitive) Please Enter Username"

 103:     $pstring = read-host "(Case Sensitive) Please Enter User Password"

 104:     # Encrypt the string and store it into the $encrypted variable

 105:     $uencrypted = Encrypt-String $ustring "U_MyStrongPassword"

 106:     $pencrypted = Encrypt-String $pstring "P_MyStrongPassword"

 107:

 108:     # Write result to the screen

 109:     write-host "Encrypted Username is: $uencrypted"

 110:     write-host ""

 111:     write-host "Encrypted Password is: $pencrypted"

 112:     write-host ""

 113:

 114:     write-host "Testing Decryption of Username / Password..."

 115:     write-host ""

 116:     # Decrypts the string and stores the decrypted value in $decrypted

 117:     $udecrypted = Decrypt-String $uencrypted "U_MyStrongPassword"

 118:     $pdecrypted = Decrypt-String $pencrypted "P_MyStrongPassword"

 119:

 120:     # Writes the decrpted value to the screen

 121:     write-host "Decrypted Password is: $udecrypted"

 122:     write-host ""

 123:     write-host "Decrypted Password is: $pdecrypted"

 124:

 125: }

 126:

 127: while ($me -ne 1)

To use this Function:

Start > Run > Type powershell.exe –noexit c:\location\EncryptDecryptStringUP.ps1

** When you are done close the window.

PowerShell Script: Finding A Distinguished Name of a Group/User: Function Find-DN

brentblawat — Mon, 08 Mar 2010 22:18:43 +0000

By: Brenton Blawat

This article explains the the method by which one would be able to Search Active Directory for the distinguished name of a User or Group. This is helpful when trying to add an object to Active Directory or adding Users to Groups.

Function Find-DN Finding Distinguished Name: Download PS1 Here

   1: # Function Find Distinguished Name

   2: function find-dn { param([string]$adfindtype, [string]$cName)

   3:     # Create A New ADSI Call

   4:     $root = [ADSI]''

   5:     # Create a New DirectorySearcher Object

   6:     $searcher = new-object System.DirectoryServices.DirectorySearcher($root)

   7:     # Set the filter to search for a specific CNAME

   8:     $searcher.filter = "(&(objectClass=$adfindtype) (CN=$cName))"

   9:     # Set results in $adfind variable

  10:     $adfind = $searcher.findall()

11:

  12:     # If Search has Multiple Answers

  13:     if ($adfind.count -gt 1) {

  14:         $count = 0

  15:         foreach($i in $adfind)

  16:         {

  17:             # Write Answers On Screen

  18:             write-host $count ": " $i.path

  19:             $count += 1

  20:         }

  21:         # Prompt User For Selection

  22:         $selection = Read-Host "Please select item: "

  23:         # Return the Selection

  24:         return $adfind[$selection].path

  25:     }

  26:     # Return The Answer

  27:     return $adfind[0].path

  28: }

Using this Function:

   1: # To use the function to find a User:

   2: find-dn "user" "Blawat"

3:

   4: # To use the function to find a Group:

   5: find-dn "group" "IT Help Desk"

PowerShell Script: Retrieving Distinguished name (DN) from A Fully Qualified Domain Name (FQDN)

brentblawat — Mon, 22 Feb 2010 19:49:40 +0000

By: Brenton Blawat

While there are many posts that describe the code to do this function, there aren’t many posts that provide variables with meaning or actually describe the syntax. This post describes the method by which you can retrieve a Distinguished Name from a Fully Qualified Domain Name.

Quick Reference:

Fully Qualified Domain Name (FQDN): division.domain.root

Distinguished Name (DC): DC=division,DC=Domain,DC=root

Canonical Name(CN): division.domain.root/OrganizationalUnit/

If you are looking for a quick way to obtain a Distinguished Name or Fully Qualified Domain Name See this article.

Mr. Weaver’s Code

Mark A. Weaver’s post Powershell – Recursive Group Membership, he describes the methods by which you can convert to and from multiple variables. Here is how Mr. Weaver performs the conversion operation:

   1: function Convert-DNStoDN ($DNSName)

   2: {

   3:    #  Create an array of each item in the string separated by "."

   4:    $DNSArray = $DNSName.Split(".")

   5:   # Let's go through our new array and do something with each item

   6:    for ($x = 0; $x -lt $DNSArray.Length ; $x++)

   7:       {

   8:         #I don't want a comma after my last item, so check to see if I am on my last one and set

   9:         # $Separator equal to nothing.

