Just wanted to vent a bit of frustration with System Center Operations Manager this morning. As you can see from the task manager shot below, SCOM (showing its Microsoft Operations Manager roots with the process name) likes to eat memory. I left it running over the weekend on my work PC. Bad idea.

P.S. Mom, this has nothing to do with you, I promise!

If you have a server that needs to have the same Windows Server features and roles as another system, here’s an easy way to quickly get that done using PowerShell. I did this logged into each server locally, but you could easily use PowerShell remoting to do the same thing.

Step 1: Run PowerShell with ServerManager module:

Step 2: Export list of currently installed features to XML

Get-WindowsFeature | ? { $_.installed } | Export-Clixml \\server\share\features.xml

Step 3: On second server, run PowerShell and import XML

$f = Import-Clixml \\server\share\features.xml

Step 4: Pipe that bad boy into Add-WindowsFeature!

$f | Add-WindowsFeature

Step 5: Restart, if needed

Restart-Computer

That’s it!

First of all—I feel like such a n00b to be posting this. It’s fair to say that I know a bit about PowerShell but, man, the world is so big and I certainly do not know it all. As I always say, if I didn’t learn something today, then I must be dead.

Ok, on to the learning. As you may have heard, I changed jobs recently. I now work at a 500-person insurance company with a 70-person IT staff. By far the smallest company I’ve ever worked for (following MCI, HP, IBM, The Home Depot). In this new job, I have to wear many hats, which should be no surprise to those of you who work in SMB! I think it’s great, actually, because I’m exercising my brain in ways it hasn’t been in ages. For example, I don’t know crap about Active Directory, at least relative to other aspects of Windows considering the amount of time that I’ve called myself a Windows admin. So when it came time for me to do some routine AD cleanup, I certainly had to learn a few things—which is a good thing to me.

The task ahead of me was that there were tons of stale AD computer accounts in our domain. (See, I call it a domain, that’s how old my AD knowledge is.) Normally, this doesn’t hurt anything, but in our case, we have an anti-virus app which allocates licenses automatically based on the computer objects! So we were wasting licenses on computers which didn’t exist, and that needed cleaning up.

Of course, my first thought was to do it with PowerShell. I already had the venerable Quest AD snap-in loaded, so I just ran a quick one-liner to make my list of potential accounts. This was the easy part.

$c = Get-QADComputer -InactiveFor 90

After doing some sanity ping checks to make sure this list was good, I went to delete the first one:

PS> $c[0] | Remove-QADObject

Warning!
Are you sure you want to delete this object: CN=foobar,DC=domain,DC=com?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"):
Remove-QADObject : The directory service can perform the requested operation only on a leaf object.
At line:1 char:25
+ $c[0] | Remove-QADObject <<<<
    + CategoryInfo          : NotSpecified: (:) [Remove-QADObject], DirectoryServicesCOMException
    + FullyQualifiedErrorId : System.DirectoryServices.DirectoryServicesCOMException,Quest.ActiveRoles.ArsPowerShell
   eObjectCmdlet

Oops, that didn’t work! Well, I did some research and found an old newsgroup post that says that computer objects are really containers and that in order to delete them, you have to use the DeleteTree switch. So, I tried that:

PS> $c[0] | Remove-QADObject –DeleteTree

Warning!
Are you sure you want to delete this object and its children: CN=foobar,DC=domain,DC=com?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"):
Remove-QADObject : Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
At line:1 char:25
+ $c[0] | Remove-QADObject <<<<  -DeleteTree
    + CategoryInfo          : NotSpecified: (:) [Remove-QADObject], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Quest.ActiveRoles.ArsPowerShellSnapIn.Cmdlets.RemoveO
   bjectCmdlet

Access denied! So, I tried an elevated shell. No help. Back to Google. I searched for “access denied remove-qadobject deletetree” and the third hit looked interesting. It was a section on working with computer objects in the book Active Directory Cookbook (awesome that google books does that). From reading this, I realized that somewhere in the permissions hierarchy, these computer objects had accidental deletion prevention enabled! Luckily, they had some PowerShell code that I quickly adapted to my situation:

