scripts Archives - IT-Admins

PRTG sensor to monitor a directory for a specific file type and minimum size and age

The following script will monitor a specific directory for a file of a defined type and minimum size, it will report back to you the newest file of the specified type and over the minimum size and provide you the file age and size to PRTG.

The name of the file will also be reported back as a text value for the sensor in PRTG.

If the script encounters any errors, the total files value will be 0 for no files found or -1 for a script error. Therefor please set minimum channel error values accordingly to get alerted.

The goal here is to get the age of the file back that was found, to make sure the file is not older than expected. This is needed for some automated exports or data transfer files, this was you can be sure that your export routines work as expected.

param(
    &#91;string] $FolderPath = "C:\",
    &#91;string] $Extension = "*.undefined",
    &#91;int] $FileMinimumSizeByte = 1
)

Function WriteXmlToScreen (&#91;xml]$xml)
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

Try {
    $Files = Get-ChildItem -Path $FolderPath -Filter $Extension | Where {$_.Lengthength -gt $FileMinimumSizeByte} | Sort-Object CreationTime -Descending
    If ($Files.Count -gt 0) { 
        Foreach ($File in $Files)
        {
            $TotalFiles = $Files.Count
            $Date = Get-Date
            $FileAgeSeconds = &#91;math]::Round(($Date - $File.CreationTime).TotalSeconds)
            $FileSize = $File.Length
            $FileName = $File.Name

            $XML =  "&lt;prtg>"
            $XML += "&lt;result>&lt;channel>Total Files&lt;/channel>&lt;value>$TotalFiles&lt;/value>&lt;unit>Count&lt;/unit>&lt;/result>"
            $XML += "&lt;result>&lt;channel>Newest File - Age in Seconds&lt;/channel>&lt;value>$FileAgeHours&lt;/value>&lt;unit>TimeSeconds&lt;/unit>&lt;/result>"
            $XML += "&lt;result>&lt;channel>Newest File - Size in Bytes&lt;/channel>&lt;value>$FileSize&lt;/value>&lt;unit>Byte&lt;/unit>&lt;/result>"
            $XML += "&lt;text>$FileName&lt;/text>"
            $XML += "&lt;/prtg>"

            WriteXmlToScreen $XML
        
            Break;
        }
    } else {
        $XML =  "&lt;prtg>"
        $XML += "&lt;result>&lt;channel>Total Files&lt;/channel>&lt;value>0&lt;/value>&lt;unit>Count&lt;/unit>&lt;/result>"
        $XML += "&lt;result>&lt;channel>Newest File - Age in Seconds&lt;/channel>&lt;value>0&lt;/value>&lt;unit>Count&lt;/unit>&lt;/result>"
        $XML += "&lt;result>&lt;channel>Newest File - Size in Bytes&lt;/channel>&lt;value>0&lt;/value>&lt;unit>Byte&lt;/unit>&lt;/result>"
        $XML += "&lt;text>No Files found&lt;/text>"
        $XML += "&lt;/prtg>"

        WriteXmlToScreen $XML
    }
} Catch {

    $XML =  "&lt;prtg>"
    $XML += "&lt;result>&lt;channel>Total Files&lt;/channel>&lt;value>-1&lt;/value>&lt;unit>Count&lt;/unit>&lt;/result>"
    $XML += "&lt;result>&lt;channel>Newest File - Age in Seconds&lt;/channel>&lt;value>-1&lt;/value>&lt;unit>Count&lt;/unit>&lt;/result>"
    $XML += "&lt;result>&lt;channel>Newest File - Size in Bytes&lt;/channel>&lt;value>-1&lt;/value>&lt;unit>Byte&lt;/unit>&lt;/result>"
    $XML += "&lt;text>Error&lt;/text>"
    $XML += "&lt;/prtg>"

    WriteXmlToScreen $XML

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

param(

[string] $FolderPath = "C:\",

[string] $Extension = "*.undefined",

[int] $FileMinimumSizeByte = 1

)

Function WriteXmlToScreen ([xml]$xml)

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

Try {

$Files = Get-ChildItem -Path $FolderPath -Filter $Extension | Where {$_.Lengthength -gt $FileMinimumSizeByte} | Sort-Object CreationTime -Descending

If ($Files.Count -gt 0) {

Foreach ($File in $Files)

{

$TotalFiles = $Files.Count

$Date = Get-Date

$FileAgeSeconds = [math]::Round(($Date - $File.CreationTime).TotalSeconds)

$FileSize = $File.Length

$FileName = $File.Name

$XML = "<prtg>"

$XML += "<result><channel>Total Files</channel><value>$TotalFiles</value><unit>Count</unit></result>"

$XML += "<result><channel>Newest File - Age in Seconds</channel><value>$FileAgeHours</value><unit>TimeSeconds</unit></result>"

$XML += "<result><channel>Newest File - Size in Bytes</channel><value>$FileSize</value><unit>Byte</unit></result>"

$XML += "<text>$FileName</text>"

$XML += "</prtg>"

WriteXmlToScreen $XML

Break;

}

} else {

$XML = "<prtg>"

$XML += "<result><channel>Total Files</channel><value>0</value><unit>Count</unit></result>"

$XML += "<result><channel>Newest File - Age in Seconds</channel><value>0</value><unit>Count</unit></result>"

$XML += "<result><channel>Newest File - Size in Bytes</channel><value>0</value><unit>Byte</unit></result>"

$XML += "<text>No Files found</text>"

$XML += "</prtg>"

WriteXmlToScreen $XML

}

} Catch {

$XML = "<prtg>"

$XML += "<result><channel>Total Files</channel><value>-1</value><unit>Count</unit></result>"

$XML += "<result><channel>Newest File - Age in Seconds</channel><value>-1</value><unit>Count</unit></result>"

$XML += "<result><channel>Newest File - Size in Bytes</channel><value>-1</value><unit>Byte</unit></result>"

$XML += "<text>Error</text>"

$XML += "</prtg>"

WriteXmlToScreen $XML

}

Monitor group memberships in Active Directory with PRTG

There is at least one group you want to monitor for any membership changes in Active Directory / LDAP – the Domain Admins group. This is so important, as any changes to this group could cause great harm to your whole system. Of course there are other ways in but you for sure want to monitor at least the basic information of the amount of users in this group.

In order to do so, I wrote a PowerShell script that provides you the amount of members of any given group in Active Directory, as well as a text response (under the probe name and in some alerts if activated) of the sAMAccountName of each member in the group. This way you can hopefully right away determine the changed object, assuming you know what should be in there and what not.

If you have nested groups, you might wanna monitor them as well till you reach a user only level.

Create the script as always on your PRTG probing server in C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML and add a new EXE/Advanced XML sensor in PRTG. Select the script and provide at a bare minimum the parameter MonitoredGroup.

Parameter samples:

-MonitoredGroup “Domain Admins”
-MonitoredGroup “Domain Admins” -Server “MyDC.domain.local”

If you do not provide a server name, the system will try determine it on it’s own – default Domain-Membership etc..

Once the first run was successful you should review the results and set the upper and lower error limit on the PRTG sensor to the current amount of members. Any change then will cause the sensor to go in to error status and inform you therefor about the change.

param(
	[string]$Server = "",
	[string]$MonitoredGroup = ""
)
Import-Module ActiveDirectory

If ($Server.Length -gt 0) {
    $LDAPGroup = Get-ADGroupMember $MonitoredGroup -Server $Server
} Else {
    $LDAPGroup = Get-ADGroupMember $MonitoredGroup 
}

[string]$LDAPGroupMembers = ""
Foreach ($Member in $LDAPGroup){
    If ($LDAPGroupMembers.Length -gt 0) {$LDAPGroupMembers += ", "}
    $LDAPGroupMembers += $Member.SamAccountName
}

$XML = "<prtg>
            <result>
                <channel>Amound of Users in Group</channel>
                <value>"+ $LDAPGroup.count +"</value>
            </result>			
            <text>"+ $MonitoredGroup +" Members: " + $LDAPGroupMembers + "</text>
        </prtg>"
 
Function WriteXmlToScreen ([xml]$XML) #just to make it clean XML code...
{
	$StringWriter = New-Object System.IO.StringWriter;
	$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
	$XmlWriter.Formatting = "indented";
	$xml.WriteTo($XmlWriter);
	$XmlWriter.Flush();
	$StringWriter.Flush();
	Write-Output $StringWriter.ToString();
}
 
WriteXmlToScreen $XML;

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

param(

[string]$Server = "",

[string]$MonitoredGroup = ""

)

Import-Module ActiveDirectory

If ($Server.Length -gt 0) {

$LDAPGroup = Get-ADGroupMember $MonitoredGroup -Server $Server

} Else {

$LDAPGroup = Get-ADGroupMember $MonitoredGroup

}

[string]$LDAPGroupMembers = ""

Foreach ($Member in $LDAPGroup){

If ($LDAPGroupMembers.Length -gt 0) {$LDAPGroupMembers += ", "}

$LDAPGroupMembers += $Member.SamAccountName

}

$XML = "<prtg>

<channel>Amound of Users in Group</channel>

<value>"+ $LDAPGroup.count +"</value>

</result>

<text>"+ $MonitoredGroup +" Members: " + $LDAPGroupMembers + "</text>

</prtg>"

Function WriteXmlToScreen ([xml]$XML) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen $XML;

October 13, 2020 by Florian Rossmark monitoring prtg scripts security server

Monitoring relative printer page counts with PRTG

PRTG has many standard sensors, but one I was always missing is a daily page count compare. The standard printer sensor gives you a total page count – but this to some extend will always be a graph that only will go up. You can only estimate the total page counts in those graphs.

If you ever looked in to the IT Assets database project, you will see that in the Printers area there is a possibility to enable detailed graphs for relative page counts.

Why is this important you might wonder. The answer is simple, as an IT Manager you need to know if a certain kind of a printer makes sense at a certain location. If you have a low end printer for only casual print-outs but you have a total over e.g. 10,000 pages printed every month, you might need to reconsider the printer model. The reasons would likely be:

higher cost per page
- constant toner exchange of a compared more expensive toner cartridge
maintenance cost
- you might need to constantly maintenance the printer
- the cost for the maintenance kit are relatively high
downtime issues
- due to toner empty
- printer needs maintenance again
- less pages in paper tray

On the other hand, a printer might also be overkill for a certain area and not be cost efficient. Those conditions also might change over time of course. Further is there often the question – is a single area printer (copier) better or multiple smaller printers. This of course can go pretty far and you want to consider Lean processes, Six Sigma guidelines and others along with this data.

How ever, I started a first draft of a script that provides me at least the total page count relative to each day in PRTG. This sure is not as efficient yet as I do this in the IT Assets database printer module, where I collect data e.g. every 30 minutes in a huge table and then later calculate all the data in a daily range respective monthly range while collecting total page counts and possibly counts per copy vs. print outs and additionally color vs. black and white print. But at least it is a start.

Below you find the first draft of this script.

One thing to know – you will need to run the following command in order to install the PowerShell SNMP module on your PRTG probing server:

Install-Module -Name SNMP

1	Install-Module -Name SNMP

The current version of the PRTG script:

#For PRTG - default parameter list: 
#-deviceID %deviceid -targetHost '%host' -OID '1.3.6.1.2.1.43.10.2.1.4.1.1' 
#find a list with OID examples at the following link as they differ by vendor and partly model
#https://www.it-admins.com/it-assets-database/online-manual/printers/
param(
    [Parameter(
        Mandatory = $true
    )][int]$deviceID,

    [Parameter(
        Mandatory = $true
    )][string]$targetHost,

    [Parameter(
        Mandatory = $true
    )][string]$OID = "",

    [string]$Community = "public"
)

Import-Module -Name SNMP

[string]$ErrorText = "" #will hold error information to be returned to PRTG text field / sensor message
[int]$ErrorValue = 0 #default no errors initiated with 0 (0 = OK | 1 = Warning | 2 = Error)

[string]$LogFile = "$PSScriptRoot\PrinterLog_$deviceID.log"

[int]$result = -2 #standard response would be negative 2 as initialized integer value

try{
    $result = (Get-SNMPdata -IP $targetHost -OID $OID -Community $Community).Data
    #if no error occured, we have the current page count as a result
} catch {
    $result = -1 #if any error happened, we now have the result set to negative 1
    $ErrorText += "error: can't read SNMP OID value from device "
    $ErrorValue = 2
}

[int]$returnValue = 0 #default return value, integer, initialized with 0
[string]$LogFileContent = -1 #default logfilecontent is integer, intialized with negative 1
[string]$LogFileDate 
[int]$LogFileCount = -1

if ($result -gt 0) {
    #we seem to have a page count from SNMP

    if (Test-Path $LogFile -PathType Leaf){
        #we do have an exisiting LogFile
        try{
            $LogFileContent = Get-Content $LogFile -Raw
            if ($LogFileContent.Length -gt 0){
                $LogFileDate = $LogFileContent.Split("|")[0] 
                $LogFileCount = $LogFileContent.Split("|")[1]
            } else {
                #LogFile empty
                $LogFileCount = 0
                $ErrorText += "warning: initial run or no logfile yet "
                $ErrorValue = 1
            }
        } catch {
            $LogFileCount = -2 #negative 2 as error catch
        } finally {
            if ($LogFileCount -gt 0){
                #no error occured as for the LogFile reading
                if (($result - $LogFileCount) -gt -1){
                    #it should be either the same value or higher then the last logfile value
                    $returnValue = $result - $LogFileCount
                } else {
                    #LogFile value is higher then current count - this is weird
                    #still returning this - but it will show a negative count and should raise a flag
                    $returnValue = $result - $LogFileCount
                    $ErrorText += "error: logfile value higher then current printer read "
                    $ErrorValue = 2
                }
            } else {
                #there was some kind of error in the LogFile read - not an integer value or new Logfile started and result was 0
                $ErrorText += "error: can't read logfile for data compare "
                $ErrorValue = 2
            }
        }

    } else {
        #no LogFile yet - will need one but return value as difference initially will stay 0
        #we set the LogFileContent to 0 as this is the current status
        $LogFileCount = 0
        $ErrorText += "warning: initial run or no logfile yet or wrong data format "
        $ErrorValue = 1
    }

    #we need to write the positive SNMP OID result to the LogFile 
    #but only if the date differs more then 1x day

    [bool]$WriteLog = $false
    [string]$CurrentDate = (Get-Date -Format yyyy-MM-dd)

    if ($LogFileDate.Length -gt 0){
        try{
            if ((New-TimeSpan -Start $LogFileDate -End $CurrentDate).Days -gt 1){ 
                #date difference more then 1 day 
                $WriteLog = $true
            } else {
                #date difference not sufficient - same day? Future?
                if ((New-TimeSpan -Start $LogFileDate -End $CurrentDate).Days -lt 0){ 
                    #LogFile newer then current date? That's just wrong
                    $WriteLog = $true
                    $ErrorText += "warning: Logfile date above current date $LogFileDate - rewriting log"
                    $ErrorValue = 1
                } else {
                    #not greater then 1 day (0 and 1) or less must be equal as a result...
                    #nothing to do as WriteLog is initialized false
                }
            }
        } catch {
            #couldn't compare the date - let's write the Log to be save
            $WriteLog = $true
        }
    } else {
        #LogFileDate length 0 means we need to write a logfile as it might not exist
        $WriteLog = $true
    }

    if ($WriteLog){
        try {
            Set-Content -Path $LogFile -Value "$CurrentDate|$result"
            $LogFileDate = $CurrentDate
        } catch {
            #there was an issue writing to the LogFile
            $ErrorText += "error: can't write to logfile "
            $ErrorValue = 2
        }
    }

} else {
    #no pagecount available due to errors or issues
    #uncomment the next line for debugging only
    #$returnValue = $result
    #the returnValue will now show the current result value and point therefor to the error section
    $ErrorText += "error: no pagecount available "
    $ErrorValue = 2
}

#Assuming no errors - the text result will be the last LogFile date
if ($ErrorText.Length -eq 0){
    $ErrorText = "Last LogFile write date: $LogFileDate"
}

$XML = "<prtg>
            <result>
                <channel>last relative Page Count</channel>
                <value>$returnValue</value>
            </result>
            <result>
                <channel>last total from Printer</channel>
                <value>$result</value>
            </result>
            <result>
                <channel>last total from LogFile</channel>
                <value>$LogFileCount</value>
            </result>
            <result>
                <channel>Script Error Status</channel>
                <value>$ErrorValue</value>
                <LimitMode>1</LimitMode>
                <LimitMaxWarning>0</LimitMaxWarning>
                <LimitMaxError>1</LimitMaxError>
            </result>
            <text>$ErrorText</text>
        </prtg>"
 
