powershell Archives

PRTG sensor to monitor a directory for a specific file type and minimum size and age

The following script will monitor a specific directory for a file of a defined type and minimum size, it will report back to you the newest file of the specified type and over the minimum size and provide you the file age and size to PRTG.

The name of the file will also be reported back as a text value for the sensor in PRTG.

If the script encounters any errors, the total files value will be 0 for no files found or -1 for a script error. Therefor please set minimum channel error values accordingly to get alerted.

The goal here is to get the age of the file back that was found, to make sure the file is not older than expected. This is needed for some automated exports or data transfer files, this was you can be sure that your export routines work as expected.

param(
    &#91;string] $FolderPath = "C:\",
    &#91;string] $Extension = "*.undefined",
    &#91;int] $FileMinimumSizeByte = 1
)

Function WriteXmlToScreen (&#91;xml]$xml)
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

Try {
    $Files = Get-ChildItem -Path $FolderPath -Filter $Extension | Where {$_.Lengthength -gt $FileMinimumSizeByte} | Sort-Object CreationTime -Descending
    If ($Files.Count -gt 0) { 
        Foreach ($File in $Files)
        {
            $TotalFiles = $Files.Count
            $Date = Get-Date
            $FileAgeSeconds = &#91;math]::Round(($Date - $File.CreationTime).TotalSeconds)
            $FileSize = $File.Length
            $FileName = $File.Name

            $XML =  "&lt;prtg>"
            $XML += "&lt;result>&lt;channel>Total Files&lt;/channel>&lt;value>$TotalFiles&lt;/value>&lt;unit>Count&lt;/unit>&lt;/result>"
            $XML += "&lt;result>&lt;channel>Newest File - Age in Seconds&lt;/channel>&lt;value>$FileAgeHours&lt;/value>&lt;unit>TimeSeconds&lt;/unit>&lt;/result>"
            $XML += "&lt;result>&lt;channel>Newest File - Size in Bytes&lt;/channel>&lt;value>$FileSize&lt;/value>&lt;unit>Byte&lt;/unit>&lt;/result>"
            $XML += "&lt;text>$FileName&lt;/text>"
            $XML += "&lt;/prtg>"

            WriteXmlToScreen $XML
        
            Break;
        }
    } else {
        $XML =  "&lt;prtg>"
        $XML += "&lt;result>&lt;channel>Total Files&lt;/channel>&lt;value>0&lt;/value>&lt;unit>Count&lt;/unit>&lt;/result>"
        $XML += "&lt;result>&lt;channel>Newest File - Age in Seconds&lt;/channel>&lt;value>0&lt;/value>&lt;unit>Count&lt;/unit>&lt;/result>"
        $XML += "&lt;result>&lt;channel>Newest File - Size in Bytes&lt;/channel>&lt;value>0&lt;/value>&lt;unit>Byte&lt;/unit>&lt;/result>"
        $XML += "&lt;text>No Files found&lt;/text>"
        $XML += "&lt;/prtg>"

        WriteXmlToScreen $XML
    }
} Catch {

    $XML =  "&lt;prtg>"
    $XML += "&lt;result>&lt;channel>Total Files&lt;/channel>&lt;value>-1&lt;/value>&lt;unit>Count&lt;/unit>&lt;/result>"
    $XML += "&lt;result>&lt;channel>Newest File - Age in Seconds&lt;/channel>&lt;value>-1&lt;/value>&lt;unit>Count&lt;/unit>&lt;/result>"
    $XML += "&lt;result>&lt;channel>Newest File - Size in Bytes&lt;/channel>&lt;value>-1&lt;/value>&lt;unit>Byte&lt;/unit>&lt;/result>"
    $XML += "&lt;text>Error&lt;/text>"
    $XML += "&lt;/prtg>"

    WriteXmlToScreen $XML

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

param(

[string] $FolderPath = "C:\",

[string] $Extension = "*.undefined",

[int] $FileMinimumSizeByte = 1

)

Function WriteXmlToScreen ([xml]$xml)

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

Try {

$Files = Get-ChildItem -Path $FolderPath -Filter $Extension | Where {$_.Lengthength -gt $FileMinimumSizeByte} | Sort-Object CreationTime -Descending

If ($Files.Count -gt 0) {

Foreach ($File in $Files)

{

$TotalFiles = $Files.Count

$Date = Get-Date

$FileAgeSeconds = [math]::Round(($Date - $File.CreationTime).TotalSeconds)

$FileSize = $File.Length

$FileName = $File.Name

$XML = "<prtg>"

$XML += "<result><channel>Total Files</channel><value>$TotalFiles</value><unit>Count</unit></result>"

$XML += "<result><channel>Newest File - Age in Seconds</channel><value>$FileAgeHours</value><unit>TimeSeconds</unit></result>"

$XML += "<result><channel>Newest File - Size in Bytes</channel><value>$FileSize</value><unit>Byte</unit></result>"

$XML += "<text>$FileName</text>"

$XML += "</prtg>"

WriteXmlToScreen $XML

Break;

}

} else {

$XML = "<prtg>"

$XML += "<result><channel>Total Files</channel><value>0</value><unit>Count</unit></result>"

$XML += "<result><channel>Newest File - Age in Seconds</channel><value>0</value><unit>Count</unit></result>"

$XML += "<result><channel>Newest File - Size in Bytes</channel><value>0</value><unit>Byte</unit></result>"

$XML += "<text>No Files found</text>"

$XML += "</prtg>"

WriteXmlToScreen $XML

}

} Catch {

$XML = "<prtg>"

$XML += "<result><channel>Total Files</channel><value>-1</value><unit>Count</unit></result>"

$XML += "<result><channel>Newest File - Age in Seconds</channel><value>-1</value><unit>Count</unit></result>"

$XML += "<result><channel>Newest File - Size in Bytes</channel><value>-1</value><unit>Byte</unit></result>"

$XML += "<text>Error</text>"

$XML += "</prtg>"

WriteXmlToScreen $XML

}

ActiveDirectory/LDAP result limits – MaxPageSize

ns a website from a systems administrator for systems administrators Home IT-Admins CMDB IT-Admins tool IT Search EOL Solutions Blog Contact Links ActiveDirectory/LDAP result limits – MaxPageSize

ActiveDirectory, respective LDAP, has a result limit setting, MaxPageSize. Those are set by default to 1000 rows per query.