PS> $c | Add-QADPermission -Account 'EVERYONE' -Rights 'Delete,DeleteTree' -ApplyTo 'ThisObjectOnly'

Ctrl   Account                                  Rights                              Source           AppliesTo
----   -------                                  ------                              ------           ---------
       Everyone                                 Special                             Not inherited    This object only
       Everyone                                 Special                             Not inherited    This object only
       Everyone                                 Special                             Not inherited    This object only

Plus 507 more lines just like that. And then, I tried again and…

PS> $c = Get-QADComputer -InactiveFor 90
PS> $c
PS> 

Success! I hope that this post that illustrates my learning process helps someone else who comes across the same situation.

PowerShell is so cool…

I had no idea how to automate Outlook with COM before today. Took me about 5 minutes to learn how with PowerShell. I knew it could be done with VBS, right? That’s how viruses are made.

This won’t be a long blog unfortunately, but wanted to paste real quick a series of commands which I basically figured out in a shell interactively. I didn’t have to read any docs, Get-Member told me all I needed to know.

I did go back and add some comments. I hope you find it useful.

$ol = New-Object -com Outlook.Application # starts outlook

$ol.Reminders | select caption, nextreminderdate # show reminders

$ol | gm -mem method # show all methods (actions) on the com object

$n = $ol.CreateItem('olNoteItem') # creates a note

$n # display note object

$n.Body = 'test' # set body of note

$n | gm # display object members (methods & properties) of note

$n.Display() # show note

$n.Color # display color value

$n.Color = 4 # set color

1..5 | ForEach-Object { $n.Color = $_; sleep 1 } # change color of note 5 times

$m = $ol.CreateItem('olMailItem') # create mail object

$m # display mail object

$m | gm -mem property # show mail properties

$m.Subject = 'test' # set subject

$m.Body = 'test' # set body

$m.To = 'email@domain.com' # set to address

$m.Display() # display mail item on screen 

$m.Send() # send mail item

$ol # display outlook object

$ol | gm # display outlook methods

This is very much a work-in-progress, but I just successfully built an MSI package from PowerShell using WixSharp and the following test code:

$dll = 'C:\Program Files\WixSharp\WixSharp.dll'
$path = "c:\temp\out.msi"
[system.Environment]::CurrentDirectory = ( Split-Path $path )
Add-Type -Path $dll
$project = New-Object wixsharp.Project
$project.Name = "MyApp"
$project.GUID = [system.Guid]'3bb9cf27-5258-4192-b35b-418f0782c7a3'
$project.Id = "MyApp"
$dir = New-Object wixsharp.Dir( "%ProgramFiles%\My Company\My Product" )
$dir.files = @(
	( New-Object wixsharp.File( "C:\temp\ext18866\install.exe" ) ),
	( New-Object wixsharp.File( "c:\temp\ext18866\install.res.dll" ) )
)
$project.Dirs = @( $dir )
[wixsharp.Compiler]::BuildMsi( $project, $path )

Very simple installer, obviously, but it may just solve a problem for me.  I’ll have to write more about my research which led up to Wixsharp, but for now—it’s time to sleep. 

One more thing: this Wixsharp howto was invaluable.

I hate this window! And it really isn’t much better on Vista. I spent several minutes looking for a single app (old version of PowerShell) this morning so that I could uninstall it and install CTP3. I really want a list that I can filter by partial string. And it takes so long to open!

I know there’s third-party several replacements for it, but I’ve not tried any. Do you have any that you use?

Just found this cool post from sepeck with a script that shows you the drive stats on remote servers in a very nice table.

Read the post.

Here’s what it looks like in action:

PS > Get-DriveSpace -SystemName eastman

deviceid                 FreeSpaceGB              DriveSizeGB             Percentfree
--------                 -----------              -----------             -----------
C:                       3.11                     12.00                   25.92
D:                       69.44                    824.56                  8.42

Ok—technically, I’m still a human. but I am big on the PC thang.