Function WriteXmlToScreen ([xml]$XML) #just to make it clean XML code...
{
	$StringWriter = New-Object System.IO.StringWriter;
	$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
	$XmlWriter.Formatting = "indented";
	$xml.WriteTo($XmlWriter);
	$XmlWriter.Flush();
	$StringWriter.Flush();
	Write-Output $StringWriter.ToString();
}
 
WriteXmlToScreen $XML;

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

#For PRTG - default parameter list:

#-deviceID %deviceid -targetHost '%host' -OID '1.3.6.1.2.1.43.10.2.1.4.1.1'

#find a list with OID examples at the following link as they differ by vendor and partly model

#https://www.it-admins.com/it-assets-database/online-manual/printers/

param(

[Parameter(

Mandatory = $true

)][int]$deviceID,

[Parameter(

Mandatory = $true

)][string]$targetHost,

[Parameter(

Mandatory = $true

)][string]$OID = "",

[string]$Community = "public"

)

Import-Module -Name SNMP

[string]$ErrorText = "" #will hold error information to be returned to PRTG text field / sensor message

[int]$ErrorValue = 0 #default no errors initiated with 0 (0 = OK | 1 = Warning | 2 = Error)

[string]$LogFile = "$PSScriptRoot\PrinterLog_$deviceID.log"

[int]$result = -2 #standard response would be negative 2 as initialized integer value

try{

$result = (Get-SNMPdata -IP $targetHost -OID $OID -Community $Community).Data

#if no error occured, we have the current page count as a result

} catch {

$result = -1 #if any error happened, we now have the result set to negative 1

$ErrorText += "error: can't read SNMP OID value from device "

$ErrorValue = 2

}

[int]$returnValue = 0 #default return value, integer, initialized with 0

[string]$LogFileContent = -1 #default logfilecontent is integer, intialized with negative 1

[string]$LogFileDate

[int]$LogFileCount = -1

if ($result -gt 0) {

#we seem to have a page count from SNMP

if (Test-Path $LogFile -PathType Leaf){

#we do have an exisiting LogFile

try{

$LogFileContent = Get-Content $LogFile -Raw

if ($LogFileContent.Length -gt 0){

$LogFileDate = $LogFileContent.Split("|")[0]

$LogFileCount = $LogFileContent.Split("|")[1]

} else {

#LogFile empty

$LogFileCount = 0

$ErrorText += "warning: initial run or no logfile yet "

$ErrorValue = 1

}

} catch {

$LogFileCount = -2 #negative 2 as error catch

} finally {

if ($LogFileCount -gt 0){

#no error occured as for the LogFile reading

if (($result - $LogFileCount) -gt -1){

#it should be either the same value or higher then the last logfile value

$returnValue = $result - $LogFileCount

} else {

#LogFile value is higher then current count - this is weird

#still returning this - but it will show a negative count and should raise a flag

$returnValue = $result - $LogFileCount

$ErrorText += "error: logfile value higher then current printer read "

$ErrorValue = 2

}

} else {

#there was some kind of error in the LogFile read - not an integer value or new Logfile started and result was 0

$ErrorText += "error: can't read logfile for data compare "

$ErrorValue = 2

}

} else {

#no LogFile yet - will need one but return value as difference initially will stay 0

#we set the LogFileContent to 0 as this is the current status

$LogFileCount = 0

$ErrorText += "warning: initial run or no logfile yet or wrong data format "

$ErrorValue = 1

}

#we need to write the positive SNMP OID result to the LogFile

#but only if the date differs more then 1x day

[bool]$WriteLog = $false

[string]$CurrentDate = (Get-Date -Format yyyy-MM-dd)

if ($LogFileDate.Length -gt 0){

try{

if ((New-TimeSpan -Start $LogFileDate -End $CurrentDate).Days -gt 1){

#date difference more then 1 day

$WriteLog = $true

} else {

#date difference not sufficient - same day? Future?

if ((New-TimeSpan -Start $LogFileDate -End $CurrentDate).Days -lt 0){

#LogFile newer then current date? That's just wrong

$WriteLog = $true

$ErrorText += "warning: Logfile date above current date $LogFileDate - rewriting log"

$ErrorValue = 1

} else {

#not greater then 1 day (0 and 1) or less must be equal as a result...

#nothing to do as WriteLog is initialized false

}

} catch {

#couldn't compare the date - let's write the Log to be save

$WriteLog = $true

}

} else {

#LogFileDate length 0 means we need to write a logfile as it might not exist

$WriteLog = $true

}

if ($WriteLog){

try {

Set-Content -Path $LogFile -Value "$CurrentDate|$result"

$LogFileDate = $CurrentDate

} catch {

#there was an issue writing to the LogFile

$ErrorText += "error: can't write to logfile "

$ErrorValue = 2

}

} else {

#no pagecount available due to errors or issues

#uncomment the next line for debugging only

#$returnValue = $result

#the returnValue will now show the current result value and point therefor to the error section

$ErrorText += "error: no pagecount available "

$ErrorValue = 2

}

#Assuming no errors - the text result will be the last LogFile date

if ($ErrorText.Length -eq 0){

$ErrorText = "Last LogFile write date: $LogFileDate"

}

$XML = "<prtg>

<channel>last relative Page Count</channel>

<value>$returnValue</value>

</result>

<channel>last total from Printer</channel>

<value>$result</value>

</result>

<channel>last total from LogFile</channel>

<value>$LogFileCount</value>

</result>

<channel>Script Error Status</channel>

<value>$ErrorValue</value>

</result>

<text>$ErrorText</text>

</prtg>"

Function WriteXmlToScreen ([xml]$XML) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen $XML;

June 17, 2020 by Florian Rossmark monitoring prtg recommendations scripts server

Office 365 licenses and activated features per user

Ever wondered which user has what license activated and e.g. which specific feature is activated? Recently I was challenged to see who has the Exchange mailbox feature enabled and who not out of the active user base. Due to the huge user-base this would have taken hours to review manually. Using PowerShell for this, connecting to Office 365, exporting the data eventually to a CSV file and filtering it in Microsoft Excel made this way easier.

The challenge here is that Microsoft uses SKU’s – or licenses – that again can have various features enabled or disabled. Let’s say you have a E5 Plan (license) assigned to your user, you still can disabled various features within this plan, e.g. Microsoft Exchange.

If you take a look at the following website, you find a whole list of GUIDs / IDs of all those various features.

https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-service-plan-reference

In case of the Microsoft Exchange Mailbox feature – we are talking about this GUID: efb87545-963c-4e0d-99df-69c6916d9eb0

Once I had identified the GUID the next step was to grab users from a specific on premise Active Directory OU and query them against Microsoft Azure on the Office 365 environment as for their assigned licenses/features. The results then are collected in a PowerShell object and eventually saved in a defined file name in a CSV format that you easily can filter in Excel afterwards.

Please keep in mind that you will need RSAT tools (PowerShell) and Azure/Office 365 connectivity, rights etc. in order for this to work.

#script looks for all users in a base OU path
#it checks for the license defined per user
#it will write a CSV file in the path the script is in: O365UserMailboxList.csv 

#Base OU path - needs to be set
$BaseOU = "DC=domain,DC=local"


#Exchange mailbox license ID - see link for full list
#https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-service-plan-reference
$ExchangeMailboxId = "efb87545-963c-4e0d-99df-69c6916d9eb0"


#Script starts below - no additional changes should be needed - besides the last line for the output file name
$tbl = New-Object System.Data.DataTable "Results"
$col1 = New-Object System.Data.DataColumn UserPrincipalName
$col2 = New-Object System.Data.DataColumn ADUserEnabled
$col3 = New-Object System.Data.DataColumn ExchangeMailboxEnabled
$col4 = New-Object System.Data.DataColumn ErrorMessage
$tbl.Columns.Add($col1)
$tbl.Columns.Add($col2)
$tbl.Columns.Add($col3)
$tbl.Columns.Add($col4)

$ADUsersFromOU = Get-ADUser -SearchBAse $BaseOU -filter * 

Connect-AzureAD

ForEach ($ADUser In $ADUsersFromOU) {
    $i += 1
    $p = [math]::Round(($i/$ADusersFromOU.Count*100),0)
    Write-Host "..processing $i of"$ADusersFromOU.Count"- $p% - "$ADUser.UserPrincipalName
    $MailboxEnabled = $false
    $ErrorMessage = ""
    try {
        $UserLicenses = Get-AzureADUser -objectid $ADUser.UserPrincipalName | Select -ExpandProperty AssignedPlans | Where {$_.CapabilityStatus -eq "Enabled"}
    } catch {
        $ErrorMessage = $Error[0]
        #Write-Host "....Error: "$Error[0]
    }
    ForEach ($ULicense In $UserLicenses) {
        If ($ULicense.ServicePlanId -eq $ExchangeMailboxId)
        {
            $MailboxEnabled = $true
            break;
        }
    }
    $row = $tbl.NewRow()
    $row.UserPrincipalName = $ADUser.UserPrincipalName
    $row.ADUserEnabled = $ADUser.Enabled
    $row.ExchangeMailboxEnabled = $MailboxEnabled
    $row.ErrorMessage = $ErrorMessage
    $tbl.Rows.Add($row)
}

$tbl |ft

#adjust this export-file name if you want to
$tbl | Export-Csv -Path .\O365UserMailboxList.csv

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

#script looks for all users in a base OU path

#it checks for the license defined per user

#it will write a CSV file in the path the script is in: O365UserMailboxList.csv

#Base OU path - needs to be set

$BaseOU = "DC=domain,DC=local"

#Exchange mailbox license ID - see link for full list

#https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-service-plan-reference

$ExchangeMailboxId = "efb87545-963c-4e0d-99df-69c6916d9eb0"

#Script starts below - no additional changes should be needed - besides the last line for the output file name

$tbl = New-Object System.Data.DataTable "Results"

$col1 = New-Object System.Data.DataColumn UserPrincipalName

$col2 = New-Object System.Data.DataColumn ADUserEnabled

$col3 = New-Object System.Data.DataColumn ExchangeMailboxEnabled

$col4 = New-Object System.Data.DataColumn ErrorMessage

$tbl.Columns.Add($col1)

$tbl.Columns.Add($col2)

$tbl.Columns.Add($col3)

$tbl.Columns.Add($col4)

$ADUsersFromOU = Get-ADUser -SearchBAse $BaseOU -filter *

Connect-AzureAD

ForEach ($ADUser In $ADUsersFromOU) {

$i += 1

$p = [math]::Round(($i/$ADusersFromOU.Count*100),0)

Write-Host "..processing $i of"$ADusersFromOU.Count"- $p% - "$ADUser.UserPrincipalName

$MailboxEnabled = $false

$ErrorMessage = ""

try {

$UserLicenses = Get-AzureADUser -objectid $ADUser.UserPrincipalName | Select -ExpandProperty AssignedPlans | Where {$_.CapabilityStatus -eq "Enabled"}

} catch {

$ErrorMessage = $Error[0]

#Write-Host "....Error: "$Error[0]

}

ForEach ($ULicense In $UserLicenses) {

If ($ULicense.ServicePlanId -eq $ExchangeMailboxId)

{

$MailboxEnabled = $true

break;

}

$row = $tbl.NewRow()

$row.UserPrincipalName = $ADUser.UserPrincipalName

$row.ADUserEnabled = $ADUser.Enabled

$row.ExchangeMailboxEnabled = $MailboxEnabled

$row.ErrorMessage = $ErrorMessage

$tbl.Rows.Add($row)

}

$tbl |ft

#adjust this export-file name if you want to

$tbl | Export-Csv -Path .\O365UserMailboxList.csv

March 24, 2020 by Florian Rossmark o365 / m365 scripts

RDS – Fix broken local RDS links in start menu

RemoteApp and Desktop Connections are quite powerful. Still, it happens that RDS icons configured through your Windows Remote Desktop Application broker either won’t update or vanish. This can have various reasons. Out of experience, the easiest way is to manually clean up and then configure the source again – as explained step by step below…

Open REGEDIT as the current user (DO NOT run as!)
1. Navigate to:
  1. Computer\HKEY_CURRENT_USER\Software\Microsoft\Workspaces
2. Delete the whole key WORKSPACES (just delete it! no worries)
In Windows Explorer
1. Navigate to:
  1. %appdata%\Microsoft\Workspaces
  2. Delete the whole WORKSPACES folder (yes – delete it!)
2. Navigate to:
  1. %appdata%\Microsoft\Windows\Start Menu\Programs
  2. If there is a folder “RDS Farm Name (RADC)” then delete it completely
(see footer note) Open Control Pannel
1. Navigate to “RemoteApp and Desktop Connections” or type in search box: remote
2. There should be nothing in the connections, add a new one while clicking on “Access RemoteApp and desktops” in the left hand menu
  1. use your RDS URL
3. If asked for credentials, use the users credentials or have them type em in
4. This should finish successfully
You now should see the applications in the start menu again

Note: If you have a GPO or script configured to auto-configure the Control-Panel, you could just reboot as well instead of manually configuring the Control Panel again.

October 3, 2019 by Florian Rossmark configuration scripts server solutions windows

Search the Windows Security Eventlog for a string / text

Lately I had to search a lot through logs – as you can tell by all my postings… I just had to create yet another script that allows you to search through the Windows Security Eventlog – while the script is easily adjustable to other log types like application log or system log.

It’s not the most pretty script – but it certainly works. Don’t be surprised if the script takes it sweet time – it might be it needs to read through a lot of eventlog entries.

param(
    [string] $RemoteComputer = "",
    [string] $SearchString = "",
	[int] 	 $MaxAgeHours = 24,
    [bool]   $FullDetails = $false
)

$Query = @"
<QueryList>
    <Query Id="0" Path="Security">
    <Select Path="Security">*</Select>
  </Query>
</QueryList>
"@

if ($RemoteComputer.Length -gt 0){
	if ($FullDetails) {
		Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) -ComputerName $RemoteComputer |fl
	} else {
		Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) -ComputerName $RemoteComputer |ft
	}
} else {
	if ($FullDetails) {
		Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) |fl
	} else {
		Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) |ft
	}
}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

param(

[string] $RemoteComputer = "",

[string] $SearchString = "",

[int] $MaxAgeHours = 24,

[bool] $FullDetails = $false

)

$Query = @"

</Query>

</QueryList>

"@

if ($RemoteComputer.Length -gt 0){

if ($FullDetails) {

Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) -ComputerName $RemoteComputer |fl

} else {

Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) -ComputerName $RemoteComputer |ft

}

} else {

if ($FullDetails) {

Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) |fl

} else {

Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) |ft

}

August 7, 2019 by Florian Rossmark scripts security server

Active Directory password reset events and group change events

The script below uses the security event log on defined DCs within your Active Directory to export events related to certain activities. Eventually the script will export this even to an email and send it to you as a report – if needed.

As is – the script will specifically look for those events

4724 – a user password was reset by an administrator respective via Active Directory Users and Groups MMC (or similar)
4728 – a user was added to a security group
4729 – a user was removed from a security group

There are more events – specifically events related to adding/removing users from distribution groups etc. – for the purpose of for what I wrote the script, I did not need this. Still, I thought it is worth publishing this, as others might find it helpful.