This is primarily important if you use some kind of programming language to get results from LDAP, this code must compensate those limits and engage paging.

Your LDAP query does not need to provide the limit, only the code needs to do the paging as you always just get the max. amount of results set in the current settings.

In order to check your settings do the following commands in a command prompt / cmd window:

ntdsutil
ldap policies 
connections
connect to domain YOURDOMAIN.LOCAL
quit
show values

1

2

3

4

5

6

ntdsutil

ldap policies

connections

connect to domain YOURDOMAIN.LOCAL

quit

show values

In theory you could set different values now as well, assuming you have the permission level to do so. But this is not recommended and you should engage paging instead, as you otherwise risk to overload your DCs – even if your commands won’t cause it, a possibly DoS attack could happen – malicious or not, so leave the limits, but be aware of them.

April 7, 2021 by Florian Rossmark configuration server solutions

Monitor group memberships in Active Directory with PRTG

There is at least one group you want to monitor for any membership changes in Active Directory / LDAP – the Domain Admins group. This is so important, as any changes to this group could cause great harm to your whole system. Of course there are other ways in but you for sure want to monitor at least the basic information of the amount of users in this group.

In order to do so, I wrote a PowerShell script that provides you the amount of members of any given group in Active Directory, as well as a text response (under the probe name and in some alerts if activated) of the sAMAccountName of each member in the group. This way you can hopefully right away determine the changed object, assuming you know what should be in there and what not.

If you have nested groups, you might wanna monitor them as well till you reach a user only level.

Create the script as always on your PRTG probing server in C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML and add a new EXE/Advanced XML sensor in PRTG. Select the script and provide at a bare minimum the parameter MonitoredGroup.

Parameter samples:

-MonitoredGroup “Domain Admins”
-MonitoredGroup “Domain Admins” -Server “MyDC.domain.local”

If you do not provide a server name, the system will try determine it on it’s own – default Domain-Membership etc..

Once the first run was successful you should review the results and set the upper and lower error limit on the PRTG sensor to the current amount of members. Any change then will cause the sensor to go in to error status and inform you therefor about the change.

param(
	[string]$Server = "",
	[string]$MonitoredGroup = ""
)
Import-Module ActiveDirectory

If ($Server.Length -gt 0) {
    $LDAPGroup = Get-ADGroupMember $MonitoredGroup -Server $Server
} Else {
    $LDAPGroup = Get-ADGroupMember $MonitoredGroup 
}

[string]$LDAPGroupMembers = ""
Foreach ($Member in $LDAPGroup){
    If ($LDAPGroupMembers.Length -gt 0) {$LDAPGroupMembers += ", "}
    $LDAPGroupMembers += $Member.SamAccountName
}

$XML = "<prtg>
            <result>
                <channel>Amound of Users in Group</channel>
                <value>"+ $LDAPGroup.count +"</value>
            </result>			
            <text>"+ $MonitoredGroup +" Members: " + $LDAPGroupMembers + "</text>
        </prtg>"
 
Function WriteXmlToScreen ([xml]$XML) #just to make it clean XML code...
{
	$StringWriter = New-Object System.IO.StringWriter;
	$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
	$XmlWriter.Formatting = "indented";
	$xml.WriteTo($XmlWriter);
	$XmlWriter.Flush();
	$StringWriter.Flush();
	Write-Output $StringWriter.ToString();
}
 
WriteXmlToScreen $XML;

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

param(

[string]$Server = "",

[string]$MonitoredGroup = ""

)

Import-Module ActiveDirectory

If ($Server.Length -gt 0) {

$LDAPGroup = Get-ADGroupMember $MonitoredGroup -Server $Server

} Else {

$LDAPGroup = Get-ADGroupMember $MonitoredGroup

}

[string]$LDAPGroupMembers = ""

Foreach ($Member in $LDAPGroup){

If ($LDAPGroupMembers.Length -gt 0) {$LDAPGroupMembers += ", "}

$LDAPGroupMembers += $Member.SamAccountName

}

$XML = "<prtg>

<channel>Amound of Users in Group</channel>

<value>"+ $LDAPGroup.count +"</value>

</result>

<text>"+ $MonitoredGroup +" Members: " + $LDAPGroupMembers + "</text>

</prtg>"

Function WriteXmlToScreen ([xml]$XML) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen $XML;

October 13, 2020 by Florian Rossmark monitoring prtg scripts security server

Monitoring relative printer page counts with PRTG

PRTG has many standard sensors, but one I was always missing is a daily page count compare. The standard printer sensor gives you a total page count – but this to some extend will always be a graph that only will go up. You can only estimate the total page counts in those graphs.

If you ever looked in to the IT Assets database project, you will see that in the Printers area there is a possibility to enable detailed graphs for relative page counts.

Why is this important you might wonder. The answer is simple, as an IT Manager you need to know if a certain kind of a printer makes sense at a certain location. If you have a low end printer for only casual print-outs but you have a total over e.g. 10,000 pages printed every month, you might need to reconsider the printer model. The reasons would likely be:

higher cost per page
- constant toner exchange of a compared more expensive toner cartridge
maintenance cost
- you might need to constantly maintenance the printer
- the cost for the maintenance kit are relatively high
downtime issues
- due to toner empty
- printer needs maintenance again
- less pages in paper tray

On the other hand, a printer might also be overkill for a certain area and not be cost efficient. Those conditions also might change over time of course. Further is there often the question – is a single area printer (copier) better or multiple smaller printers. This of course can go pretty far and you want to consider Lean processes, Six Sigma guidelines and others along with this data.

How ever, I started a first draft of a script that provides me at least the total page count relative to each day in PRTG. This sure is not as efficient yet as I do this in the IT Assets database printer module, where I collect data e.g. every 30 minutes in a huge table and then later calculate all the data in a daily range respective monthly range while collecting total page counts and possibly counts per copy vs. print outs and additionally color vs. black and white print. But at least it is a start.

Below you find the first draft of this script.