And it is back in style. Tomorrow morning (Aug 25th), the new beta for PowerShell Plus Professional 2.0 will be officially released, and it is HOT. Tobias has been working extremely hard over the past several months adding new features and tweaking the UI. He has put out an application which is very nearly perfect. I’ve had inside access and have been watching 2.0 extremely closely ever since 1.0 was out the door and I imagine he could not be more pleased and excited to be able to finally show everyone what he has been working on.

Go check it out for yourself and download the beta over at Idera.com. Here are a few screenshots to whet your appetite.

I really didn’t think much of the Sideshow feature when I had first heard about it. But that was before I saw this:

This is very cool – you can use your Windows Mobile device to control your Powerpoint slides via Bluetooth.  It basically combines the Windows SideShow for Windows Mobile preview with a SideShow gadget for Powerpoint.

To do this you will need two components:

1. Windows SideShow for Windows Mobile Developer Preview
2. Office PowerPoint Remote

Man, this would be awesome for doing presentations! That’s it, I gotta rebuild my laptop.

(via MR Mobile)

I this is at the root of that sentiment:

Beyond the SOAP issues, WMI/CIM/WBEM is simply butt-ugly (maybe even fugly).

This article isn’t about WS-Management or WinRM per se but I found some interesting commentary on it and other management protocls.

As some know, I’m working on a book.  The subject involves working with over 120 PowerShell cmdlets.  Many of these cmdlets have help files that are incomplete, so I have been blazing some pretty new territory.  I constantly have to look up the parameters for these cmdlets so that I can be sure that what I’m writing is accurate.  Rather than view the detailed help (which might not even be helpful), I wrote a script to pull out the parameters into a list.  The script was embarrassing, really, but it was a quick hack that I needed and it worked.  Then, just the other day while browsing the VMware Community forums, another user who goes by the name LucD spouted a snippet of code that for some reason I had not happened upon before.  It was a much better way to do what I had been doing with my previous Get-Parameter function.  I took his technique and added some BSonPosh-style custom object goodness and a few other features and hark!  The script is ready for all to see. 

function Get-Parameter ($Cmdlet) {

    foreach ($paramset in (Get-Command $Cmdlet).ParameterSets){

        $Output = @()

        foreach ($param in $paramset.Parameters) {

            $process = "" | Select-Object Name, ParameterSet, Aliases, IsMandatory, CommonParameter

            $process.Name = $param.Name

            if ( $paramset.name -eq "__AllParameterSets" ) { $process.ParameterSet = "Default" }

            else { $process.ParameterSet = $paramset.Name }

            $process.Aliases = $param.aliases

            $process.IsMandatory = $param.IsMandatory 

            if ($param.aliases -match "vb|db|ea|wa|ev|wv|ov|ob") { $process.CommonParameter = $TRUE }

            else { $process.CommonParameter = $FALSE }

            $output += $process

        }

        Write-Output $Output

        Write-Host "`n"

    }

}

As input it takes a single cmdlet name.  The output looks like the below.  Note the blank line, that’s to help separate when you have multiple ParameterSets.  I added a CommonParameter field so that you could filter out the boring stuff if you want.

PS > Get-Parameter New-Runspace | ft

Name               ParameterSet       Aliases                   IsMandatory    CommonParameter
----               ------------       -------                   -----------    ---------------
ComputerName       ComputerName       {Cp}                            False              False
Authentication     ComputerName       {}                              False              False
Credential         ComputerName       {}                              False              False
Port               ComputerName       {}                              False              False
UseSSL             ComputerName       {}                              False              False
Shell              ComputerName       {}                              False              False
ApplicationName    ComputerName       {}                              False              False
ThrottleLimit      ComputerName       {}                              False              False
Verbose            ComputerName       {vb}                            False               True
Debug              ComputerName       {db}                            False               True
ErrorAction        ComputerName       {ea}                            False               True
WarningAction      ComputerName       {wa}                            False               True
ErrorVariable      ComputerName       {ev}                            False               True
WarningVariable    ComputerName       {wv}                            False               True
OutVariable        ComputerName       {ov}                            False               True
OutBuffer          ComputerName       {ob}                            False               True