To add more events – just adjust line 19 – eventually just add more “or EventID=1234” statements – should be rather easy… in theory you could build that out as a parameter as well and inject it via the script.

param(
    [string] $DomainControllers = "",
    [bool]   $FullDetails = $false,
    [int]    $HoursInThePast = 24,
    [bool]   $SendMail = $false,
    [string] $SMTPfrom = "",
    [string] $SMTPto = "",
    [string] $SMTPsubject = "",
    [string] $SMTPserver = ""
)

#4724 - user PW reset by admin
#4728 - user added to security group
#4729 - user removed from security group

$Query = @"
<QueryList>
    <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4724 or EventID=4728 or EventID=4729)]]</Select>
  </Query>
</QueryList>
"@

If ($DomainControllers.Length -eq 0) {
    Import-Module ActiveDirectory
    $DomainControllers = Get-ADDomainController -Filter * | Select-Object -ExpandProperty Name
    ForEach($DC In $DomainControllers) {
        Write-Host "checking DC: $DC"
        $OutPut += "Export from DC: $DC" 
        $OutPut += ""
        If ($FullDetails) {
            $OutPut += Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | fl | Out-String
        } Else {
            $OutPut += Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | ft | Out-String
        }
    }
} Else {
    $DCs = $DomainControllers.Split(',')
    foreach ($DomainController in $DCs) {
        Write-Host "checking DC: $DomainController"
        $OutPut += "Export from DC: $DomainController" 
        $OutPut += ""
        If ($FullDetails) {
            $OutPut += Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | fl | Out-String
        } Else {
            $OutPut += Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | ft | Out-String
        }
    }
}

$OutPut

if ($SendMail) {
    Send-MailMessage -From $SMTPfrom -to $SMTPto -Subject $SMTPsubject -Body $OutPut -SmtpServer $SMTPserver
}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

param(

[string] $DomainControllers = "",

[bool] $FullDetails = $false,

[int] $HoursInThePast = 24,

[bool] $SendMail = $false,

[string] $SMTPfrom = "",

[string] $SMTPto = "",

[string] $SMTPsubject = "",

[string] $SMTPserver = ""

)

#4724 - user PW reset by admin

#4728 - user added to security group

#4729 - user removed from security group

$Query = @"

<Select Path="Security">*[System[(EventID=4724 or EventID=4728 or EventID=4729)]]</Select>

</Query>

</QueryList>

"@

If ($DomainControllers.Length -eq 0) {

Import-Module ActiveDirectory

$DomainControllers = Get-ADDomainController -Filter * | Select-Object -ExpandProperty Name

ForEach($DC In $DomainControllers) {

Write-Host "checking DC: $DC"

$OutPut += "Export from DC: $DC"

$OutPut += ""

If ($FullDetails) {

$OutPut += Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | fl | Out-String

} Else {

$OutPut += Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | ft | Out-String

}

} Else {

$DCs = $DomainControllers.Split(',')

foreach ($DomainController in $DCs) {

Write-Host "checking DC: $DomainController"

$OutPut += "Export from DC: $DomainController"

$OutPut += ""

If ($FullDetails) {

$OutPut += Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | fl | Out-String

} Else {

$OutPut += Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | ft | Out-String

}

$OutPut

if ($SendMail) {

Send-MailMessage -From $SMTPfrom -to $SMTPto -Subject $SMTPsubject -Body $OutPut -SmtpServer $SMTPserver

}

August 1, 2019 by Florian Rossmark scripts security server

APC InRow A/C error monitoring with PRTG

It is rather hard to get valuable alarm monitoring from an APC InRow air conditioning unit. The APC A/C’s are a real pain when it comes to this, it might even be that this same principle applies to APC UPS units, but I did not have yet time to test this out.

What I really wanted is a way to monitor alerts that the unit reports. Doing so seemed to be fine with a simple SNMP sensor in PRTG but the real challenge was getting the alert text. Now, there are SNMP channels but they are only available when an alert is ongoing, meaning when there is no alert status the whole OID fails.

To compensate this, I ended up writing a simple PowerShell script that interprets the SNMP OID results, even ignores a certain failure cause I didn’t care about it, and reports back the results as a total error count (set the channel to ErrorLimit = 0 in PRTG) and if there are Errors it will write them to the text.

This is an Advanced EXE script that needs to reside in the following path:

C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML

1	C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML

It expects the parameters for community and IP-Address

public %host

1	public %host

The results of the script will always hold the top 4 error messages, but it will exclude the phrase “No Backup Units Available Alarm” from the error count – cause in certain setups like hours there are multiple units but they are not necessarily clustered – this is not a full alarm rather then a warning in my case. Feel free to adjust this in the script if you want to raise the error. You could simply remove / remark the following line:

$TotalErrors.Data = $TotalErrors.Data - $SubstractError

1	$TotalErrors.Data = $TotalErrors.Data - $SubstractError

Here a picture of a real world alarm respective issue with the APC InRow A/C in PRTG generated by the script

Param(
    $Community,
    $IP
)

$TotalErrors = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.1.0
$Error1 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.1
$Error2 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.2
$Error3 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.3
$Error4 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.4

$SubstractError = 0

if ($Error1.Data.length -gt 0) {
    if ($Error1.Data -ne "NoSuchInstance") {
        if ($Error1.Data -eq "No Backup Units Available Alarm") {    
            $SubstractError += 1
        }
        $ErrorText = $Error1.Data
    }
}
if ($Error2.Data.length -gt 0) {
    if ($Error2.Data -ne "NoSuchInstance") {
        if ($Error2.Data -eq "No Backup Units Available Alarm") {    
            $SubstractError += 1
        }
        $ErrorText += " - " + $Error2.Data
    }
}
if ($Error3.Data.length -gt 0) {
    if ($Error3.Data -ne "NoSuchInstance") {
        if ($Error3.Data -eq "No Backup Units Available Alarm") {    
            $SubstractError += 1
        }
        $ErrorText += " - " + $Error3.Data
    }
}
if ($Error4.Data.length -gt 0) {
    if ($Error4.Data -ne "NoSuchInstance") {
        if ($Error4.Data -eq "No Backup Units Available Alarm") {    
            $SubstractError += 1
        }
        $ErrorText += " - " + $Error4.Data
    }
}

$TotalErrors.Data = $TotalErrors.Data - $SubstractError

$XML =  "<prtg>"
$XML += "<result><channel>Total Errors</channel><value>" + $TotalErrors.Data + "</value><unit>Count</unit></result>"
$XML += "<text>$ErrorText</text>"
$XML += "</prtg>"

Function WriteXmlToScreen ([xml]$xml)
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen $XML

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

Param(

$Community,

$IP

)

$TotalErrors = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.1.0

$Error1 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.1

$Error2 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.2

$Error3 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.3

$Error4 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.4

$SubstractError = 0

if ($Error1.Data.length -gt 0) {

if ($Error1.Data -ne "NoSuchInstance") {

if ($Error1.Data -eq "No Backup Units Available Alarm") {

$SubstractError += 1

}

$ErrorText = $Error1.Data

}

if ($Error2.Data.length -gt 0) {

if ($Error2.Data -ne "NoSuchInstance") {

if ($Error2.Data -eq "No Backup Units Available Alarm") {

$SubstractError += 1

}

$ErrorText += " - " + $Error2.Data

}

if ($Error3.Data.length -gt 0) {

if ($Error3.Data -ne "NoSuchInstance") {

if ($Error3.Data -eq "No Backup Units Available Alarm") {

$SubstractError += 1

}

$ErrorText += " - " + $Error3.Data

}

if ($Error4.Data.length -gt 0) {

if ($Error4.Data -ne "NoSuchInstance") {

if ($Error4.Data -eq "No Backup Units Available Alarm") {

$SubstractError += 1

}

$ErrorText += " - " + $Error4.Data

}

$TotalErrors.Data = $TotalErrors.Data - $SubstractError

$XML = "<prtg>"

$XML += "<result><channel>Total Errors</channel><value>" + $TotalErrors.Data + "</value><unit>Count</unit></result>"

$XML += "<text>$ErrorText</text>"

$XML += "</prtg>"

Function WriteXmlToScreen ([xml]$xml)

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen $XML

July 19, 2019 by Florian Rossmark monitoring prtg scripts

Move user Documents and Desktop to OneDrive

The PowerShell script below was design to move Documents, Music, Videos, Pictures, Favorites and Desktop to a sub-folder in a connected OneDrive. In theory the script does not depend on OneDrive and could be adjusted to any other destination.

While it normally is wise to engage GPOs to adjust those paths to internal server resources, this is not possible easily while using OneDrive. The script therefor works better here.

What it does

is the current path per folder accessible
does the target path exist
1. YES: adjust the registry respective folder targets to the target path – FINISHED
2. NO: create the target folders – see 3.
is the source path on the same volume / partition – like C:
1. YES: see below – 4.
2. NO: check if there is enough free space for the amount of data needed to be moved
  1. YES: see below – 4.
  2. ALMOST: YELLOW warning – see below 4.
  3. NO: RED error – you could still proceed or simply close the script
move the data to the new target folder
remove the old folder – if not possible rename it

The script retains the special icons for the folders and engages the Windows API to adjust the folder paths.

What you need to do

Adjust the target-path in the top of the script
If desired, adjust the minimum free space value (2 GB by default) for the warning in regards to the free space – this only matters if the source and target volume / partition aren’t the same

To start the script, either right click and say run with PowerShell or run it directly in a PowerShell. This script will need to execute in the user-context and does NOT need administrative rights.

Clear
$NewRootPath = "$env:USERPROFILE\OneDrive - MYDOMAIN\User Profile"
$regUSF = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
$regSF = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" 

$Folders = "Personal,My Pictures,My Music,My Video,Favorites,Desktop"
$Folders = $Folders.Split(",")
$FolderNames = "Documents,Pictures,Music,Videos,Favorites,Desktop"
$FolderNames = $FolderNames.Split(",")

$AddSize = 2000000000 #free space in Bytes to add if files are on a different volume (2000000000 = about 2 GB)

$ArrayPosition = -1

Function Move-KnownFolderPath {
    Param (
            [Parameter(Mandatory = $true)]
            [ValidateSet('Desktop', 'Documents', 'Downloads', 'Favorites', 'Music', 'Pictures', 'Videos')]
            [string]$KnownFolder,
            [Parameter(Mandatory = $true)]
            [string]$Path
    )

    # Known Folder GUIDs
    $KnownFolders = @{
        'Desktop' = @('B4BFCC3A-DB2C-424C-B029-7FE99A87C641');
        'Documents' = @('FDD39AD0-238F-46AF-ADB4-6C85480369C7','f42ee2d3-909f-4907-8871-4c22fc0bf756');
        'Downloads' = @('374DE290-123F-4565-9164-39C4925E467B','7d83ee9b-2244-4e70-b1f5-5393042af1e4'); #not in use - just in case you want to use it..
        'Favorites' = '1777F761-68AD-4D8A-87BD-30B759FA33DD';
        'Music' = @('4BD8D571-6D19-48D3-BE97-422220080E43','a0c69a99-21c8-4671-8703-7934162fcf1d');
        'Pictures' = @('33E28130-4E1E-4676-835A-98395C3BC3BB','0ddd015d-b06c-45d5-8c4c-f59713854639');
        'Videos' = @('18989B1D-99B5-455B-841C-AB7C74E4DDFC','35286a68-3c57-41a1-bbb1-0eae73d76c95');
    }

    $FolderGUID = ([System.Management.Automation.PSTypeName]'KnownFolders').Type
	#create the Type entry if it does not yet exist / relates to the Registry eventually
    If (-not $FolderGUID) {
        $KnownFolderGUID = @'
[DllImport("shell32.dll")]
public extern static int SHSetKnownFolderPath(ref Guid folderId, uint flags, IntPtr token, [MarshalAs(UnmanagedType.LPWStr)] string path);
'@
        $FolderGUID = Add-Type -MemberDefinition $KnownFolderGUID -Name 'KnownFolders' -Namespace 'SHSetKnownFolderPath' -PassThru
    }

    If(!(Test-Path $Path)){
		#in case folder does yet exist, we create it
		Try {
			New-Item -Path $Path -Type Directory -Force -ErrorAction SilentlyContinue
		} Catch {}
    }
	#set the new folder path
	ForEach ($TmpGUID in $KnownFolders[$KnownFolder]) {
		$tmp = $FolderGUID::SHSetKnownFolderPath([ref]$TmpGUID, 0, 0, $Path)	
	}	
	Attrib +r $Path	#needed to retain the icon 
}

ForEach ($Folder In $Folders)
{	
	$ArrayPosition += 1
    Write-Host "Working on folder"$FolderNames[$ArrayPosition] -BackgroundColor DarkGreen
    $SourcePath = (Get-ItemProperty -Path $regUSF -Name $Folder).$Folder
    If ($SourcePath.Length -gt 0)
    {
		Write-Host "..checking source path: $SourcePath"
		If ((Test-Path -Path $SourcePath)){
			Write-Host "....path is accessible"
			$CompSource = Get-Item -Path $SourcePath
			$CompareResult = $false
			If ((Test-Path -Path ($NewRootPath + "\" + $CompSource.Name))){
				$CompTarget = Get-Item -Path ($NewRootPath + "\" + $CompSource.Name)
				Write-Host "..Comparing Source Path: "$CompSource.FullName
				Write-Host "....with Target Path:    "$CompTarget.FullName
				If ($CompSource.FullName.ToLower() -eq $CompTarget.FullName.ToLower()){
					$CompareResult = $true
				} Else {
					$CompareResult = $false
				}
			} Else {
				Write-Host "..Target Path does not exist"
			}
			If ($CompareResult -eq $true){
				Write-Host "..Source and Target path are identical: $CompTarget" -ForegroundColor Yellow
				Write-Host "....Not applying any changes!" -ForegroundColor Yellow
				Pause
			} Else {
				$SourceFolder = Get-Item -Path $SourcePath
				Write-Host "..accessing source folder $SourceFolder" -ForegroundColor Green
				If (!(Test-Path -Path ($NewRootPath + '\' + $SourceFolder.Name))){
					Move-KnownFolderPath -KnownFolder ("" + $FolderNames[$ArrayPosition] + "") -Path ($NewRootPath + '\' + $FolderNames[$ArrayPosition])
					$TargetPath = Get-Item -Path ("$NewRootPath\" + $FolderNames[$ArrayPosition])
					Write-Host "..created new folder $TargetPath"
					
					#compare source size with target free space here
					Write-Host "..Comparing Source and Target drive letters"
					If ($NewRootPath.SubString(0,2).ToLower() -ne $SourcePath.SubString(0,2).ToLower())
					{
						#source drives are different.. we need to obey the SourceSize against the free space on the target
						Write-Host "....Source and Target drive letters are different"
						Write-Host "......Please wait while calculating the source size"
						$SourceSize = (Get-ChildItem -Path $SourcePath -Recurse | Measure-Object -Property Length -Sum -ErrorAction SilentlyContinue).Sum
						$TargetFree = Get-PSDrive $NewRootPath.SubString(0,1) | Select-Object Free
						If ($SourceSize -gt $TargetFree.Free) {
							Write-Host "......The Source size of $SourceSize Bytes is bigger then the free space on the Target of $TargetFree.Free Bytes" -ForegroundColor Red
						} ElseIf (($SourceSize + $AddSize) -gt $TargetFree.Free) {
							Write-Host "......The Source size of $SourceSize Bytes is close to the free space on the Target of $TargetFree.Free Bytes" -ForegroundColor Yellow
						} Else {
							Write-Host "......The Source size of $TargetFree.Free Bytes is sufficient to hold the data from the Source of $SourceSize Bytes" -ForegroundColor Green
						}
						Pause
					} Else {
						Write-Host "....Source and Targets are on the same drive, all good"
					}
					
					Write-Host "..Moving data from: $SourcePath"
					Write-Host "....to folder:      $TargetPath"
					Write-Host "....This can take several minutes..."
					Move-Item -Path ("" + $SourcePath + "\*") -Destination $TargetPath -Force -ErrorAction SilentlyContinue
					Write-Host "....Done moving data"
				} Else {
					Write-Host "..Warning - Target Path exists already: $CompTarget" -ForegroundColor Yellow
					Write-Host "....Files will not be moved, registry still will be adjusted to the target path!" -ForegroundColor Yellow
					Pause
					Move-KnownFolderPath -KnownFolder ("" + $FolderNames[$ArrayPosition] + "") -Path ($NewRootPath + '\' + $FolderNames[$ArrayPosition])
					Write-Host "....Finished adjusting registry"
				}
				Write-Host "..Trying to remove $SourcePath"
				Pause
				Try {
					Attrib -r -s $SourceFolder.FullName	
					Remove-Item -Path $SourceFolder.FullName -Force -Confirm:$false -Recurse -ErrorAction SilentlyContinue
				} Catch {}	
				Try {
					Attrib -r -s ($SourceFolder + "\desktop.ini")	
					Remove-Item -Path ($SourceFolder + "\desktop.ini") -Force -Confirm:$false -ErrorAction SilentlyContinue
				} Catch {}						
				Try {
					Rename-Item -Path $SourceFolder -NewName ($SourceFolder.Name + ".old") -Force -ErrorAction SilentlyContinue
				} Catch {}		
			}
		} Else {
			Write-Host "....SourceFolder Path invalid: $SourcePath" -ForegroundColor Red
		}
    } 
	Write-Host "..Done processing"$FolderNames[$ArrayPosition] -BackgroundColor Blue
	Pause
}
Write-Host "Script finished processing" -ForegroundColor Green
Pause

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

Clear

$NewRootPath = "$env:USERPROFILE\OneDrive - MYDOMAIN\User Profile"

$regUSF = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"

$regSF = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"

$Folders = "Personal,My Pictures,My Music,My Video,Favorites,Desktop"

$Folders = $Folders.Split(",")

$FolderNames = "Documents,Pictures,Music,Videos,Favorites,Desktop"

$FolderNames = $FolderNames.Split(",")

$AddSize = 2000000000 #free space in Bytes to add if files are on a different volume (2000000000 = about 2 GB)

$ArrayPosition = -1

Function Move-KnownFolderPath {

Param (

[Parameter(Mandatory = $true)]

[ValidateSet('Desktop', 'Documents', 'Downloads', 'Favorites', 'Music', 'Pictures', 'Videos')]

[string]$KnownFolder,

[Parameter(Mandatory = $true)]

[string]$Path

)

# Known Folder GUIDs

$KnownFolders = @{

'Desktop' = @('B4BFCC3A-DB2C-424C-B029-7FE99A87C641');

'Documents' = @('FDD39AD0-238F-46AF-ADB4-6C85480369C7','f42ee2d3-909f-4907-8871-4c22fc0bf756');

'Downloads' = @('374DE290-123F-4565-9164-39C4925E467B','7d83ee9b-2244-4e70-b1f5-5393042af1e4'); #not in use - just in case you want to use it..