One thing to know – you will need to run the following command in order to install the PowerShell SNMP module on your PRTG probing server:

Install-Module -Name SNMP

1	Install-Module -Name SNMP

The current version of the PRTG script:

#For PRTG - default parameter list: 
#-deviceID %deviceid -targetHost '%host' -OID '1.3.6.1.2.1.43.10.2.1.4.1.1' 
#find a list with OID examples at the following link as they differ by vendor and partly model
#https://www.it-admins.com/it-assets-database/online-manual/printers/
param(
    [Parameter(
        Mandatory = $true
    )][int]$deviceID,

    [Parameter(
        Mandatory = $true
    )][string]$targetHost,

    [Parameter(
        Mandatory = $true
    )][string]$OID = "",

    [string]$Community = "public"
)

Import-Module -Name SNMP

[string]$ErrorText = "" #will hold error information to be returned to PRTG text field / sensor message
[int]$ErrorValue = 0 #default no errors initiated with 0 (0 = OK | 1 = Warning | 2 = Error)

[string]$LogFile = "$PSScriptRoot\PrinterLog_$deviceID.log"

[int]$result = -2 #standard response would be negative 2 as initialized integer value

try{
    $result = (Get-SNMPdata -IP $targetHost -OID $OID -Community $Community).Data
    #if no error occured, we have the current page count as a result
} catch {
    $result = -1 #if any error happened, we now have the result set to negative 1
    $ErrorText += "error: can't read SNMP OID value from device "
    $ErrorValue = 2
}

[int]$returnValue = 0 #default return value, integer, initialized with 0
[string]$LogFileContent = -1 #default logfilecontent is integer, intialized with negative 1
[string]$LogFileDate 
[int]$LogFileCount = -1

if ($result -gt 0) {
    #we seem to have a page count from SNMP

    if (Test-Path $LogFile -PathType Leaf){
        #we do have an exisiting LogFile
        try{
            $LogFileContent = Get-Content $LogFile -Raw
            if ($LogFileContent.Length -gt 0){
                $LogFileDate = $LogFileContent.Split("|")[0] 
                $LogFileCount = $LogFileContent.Split("|")[1]
            } else {
                #LogFile empty
                $LogFileCount = 0
                $ErrorText += "warning: initial run or no logfile yet "
                $ErrorValue = 1
            }
        } catch {
            $LogFileCount = -2 #negative 2 as error catch
        } finally {
            if ($LogFileCount -gt 0){
                #no error occured as for the LogFile reading
                if (($result - $LogFileCount) -gt -1){
                    #it should be either the same value or higher then the last logfile value
                    $returnValue = $result - $LogFileCount
                } else {
                    #LogFile value is higher then current count - this is weird
                    #still returning this - but it will show a negative count and should raise a flag
                    $returnValue = $result - $LogFileCount
                    $ErrorText += "error: logfile value higher then current printer read "
                    $ErrorValue = 2
                }
            } else {
                #there was some kind of error in the LogFile read - not an integer value or new Logfile started and result was 0
                $ErrorText += "error: can't read logfile for data compare "
                $ErrorValue = 2
            }
        }

    } else {
        #no LogFile yet - will need one but return value as difference initially will stay 0
        #we set the LogFileContent to 0 as this is the current status
        $LogFileCount = 0
        $ErrorText += "warning: initial run or no logfile yet or wrong data format "
        $ErrorValue = 1
    }

    #we need to write the positive SNMP OID result to the LogFile 
    #but only if the date differs more then 1x day

    [bool]$WriteLog = $false
    [string]$CurrentDate = (Get-Date -Format yyyy-MM-dd)

    if ($LogFileDate.Length -gt 0){
        try{
            if ((New-TimeSpan -Start $LogFileDate -End $CurrentDate).Days -gt 1){ 
                #date difference more then 1 day 
                $WriteLog = $true
            } else {
                #date difference not sufficient - same day? Future?
                if ((New-TimeSpan -Start $LogFileDate -End $CurrentDate).Days -lt 0){ 
                    #LogFile newer then current date? That's just wrong
                    $WriteLog = $true
                    $ErrorText += "warning: Logfile date above current date $LogFileDate - rewriting log"
                    $ErrorValue = 1
                } else {
                    #not greater then 1 day (0 and 1) or less must be equal as a result...
                    #nothing to do as WriteLog is initialized false
                }
            }
        } catch {
            #couldn't compare the date - let's write the Log to be save
            $WriteLog = $true
        }
    } else {
        #LogFileDate length 0 means we need to write a logfile as it might not exist
        $WriteLog = $true
    }

    if ($WriteLog){
        try {
            Set-Content -Path $LogFile -Value "$CurrentDate|$result"
            $LogFileDate = $CurrentDate
        } catch {
            #there was an issue writing to the LogFile
            $ErrorText += "error: can't write to logfile "
            $ErrorValue = 2
        }
    }

} else {
    #no pagecount available due to errors or issues
    #uncomment the next line for debugging only
    #$returnValue = $result
    #the returnValue will now show the current result value and point therefor to the error section
    $ErrorText += "error: no pagecount available "
    $ErrorValue = 2
}

#Assuming no errors - the text result will be the last LogFile date
if ($ErrorText.Length -eq 0){
    $ErrorText = "Last LogFile write date: $LogFileDate"
}

$XML = "<prtg>
            <result>
                <channel>last relative Page Count</channel>
                <value>$returnValue</value>
            </result>
            <result>
                <channel>last total from Printer</channel>
                <value>$result</value>
            </result>
            <result>
                <channel>last total from LogFile</channel>
                <value>$LogFileCount</value>
            </result>
            <result>
                <channel>Script Error Status</channel>
                <value>$ErrorValue</value>
                <LimitMode>1</LimitMode>
                <LimitMaxWarning>0</LimitMaxWarning>
                <LimitMaxError>1</LimitMaxError>
            </result>
            <text>$ErrorText</text>
        </prtg>"
 
Function WriteXmlToScreen ([xml]$XML) #just to make it clean XML code...
{
	$StringWriter = New-Object System.IO.StringWriter;
	$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
	$XmlWriter.Formatting = "indented";
	$xml.WriteTo($XmlWriter);
	$XmlWriter.Flush();
	$StringWriter.Flush();
	Write-Output $StringWriter.ToString();
}
 
WriteXmlToScreen $XML;

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

#For PRTG - default parameter list:

#-deviceID %deviceid -targetHost '%host' -OID '1.3.6.1.2.1.43.10.2.1.4.1.1'