Authentication     Uri                {}                              False              False
Credential         Uri                {}                              False              False
Shell              Uri                {}                              False              False
ThrottleLimit      Uri                {}                              False              False
ConnectionUri      Uri                {URI, CU}                       False              False
Verbose            Uri                {vb}                            False               True
Debug              Uri                {db}                            False               True
ErrorAction        Uri                {ea}                            False               True
WarningAction      Uri                {wa}                            False               True
ErrorVariable      Uri                {ev}                            False               True
WarningVariable    Uri                {wv}                            False               True
OutVariable        Uri                {ov}                            False               True
OutBuffer          Uri                {ob}                            False               True

Runspace           Runspace           {RunspaceInfo}                  False              False
ThrottleLimit      Runspace           {}                              False              False
Verbose            Runspace           {vb}                            False               True
Debug              Runspace           {db}                            False               True
ErrorAction        Runspace           {ea}                            False               True
WarningAction      Runspace           {wa}                            False               True
ErrorVariable      Runspace           {ev}                            False               True
WarningVariable    Runspace           {wv}                            False               True
OutVariable        Runspace           {ov}                            False               True
OutBuffer          Runspace           {ob}                            False               True

If you’ve been under a rock, Live Mesh is Microsoft’s latest foray into the cloud computing space.  So far it’s just a “tech preview” and feature-wise, it’s fairly limited.  Today, it’s basically FolderShare with a few extra features.

But if you read up on the Live Mesh blog, there is a ton of cool stuff in store.  It’s very visionary–hopefully that stuff lands here on Earth with us. 

If you need an invite, leave a comment on the blog.  Also, if you are interested in joining a little proof-of-concept file sharing group we have going right now for sharing PowerShell scripts, let me know.

P.S. Sorry I’m so light on blogging lately–Twitter has sorta caught my fancy lately and I’ve been writing more there.

Very cool-looking tool!  From the site:

What is Start++?

Start++ is an enhancement for the Start Menu in Windows Vista. It also extends the Run box and the command-line with customizable commands.  For example, typing “w Windows Vista” will take you to the Windows Vista page on Wikipedia!

And now, some screenshots:

(thanks to Trent, a Lifehacker commenter)

My long reply to a long reply was getting a bit…long, so I thought I’d move it here. Much easier to do the editing in Live Writer anyhow.

You can find the original article and several comments from myself and the author at this blog post: Why PowerShell, Servermanagercmd and co. don’t really rock on the command prompt. I recommend you read the article, it’s a nicely-worded opinion piece. The article deals with the author’s frustrations with Server 2008 command-line utilities (which I agree with) but he then extends those opinions on to PowerShell. I’m making the point that PowerShell addresses most if not all of his frustrations. He also goes into reasons why he thinks the GUI is generally superior for any task, which I also disagree with. (Lots of dangling prepositions today.)

My reply continues below:

Well, the PowerShell rebuttal to ‘difficulty in memorizing commands’ is handled by a cmdlet called “get-command”, and the enforced (by Microsoft’s Common Engineering Criteria internally) consistent naming convention for cmdlets and other related interfaces such as PS Providers. For example, say you want to do something with a mailbox in exchange. You already know the noun you are dealing with–it’s a mailbox. So you type “get-command *mailbox” or “get-command -noun mailbox” and you’ll get several matches. To go a step higher, say you know you want to do something with VMware but you forgot how to connect to the auth server and you have no idea if the verb (the part before the dash) is even called ‘connect’. In a case like that you would use “get-command -pssnapin v*”. That will return all cmdlets which are contained within any snapin which starts with the letter V.