'Favorites' = '1777F761-68AD-4D8A-87BD-30B759FA33DD';

'Music' = @('4BD8D571-6D19-48D3-BE97-422220080E43','a0c69a99-21c8-4671-8703-7934162fcf1d');

'Pictures' = @('33E28130-4E1E-4676-835A-98395C3BC3BB','0ddd015d-b06c-45d5-8c4c-f59713854639');

'Videos' = @('18989B1D-99B5-455B-841C-AB7C74E4DDFC','35286a68-3c57-41a1-bbb1-0eae73d76c95');

}

$FolderGUID = ([System.Management.Automation.PSTypeName]'KnownFolders').Type

#create the Type entry if it does not yet exist / relates to the Registry eventually

If (-not $FolderGUID) {

$KnownFolderGUID = @'

[DllImport("shell32.dll")]

public extern static int SHSetKnownFolderPath(ref Guid folderId, uint flags, IntPtr token, [MarshalAs(UnmanagedType.LPWStr)] string path);

'@

$FolderGUID = Add-Type -MemberDefinition $KnownFolderGUID -Name 'KnownFolders' -Namespace 'SHSetKnownFolderPath' -PassThru

}

If(!(Test-Path $Path)){

#in case folder does yet exist, we create it

Try {

New-Item -Path $Path -Type Directory -Force -ErrorAction SilentlyContinue

} Catch {}

}

#set the new folder path

ForEach ($TmpGUID in $KnownFolders[$KnownFolder]) {

$tmp = $FolderGUID::SHSetKnownFolderPath([ref]$TmpGUID, 0, 0, $Path)

}

Attrib +r $Path #needed to retain the icon

}

ForEach ($Folder In $Folders)

{

$ArrayPosition += 1

Write-Host "Working on folder"$FolderNames[$ArrayPosition] -BackgroundColor DarkGreen

$SourcePath = (Get-ItemProperty -Path $regUSF -Name $Folder).$Folder

If ($SourcePath.Length -gt 0)

{

Write-Host "..checking source path: $SourcePath"

If ((Test-Path -Path $SourcePath)){

Write-Host "....path is accessible"

$CompSource = Get-Item -Path $SourcePath

$CompareResult = $false

If ((Test-Path -Path ($NewRootPath + "\" + $CompSource.Name))){

$CompTarget = Get-Item -Path ($NewRootPath + "\" + $CompSource.Name)

Write-Host "..Comparing Source Path: "$CompSource.FullName

Write-Host "....with Target Path: "$CompTarget.FullName

If ($CompSource.FullName.ToLower() -eq $CompTarget.FullName.ToLower()){

$CompareResult = $true

} Else {

$CompareResult = $false

}

} Else {

Write-Host "..Target Path does not exist"

}

If ($CompareResult -eq $true){

Write-Host "..Source and Target path are identical: $CompTarget" -ForegroundColor Yellow

Write-Host "....Not applying any changes!" -ForegroundColor Yellow

Pause

} Else {

$SourceFolder = Get-Item -Path $SourcePath

Write-Host "..accessing source folder $SourceFolder" -ForegroundColor Green

If (!(Test-Path -Path ($NewRootPath + '\' + $SourceFolder.Name))){

Move-KnownFolderPath -KnownFolder ("" + $FolderNames[$ArrayPosition] + "") -Path ($NewRootPath + '\' + $FolderNames[$ArrayPosition])

$TargetPath = Get-Item -Path ("$NewRootPath\" + $FolderNames[$ArrayPosition])

Write-Host "..created new folder $TargetPath"

#compare source size with target free space here

Write-Host "..Comparing Source and Target drive letters"

If ($NewRootPath.SubString(0,2).ToLower() -ne $SourcePath.SubString(0,2).ToLower())

{

#source drives are different.. we need to obey the SourceSize against the free space on the target

Write-Host "....Source and Target drive letters are different"

Write-Host "......Please wait while calculating the source size"

$SourceSize = (Get-ChildItem -Path $SourcePath -Recurse | Measure-Object -Property Length -Sum -ErrorAction SilentlyContinue).Sum

$TargetFree = Get-PSDrive $NewRootPath.SubString(0,1) | Select-Object Free

If ($SourceSize -gt $TargetFree.Free) {

Write-Host "......The Source size of $SourceSize Bytes is bigger then the free space on the Target of $TargetFree.Free Bytes" -ForegroundColor Red

} ElseIf (($SourceSize + $AddSize) -gt $TargetFree.Free) {

Write-Host "......The Source size of $SourceSize Bytes is close to the free space on the Target of $TargetFree.Free Bytes" -ForegroundColor Yellow

} Else {

Write-Host "......The Source size of $TargetFree.Free Bytes is sufficient to hold the data from the Source of $SourceSize Bytes" -ForegroundColor Green

}

Pause

} Else {

Write-Host "....Source and Targets are on the same drive, all good"

}

Write-Host "..Moving data from: $SourcePath"

Write-Host "....to folder: $TargetPath"

Write-Host "....This can take several minutes..."

Move-Item -Path ("" + $SourcePath + "\*") -Destination $TargetPath -Force -ErrorAction SilentlyContinue

Write-Host "....Done moving data"

} Else {

Write-Host "..Warning - Target Path exists already: $CompTarget" -ForegroundColor Yellow

Write-Host "....Files will not be moved, registry still will be adjusted to the target path!" -ForegroundColor Yellow

Pause

Move-KnownFolderPath -KnownFolder ("" + $FolderNames[$ArrayPosition] + "") -Path ($NewRootPath + '\' + $FolderNames[$ArrayPosition])

Write-Host "....Finished adjusting registry"

}

Write-Host "..Trying to remove $SourcePath"

Pause

Try {

Attrib -r -s $SourceFolder.FullName

Remove-Item -Path $SourceFolder.FullName -Force -Confirm:$false -Recurse -ErrorAction SilentlyContinue

} Catch {}

Try {

Attrib -r -s ($SourceFolder + "\desktop.ini")

Remove-Item -Path ($SourceFolder + "\desktop.ini") -Force -Confirm:$false -ErrorAction SilentlyContinue

} Catch {}

Try {

Rename-Item -Path $SourceFolder -NewName ($SourceFolder.Name + ".old") -Force -ErrorAction SilentlyContinue

} Catch {}

}

} Else {

Write-Host "....SourceFolder Path invalid: $SourcePath" -ForegroundColor Red

}

Write-Host "..Done processing"$FolderNames[$ArrayPosition] -BackgroundColor Blue

Pause

}

Write-Host "Script finished processing" -ForegroundColor Green

Pause

Please be advised – the script will by default not try to move e.g. DOWNLOADS.

You can adjust this, while adding the folder to the two parameter, see sample below.

$Folders = "Personal,My Pictures,My Music,My Video,Favorites,Desktop<strong>,Downloads</strong>" 
$Folders = $Folders.Split(",") 
$FolderNames = "Documents,Pictures,Music,Videos,Favorites,Desktop<strong>,Downloads</strong>" 
$FolderNames = $FolderNames.Split(",")

1

2

3

4

$Folders = "Personal,My Pictures,My Music,My Video,Favorites,Desktop<strong>,Downloads</strong>"

$Folders = $Folders.Split(",")

$FolderNames = "Documents,Pictures,Music,Videos,Favorites,Desktop<strong>,Downloads</strong>"

$FolderNames = $FolderNames.Split(",")

If you want more folder, the script would need some special adjustments. It can be used as a base script, if you want.

April 18, 2019 by Florian Rossmark o365 / m365 recommendations scripts windows

Compare a TRACEROUTE against an expected route

Some times it is important to know if a route to a specific target changed. The best way to check this is for sure to engage a monitoring software. But there might not be a real standard solution in the monitoring software. Now you end up wondering how should you approach this and find a solution to monitor a traceroute result and the hops between you and the target and find out if something changed.

For this exact case I wrote a PowerShell script that expects the following two parameter:

a target IP address or DNS name
a list of IP addresses in order as they should come up in the traceroute (comma separated)
1. include the target IP address as a final HOP

The script then will execute a tracert or traceroute to the target and compare the results step by step against the IP address list you injected. If a HOP is different at a certain position from what was expected an error will be reported back which IP was found and which was expected.

If there are no differences as for the injected IP list, it still could be the case that the traceroute to the target was e.g. longer or shorter – if there then is a difference in the HOP count between the actual traceroute results and the injected IP address list you still will get an error raised and a report back on the amount of found hops and expected hops.

Since the whole output is optimized to be processed by Paessler’s PRTG you also get an error from the sensor / script when the target was not reachable.

Additionally some information on the round-trip-time (RTT) and total HOPs is reported back to the sensor, ending up in a total of four channels:

Target reached
Round Trip Time
Total HOPs
Route matches expected route

As of September 2020 there are two versions of this script. First see the original script, after this I detail out the second version, see further below please.

param(
  [string]$Target,
  [string]$ExpectedRoute
)

$ER = $ExpectedRoute.Split(",");

$Trace=TNC $Target -TraceRoute;
$Count=[string]$Trace.TraceRoute.Count;

$Message = "";
$asexpected = 1;
[int]$i = 0;
ForEach ($IP in $Trace.TraceRoute) {
    If ($i -lt $ER.Length){
        If ($IP.Trim() -ne $ER[$i].Trim()) {
            $Message = "Route change at HOP #" + ($i + 1).ToString() + " - IP expected: " + $ER[$i] + " - IP found: $IP";
            $asexpected = 0;
            break;
        }
    }
    $i += 1;
}

If ($Trace.TraceRoute.Count -ne $ER.Length) {
    If ($asexpected -eq 1) {
        $Message = "Route changed - expected HOP count: " + $ER.Length + " - detected HOP count: " + $Trace.TraceRoute.Count;
        $asexpected = 1;
    }
}

$reached = 0;
If ($Trace.PingSucceeded) {
    $reached = 1;
}


$XML = "<prtg>
    <result>
        <channel>Target reached</channel>
        <value>$reached</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
    </result>
    <result>
        <channel>Round Trip Time</channel>
        <value>" + $Trace.PingReplyDetails.RoundtripTime + "</value>
    </result>
    <result>
        <channel>Total HOPs</channel>
        <value>" + $Trace.TraceRoute.Count + "</value>
    </result>
    <result>
        <channel>Route matches expected route</channel>
        <value>$asexpected</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
        <LimitErrorMsg>$Message</LimitErrorMsg>
    </result>
</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen "$XML"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

param(

[string]$Target,

[string]$ExpectedRoute

)

$ER = $ExpectedRoute.Split(",");

$Trace=TNC $Target -TraceRoute;

$Count=[string]$Trace.TraceRoute.Count;

$Message = "";

$asexpected = 1;

[int]$i = 0;

ForEach ($IP in $Trace.TraceRoute) {

If ($i -lt $ER.Length){

If ($IP.Trim() -ne $ER[$i].Trim()) {

$Message = "Route change at HOP #" + ($i + 1).ToString() + " - IP expected: " + $ER[$i] + " - IP found: $IP";

$asexpected = 0;

break;

}

$i += 1;

}

If ($Trace.TraceRoute.Count -ne $ER.Length) {

If ($asexpected -eq 1) {

$Message = "Route changed - expected HOP count: " + $ER.Length + " - detected HOP count: " + $Trace.TraceRoute.Count;

$asexpected = 1;

}

$reached = 0;

If ($Trace.PingSucceeded) {

$reached = 1;

}

$XML = "<prtg>

<channel>Target reached</channel>

<value>$reached</value>

</result>

<channel>Round Trip Time</channel>

<value>" + $Trace.PingReplyDetails.RoundtripTime + "</value>

</result>

<channel>Total HOPs</channel>

<value>" + $Trace.TraceRoute.Count + "</value>

</result>

<channel>Route matches expected route</channel>

<value>$asexpected</value>

<LimitErrorMsg>$Message</LimitErrorMsg>

</result>

</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

As mentioned further above, after a request in September 2020 in the Paessler KB a version 2 of the script was created. This version includes a third needed parameter – Expected IP address. This also introduces a new channel, that will indicate if the expected IP was found or not (error status).

This can possibly help, as the requestor stated, to determine if route still goes over a primary gateway or a backup gateway. Sometimes you a route might change further below, but a certain router needs to be active. You could also easily change the expected IP behavior to not expected IP behavior, by changing the $ExpectedIPFound value in line 33 to 1 and in line 36 to 0. This will invert the script behavior for this function and therefor only alert (indicate) IF this IP suddenly appears on the route, besides the fact that the route will have changed anyways.

param(
  [string]$Target,
  [string]$ExpectedRoute,
  [string]$ExpectedIP
)

$ER = $ExpectedRoute.Split(",");

$Trace=TNC $Target -TraceRoute;
$Count=[string]$Trace.TraceRoute.Count;

$Message = "";
$asexpected = 1;
[int]$i = 0;
ForEach ($IP in $Trace.TraceRoute) {
    If ($i -lt $ER.Length){
        If ($IP.Trim() -ne $ER[$i].Trim()) {
            $Message = "Route change at HOP #" + ($i + 1).ToString() + " - IP expected: " + $ER[$i] + " - IP found: $IP";
            $asexpected = 0;
            break;
        }
    }
    $i += 1;
}

If ($Trace.TraceRoute.Count -ne $ER.Length) {
    If ($asexpected -eq 1) {
        $Message = "Route changed - expected HOP count: " + $ER.Length + " - detected HOP count: " + $Trace.TraceRoute.Count;
        $asexpected = 1;
    }
}

$ExpectedIPFound = 0
ForEach ($IP in $Trace.TraceRoute) {
	If ($IP.Trim() -eq $ExpectedIP.Trim()) {
		$ExpectedIPFound = 1;
		break;
	}
}

$reached = 0;
If ($Trace.PingSucceeded) {
    $reached = 1;
}

$XML = "<prtg>
    <result>
        <channel>Target reached</channel>
        <value>$reached</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
    </result>
    <result>
        <channel>Round Trip Time</channel>
        <value>" + $Trace.PingReplyDetails.RoundtripTime + "</value>
    </result>
    <result>
        <channel>Total HOPs</channel>
        <value>" + $Trace.TraceRoute.Count + "</value>
    </result>
    <result>
        <channel>Expected IP Found</channel>
        <value>$ExpectedIPFound</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>		
    </result>	
    <result>
        <channel>Route matches expected route</channel>
        <value>$asexpected</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
        <LimitErrorMsg>$Message</LimitErrorMsg>
    </result>
	<text>$Message</text>
</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen "$XML"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

param(

[string]$Target,

[string]$ExpectedRoute,

[string]$ExpectedIP

)

$ER = $ExpectedRoute.Split(",");

$Trace=TNC $Target -TraceRoute;

$Count=[string]$Trace.TraceRoute.Count;

$Message = "";

$asexpected = 1;

[int]$i = 0;

ForEach ($IP in $Trace.TraceRoute) {

If ($i -lt $ER.Length){

If ($IP.Trim() -ne $ER[$i].Trim()) {

$Message = "Route change at HOP #" + ($i + 1).ToString() + " - IP expected: " + $ER[$i] + " - IP found: $IP";

$asexpected = 0;

break;

}

$i += 1;

}

If ($Trace.TraceRoute.Count -ne $ER.Length) {

If ($asexpected -eq 1) {

$Message = "Route changed - expected HOP count: " + $ER.Length + " - detected HOP count: " + $Trace.TraceRoute.Count;

$asexpected = 1;

}

$ExpectedIPFound = 0

ForEach ($IP in $Trace.TraceRoute) {

If ($IP.Trim() -eq $ExpectedIP.Trim()) {

$ExpectedIPFound = 1;

break;

}

$reached = 0;

If ($Trace.PingSucceeded) {

$reached = 1;

}

$XML = "<prtg>

<channel>Target reached</channel>

<value>$reached</value>

</result>

<channel>Round Trip Time</channel>

<value>" + $Trace.PingReplyDetails.RoundtripTime + "</value>

</result>

<channel>Total HOPs</channel>

<value>" + $Trace.TraceRoute.Count + "</value>

</result>

<channel>Expected IP Found</channel>

<value>$ExpectedIPFound</value>

</result>

<channel>Route matches expected route</channel>

<value>$asexpected</value>

<LimitErrorMsg>$Message</LimitErrorMsg>

</result>

<text>$Message</text>

</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

March 6, 2019 by Florian Rossmark monitoring prtg scripts

Request a DNS based web site directly from an IP address

If you are using multiple web servers and some more advanced DNS configuration like e.g. Round-Robin (and other) to load balance and possibly even GEO divide traffic to those web servers while those are all hosting the same web site you might as well want to monitor if this is all working as expected.