#find a list with OID examples at the following link as they differ by vendor and partly model

#https://www.it-admins.com/it-assets-database/online-manual/printers/

param(

[Parameter(

Mandatory = $true

)][int]$deviceID,

[Parameter(

Mandatory = $true

)][string]$targetHost,

[Parameter(

Mandatory = $true

)][string]$OID = "",

[string]$Community = "public"

)

Import-Module -Name SNMP

[string]$ErrorText = "" #will hold error information to be returned to PRTG text field / sensor message

[int]$ErrorValue = 0 #default no errors initiated with 0 (0 = OK | 1 = Warning | 2 = Error)

[string]$LogFile = "$PSScriptRoot\PrinterLog_$deviceID.log"

[int]$result = -2 #standard response would be negative 2 as initialized integer value

try{

$result = (Get-SNMPdata -IP $targetHost -OID $OID -Community $Community).Data

#if no error occured, we have the current page count as a result

} catch {

$result = -1 #if any error happened, we now have the result set to negative 1

$ErrorText += "error: can't read SNMP OID value from device "

$ErrorValue = 2

}

[int]$returnValue = 0 #default return value, integer, initialized with 0

[string]$LogFileContent = -1 #default logfilecontent is integer, intialized with negative 1

[string]$LogFileDate

[int]$LogFileCount = -1

if ($result -gt 0) {

#we seem to have a page count from SNMP

if (Test-Path $LogFile -PathType Leaf){

#we do have an exisiting LogFile

try{

$LogFileContent = Get-Content $LogFile -Raw

if ($LogFileContent.Length -gt 0){

$LogFileDate = $LogFileContent.Split("|")[0]

$LogFileCount = $LogFileContent.Split("|")[1]

} else {

#LogFile empty

$LogFileCount = 0

$ErrorText += "warning: initial run or no logfile yet "

$ErrorValue = 1

}

} catch {

$LogFileCount = -2 #negative 2 as error catch

} finally {

if ($LogFileCount -gt 0){

#no error occured as for the LogFile reading

if (($result - $LogFileCount) -gt -1){

#it should be either the same value or higher then the last logfile value

$returnValue = $result - $LogFileCount

} else {

#LogFile value is higher then current count - this is weird

#still returning this - but it will show a negative count and should raise a flag

$returnValue = $result - $LogFileCount

$ErrorText += "error: logfile value higher then current printer read "

$ErrorValue = 2

}

} else {

#there was some kind of error in the LogFile read - not an integer value or new Logfile started and result was 0

$ErrorText += "error: can't read logfile for data compare "

$ErrorValue = 2

}

} else {

#no LogFile yet - will need one but return value as difference initially will stay 0

#we set the LogFileContent to 0 as this is the current status

$LogFileCount = 0

$ErrorText += "warning: initial run or no logfile yet or wrong data format "

$ErrorValue = 1

}

#we need to write the positive SNMP OID result to the LogFile

#but only if the date differs more then 1x day

[bool]$WriteLog = $false

[string]$CurrentDate = (Get-Date -Format yyyy-MM-dd)

if ($LogFileDate.Length -gt 0){

try{

if ((New-TimeSpan -Start $LogFileDate -End $CurrentDate).Days -gt 1){

#date difference more then 1 day

$WriteLog = $true

} else {

#date difference not sufficient - same day? Future?

if ((New-TimeSpan -Start $LogFileDate -End $CurrentDate).Days -lt 0){

#LogFile newer then current date? That's just wrong

$WriteLog = $true

$ErrorText += "warning: Logfile date above current date $LogFileDate - rewriting log"

$ErrorValue = 1

} else {

#not greater then 1 day (0 and 1) or less must be equal as a result...

#nothing to do as WriteLog is initialized false

}

} catch {

#couldn't compare the date - let's write the Log to be save

$WriteLog = $true

}

} else {

#LogFileDate length 0 means we need to write a logfile as it might not exist

$WriteLog = $true

}

if ($WriteLog){

try {

Set-Content -Path $LogFile -Value "$CurrentDate|$result"

$LogFileDate = $CurrentDate

} catch {

#there was an issue writing to the LogFile

$ErrorText += "error: can't write to logfile "

$ErrorValue = 2

}

} else {

#no pagecount available due to errors or issues

#uncomment the next line for debugging only

#$returnValue = $result

#the returnValue will now show the current result value and point therefor to the error section

$ErrorText += "error: no pagecount available "

$ErrorValue = 2

}

#Assuming no errors - the text result will be the last LogFile date

if ($ErrorText.Length -eq 0){

$ErrorText = "Last LogFile write date: $LogFileDate"

}

$XML = "<prtg>

<channel>last relative Page Count</channel>

<value>$returnValue</value>

</result>

<channel>last total from Printer</channel>

<value>$result</value>

</result>

<channel>last total from LogFile</channel>

<value>$LogFileCount</value>

</result>

<channel>Script Error Status</channel>

<value>$ErrorValue</value>

</result>

<text>$ErrorText</text>

</prtg>"

Function WriteXmlToScreen ([xml]$XML) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen $XML;

June 17, 2020 by Florian Rossmark monitoring prtg recommendations scripts server

Office 365 licenses and activated features per user

Ever wondered which user has what license activated and e.g. which specific feature is activated? Recently I was challenged to see who has the Exchange mailbox feature enabled and who not out of the active user base. Due to the huge user-base this would have taken hours to review manually. Using PowerShell for this, connecting to Office 365, exporting the data eventually to a CSV file and filtering it in Microsoft Excel made this way easier.

The challenge here is that Microsoft uses SKU’s – or licenses – that again can have various features enabled or disabled. Let’s say you have a E5 Plan (license) assigned to your user, you still can disabled various features within this plan, e.g. Microsoft Exchange.

If you take a look at the following website, you find a whole list of GUIDs / IDs of all those various features.

https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-service-plan-reference

In case of the Microsoft Exchange Mailbox feature – we are talking about this GUID: efb87545-963c-4e0d-99df-69c6916d9eb0

Once I had identified the GUID the next step was to grab users from a specific on premise Active Directory OU and query them against Microsoft Azure on the Office 365 environment as for their assigned licenses/features. The results then are collected in a PowerShell object and eventually saved in a defined file name in a CSV format that you easily can filter in Excel afterwards.