On top of all that, there’s some great IDEs and enhanced editors and graphical consoles whicih make all of this even easier. You can tet real visual studio-like Intellisense on filenames, cmdlets, parameters, .NET types, WMI classes…I certainly can’t memorize every WMI class, but I can type “get-wmiobject win32_net” and hit TAB and voila, there’s a dozen answers popped up in a listbox.

In answer to your point that “The number of software vendors offering tools for administrators has been growing dramatically in the last years.”: I would say YES–and PowerShell is/will be largely seen as responsible for accelerating that trend. VMware, Citrix, IBM and many more vendors are starting to provide PowerShell hooks.

And lastly, of course GUIs are more prone to mistake! How many times have people accidentally clicked on shutdown when they meant logoff (before the start menu was rearranged in what…2003)? I mean…seriously, I could go on and on. GUI accidents could be blamed for spyware installs, too.

If I’m about to make a change in a production environment which may have adverse affects, best practice wisdom would say (yeah, I know that’s like saying “they say” but hear me out) you should make a change plan and a backout plan. You are already doing things to a high level of detail, you might as well script the whole thing. This allows you to not only automate the change, but to validate the change, and if necessary, reverse it. This applies doubly so if you are not the person to make the change. Maybe you are the lead admin delegating a task off to a junior admin or an offshore resource. you tell them:

Run this script, wake me if stuff starts blowing up!

If you are going, let me know via the event I just created in Facebook.  Details are in the link.

This will be a quick blog post because it’s late.

Development has been rapid lately on the ShellTools team.  Check out these bits from the PS+ change log:

• Added a separate input panel below the console. Press CTRL+I to toggle. ENTER will execute code inside the panel, SHIFT+ENTER will add a new line and CTRL+ENTER executes without adding a new line
• Editor now supports code folding
• Improved color highlighting in editor and added support for here-strings
• Tools/Logging will write out a transcript of your commands to a text file

Check out the public beta of PowerShell Plus today!

Check out the notes buried near the bottom of this article on WinRM: WinRM: Remote Management Across the Internet

Something else to consider. Sometime before the end of the year an upgraded CTP (Community Technology Preview) version of Windows PowerShell will be released, an upgrade that will enable you to run most Windows PowerShell cmdlets against remote computers. The catch? This new version of Windows PowerShell also relies on WinRM as its remote transport protocol. If you?re interested in using Windows PowerShell to manage remote computers you?ll need to download and install WinRM on your Windows XP and Windows Server 2003 machines.

So this is good and bad.  It’s great that now we know the direction MS is headed with regards to remote management in PowerShell.  It sucks to have to install yet another piece of software on all your servers though.  For many IT shops this is a non-trivial thing.  As Gaurhoth on #Powershell advises, it might make sense to get WinRM in your new server builds now:

I don’t have to do change management on ‘new’ stuff…. getting WinRM installed on existing servers might be a little harder.

CodeBank v2 is tree based (XML) personal information database.

It allows you to maintain a hierachical database of textual information like:

• programming code snippets
• notes
• links
• quotes
• SQL queries
• whatever you like you name it

CodeBank is designed to work with relatively large amount of records. I have successfuly tested it with 20000+ records.  Unlike similar programs CodeBank is fully portable and can be carried on removable media. The compression feature helps in that matter too. The encryption feature provides high grade (256bit AES) of security for sensitive information.  The internal search engine can search for words, phrases and regular expressions.  CodeBank also allows you to comment and tag your own snippets/records so you can find them easier later.  The initial reason I developped this application was to help with the training of a programming team for programming competitions (ACM, TopCoder etc.)

• remembers the exact state you left it
• Great “Search Engine” for the database
• syntax highlightning in C/C++, Object Pascal, Java, XML, Visual Basic, VBScript, JavaScript, CSS, HTML, PHP, Perl, Python, SQL
• Drag & Drop
• Unlimited database size
• Export/Import between databases
• zip Compression
• AES Encryption

Go get it!

Taskix is a neat little utility which lets you re-order the buttons in your Windows taskbar.  It’s tiny, and free.  What more could you ask?