The challenge in this case is – your monitoring system might get just a single IP that might even change every now and then back from DNS when it requests it from DNS. So you would end up needing to use the target IP addresses of the individual web servers instead. But those expect you that your request for the web site goes through the domain name, since the servers aren’t supposed to answer on direct host-name / IP address requests or another web-site might be hosted there.

In order to accomplish this – I wrote the script below. It allows you to request a website directly from an IP address while injecting the DNS host in the header section of the Invoke-WebRequest (IWR) in PowerShell.

If you need to target a specific target site you can inject of just the IP address additional information, for example:

Standard parameters
- -DomainName “google.com” -IP “8.8.8.8”
  - this will request the web-root / default page
Sub-Page parameters
- -DomainName “google.com” -IP “8.8.8.8/monitoring.html”
  - this will request the content of /monitoring.html on the IP 8.8.8.8 with the DNS name google.com

PS: Please be aware – the above will not work – 8.8.8.8 is a Google-DNS server and not one of their web-servers. The above is only an example to show what is possible.

The below script output was optimized to be used in PRTG.

param(
    [string] $DomainName = "",
    [string] $IP = "",
    [string] $KeyWord = " ",
    [int] $MinimumResponseSizeInByte = 1,
    [bool] $useHTTPS = $true
)
add-type @"
    using System.Net;
    using System.Security.Cryptography.X509Certificates;
    public class TrustAllCertsPolicy : ICertificatePolicy {
        public bool CheckValidationResult(
            ServicePoint srvPoint, X509Certificate certificate,
            WebRequest request, int certificateProblem) {
            return true;
        }
    }
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

If ($useHTTPS -eq $true) { 
    $Prefix = "https://" 
} Else { 
    $Prefix = "http://" 
}

$IWRResponse = "";
$IWRError = 0;
$IWRErrorMessage = "";

$IWRResponse = Try {
    Invoke-WebRequest -Uri "$Prefix$IP" -Headers @{Host="$DomainName"} -ErrorAction Stop
} Catch {
    $IWRError = $_.Exception.GetHashCode()        
    If ($IWRError -eq 0) {
        $IWRError = 1 
    }
    $IWRErrorMessage = $_.Exception.Message
}
Try {
    $IWRResponse = $IWRResponse.ToString()
} Catch {}

$KeyWordFound = 0
Try {
    If ($IWRResponse.Contains($KeyWord)) { 
        $KeyWordFound = 1 
    } 
} Catch {}

$ResponseSufficient = 0 
Try {
    If ($IWRResponse -gt $MinimumResponseSizeInByte) { 
        $ResponseSufficient = 1 
    }  
} Catch {}

$XML = "<prtg>
    <result>
        <channel>Check result</channel>
        <value>$IWRError</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>0</LimitMinError>
        <LimitMaxError>0</LimitMaxError>
        <LimitErrorMsg>$IWRErrorMessage</LimitErrorMsg>
    </result>
    <result>
        <channel>Keyword found</channel>
        <value>$KeyWordFound</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
        <LimitErrorMsg>Keyword was not found in response</LimitErrorMsg>
    </result>
    <result>
        <channel>Response Length</channel>
        <value>" + $IWRResponse.Length + "</value>
        <VolumeSize>Byte</VolumeSize>
        <NotifyChanged>1</NotifyChanged>
    </result>
    <result>
        <channel>Reponse Length sufficient</channel>
        <value>$ResponseSufficient</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
        <LimitErrorMsg>Response size not sufficient</LimitErrorMsg>
    </result>
</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen "$XML"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

param(

[string] $DomainName = "",

[string] $IP = "",

[string] $KeyWord = " ",

[int] $MinimumResponseSizeInByte = 1,

[bool] $useHTTPS = $true

)

add-type @"

using System.Net;

using System.Security.Cryptography.X509Certificates;

public class TrustAllCertsPolicy : ICertificatePolicy {

public bool CheckValidationResult(

ServicePoint srvPoint, X509Certificate certificate,

WebRequest request, int certificateProblem) {

return true;

}

"@

[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

If ($useHTTPS -eq $true) {

$Prefix = "https://"

} Else {

$Prefix = "http://"

}

$IWRResponse = "";

$IWRError = 0;

$IWRErrorMessage = "";

$IWRResponse = Try {

Invoke-WebRequest -Uri "$Prefix$IP" -Headers @{Host="$DomainName"} -ErrorAction Stop

} Catch {

$IWRError = $_.Exception.GetHashCode()

If ($IWRError -eq 0) {

$IWRError = 1

}

$IWRErrorMessage = $_.Exception.Message

}

Try {

$IWRResponse = $IWRResponse.ToString()

} Catch {}

$KeyWordFound = 0

Try {

If ($IWRResponse.Contains($KeyWord)) {

$KeyWordFound = 1

}

} Catch {}

$ResponseSufficient = 0

Try {

If ($IWRResponse -gt $MinimumResponseSizeInByte) {

$ResponseSufficient = 1

}

} Catch {}

$XML = "<prtg>

<channel>Check result</channel>

<value>$IWRError</value>

<LimitErrorMsg>$IWRErrorMessage</LimitErrorMsg>

</result>

<channel>Keyword found</channel>

<value>$KeyWordFound</value>

<LimitErrorMsg>Keyword was not found in response</LimitErrorMsg>

</result>

<channel>Response Length</channel>

<value>" + $IWRResponse.Length + "</value>

</result>

<channel>Reponse Length sufficient</channel>

<value>$ResponseSufficient</value>

<LimitErrorMsg>Response size not sufficient</LimitErrorMsg>

</result>

</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

March 6, 2019 by Florian Rossmark monitoring prtg scripts web

Using PRTG to monitor manufacturing machines

ns a website from a systems administrator for systems administrators Home IT-Admins CMDB IT-Admins tool IT Search EOL Solutions Blog Contact Links Using PRTG to monitor manufacturing machines

This is a screenshot of the real-time data map of the PRTG instance that is used to monitor the data collected by the Raspberry PI and processed by PRTG to show how the progress of the production machine in manufacturing

A few weeks ago Paessler published on their blog an article I was part of that talked about a case study and implementation of how to use PRTG to real-time monitor a manufacturing machine / production machine while engaging a Raspberry PI.

The article describes what Dominik Wosiek and I implemented to monitor a manufacturing machine in real time. He started using a Raspberry PI and added eventually some magnetic field sensors to the machines robot arms to detect their movement. The data those sensor collected is interpreted by a script on the Raspberry PI and then send off to various HTTP push sensors on a free Paessler PRTG installation (we needed way less then 100 sensors and wanted to keep the installation independent).

On the PRTG instance, the data is of course collected and PRTG creates various graphs for us. We further added a PowerShell script that calculates the past time of the day. Due to us knowing the work-windows of the manufacturing department and how many parts are their daily target, we where able to use a Sensor Factory Sensor in PRTG to do some calculations and eventually show how the machine and the group controlling it was doing while comparing the output of parts relative to the time of the day – respective work hours past.

#1:Production time passed in percent [%]
((channel(2323,2) - (8 * 60)) / (17 * 60 - 8 * 60) * 100)
#2:Part output vs. time [%]
(channel(3232,2)/25000*100) - ((channel(2323,2) - (7 * 60)) / (16 * 60 - 7 * 60) * 100)
#3:Part output count
channel(3232,2)
#4:Part output in percent [%]
(channel(3232,2)/25000*100)

1

2

3

4

5

6

7

8

#1:Production time passed in percent [%]

((channel(2323,2) - (8 * 60)) / (17 * 60 - 8 * 60) * 100)

#2:Part output vs. time [%]

(channel(3232,2)/25000*100) - ((channel(2323,2) - (7 * 60)) / (16 * 60 - 7 * 60) * 100)

#3:Part output count

channel(3232,2)

#4:Part output in percent [%]

(channel(3232,2)/25000*100)

Above is an example configuration of the Sensor Factory Sensor in PRTG. We defined four channels:

Production time passed in percent [%]
1. this sensor pulls the passed time in minutes from the PowerShell Script sensor we created, it then does some math – the formula looks like this
  1. (passed minutes of the day – minutes passed when manufacturing starts) / (minutes passed when manufacturing ends – minutes passed when manufacturing starts) * 100 (to get percent)
  2. what it does in the example above:
    1. pull the passed minutes from the foreign sensor
    2. calculate 8 hours times 60 minutes (start of the day)
    3. subtract start time from passed time of the day (at 10 AM we would end up with 120 minutes)
    4. divide it with 17 hours times 60 or 5 PM in minutes of the day minus 8 AM minutes of the day – this gives you the total minutes between 8 AM and 5 PM – what is the defined manufacturing work time window
    5. multiply the result with 100 to get a percent value that shows the past time relative to the total work time window
Part output vs. time [%]
1. while the formula seems to be longer – it does nothing else then the using the same formula described in channel 4 minus the formula described in channel 2
2. in other words – the value of part output in percent minus the value of work time passed in percent
3. this results in either 0% – meaning the output is exactly at where they should be relative to the time past, or a negative number meaning the output is falling behind while a positive number would mean the part output is higher then expect relative to the time
  1. Note: this is all a bit relative, it might start negative in the morning, catch up to a positive number before lunch break, falling back to a negative number and then catching up to zero by the end of the day.. it depends on various factors but is a pretty good indicator
Part output count
1. this just loads the foreign channel of another sensor to show it in the same table/graph
Part output in percent [%]
1. while 25000 is the daily target amount of produced parts, this channel calculates how much of this was accomplished in percent while dividing the current count with the target count

Here is the script that I created to inject the minutes of the day in to a PRTG sensor – this is above used in channel(2323,2) within the formula.

$CurrentTime = Get-Date -UFormat %R
$CurrentHours = [int]$CurrentTime.ToString().Split(":")[0]
$CurrentMinutes = [int]$CurrentTime.ToString().Split(":")[1]

$MinutesToday = $CurrentMinutes + ($CurrentHours * 60)

$XML = "
<prtg>
    <result>
        <channel>Current Minutes Today</channel>
        <value>$MinutesToday</value>
    </result>
</prtg>
"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}
WriteXmlToScreen "$XML"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

$CurrentTime = Get-Date -UFormat %R

$CurrentHours = [int]$CurrentTime.ToString().Split(":")[0]

$CurrentMinutes = [int]$CurrentTime.ToString().Split(":")[1]

$MinutesToday = $CurrentMinutes + ($CurrentHours * 60)

$XML = "

<prtg>

<channel>Current Minutes Today</channel>

<value>$MinutesToday</value>

</result>

</prtg>

"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

Further details are described in the blog entry on the Paessler web site.

March 6, 2019 by Florian Rossmark monitoring prtg recommendations scripts solutions

Find user account lockout events

There are various ways and tools to tackle this – in the end it boils down to a few facts

account lockouts are logged per domain controller – to be more specific – only on the DC where the lockout happened
- this can be complicated in bigger environments
the lockout event 4771 does not necessarily reveal the initial reason – but it should give you enough information about where it occurred to further investigate

The manual way via Eventlog / Eventviewer in Windows on a DC

right click on the SECURITY eventlog
select Filter Current Log
go to the register card XML
check the box Edit query manually
Insert the XML code below – make sure you replace the USERNAMEHERE value with the actual username
1. no domain
2. exact username
3. NOT case sensitive

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4771)]][EventData[Data[@Name='TargetUserName'] and (Data='USERNAMEHERE')]]</Select>
  </Query>
</QueryList>

1

2

3

4

5

<Select Path="Security">*[System[(EventID=4771)]][EventData[Data[@Name='TargetUserName'] and (Data='USERNAMEHERE')]]</Select>

</Query>

</QueryList>

This results in to a filtered eventlog view for the event id 4771 and the username you specified.

Using PowerShell to automate this

PowerShell can execute a script that would give you the same output – I wrote the script below. It expects at least the parameter UserName – see below for more information.

UserName
- this parameter is mandatory – the exact username without the domain, this is NOT case sensitive
DomainController
- specify this to narrow it down to a single DC – otherwise all domain controllers will be contacted (might take a while)
FullDetails
- set it to $true if you want to see details – otherwise you get only the table format
Example
- Find-AccountLockoutOnDCForUser.ps1 -FullDetails $true -UserName JDoe

param(
    [string] $DomainController = "",
    [string] $UserName = "",
    [bool]   $FullDetails = $false
)

$Query = @"
<QueryList>
    <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4771)]][EventData[Data[@Name='TargetUserName'] and (Data='$UserName')]]</Select>
  </Query>
</QueryList>
"@

If ($DomainController.Length -eq 0) {
    Import-Module ActiveDirectory
    $DomainControllers = Get-ADDomainController -Filter * | Select-Object -ExpandProperty Name
    ForEach($DC In $DomainControllers) {
        Write-Host "checking DC: $DC"
        If ($FullDetails) {
            Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | fl
        } Else {
            Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | ft
        }
    }
} Else {
    If ($FullDetails) {
        Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | fl
    } Else {
        Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | ft
    }
}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

param(

[string] $DomainController = "",

[string] $UserName = "",

[bool] $FullDetails = $false

)

$Query = @"

<Select Path="Security">*[System[(EventID=4771)]][EventData[Data[@Name='TargetUserName'] and (Data='$UserName')]]</Select>

</Query>

</QueryList>

"@

If ($DomainController.Length -eq 0) {

Import-Module ActiveDirectory

$DomainControllers = Get-ADDomainController -Filter * | Select-Object -ExpandProperty Name

ForEach($DC In $DomainControllers) {

Write-Host "checking DC: $DC"

If ($FullDetails) {

Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | fl

} Else {

Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | ft

}

} Else {

If ($FullDetails) {

Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | fl

} Else {

Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | ft

}

February 20, 2019 by Florian Rossmark scripts security server

Windows Search Index monitoring

While rolling out Windows Search Indexing I bumped in to quite a few issues and things I wanted to monitor. One of the main information I actually was after is the amount of files in the Windows Search Index. I could see this information in the Indexing Options of the system and it was constantly updating, but I was not able to find the same information per WMI, PowerShell cmdlets, Performance Counters etc.

This caused me headache cause it was clear that the index a) had to grow till it reached a fully indexed system and b) if the index-size dropped below a certain amount (once finished) I surely had an issue – I saw the database rebuilding out of no where – due to pagefile-issues or space on the partition where the index-database resided.

All of this made it clear that monitoring was inherent – but I did not want to play around with EventIDs – clearly the amount of files in the index was a way better indicator.