  10:         # Remember that we need to go to Length-1 because arrays are "0 based indexes"

  11:          if ($x -eq ($DNSArray.Length - 1)){$Separator = ""}else{$Separator =","}

  12:          [string]$DN += "DC=" + $DNSArray[$x] + $Separator

  13:       }

  14:    return $DN

  15: }

My Code – Explained

While my code is almost identical to Mr. Weaver’s Code, my only criticism is not providing useful variables and describing the functions. I can state, however, Mr. Weaver’s code provided a platform for a function that I use in a large production environment. I took the liberty to optimize the code (slightly) to meet my needs (Thank you sir!).

My Function looks like: Download PS1 Here

   1: function Get-Domain {

2:

   3:     #Retrieve the Fully Qualified Domain Name if one is not supplied

   4:     # division.domain.root

5:

   6:     if ($FQDN -eq "") {

   7:         [String]$fqdn = [System.DirectoryServices.ActiveDirectory.Domain]::getcurrentdomain()

   8:     }

9:

  10:     # Create a New Array 'Item' for each item in between the '.' characters

  11:     # Arrayitem1 division

  12:     # Arrayitem2 domain

  13:     # Arrayitem3 root

  14:     $FQDNArray = $FQDN.split(".")

15:

  16:     # Add A Separator of ','

  17:     $Separator = ","

18:

  19:     # For Each Item in the Array

  20:     # for (CreateVar; Condition; RepeatAction)

  21:     # for ($x is now equal to 0; while $x is less than total array length; add 1 to X

  22:     for ($x = 0; $x -lt $FQDNArray.Length ; $x++)

  23:         {

24:

  25:         #If it's the last item in the array don't append a ','

  26:         if ($x -eq ($FQDNArray.Length - 1)) { $Separator = "" }

27:

  28:         # Append to $DN DC= plus the array item with a separator after

  29:         [string]$DN += "DC=" + $FQDNArray[$x] + $Separator

30:

  31:         # continue to next item in the array

  32:         }

33:

  34:     #return the Distinguished Name

  35:     return $DN

  36: }

To use the Function to get the Distinguished Name of the Domain:

   1: # Store the distinguished name in a variable named $objCrntDN.

   2: $objCrntDN = Get-Domain

To use the function to get the Distinguished Name From a Fully Qualified Domain Name:

   1: # Store the distinguished name in a variable named $objCrntDN

   2: # Pass the Fully Qualified Domain Name with call

   3: $objCrntDN = Get-Domain division.domain.root

Note: This function also works if you place the division.domain.root in parentheses with quotations:

Get-Domain(“division.domain.root”)

What’s Different??

While the output is basically the same, I’ve made a few changes in the code:

“DNSname” is technically inaccurate, while I understand what he is meaning. He is referring to is the FQDN – a point of confusion for the readers.
I made the passing of a FQDN (optional) – as sometimes we don’t need to determine the FQDN (outside the function) before we get the Distinguished Name.
I named my function ‘Get-Domain’ . DNS-DN is a very specific function. Your will see that Marc has to call three different functions to convert between each of these. I chose to make a single function, and establish what the ultimate output will be. Name the function what you are getting or creating with the function. Get-Domain –> You already know what the output will be — the Domain.
I removed the Else { $separator } out of the loop. In batch processing such as PowerShell, the interpreter will replace the $separator variable each time it passes through the loop for the items in the array. To make the code more efficient, I set the variable outside the loop as it only gets changed for the last array evaluation.

PowerShell Script: Distinguished Name / Fully Qualified Domain Name to string

brentblawat — Mon, 22 Feb 2010 19:39:24 +0000

By: Brenton Blawat

This article is designed to be short and sweet. This article displays the method by which one would retrieve the FQDN or Distinguished Name of the Domain. This is code is very useful for any operations in Active Directory. A must know for any scripter that needs to call the domain on a system without hard coding the value in the script.

Lets take a theoretical network that consists of ‘division’ subdomain, ‘domain’ as the domain, and ‘root’ as the domain root.

Root Distinguished name – Easy Method in PowerShell

   1: # Instantiate The ADSI Provider

   2: $root = [ADSI]''

   3: $CurrentDN = $root.DistinguishedName

Result:

The variable $CurrentDN will contain:

DN=division,DN=domain,DN=root

E.G. DN=bittangents,DN=com

Root Fully Qualified Domain Name (FQDN) – Easy Method In PowerShell

   1: # Retrieve the Fully Qualified Domain Name and store it in $FQDN Variable

   2: [String]$FQDN =  [System.DirectoryServices.ActiveDirectory.Domain]::getCurrentDomain()

3:

Result:

The variable $FQDN will contain:

division.domain.root

E.G. bittangents.com