Please keep in mind that you will need RSAT tools (PowerShell) and Azure/Office 365 connectivity, rights etc. in order for this to work.

#script looks for all users in a base OU path
#it checks for the license defined per user
#it will write a CSV file in the path the script is in: O365UserMailboxList.csv 

#Base OU path - needs to be set
$BaseOU = "DC=domain,DC=local"


#Exchange mailbox license ID - see link for full list
#https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-service-plan-reference
$ExchangeMailboxId = "efb87545-963c-4e0d-99df-69c6916d9eb0"


#Script starts below - no additional changes should be needed - besides the last line for the output file name
$tbl = New-Object System.Data.DataTable "Results"
$col1 = New-Object System.Data.DataColumn UserPrincipalName
$col2 = New-Object System.Data.DataColumn ADUserEnabled
$col3 = New-Object System.Data.DataColumn ExchangeMailboxEnabled
$col4 = New-Object System.Data.DataColumn ErrorMessage
$tbl.Columns.Add($col1)
$tbl.Columns.Add($col2)
$tbl.Columns.Add($col3)
$tbl.Columns.Add($col4)

$ADUsersFromOU = Get-ADUser -SearchBAse $BaseOU -filter * 

Connect-AzureAD

ForEach ($ADUser In $ADUsersFromOU) {
    $i += 1
    $p = [math]::Round(($i/$ADusersFromOU.Count*100),0)
    Write-Host "..processing $i of"$ADusersFromOU.Count"- $p% - "$ADUser.UserPrincipalName
    $MailboxEnabled = $false
    $ErrorMessage = ""
    try {
        $UserLicenses = Get-AzureADUser -objectid $ADUser.UserPrincipalName | Select -ExpandProperty AssignedPlans | Where {$_.CapabilityStatus -eq "Enabled"}
    } catch {
        $ErrorMessage = $Error[0]
        #Write-Host "....Error: "$Error[0]
    }
    ForEach ($ULicense In $UserLicenses) {
        If ($ULicense.ServicePlanId -eq $ExchangeMailboxId)
        {
            $MailboxEnabled = $true
            break;
        }
    }
    $row = $tbl.NewRow()
    $row.UserPrincipalName = $ADUser.UserPrincipalName
    $row.ADUserEnabled = $ADUser.Enabled
    $row.ExchangeMailboxEnabled = $MailboxEnabled
    $row.ErrorMessage = $ErrorMessage
    $tbl.Rows.Add($row)
}

$tbl |ft

#adjust this export-file name if you want to
$tbl | Export-Csv -Path .\O365UserMailboxList.csv

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

#script looks for all users in a base OU path

#it checks for the license defined per user

#it will write a CSV file in the path the script is in: O365UserMailboxList.csv

#Base OU path - needs to be set

$BaseOU = "DC=domain,DC=local"

#Exchange mailbox license ID - see link for full list

#https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-service-plan-reference

$ExchangeMailboxId = "efb87545-963c-4e0d-99df-69c6916d9eb0"

#Script starts below - no additional changes should be needed - besides the last line for the output file name

$tbl = New-Object System.Data.DataTable "Results"

$col1 = New-Object System.Data.DataColumn UserPrincipalName

$col2 = New-Object System.Data.DataColumn ADUserEnabled

$col3 = New-Object System.Data.DataColumn ExchangeMailboxEnabled

$col4 = New-Object System.Data.DataColumn ErrorMessage

$tbl.Columns.Add($col1)

$tbl.Columns.Add($col2)

$tbl.Columns.Add($col3)

$tbl.Columns.Add($col4)

$ADUsersFromOU = Get-ADUser -SearchBAse $BaseOU -filter *

Connect-AzureAD

ForEach ($ADUser In $ADUsersFromOU) {

$i += 1

$p = [math]::Round(($i/$ADusersFromOU.Count*100),0)

Write-Host "..processing $i of"$ADusersFromOU.Count"- $p% - "$ADUser.UserPrincipalName

$MailboxEnabled = $false

$ErrorMessage = ""

try {

$UserLicenses = Get-AzureADUser -objectid $ADUser.UserPrincipalName | Select -ExpandProperty AssignedPlans | Where {$_.CapabilityStatus -eq "Enabled"}

} catch {

$ErrorMessage = $Error[0]

#Write-Host "....Error: "$Error[0]

}

ForEach ($ULicense In $UserLicenses) {

If ($ULicense.ServicePlanId -eq $ExchangeMailboxId)

{

$MailboxEnabled = $true

break;

}

$row = $tbl.NewRow()

$row.UserPrincipalName = $ADUser.UserPrincipalName

$row.ADUserEnabled = $ADUser.Enabled

$row.ExchangeMailboxEnabled = $MailboxEnabled

$row.ErrorMessage = $ErrorMessage

$tbl.Rows.Add($row)

}

$tbl |ft

#adjust this export-file name if you want to

$tbl | Export-Csv -Path .\O365UserMailboxList.csv

March 24, 2020 by Florian Rossmark o365 / m365 scripts

Amount of locked out accounts

It is a good to know how many of your user accounts are locked out right now… I would go as far as saying you should monitor this and have alert levels on it, cause this could indicate and reveal a brute-force like attack against your system.

Doing it manually in a PowerShell (assuming you have RSAT / Active-Directory PowerShell modules installed) can be done with the following command that will show you who is locked out and the calculated amount as well..