This caused me to write the following PowerShell script – it will invoke a command to a target system and count the files currently in the index. This has to be invoked, though the OLEDB provider of the Search Index allows remote-requests, it does not give you accurate numbers for the overall scope of the index on the system using remote requests. Getting to a point to even get this information was quite a challenge, I am certain who ever finds this here will know already, assuming you did some research. Hope it helps, though.

param(
    $TargetServer
)
Invoke-Command -Computer $TargetServer -ScriptBlock {
    $value = 0;
    try{
        $objConn = New-Object System.Data.OleDb.OleDbConnection("Provider=Search.CollatorDSO;Extended Properties='Application=Windows'")
        $sqlCommand = New-Object System.Data.OleDb.OleDbCommand("GROUP ON workid [0] AGGREGATE COUNT() as 'Total' OVER (SELECT workid FROM systemindex)")
        $sqlCommand.Connection = $objConn
        $objConn.open()
        $reader = $sqlCommand.ExecuteReader()
        try{
            $ignore = $reader.Read() #will cause an error but we can ignore it... without this we won't have data
        } catch {}
		$value = $reader[2]
	} catch {}
	$XML = "<prtg>"
	$XML += "<result>"
	$XML += "<channel>indexed files count</channel>"
	$XML += "<value>$value</value>"
	$XML += "</result>"
	$XML += "</prtg>"

	Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
	{
		$StringWriter = New-Object System.IO.StringWriter;
		$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
		$XmlWriter.Formatting = "indented";
		$xml.WriteTo($XmlWriter);
		$XmlWriter.Flush();
		$StringWriter.Flush();
		Write-Output $StringWriter.ToString();
	}

	WriteXmlToScreen $XML;
}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

param(

$TargetServer

)

Invoke-Command -Computer $TargetServer -ScriptBlock {

$value = 0;

try{

$objConn = New-Object System.Data.OleDb.OleDbConnection("Provider=Search.CollatorDSO;Extended Properties='Application=Windows'")

$sqlCommand = New-Object System.Data.OleDb.OleDbCommand("GROUP ON workid [0] AGGREGATE COUNT() as 'Total' OVER (SELECT workid FROM systemindex)")

$sqlCommand.Connection = $objConn

$objConn.open()

$reader = $sqlCommand.ExecuteReader()

try{

$ignore = $reader.Read() #will cause an error but we can ignore it... without this we won't have data

} catch {}

$value = $reader[2]

} catch {}

$XML = "<prtg>"

$XML += "<result>"

$XML += "<channel>indexed files count</channel>"

$XML += "<value>$value</value>"

$XML += "</result>"

$XML += "</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen $XML;

}

An update to this or what I learned

Of course you wouldn’t just monitor the amount of indexed files with the script above. You likely have a dedicated drive / partition where the index resides. You definitive want to monitor the used or free drive space there as well. What you will discover especially in the beginning but as well later if many files are moved or copied to the server, is that the Windows Search Index database will grow after the indexing of huge amounts of files is done and shrink again. As far as I understand this, there is some maintenance and deduplication going on.

On a server with about 14 million files that took about 1 week to index, I ended up with a 250 GB index database, the second it finished it took another 12 hours while the database grew another 100 GB and then shrunk back to actually 200 GB.

Don’t let those numbers scare you, we talk about 10 TB (terra byte) of data in those 14 million files. This is quite a bit. Most other file servers won’t have such huge databases and you won’t see such huge increases while the index database is doing some kind of clean up, nor will it take a week for the initial index to finish.

What I wanted to show with this is simply that you really want to monitor all those information and keep a close eye on it. I saw the database make huge jumps in size in very very short periods of time. If the drive then is full your index possibly would get corrupted and Windows will start from zero again. You want to avoid this. Once the index is finished and no huge incoming file operations take place you won’t see to many jumps anymore. It will calm down. But still, always make sure you have enough space on the partition where the index database resides and proper monitoring on it to be able to react quickly (going as far as automating a service stop for the Windows Search index while the space goes down to avoid database corruption).

February 20, 2019 by Florian Rossmark monitoring prtg scripts server

Monitor the total amount of sessions on your RDS farm

ins a website from a systems administrator for systems administrators Home IT-Admins CMDB IT-Admins tool IT Search EOL Solutions Blog Contact Links Monitor the total amount of sessions on your RDS farm

This script is designed for PRTG and will allow you to go through all your RDS hosts and result back the total amount of sessions and active sessions.

You have various options as server name source, see the parameter section on top of the script.

This was also posted here: https://kb.paessler.com/en/topic/83151-total-user-count-rds-windows-2016

Please note that I grabbed the original script and re-wrote it completely, adjust some issues I encountered and tried to make it as variable as possible.

param(
    $ServerNameSource, #Numeric script config parameter: 1 = Parameter ServerNames list / 2 = Parameter InputFile / 3 = LDAP query with name-prefix / 4 = LDAP query with filter on OU / 5 = LDAP query with name-prefix and OU filter
    $ServerNames, #depending on ServerNameSource (1) - a simple, coma separated list of server names e.g. @("server1", "server2", "server3")
    $ServerNamesInputFile, #depending on ServerNameSource (2) - path and name of a file that holds the server names, one servername per line - e.g.: "C:\servernames.txt"
    $ServerNamesLDAPnameFilter, #depending on ServerNameSource (3 and/or 5) - name search string - can hold wildcards (*) e.g.: "RDS*"
    $ServerNamesLDAPOUFilter, #depending on ServerNameSource (4 and/or 5) - e.g.: "OU=RDS hosts,DC=domain,DC=local"
    $SubstractSessionsPerHost = 2, #substract this amount of sessions per host - due to e.g. two RDS listeners (would make 2 sessions) or additional e.g. 1x ICA listener (would make 3 sessions) etc...
    $UseWMI = $false #use WMI - if not set it will use QWINSTA by default: enable with: $true
)

#function to convert a string to proper XML and write it as output/screen
Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

$ServerNameList;

If ($ServerNameSource -gt 0 -and $ServerNameSource -lt 6) {

    Switch ($ServerNameSource) {
        1 {
            $ServerNameList = $ServerNames;
        }
        2 {
            $ServerNameList = Get-Content $ServerNamesInputFile;
        }
        3 {
            $ServerNameList = (Get-ADComputer -LDAPFilter "(name=$ServerNamesLDAPnameFilter)" | Select Name).Name;
        }
        4 {
            $ServerNameList = (Get-ADComputer -Filter "*" -SearchBase $ServerNamesLDAPOUFilter | Select Name).Name;
        }
        5 {
            $ServerNameList = (Get-ADComputer -LDAPFilter "(name=$ServerNamesLDAPnameFilter)" -SearchBase $ServerNamesLDAPOUFilter | Select Name).Name;
        }
    }
} Else {
    Write-Output "Missing Parameter or wrong value for: ServerNameSource";
    Exit;
}
  
#if the array holds entries
If ($ServerNameList.Count -gt 0) {
 
    $SessionsTotal = 0;
    $SessionsActive = 0;
    $ServersNotReached = 0;

    #go through the list
    ForEach ($ServerName in $ServerNameList) {
        #try to connect - on error jump to catch
        Try {
            $FoundTotal = 0;
            $FoundActive = 0;
            
            
            If ($UseWMI -eq $false) {
                #less control in theory - due to reformatting and searching through the results
                #single execution of the query / command
                $QWinstaResults = qwinsta /server $ServerName | ForEach-Object {
                        $_.Trim() -replace "\s+",","
                    } | ConvertFrom-Csv -Header "SessionName","UserName","ID","State","Type","Device"; #we add manual headers here, since this otherwise can cause issues with the filter later on
                $FoundTotal = $QWinstaResults.Count-1;  #if we use QWINSTA we need to substract one more session from the results
                $FoundActive = ($QWinstaResults | ? { $_.State -eq "Active" }).Count;
            } else {            
                #more control - but might run slower
                #in theory you can invoke all server-names at once, but then you need to run through the table and you lose some control over what was reached and what wasn't - first run might always be slowest depending on amount of servers
                $FoundTotal = (Get-WmiObject -Query "SELECT TotalSessions FROM Win32_TerminalService" -ComputerName $ServerName | Select TotalSessions).TotalSessions;
                $FoundActive = (Get-WmiObject -Query "SELECT ActiveSessions FROM Win32_PerfFormattedData_LocalSessionManager_TerminalServices" -ComputerName $ServerName | Select ActiveSessions).ActiveSessions;
            }

            #SessionsTotal might need a substract depending on the parameter input
            $FoundTotal = $FoundTotal - $SubstractSessionsPerHost;
            #we need to avoid that the substractions is negative, to avoid false substraction
            If ($FoundTotal -le 0){
                $FoundTotal = 0;
            }
            
            #we now add the results to the current counters
            $SessionsTotal += $FoundTotal;
            $SessionsActive += $FoundActive;
        } Catch {
            $ServersNotReached += 1;
        } Finally {
            #nothing to do here
        }
    }

    #Lets put together the results
    $PRTGstring="<prtg>
        <result>
	    <channel>Total Servers checked</channel>
        <value>" +  $ServerNameList.Count + "</value>
	    </result>
        <result>
	    <channel>Total Servers responded</channel>
        <value>" + ($ServerNameList.Count - $ServersNotReached)  + "</value>
	    </result>
        <result>
	    <channel>Total Servers not reached</channel>
        <value>$ServersNotReached</value>
	    </result>
        <result>
	    <channel>Total Sessions found</channel>
        <value>$SessionsTotal</value>
	    </result>
        <result>
	    <channel>Total Sessions active</channel>
        <value>$SessionsActive</value>
	    </result>
        </prtg>"

    #we call the function WriteXmlToScreen to transform the $PRTGstring to XML and output it 
    WriteXmlToScreen "$PRTGstring"

} Else {
    Write-Output "Parameter Error or List did not contain any names / no server names found"
    Exit;
}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

param(

$ServerNameSource, #Numeric script config parameter: 1 = Parameter ServerNames list / 2 = Parameter InputFile / 3 = LDAP query with name-prefix / 4 = LDAP query with filter on OU / 5 = LDAP query with name-prefix and OU filter

$ServerNames, #depending on ServerNameSource (1) - a simple, coma separated list of server names e.g. @("server1", "server2", "server3")

$ServerNamesInputFile, #depending on ServerNameSource (2) - path and name of a file that holds the server names, one servername per line - e.g.: "C:\servernames.txt"

$ServerNamesLDAPnameFilter, #depending on ServerNameSource (3 and/or 5) - name search string - can hold wildcards (*) e.g.: "RDS*"

$ServerNamesLDAPOUFilter, #depending on ServerNameSource (4 and/or 5) - e.g.: "OU=RDS hosts,DC=domain,DC=local"

$SubstractSessionsPerHost = 2, #substract this amount of sessions per host - due to e.g. two RDS listeners (would make 2 sessions) or additional e.g. 1x ICA listener (would make 3 sessions) etc...

$UseWMI = $false #use WMI - if not set it will use QWINSTA by default: enable with: $true

)

#function to convert a string to proper XML and write it as output/screen

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

$ServerNameList;

If ($ServerNameSource -gt 0 -and $ServerNameSource -lt 6) {

Switch ($ServerNameSource) {

1 {

$ServerNameList = $ServerNames;

}

2 {

$ServerNameList = Get-Content $ServerNamesInputFile;

}

3 {

$ServerNameList = (Get-ADComputer -LDAPFilter "(name=$ServerNamesLDAPnameFilter)" | Select Name).Name;

}

4 {

$ServerNameList = (Get-ADComputer -Filter "*" -SearchBase $ServerNamesLDAPOUFilter | Select Name).Name;

}

5 {

$ServerNameList = (Get-ADComputer -LDAPFilter "(name=$ServerNamesLDAPnameFilter)" -SearchBase $ServerNamesLDAPOUFilter | Select Name).Name;

}

} Else {

Write-Output "Missing Parameter or wrong value for: ServerNameSource";

Exit;

}

#if the array holds entries

If ($ServerNameList.Count -gt 0) {

$SessionsTotal = 0;

$SessionsActive = 0;

$ServersNotReached = 0;

#go through the list

ForEach ($ServerName in $ServerNameList) {

#try to connect - on error jump to catch

Try {

$FoundTotal = 0;

$FoundActive = 0;

If ($UseWMI -eq $false) {

#less control in theory - due to reformatting and searching through the results

#single execution of the query / command

$QWinstaResults = qwinsta /server $ServerName | ForEach-Object {

$_.Trim() -replace "\s+",","

} | ConvertFrom-Csv -Header "SessionName","UserName","ID","State","Type","Device"; #we add manual headers here, since this otherwise can cause issues with the filter later on

$FoundTotal = $QWinstaResults.Count-1; #if we use QWINSTA we need to substract one more session from the results

$FoundActive = ($QWinstaResults | ? { $_.State -eq "Active" }).Count;

} else {

#more control - but might run slower

#in theory you can invoke all server-names at once, but then you need to run through the table and you lose some control over what was reached and what wasn't - first run might always be slowest depending on amount of servers

$FoundTotal = (Get-WmiObject -Query "SELECT TotalSessions FROM Win32_TerminalService" -ComputerName $ServerName | Select TotalSessions).TotalSessions;

$FoundActive = (Get-WmiObject -Query "SELECT ActiveSessions FROM Win32_PerfFormattedData_LocalSessionManager_TerminalServices" -ComputerName $ServerName | Select ActiveSessions).ActiveSessions;

}

#SessionsTotal might need a substract depending on the parameter input

$FoundTotal = $FoundTotal - $SubstractSessionsPerHost;

#we need to avoid that the substractions is negative, to avoid false substraction

If ($FoundTotal -le 0){

$FoundTotal = 0;

}

#we now add the results to the current counters

$SessionsTotal += $FoundTotal;

$SessionsActive += $FoundActive;

} Catch {

$ServersNotReached += 1;

} Finally {

#nothing to do here

}

#Lets put together the results

$PRTGstring="<prtg>

<channel>Total Servers checked</channel>

<value>" + $ServerNameList.Count + "</value>

</result>

<channel>Total Servers responded</channel>

<value>" + ($ServerNameList.Count - $ServersNotReached) + "</value>

</result>

<channel>Total Servers not reached</channel>

<value>$ServersNotReached</value>

</result>

<channel>Total Sessions found</channel>

<value>$SessionsTotal</value>

</result>

<channel>Total Sessions active</channel>

<value>$SessionsActive</value>

</result>

</prtg>"

#we call the function WriteXmlToScreen to transform the $PRTGstring to XML and output it

WriteXmlToScreen "$PRTGstring"

} Else {

Write-Output "Parameter Error or List did not contain any names / no server names found"

Exit;

}

January 14, 2019 by Florian Rossmark monitoring prtg scripts server

Read the UEFI stored Windows key and activate Windows

Ever wanted to read out the UEFI stored Windows key and probably automatically try to activate Windows with a single script?

The UEFI stored Windows license key is essential due to the fact that you don’t have a physical license anymore and you should keep it just in case for situations like your motherboard was exchanged and the key not transferred properly. I came across similar situations and was glad that I had the key.

But the script below does more then just reading and displaying the key – it will try to activate Windows as well.

Please note – it is wise to combine the read out of the key with an export and save method – like writing it to a database – this script will only show the basic functionality – but this is the most important part already.

$service = get-wmiObject -query 'select * from SoftwareLicensingService'
if($key = $service.OA3xOriginalProductKey){
	Write-Host 'Product Key:' $service.OA3xOriginalProductKey
	$service.InstallProductKey($key)
}else{
	Write-Host 'Key not found.'
}

1

2

3

4

5

6

7

$service = get-wmiObject -query 'select * from SoftwareLicensingService'

if($key = $service.OA3xOriginalProductKey){

Write-Host 'Product Key:' $service.OA3xOriginalProductKey

$service.InstallProductKey($key)

}else{

Write-Host 'Key not found.'

}

The next two lines help additionally – if you create this batch file as well and store both files in the same directory, you simply can right click the .CMD file and execute it with elevated rights (run as administrator) and it will make your live even easier. This is just a simple trick to bypass some restrictions that you might encounter while trying to execute a PowerShell script with elevated rights and bypassing the execution policy for scripts at the same time.

powershell.exe -executionpolicy unrestricted -file "%~dp0\ReadUEFIWindowsKeyAndActivateWindows.ps1"
pause

1 2	powershell.exe -executionpolicy unrestricted -file "%~dp0\ReadUEFIWindowsKeyAndActivateWindows.ps1" pause

December 11, 2018 by Florian Rossmark recommendations scripts web

VMware alert monitoring with PRTG and PowerShell

There is a way to read out and process ALL alerts of your VMware environment using PowerShell and reporting the results back to PRTG. The script further down in this article does this. What you get is similar to the graphic here.

This show you the following channels:

Overall status
- this will be green as long there aren’t any not acknowledged warnings or alerts in VMware
- if the warning or alert is acknowledged, the sensor / script will return to green cause it is nothing that is new
Total Alerts – amount of alerts acknowledged and not ackowledged
Total Alerts – Acknowledged
Total Alerts – NOT Acknowledged
Total Warnings
Total Warnings – Acknowledged
Total Warnings – NOT Acknowledged
Total Warnings and Alerts
Total Warnings and Alerts – Acknowledged
Total Warnings and Alerts – NOT Acknowledged

As you can see – you can get more granular on your PRTG statuses if you use the channels for Warnings/Alerts that are acknowledged. You could set upper warning or error limits of 0 to keep a warning / error level in PRTG if you want to see them still.

While I was writing the script, I decided to create a new lookup value in PRTG to make it more clear. If you adjust the script in regards to add additional statuses for the channel overall status – you will need to adjust this file as well.

Let’s start with the value lookup file, you need to copy the text from the first script block in to a file you store here: C:\Program Files (x86)\PRTG Network Monitor\lookups\custom

Name the file: vmware.alerts.search.ovl

<?xml version="1.0" encoding="utf-8"?>
  <ValueLookup id="vmware.alerts.search" desiredValue="0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="PaeValueLookup.xsd" undefinedState="Warning">
    <Lookups>
      <SingleInt state="Ok" value="0">Overall Status - Green - OK</SingleInt>
      <SingleInt state="Warning" value="1">Overall Status - Yellow - Warning</SingleInt>
      <SingleInt state="Error" value="2">Overall Status - Red - Error</SingleInt>
    </Lookups>
  </ValueLookup>

1

2

3

4

5

6

7

8

<?xml version="1.0" encoding="utf-8"?>

<SingleInt state="Ok" value="0">Overall Status - Green - OK</SingleInt>

<SingleInt state="Warning" value="1">Overall Status - Yellow - Warning</SingleInt>

<SingleInt state="Error" value="2">Overall Status - Red - Error</SingleInt>

</Lookups>

</ValueLookup>

Now we need to create a custom EXE/XML sensor in this directory: C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML

Name the file: VMwareAlerts.ps1

#make sure the executing user and system has those two commands run
#Find-Module -Name VMware.PowerCLI
#Install-Module -Name VMware.PowerCLI
#useful command 
#Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP:$false -confirm:$false
#Set-PowerCLIConfiguration -InvalidCertificateAction ignore -confirm:$false
#
#alternative look here: https://blogs.vmware.com/PowerCLI/2017/04/powercli-install-process-powershell-gallery.html

param(
    [string] $VCenterServer = "",
	[string] $DomainAndUser = "",
	[string] $Password = ""
)

Import-Module VMware.PowerCLI

#avoid unecessary output
Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP:$false -confirm:$false
#avoid certificate issues
Set-PowerCLIConfiguration -InvalidCertificateAction ignore -confirm:$false
Connect-VIServer $VCenterServer -username "$DomainAndUser" -Password "$Password"
$colAlarms = (Get-DataCenter).ExtensionData.TriggeredAlarmState

$XML = "<PRTG>"

[int] $Warnings = 0
[int] $WarningsAck = 0
[int] $Alerts = 0
[int] $AlertsAck = 0
[int] $OverallStatus = 0 #default green

if ($colAlarms.Count -gt 0) {
    foreach ($entry in $colAlarms) {
        if ($entry.OverallStatus -eq "yellow") {
            $Warnings += 1
            if ($entry.Acknowledged) {
                $WarningsAck =+ 1
            } else { #we only increase the overall status if this alert is not acknowledged
                if ($OverallStatus -lt 1)
                {
                    $OverallStatus = 1
                }
            }
        } elseif ($entry.OverallStatus -eq "red") {
            $Alerts += 1
            if ($entry.Acknowledged) {
                $AlertsAck =+ 1
            } else { #we only increase the overall status if this alert is not acknowledged
                if ($OverallStatus -lt 2)
                {
                    $OverallStatus = 2
                }
            }
        }
    }
}

$XML += "<result><channel>Overwall Status</channel><value>" + $OverallStatus + "</value><ValueLookup>vmware.alerts.search</ValueLookup></result>"
$XML += "<result><channel>Total Warnings and Alerts</channel><value>" + $colAlarms.Count + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Warnings and Alerts - NOT Acknowledged</channel><value>" + ($colAlarms.Count - $WarningsAck + $AlertsAck) + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Warnings and Alerts - Acknowledged</channel><value>" + ($WarningsAck + $AlertsAck) + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Warnings</channel><value>" + $Warnings + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Warnings - NOT Acknowledged</channel><value>" + ($Warnings - $WarningsAck) + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Warnings - Acknowledged</channel><value>" + $WarningsAck + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Alerts</channel><value>" + $Alerts + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Alerts - NOT Acknowledged</channel><value>" + ($Alerts - $AlertsAck) + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Alerts - Acknowledged</channel><value>" + $AlertsAck + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "</PRTG>"


Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}
#Clear
WriteXmlToScreen "$XML"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

#make sure the executing user and system has those two commands run

#Find-Module -Name VMware.PowerCLI

#Install-Module -Name VMware.PowerCLI

#useful command

#Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP:$false -confirm:$false

#Set-PowerCLIConfiguration -InvalidCertificateAction ignore -confirm:$false

#

#alternative look here: https://blogs.vmware.com/PowerCLI/2017/04/powercli-install-process-powershell-gallery.html

param(

[string] $VCenterServer = "",

[string] $DomainAndUser = "",

[string] $Password = ""

)

Import-Module VMware.PowerCLI

#avoid unecessary output

Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP:$false -confirm:$false

#avoid certificate issues

Set-PowerCLIConfiguration -InvalidCertificateAction ignore -confirm:$false

Connect-VIServer $VCenterServer -username "$DomainAndUser" -Password "$Password"

$colAlarms = (Get-DataCenter).ExtensionData.TriggeredAlarmState

$XML = "<PRTG>"

[int] $Warnings = 0

[int] $WarningsAck = 0

[int] $Alerts = 0

[int] $AlertsAck = 0

[int] $OverallStatus = 0 #default green

if ($colAlarms.Count -gt 0) {

foreach ($entry in $colAlarms) {

if ($entry.OverallStatus -eq "yellow") {

$Warnings += 1

if ($entry.Acknowledged) {

$WarningsAck =+ 1

} else { #we only increase the overall status if this alert is not acknowledged

if ($OverallStatus -lt 1)

{

$OverallStatus = 1

}

} elseif ($entry.OverallStatus -eq "red") {

$Alerts += 1

if ($entry.Acknowledged) {

$AlertsAck =+ 1

} else { #we only increase the overall status if this alert is not acknowledged

if ($OverallStatus -lt 2)

{

$OverallStatus = 2

}

$XML += "<result><channel>Overwall Status</channel><value>" + $OverallStatus + "</value><ValueLookup>vmware.alerts.search</ValueLookup></result>"

$XML += "<result><channel>Total Warnings and Alerts</channel><value>" + $colAlarms.Count + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Warnings and Alerts - NOT Acknowledged</channel><value>" + ($colAlarms.Count - $WarningsAck + $AlertsAck) + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Warnings and Alerts - Acknowledged</channel><value>" + ($WarningsAck + $AlertsAck) + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Warnings</channel><value>" + $Warnings + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Warnings - NOT Acknowledged</channel><value>" + ($Warnings - $WarningsAck) + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Warnings - Acknowledged</channel><value>" + $WarningsAck + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Alerts</channel><value>" + $Alerts + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Alerts - NOT Acknowledged</channel><value>" + ($Alerts - $AlertsAck) + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Alerts - Acknowledged</channel><value>" + $AlertsAck + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "</PRTG>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

#Clear

WriteXmlToScreen "$XML"

Once you have both files created, go to PRTG and add a new sensor called EXE/Script Advanced and select the new created script file. ~~As Parameter you either type the host-name of your vSphere server or if you created it underneath the device in PRTG just use %host.~~

UPDATE: I changed the script cause I found it to be better to go with the following expected parameters and always making sure you have control over username and password used to connect to VMware. Please use the follow parameter moving forward:

<strong>%host "%windowsdomain\%windowsuser" "%windowspassword"</strong>

1	<strong>%host "%windowsdomain\%windowsuser" "%windowspassword"</strong>

There are still a few challenges you might need to overcome on top of this:

install the VMware PowerShell extensions on your PRTG probe server
- in a PowerShell execute
  - Find-Module -Name VMware.PowerCLI
  - Install-Module -Name VMware.PowerCLI
- alternative use the documentation mentioned in the next link
  - https://blogs.vmware.com/PowerCLI/2017/04/powercli-install-process-powershell-gallery.html
~~credentials to connect to VMware can be a challenge as I tested this~~
- ~~you might need to have the service account of the PRTG probe have sufficient access rights – needs working SSO~~
- ~~alternative use a stored credentials file in PowerShell – somewhat secure~~
- ~~or provide the credentials clear text in PowerShell – least secure~~
- ~~please see line 20 respective the command “connect-viserver” for more details~~
updated the script – it now expects username and password as parameter

You might wanna test the script before you add a sensor to PRTG – the best way to do this is directly on the PRTG server with the service account of the PRTG probe to make sure it will work as a sensor later on.

Keep in mind that the script expects a parameter – the VMware vSphere server name / web-address.

This was also posted on the PRTG KB here.

December 3, 2018 by Florian Rossmark monitoring prtg scripts server solutions

Monitor multiple website certificates with a single PRTG sensor

Due to a request on the PRTG KB of someone needing a single sensor that monitors multiple URLs for their certificate expiration I came up with the following script that is posted on this PRTG KB as well. The modified PowerShell script was provided there – it is mentioned it sourced from Stack Overflow – I found it on this link: https://stackoverflow.com/questions/28386579/modifying-ssl-cert-check-powershell-script-to-loop-through-multiple-sites

The result would look like this:

<PRTG>
  <result>
    <channel>google.com</channel>
    <value>66</value>
    <CustomUnit>days</CustomUnit>
    <LimitMinWarning>30</LimitMinWarning>
    <LimitMinError>5</LimitMinError>
  </result>
  <result>
    <channel>aol.com</channel>
    <value>143</value>
    <CustomUnit>days</CustomUnit>
    <LimitMinWarning>30</LimitMinWarning>
    <LimitMinError>5</LimitMinError>
  </result>
  <result>
    <channel>yahoo.com</channel>
    <value>96</value>
    <CustomUnit>days</CustomUnit>
    <LimitMinWarning>30</LimitMinWarning>
    <LimitMinError>5</LimitMinError>
  </result>
  <result>
    <channel>espn.com</channel>
    <value>-999</value>
    <CustomUnit>days</CustomUnit>
    <LimitMinWarning>30</LimitMinWarning>
    <LimitMinError>5</LimitMinError>
  </result>
  <text>Not reached pages: espn.com</text>
</PRTG>

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

<PRTG>

<channel>google.com</channel>

</result>

</result>

<channel>yahoo.com</channel>

</result>

</result>

<text>Not reached pages: espn.com</text>

</PRTG>

To make it more usable – you can input parameters from PRTG like this:

@("domain.com","domain2.com","domain3.com")

1	@("domain.com","domain2.com","domain3.com")

or this for limits – warning 60 and error 10 – you could name them but this should work as well…

@("domain.com","domain2.com","domain3.com") 60 10

1	@("domain.com","domain2.com","domain3.com") 60 10

And here is the modified script:

param(
    $WebsiteURLs= @("google.com","aol.com","yahoo.com","espn.com"),
    $LimitMinDaysWarning=30,
    $LimitMinDaysError=5
)

$WebsitePort=443
$Threshold=120
$Severe=30
$ID=0

$XML = "<PRTG>"
$TextError = ""
foreach ($WebsiteURL in $WebsiteURLs){
    $CommonName=$WebsiteURL
    $ID+=1
    Try{
        $Conn = New-Object System.Net.Sockets.TcpClient($WebsiteURL,$WebsitePort) 
        Try {
            $Stream = New-Object System.Net.Security.SslStream($Conn.GetStream(),$false, {
                param($sender, $certificate, $chain, $sslPolicyErrors) 
                return $true
            })
            $Stream.AuthenticateAsClient($CommonName) 

            $Cert = $Stream.Get_RemoteCertificate()
            $CN=(($cert.Subject -split "=")[1] -split ",")[0]
            $ValidTo = [datetime]::Parse($Cert.GetExpirationDatestring())

            $ValidDays = $($ValidTo - [datetime]::Now).Days
            $MyFontColor="darkgreen"
            if ($ValidDays -lt $Threshold) {
                $MyFontColor="darkyellow"
            } 
            if ($ValidDays -lt $Severe) {
                $MyFontColor="red"
            }
            $XML += "<result><channel>$WebsiteURL</channel><value>$ValidDays</value><CustomUnit>days</CustomUnit><LimitMinWarning>$LimitMinDaysWarning</LimitMinWarning><LimitMinError>$LimitMinDaysError</LimitMinError></result>"
        } Catch { 
            Throw $_ 
        } Finally { 
            $Conn.close() 
        }
    } Catch {
        $XML += "<result><channel>$WebsiteURL</channel><value>-999</value><CustomUnit>days</CustomUnit><LimitMinWarning>$LimitMinDaysWarning</LimitMinWarning><LimitMinError>$LimitMinDaysError</LimitMinError></result>"
        If ($TextError.Length -gt 0) {
            $TextError += " / "
        }
        $TextError += "$WebsiteURL"
    }
}
If ($TextError.Length -gt 0) {
    $XML += "<text>Not reached pages: $TextError</text>"
}
$XML += "</PRTG>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}
WriteXmlToScreen "$XML"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

param(

$WebsiteURLs= @("google.com","aol.com","yahoo.com","espn.com"),

$LimitMinDaysWarning=30,

$LimitMinDaysError=5

)

$WebsitePort=443

$Threshold=120

$Severe=30

$ID=0

$XML = "<PRTG>"

$TextError = ""

foreach ($WebsiteURL in $WebsiteURLs){

$CommonName=$WebsiteURL

$ID+=1

Try{

$Conn = New-Object System.Net.Sockets.TcpClient($WebsiteURL,$WebsitePort)

Try {

$Stream = New-Object System.Net.Security.SslStream($Conn.GetStream(),$false, {

param($sender, $certificate, $chain, $sslPolicyErrors)

return $true

})

$Stream.AuthenticateAsClient($CommonName)

$Cert = $Stream.Get_RemoteCertificate()

$CN=(($cert.Subject -split "=")[1] -split ",")[0]

$ValidTo = [datetime]::Parse($Cert.GetExpirationDatestring())

$ValidDays = $($ValidTo - [datetime]::Now).Days

$MyFontColor="darkgreen"

if ($ValidDays -lt $Threshold) {

$MyFontColor="darkyellow"

}

if ($ValidDays -lt $Severe) {

$MyFontColor="red"

}

$XML += "<result><channel>$WebsiteURL</channel><value>$ValidDays</value><CustomUnit>days</CustomUnit><LimitMinWarning>$LimitMinDaysWarning</LimitMinWarning><LimitMinError>$LimitMinDaysError</LimitMinError></result>"

} Catch {

Throw $_

} Finally {

$Conn.close()

}

} Catch {

$XML += "<result><channel>$WebsiteURL</channel><value>-999</value><CustomUnit>days</CustomUnit><LimitMinWarning>$LimitMinDaysWarning</LimitMinWarning><LimitMinError>$LimitMinDaysError</LimitMinError></result>"

If ($TextError.Length -gt 0) {

$TextError += " / "

}

$TextError += "$WebsiteURL"

}

If ($TextError.Length -gt 0) {

$XML += "<text>Not reached pages: $TextError</text>"

}

$XML += "</PRTG>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

November 9, 2018 by Florian Rossmark monitoring prtg scripts security web

Consolidate many line based .CSV files in to a single .CSV with one header line and per file data lines

Summarize a huge amount of files that have line based columns and data in to a single file with the first line the headers found in all files and the actual data as per row for each file, while the headers might change throughout the source files and need to be added dynamically.

This is a special script I wrote for someone else that had about 45k files to process. It is crazy enough to be worth posting here 🙂 and can be found on Spiceworks as well.