$s=Search-ADAccount -LockedOut |ft
$s
'CurrentCount: ' + $s.count

1

2

3

$s=Search-ADAccount -LockedOut |ft

$s

'CurrentCount: ' + $s.count

Using PRTG you can add the following advanced script

Import-module activedirectory
$Count=-1

$Accounts = Search-ADAccount -LockedOut
$Count=$Accounts.Count

$Users = ""
foreach ($user in $Accounts) {
	if ($Users.Length -gt 0) {
		$Users += " / "
	}
	$Users += $user.SamAccountName
}

$XML =  "<prtg>"
$XML += "<result><channel>LDAP accounts locked out</channel><value>$Count</value><unit>Count</unit></result>"
$XML += "<text>$Users</text>"
$XML += "</prtg>"

Function WriteXmlToScreen ([xml]$xml)
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen $XML

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

Import-module activedirectory

$Count=-1

$Accounts = Search-ADAccount -LockedOut

$Count=$Accounts.Count

$Users = ""

foreach ($user in $Accounts) {

if ($Users.Length -gt 0) {

$Users += " / "

}

$Users += $user.SamAccountName

}

$XML = "<prtg>"

$XML += "<result><channel>LDAP accounts locked out</channel><value>$Count</value><unit>Count</unit></result>"

$XML += "<text>$Users</text>"

$XML += "</prtg>"

Function WriteXmlToScreen ([xml]$xml)

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen $XML

After adding it as a sensor, it will create a single channel with the amount of locked out users. You should set error limits:

minimum error limit: 0
- the script returns -1 if an error occurred
maximum error limit: this depends on your user base – I would say about 5% of your users – no more.. depends as well on the lockout-duration in your security policy…

The advantage of the script in PRTG is – it always reports back additional text – the currently locked out SamAccount names.. respective user-names.. so in case it generates an error – you will see some more information…

Assuming there is a brute-force, you might see this sparking and going down – meaning someone tries to find an entry account… since the lockout attribute causes an emergency-replication of your domain-controllers (this attribute bypasses the regular replication interval) you can fire it relatively simply against your domain, the script just uses the current logon domain of the executing user.

October 25, 2019 by Florian Rossmark monitoring prtg security server

PRTG and VMware 6.7 vCenter host hardware status

The following script was created to bypass an issue in the SOAP API in relation with VMware, hardware vendor drivers and PRTG. In any case, you could use the same script for other monitoring systems or any other purpose – of course while adjusting it to your needs.

You can find more information about the issue here: https://kb.paessler.com/en/topic/82458-vmware-host-hardware-status-soap-sensor-returns-warnings-after-update-to-vmware-6-7

In order to make this work you need to install the VMware PowerCLI PowerShell extension on the PRTG probe server. Further will you need to inject username and password as well as the vCenter name and internal hostname in vCenter.

LDAP authentication activated targets:

$host %host “%windowsdomain\%windowsuser” “%windowspassword”
$host %host.domain.local “%windowsdomain\%windowsuser” “%windowspassword”

Otherwise – you might need to use this format:

$host %host root MyRootPW

Test it in PowerShell as the Probe-User first – you should see the results. Eventually the script create a sensor with multiple channels – sensors in GREEN status will be counted only – sensors in UNKNOWN status will be counted and returned as text, while as long as no YELLOW or RED status (warning or error) occurs, the sensor still stays green/okay. Warning or Error levels will automatically apply and have the problematic hardware systems in the sensor message text.

My first attempt was to show all channels on top of the summary – due to getting over 100 separate hardware statuses back and the limitation in PRTG of 50 channels per sensor, I dropped the idea – while the script still has all the code to handle it.

#pre-req
#make sure the VMware PowerCLI is installed for all users
#install-module -name vmware.powercli -AllowClobber 
#make sure you set the ignore certificate error - assuming you do not have a valid cert on the vCenter
#Set-PowerCLIConfiguration -InvalidCertificateAction Ignore

param(
    [string] $vCenter  = "",
    [string] $HostFQDN = "",
    [string] $Username = "",
    [string] $Password = ""
)
Import-Module VMware.PowerCLI

#avoid unecessary output
Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP:$false -confirm:$false
#avoid certificate issues
Set-PowerCLIConfiguration -InvalidCertificateAction ignore -confirm:$false

Connect-VIServer -Server $vCenter -User $Username -Password $Password 



$VHost = Get-VMHost -Name $HostFQDN
$HSS = Get-View -Id $VHost.ExtensionData.ConfigManager.HealthStatusSystem
$HSI = $HSS.Runtime.SystemHealthInfo.NumericSensorInfo | Select Name,@{N='Health';E={$_.HealthState.Label}},CurrentReading

$XMLDetail = ""
$cntGreen = 0
$cntWarning = 0
$cntError = 0
$cntUnknown = 0

$txtWarning = ""
$txtError = ""
$txtUnknown = ""

foreach ($SI in $HSI) {
    $XMLDetail += "<result><channel>" + $SI.Name + "</channel><value>" + $SI.CurrentReading + "</value></result>"
    if ($SI.Health.ToLower() -eq "Green".ToLower()) {
        $cntGreen += 1
    } elseif ($SI.Health.ToLower() -eq "Yellow".ToLower()) {
        $cntWarning += 1
        if ($txtWarning.Length -gt 0) { 
            $txtWarning += " - " 
        }
        $txtWarning += $SI.Name
    } elseif ($SI.Health.ToLower() -eq "Red".ToLower()) {
        $cntError += 1
        if ($txtError.Length -gt 0) { 
            $txtError += " - " 
        }
        $txtError += $SI.Name
    } else {
        $cntUnknown += 1
        if ($txtUnknown.Length -gt 0) { 
            $txtUnknown += " - " 
        }
        $txtUnknown += $SI.Name
    }
}

$OverallStatus = 0
if ($cntWarning -gt 0) {
    $OverallStatus = 1
}
if ($cntError -gt 0) {
    $OverallStatus = 2
}

$OverallText = ""
if ($cntError -gt 0) {
    $OverallText = "Error status: $txtError"
}
if ($cntError -gt 0) {
    if ($OverallText.Length -gt 0) {
        $OverallText += " --- "
    }
    $OverallText = "Warning status: $txtWarning"
}
if ($cntUnknown -gt 0) {
    if ($OverallText.Length -gt 0) {
        $OverallText += " --- "
    }
    $OverallText = "Unknown status: $txtUnknown"
}

$XML = "<PRTG>"
$XML += "<result><channel>Overall Status</channel><value>$OverallStatus</value><LimitMode>1</LimitMode><LimitMaxError>1</LimitMaxError><LimitMinError>-1</LimitMinError><LimitMaxWarning>0</LimitMaxWarning></result>"
$XML += "<result><channel>Total OK</channel><value>$cntGreen</value></result>"
$XML += "<result><channel>Total Warning</channel><value>$cntWarning</value></result>"
$XML += "<result><channel>Total Error</channel><value>$cntError</value></result>"
$XML += "<result><channel>Total Uknown</channel><value>$cntUnknown</value></result>"
#$XML += $XMLDetail
#can not add the detail to PRTG cause this would create above 100 channels (likely) and PRTG has a 50 channel limit statue per sensor
$XML += "<text>$OverallText</text>"
$XML += "</PRTG>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen "$XML"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

#pre-req

#make sure the VMware PowerCLI is installed for all users

#install-module -name vmware.powercli -AllowClobber

#make sure you set the ignore certificate error - assuming you do not have a valid cert on the vCenter

#Set-PowerCLIConfiguration -InvalidCertificateAction Ignore

param(

[string] $vCenter = "",

[string] $HostFQDN = "",

[string] $Username = "",

[string] $Password = ""

)

Import-Module VMware.PowerCLI

#avoid unecessary output

Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP:$false -confirm:$false

#avoid certificate issues

Set-PowerCLIConfiguration -InvalidCertificateAction ignore -confirm:$false

Connect-VIServer -Server $vCenter -User $Username -Password $Password

$VHost = Get-VMHost -Name $HostFQDN

$HSS = Get-View -Id $VHost.ExtensionData.ConfigManager.HealthStatusSystem

$HSI = $HSS.Runtime.SystemHealthInfo.NumericSensorInfo | Select Name,@{N='Health';E={$_.HealthState.Label}},CurrentReading

$XMLDetail = ""

$cntGreen = 0

$cntWarning = 0

$cntError = 0

$cntUnknown = 0

$txtWarning = ""

$txtError = ""

$txtUnknown = ""

foreach ($SI in $HSI) {

$XMLDetail += "<result><channel>" + $SI.Name + "</channel><value>" + $SI.CurrentReading + "</value></result>"

if ($SI.Health.ToLower() -eq "Green".ToLower()) {

$cntGreen += 1

} elseif ($SI.Health.ToLower() -eq "Yellow".ToLower()) {

$cntWarning += 1

if ($txtWarning.Length -gt 0) {

$txtWarning += " - "

}

$txtWarning += $SI.Name

} elseif ($SI.Health.ToLower() -eq "Red".ToLower()) {

$cntError += 1

if ($txtError.Length -gt 0) {

$txtError += " - "

}

$txtError += $SI.Name

} else {

$cntUnknown += 1

if ($txtUnknown.Length -gt 0) {

$txtUnknown += " - "

}

$txtUnknown += $SI.Name

}

$OverallStatus = 0

if ($cntWarning -gt 0) {

$OverallStatus = 1

}

if ($cntError -gt 0) {

$OverallStatus = 2

}

$OverallText = ""

if ($cntError -gt 0) {

$OverallText = "Error status: $txtError"

}

if ($cntError -gt 0) {

if ($OverallText.Length -gt 0) {

$OverallText += " --- "

}

$OverallText = "Warning status: $txtWarning"

}

if ($cntUnknown -gt 0) {

if ($OverallText.Length -gt 0) {

$OverallText += " --- "

}

$OverallText = "Unknown status: $txtUnknown"

}

$XML = "<PRTG>"

$XML += "<result><channel>Overall Status</channel><value>$OverallStatus</value><LimitMode>1</LimitMode><LimitMaxError>1</LimitMaxError><LimitMinError>-1</LimitMinError><LimitMaxWarning>0</LimitMaxWarning></result>"

$XML += "<result><channel>Total OK</channel><value>$cntGreen</value></result>"

$XML += "<result><channel>Total Warning</channel><value>$cntWarning</value></result>"

$XML += "<result><channel>Total Error</channel><value>$cntError</value></result>"

$XML += "<result><channel>Total Uknown</channel><value>$cntUnknown</value></result>"

#$XML += $XMLDetail

#can not add the detail to PRTG cause this would create above 100 channels (likely) and PRTG has a 50 channel limit statue per sensor

$XML += "<text>$OverallText</text>"

$XML += "</PRTG>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

August 8, 2019 by Florian Rossmark monitoring prtg server solutions

Search the Windows Security Eventlog for a string / text

Lately I had to search a lot through logs – as you can tell by all my postings… I just had to create yet another script that allows you to search through the Windows Security Eventlog – while the script is easily adjustable to other log types like application log or system log.

It’s not the most pretty script – but it certainly works. Don’t be surprised if the script takes it sweet time – it might be it needs to read through a lot of eventlog entries.

param(
    [string] $RemoteComputer = "",
    [string] $SearchString = "",
	[int] 	 $MaxAgeHours = 24,
    [bool]   $FullDetails = $false
)

$Query = @"
<QueryList>
    <Query Id="0" Path="Security">
    <Select Path="Security">*</Select>
  </Query>
</QueryList>
"@

if ($RemoteComputer.Length -gt 0){
	if ($FullDetails) {
		Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) -ComputerName $RemoteComputer |fl
	} else {
		Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) -ComputerName $RemoteComputer |ft
	}
} else {
	if ($FullDetails) {
		Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) |fl
	} else {
		Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) |ft
	}
}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

param(

[string] $RemoteComputer = "",

[string] $SearchString = "",

[int] $MaxAgeHours = 24,

[bool] $FullDetails = $false

)

$Query = @"

</Query>

</QueryList>

"@

if ($RemoteComputer.Length -gt 0){

if ($FullDetails) {

Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) -ComputerName $RemoteComputer |fl

} else {

Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) -ComputerName $RemoteComputer |ft

}

} else {

if ($FullDetails) {

Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) |fl

} else {

Get-EventLog -LogName Security -Message "*$SearchString*" -After (Get-Date).AddHours(-$MaxAgeHours) |ft

}

August 7, 2019 by Florian Rossmark scripts security server

Active Directory password reset events and group change events

The script below uses the security event log on defined DCs within your Active Directory to export events related to certain activities. Eventually the script will export this even to an email and send it to you as a report – if needed.

As is – the script will specifically look for those events

4724 – a user password was reset by an administrator respective via Active Directory Users and Groups MMC (or similar)
4728 – a user was added to a security group
4729 – a user was removed from a security group

There are more events – specifically events related to adding/removing users from distribution groups etc. – for the purpose of for what I wrote the script, I did not need this. Still, I thought it is worth publishing this, as others might find it helpful.