Situation:

many .CSV files
all have the columns per line instead of in the first line
the data looks like
- column,data
- column,data
he needs all files transferred in to one file in this format
- header,header,header
- data,data,data
- data,data,data
from per line to one line as a header and the data in each line per file
additional challenge
- the headers might change throughout the files and add more headers

What the script does:

cycle through all files
1. detect all headers
cycle a second time through all files
1. detect all the data
2. write the data in the right column per line per file

Flaws:

The script does not obey if there is data with a comma “,” – it would ignore what is behind that comma

Output:

Output file is a single .CSV file, comma separated columns

Execute this way:

Source Directory – where the .csv files reside
Target Directory – where the new output .csv will be created
open CMD / command prompt
go to the script-directory (where you saved it)
1. CSCRIPT scriptname.vbs “c:\sourcedirectory” “c:\targetdirectory”

CSCRIPT will avoid that you see a million message boxes – it will output directory on your CMD / command prompt window…

Dim strPath, strOutputPath

If WScript.Arguments.Count = 2 Then
	strPath = WScript.Arguments.Item(0)
	strOutputPath = WScript.Arguments.Item(1)
Else
	Wscript.Echo "Usage: cscript AddContent.vbs ""C:\path"" ""C:\outputpath"""
	Wscript.Quit
End If

Const OutPutFileName = "OutputFile.csv"

Dim objFS
Set objFS = CreateObject("Scripting.FileSystemObject")
	If objFS.FolderExists(strPath) And objFS.FolderExists(strOutputPath) Then
		WScript.Echo "Working in directory: " & strPath
		Dim objFolder
		Set objFolder = objFS.GetFolder(strPath)
			Set outputFile = objFS.OpenTextFile(strOutputPath & "\" & OutPutFileName, 2, True) 'write/replace - don't append - create
			Dim strHeader, strLine
			For Each objFile in objFolder.Files		
				If LCase(Right(objFile.Name, 4)) = LCase(".csv") Then 'only for .CSV files
					WScript.Echo "Processing file for headers: " & objFile.Name
					Set inputFile = objFS.OpenTextFile(strPath & "\" & objFile.Name, 1) 'reading
						Do While Not inputFile.AtEndOfStream
							strLine = Split(inputFile.ReadLine, ",", -1, 1)
							If Ubound(strLine) > 0 Then 'no content in this line
								If Not Instr(1, (strHeader & ","), (strLine(0) & ","), 1) > 0 Then 'find if we have this header
									If Len(strHeader) > 0 Then strHeader = strHeader & ","
									strHeader = strHeader & strLine(0)
								End If
							End If
						Loop						
					inputFile.Close
					Set inputFile = Nothing
				End If
			Next	
			outputFile.WriteLine strHeader 'let's write our first line - the headers we have
			WScript.Echo "..Finsihed processing the headers - wrote to file: " & strOutputPath & "\" & OutPutFileName
			
			Dim arrSplitHeader, iHeaders, cntHeaders
			arrSplitHeader = Split(strHeader, ",", -1, 1)
			iHeaders = Ubound(arrSplitHeader) 

			Dim arrLines()
			ReDim arrLines((iHeaders))
			Dim strOutLine 

			For Each objFile in objFolder.Files		
				For cntHeaders = 0 To iHeaders 'cleanup
					arrLines(cntHeaders) = ""
				Next
				If LCase(Right(objFile.Name, 4)) = LCase(".csv") Then 'only for .CSV files
					WScript.Echo "Processing file for data: " & objFile.Name
					Set inputFile = objFS.OpenTextFile(strPath & "\" & objFile.Name, 1) 'reading
						Do While Not inputFile.AtEndOfStream
							strLine = Split(inputFile.ReadLine, ",", -1, 1)
							If Ubound(strLine) > 0 Then 'we do have data
								For cntHeaders = 0 To iHeaders
									If arrSplitHeader(cntHeaders) = strLine(0) Then
										arrLines(cntHeaders) = strLine(1)
										Exit For
									End If
								Next 
							End If
						Loop	
					inputFile.Close
					Set inputFile = Nothing
					strOutLine = ""
					For cntHeaders = 0 To iHeaders 'writeout
						If Len(strOutLine) > 0 Then strOutLine = strOutLine & ","
						strOutLine = strOutLine & arrLines(cntHeaders)
					Next
					outputFile.WriteLine strOutLine
				End If
			Next			
			outputFile.Close			
			Set outputFile = Nothing
			WScript.Echo "..Finsihed - wrote to file: " & strOutputPath & "\" & OutPutFileName
		Set objFolder = Nothing
	End If
Set objFS = Nothing

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

Dim strPath, strOutputPath

If WScript.Arguments.Count = 2 Then

strPath = WScript.Arguments.Item(0)

strOutputPath = WScript.Arguments.Item(1)

Else

Wscript.Echo "Usage: cscript AddContent.vbs ""C:\path"" ""C:\outputpath"""

Wscript.Quit

End If

Const OutPutFileName = "OutputFile.csv"

Dim objFS

Set objFS = CreateObject("Scripting.FileSystemObject")

If objFS.FolderExists(strPath) And objFS.FolderExists(strOutputPath) Then

WScript.Echo "Working in directory: " & strPath

Dim objFolder

Set objFolder = objFS.GetFolder(strPath)

Set outputFile = objFS.OpenTextFile(strOutputPath & "\" & OutPutFileName, 2, True) 'write/replace - don't append - create

Dim strHeader, strLine

For Each objFile in objFolder.Files

If LCase(Right(objFile.Name, 4)) = LCase(".csv") Then 'only for .CSV files

WScript.Echo "Processing file for headers: " & objFile.Name

Set inputFile = objFS.OpenTextFile(strPath & "\" & objFile.Name, 1) 'reading

Do While Not inputFile.AtEndOfStream

strLine = Split(inputFile.ReadLine, ",", -1, 1)

If Ubound(strLine) > 0 Then 'no content in this line

If Not Instr(1, (strHeader & ","), (strLine(0) & ","), 1) > 0 Then 'find if we have this header

If Len(strHeader) > 0 Then strHeader = strHeader & ","

strHeader = strHeader & strLine(0)

End If

Loop

inputFile.Close

Set inputFile = Nothing

End If

WScript.Echo "..Finsihed processing the headers - wrote to file: " & strOutputPath & "\" & OutPutFileName

Dim arrSplitHeader, iHeaders, cntHeaders

arrSplitHeader = Split(strHeader, ",", -1, 1)

iHeaders = Ubound(arrSplitHeader)

Dim arrLines()

ReDim arrLines((iHeaders))

Dim strOutLine

For Each objFile in objFolder.Files

For cntHeaders = 0 To iHeaders 'cleanup

arrLines(cntHeaders) = ""

WScript.Echo "Processing file for data: " & objFile.Name

Set inputFile = objFS.OpenTextFile(strPath & "\" & objFile.Name, 1) 'reading

Do While Not inputFile.AtEndOfStream

strLine = Split(inputFile.ReadLine, ",", -1, 1)

If Ubound(strLine) > 0 Then 'we do have data

For cntHeaders = 0 To iHeaders

If arrSplitHeader(cntHeaders) = strLine(0) Then

arrLines(cntHeaders) = strLine(1)

Exit For

End If

Loop

inputFile.Close

Set inputFile = Nothing

strOutLine = ""

For cntHeaders = 0 To iHeaders 'writeout

If Len(strOutLine) > 0 Then strOutLine = strOutLine & ","

strOutLine = strOutLine & arrLines(cntHeaders)

End If

Set outputFile = Nothing

WScript.Echo "..Finsihed - wrote to file: " & strOutputPath & "\" & OutPutFileName

Set objFolder = Nothing

End If

Set objFS = Nothing

November 9, 2018 by Florian Rossmark scripts solutions

Secured WinRM SSL session and PowerShell WinRM queries – example with a PRTG sensor for CPU, HDD and RAM

Windows Mangement Remote Mangement / WinRM can be configured as HTTPS / encrypted connection instead of using clear text transfer of the provided information. In order to do this you need to configure it accordingly and have a valid machine certificate installed on the system.

Now – the advantage here is clearly the added security layer while you request and receive those information. More information on how to do this can be found here: https://support.microsoft.com/en-us/help/2019527/how-to-configure-winrm-for-https

Only it becomes a challenge when you want to use PowerShell and e.g. PRTG to use this HTTPS encrypted system. I came across this request and had to create a script that actually works with such an HTTPS encrypted SSL session to WinRM. You can find it below.

What it does is rather simple:

set the CimSessionOptions to use SSL
- additionally it bypasses the certification checks by default – you might want to adjust this depending on your network configuration
it creates a new CimSession to your target system using the UseSSL option
and finally it executes a few queries against this session
the data in this example is then translated in to a PRTG compatible XML structure so you could use it in a Advanced EXE/XML sensor within PRTG

The data in this example combines information about the CPU(s), HardDrives / HDD(s) (only installed drives, not USB) and Memory usage to PRTG in a single sensor while using channels.

Due to some dynamic of the script, you want to make sure you have fixed upper and lower error limits on especially the channel Total Disks – so if something changes you can re-create the sensor due to it’s fixed channels once it did run the first time.

In theory you could provide limits within the XML response to PRTG – this is up to you – I always liked it more to configure them solely in PRTG in the sensor channels so I could adjust them per device.

PS: This was originally posted in the private PRTG channel on SpiceWorks here.

param(
[string]$device
)
#$cred = Get-Credential #you need to somehow get them in - from a file or as parameters... up to you actually... in theory the PRTG Probe would do that already and you wouldn't need it
$CIMSessionOptions = New-CimSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck -UseSsl #-UseSSL is important - the rest - well - I bypassed the certificate checks.. up to your environment in the end...
$CIMSession = New-CimSession -ComputerName $Server -SessionOption $CIMSessionOptions #-Credential $cred

$WMI_OS = Get-CimInstance -CimSession $CIMSession -ClassName Win32_OperatingSystem 
$WMI_CPU = Get-CimInstance -CimSession $CIMSession -ClassName  win32_processor
$WMI_DISK = Get-CimInstance -CimSession $CIMSession -ClassName  Win32_LogicalDisk


#CPU table processing
foreach ($CPU in $WMI_CPU){
    $CPUsTotal += 1
    $XMLCPUs += "<result><channel>CPU Load #$CPUsTotal</channel><value>" + $CPU.LoadPercentage + "</value><unit>Percent</unit></result>"
}

#DISK table processing
foreach ($Disk in $WMI_DISK){
    if ($Disk.DriveType -eq 3) { #DriveType = 3 means it is a LOCAL FIXED DISK
        $DISKsTotal += 1
        $XMLDisks += "<result><channel>Drive " + $Disk.DeviceID + "</channel><value>" + $Disk.FreeSpace + "</value><VolumeSize>Byte</VolumeSize></result>"
        $XMLDisks += "<result><channel>Drive " + $Disk.DeviceID + "</channel><value>" + [math]::Round(($Disk.FreeSpace/$Disk.Size)*100,2).tostring("###") + "</value><float>1</float><unit>Percent</unit></result>"
    }
}

$XML="<prtg>
    <result>
        <channel>Total CPUs</channel>
        <value>" + $CPUsTotal + "</value>
        <unit>Count</unit>
    </result>
    $XMLCPUs  
    <result>
        <channel>Total Disks</channel>
        <value>" + $DISKsTotal + "</value>
        <unit>Count</unit>
    </result>
    $XMLDisks
    <result>
        <channel>Memory total</channel>
        <value>" + $WMI_OS.TotalVisibleMemorySize + "</value>
        <VolumeSize>Bytes</VolumeSize>
    </result>
    <result>
        <channel>Memory free</channel>
        <value>" + $WMI_OS.FreeVirtualMemory + "</value>
        <VolumeSize>Bytes</VolumeSize>
    </result>
    <result>
        <channel>Memory used</channel>
        <value>" + ($WMI_OS.TotalVisibleMemorySize - $WMI_OS.FreeVirtualMemory) + "</value>
        <VolumeSize>Bytes</VolumeSize>
    </result>
    <result>
        <channel>Memory free in percent</channel>
        <value>" + [math]::Round(($WMI_OS.FreePhysicalMemory/$WMI_OS.TotalVisibleMemorySize)*100,2) + "</value>
        <float>1</float> 
        <unit>Percent</unit>
    </result>
    <result>
        <channel>Memory used in percent</channel>
        <value>" + [math]::Round(100-(($WMI_OS.FreePhysicalMemory/$WMI_OS.TotalVisibleMemorySize)*100),2) + "</value>
        <float>1</float> 
        <unit>Percent</unit>
    </result>
</prtg>
"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen "$XML"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

param(

[string]$device

)

#$cred = Get-Credential #you need to somehow get them in - from a file or as parameters... up to you actually... in theory the PRTG Probe would do that already and you wouldn't need it

$CIMSessionOptions = New-CimSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck -UseSsl #-UseSSL is important - the rest - well - I bypassed the certificate checks.. up to your environment in the end...

$CIMSession = New-CimSession -ComputerName $Server -SessionOption $CIMSessionOptions #-Credential $cred

$WMI_OS = Get-CimInstance -CimSession $CIMSession -ClassName Win32_OperatingSystem

$WMI_CPU = Get-CimInstance -CimSession $CIMSession -ClassName win32_processor

$WMI_DISK = Get-CimInstance -CimSession $CIMSession -ClassName Win32_LogicalDisk

#CPU table processing

foreach ($CPU in $WMI_CPU){

$CPUsTotal += 1

$XMLCPUs += "<result><channel>CPU Load #$CPUsTotal</channel><value>" + $CPU.LoadPercentage + "</value><unit>Percent</unit></result>"

}

#DISK table processing

foreach ($Disk in $WMI_DISK){

if ($Disk.DriveType -eq 3) { #DriveType = 3 means it is a LOCAL FIXED DISK

$DISKsTotal += 1

$XMLDisks += "<result><channel>Drive " + $Disk.DeviceID + "</channel><value>" + $Disk.FreeSpace + "</value><VolumeSize>Byte</VolumeSize></result>"

$XMLDisks += "<result><channel>Drive " + $Disk.DeviceID + "</channel><value>" + [math]::Round(($Disk.FreeSpace/$Disk.Size)*100,2).tostring("###") + "</value><float>1</float><unit>Percent</unit></result>"

}

$XML="<prtg>

<channel>Total CPUs</channel>

<value>" + $CPUsTotal + "</value>

<unit>Count</unit>

</result>

$XMLCPUs

<channel>Total Disks</channel>

<value>" + $DISKsTotal + "</value>

<unit>Count</unit>

</result>

$XMLDisks

<channel>Memory total</channel>

<value>" + $WMI_OS.TotalVisibleMemorySize + "</value>

<VolumeSize>Bytes</VolumeSize>

</result>

<channel>Memory free</channel>

<value>" + $WMI_OS.FreeVirtualMemory + "</value>

<VolumeSize>Bytes</VolumeSize>

</result>

<channel>Memory used</channel>

<value>" + ($WMI_OS.TotalVisibleMemorySize - $WMI_OS.FreeVirtualMemory) + "</value>

<VolumeSize>Bytes</VolumeSize>

</result>

<channel>Memory free in percent</channel>

<value>" + [math]::Round(($WMI_OS.FreePhysicalMemory/$WMI_OS.TotalVisibleMemorySize)*100,2) + "</value>

<unit>Percent</unit>

</result>

<channel>Memory used in percent</channel>

<value>" + [math]::Round(100-(($WMI_OS.FreePhysicalMemory/$WMI_OS.TotalVisibleMemorySize)*100),2) + "</value>

<unit>Percent</unit>

</result>

</prtg>

"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

November 8, 2018 by Florian Rossmark monitoring prtg scripts

scripts

PRTG sensor to monitor a directory for a specific file type and minimum size and age

Monitor group memberships in Active Directory with PRTG

Monitoring relative printer page counts with PRTG

Office 365 licenses and activated features per user

RDS – Fix broken local RDS links in start menu

Search the Windows Security Eventlog for a string / text

Active Directory password reset events and group change events

APC InRow A/C error monitoring with PRTG

Move user Documents and Desktop to OneDrive

Compare a TRACEROUTE against an expected route

Request a DNS based web site directly from an IP address

Using PRTG to monitor manufacturing machines

Find user account lockout events

Windows Search Index monitoring

Monitor the total amount of sessions on your RDS farm

Read the UEFI stored Windows key and activate Windows

VMware alert monitoring with PRTG and PowerShell

Monitor multiple website certificates with a single PRTG sensor

Consolidate many line based .CSV files in to a single .CSV with one header line and per file data lines

Secured WinRM SSL session and PowerShell WinRM queries – example with a PRTG sensor for CPU, HDD and RAM

Recent blog posts

Blog Archives

scripts

Recent blog posts

Blog Archives

Tags