To add more events – just adjust line 19 – eventually just add more “or EventID=1234” statements – should be rather easy… in theory you could build that out as a parameter as well and inject it via the script.

param(
    [string] $DomainControllers = "",
    [bool]   $FullDetails = $false,
    [int]    $HoursInThePast = 24,
    [bool]   $SendMail = $false,
    [string] $SMTPfrom = "",
    [string] $SMTPto = "",
    [string] $SMTPsubject = "",
    [string] $SMTPserver = ""
)

#4724 - user PW reset by admin
#4728 - user added to security group
#4729 - user removed from security group

$Query = @"
<QueryList>
    <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4724 or EventID=4728 or EventID=4729)]]</Select>
  </Query>
</QueryList>
"@

If ($DomainControllers.Length -eq 0) {
    Import-Module ActiveDirectory
    $DomainControllers = Get-ADDomainController -Filter * | Select-Object -ExpandProperty Name
    ForEach($DC In $DomainControllers) {
        Write-Host "checking DC: $DC"
        $OutPut += "Export from DC: $DC" 
        $OutPut += ""
        If ($FullDetails) {
            $OutPut += Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | fl | Out-String
        } Else {
            $OutPut += Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | ft | Out-String
        }
    }
} Else {
    $DCs = $DomainControllers.Split(',')
    foreach ($DomainController in $DCs) {
        Write-Host "checking DC: $DomainController"
        $OutPut += "Export from DC: $DomainController" 
        $OutPut += ""
        If ($FullDetails) {
            $OutPut += Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | fl | Out-String
        } Else {
            $OutPut += Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | ft | Out-String
        }
    }
}

$OutPut

if ($SendMail) {
    Send-MailMessage -From $SMTPfrom -to $SMTPto -Subject $SMTPsubject -Body $OutPut -SmtpServer $SMTPserver
}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

param(

[string] $DomainControllers = "",

[bool] $FullDetails = $false,

[int] $HoursInThePast = 24,

[bool] $SendMail = $false,

[string] $SMTPfrom = "",

[string] $SMTPto = "",

[string] $SMTPsubject = "",

[string] $SMTPserver = ""

)

#4724 - user PW reset by admin

#4728 - user added to security group

#4729 - user removed from security group

$Query = @"

<Select Path="Security">*[System[(EventID=4724 or EventID=4728 or EventID=4729)]]</Select>

</Query>

</QueryList>

"@

If ($DomainControllers.Length -eq 0) {

Import-Module ActiveDirectory

$DomainControllers = Get-ADDomainController -Filter * | Select-Object -ExpandProperty Name

ForEach($DC In $DomainControllers) {

Write-Host "checking DC: $DC"

$OutPut += "Export from DC: $DC"

$OutPut += ""

If ($FullDetails) {

$OutPut += Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | fl | Out-String

} Else {

$OutPut += Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | ft | Out-String

}

} Else {

$DCs = $DomainControllers.Split(',')

foreach ($DomainController in $DCs) {

Write-Host "checking DC: $DomainController"

$OutPut += "Export from DC: $DomainController"

$OutPut += ""

If ($FullDetails) {

$OutPut += Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | fl | Out-String

} Else {

$OutPut += Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-$HoursInThePast) } | ft | Out-String

}

$OutPut

if ($SendMail) {

Send-MailMessage -From $SMTPfrom -to $SMTPto -Subject $SMTPsubject -Body $OutPut -SmtpServer $SMTPserver

}

August 1, 2019 by Florian Rossmark scripts security server

APC InRow A/C error monitoring with PRTG

It is rather hard to get valuable alarm monitoring from an APC InRow air conditioning unit. The APC A/C’s are a real pain when it comes to this, it might even be that this same principle applies to APC UPS units, but I did not have yet time to test this out.

What I really wanted is a way to monitor alerts that the unit reports. Doing so seemed to be fine with a simple SNMP sensor in PRTG but the real challenge was getting the alert text. Now, there are SNMP channels but they are only available when an alert is ongoing, meaning when there is no alert status the whole OID fails.

To compensate this, I ended up writing a simple PowerShell script that interprets the SNMP OID results, even ignores a certain failure cause I didn’t care about it, and reports back the results as a total error count (set the channel to ErrorLimit = 0 in PRTG) and if there are Errors it will write them to the text.

This is an Advanced EXE script that needs to reside in the following path:

C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML

1	C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML

It expects the parameters for community and IP-Address

public %host

1	public %host

The results of the script will always hold the top 4 error messages, but it will exclude the phrase “No Backup Units Available Alarm” from the error count – cause in certain setups like hours there are multiple units but they are not necessarily clustered – this is not a full alarm rather then a warning in my case. Feel free to adjust this in the script if you want to raise the error. You could simply remove / remark the following line:

$TotalErrors.Data = $TotalErrors.Data - $SubstractError

1	$TotalErrors.Data = $TotalErrors.Data - $SubstractError

Here a picture of a real world alarm respective issue with the APC InRow A/C in PRTG generated by the script

Param(
    $Community,
    $IP
)

$TotalErrors = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.1.0
$Error1 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.1
$Error2 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.2
$Error3 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.3
$Error4 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.4

$SubstractError = 0

if ($Error1.Data.length -gt 0) {
    if ($Error1.Data -ne "NoSuchInstance") {
        if ($Error1.Data -eq "No Backup Units Available Alarm") {    
            $SubstractError += 1
        }
        $ErrorText = $Error1.Data
    }
}
if ($Error2.Data.length -gt 0) {
    if ($Error2.Data -ne "NoSuchInstance") {
        if ($Error2.Data -eq "No Backup Units Available Alarm") {    
            $SubstractError += 1
        }
        $ErrorText += " - " + $Error2.Data
    }
}
if ($Error3.Data.length -gt 0) {
    if ($Error3.Data -ne "NoSuchInstance") {
        if ($Error3.Data -eq "No Backup Units Available Alarm") {    
            $SubstractError += 1
        }
        $ErrorText += " - " + $Error3.Data
    }
}
if ($Error4.Data.length -gt 0) {
    if ($Error4.Data -ne "NoSuchInstance") {
        if ($Error4.Data -eq "No Backup Units Available Alarm") {    
            $SubstractError += 1
        }
        $ErrorText += " - " + $Error4.Data
    }
}

$TotalErrors.Data = $TotalErrors.Data - $SubstractError

$XML =  "<prtg>"
$XML += "<result><channel>Total Errors</channel><value>" + $TotalErrors.Data + "</value><unit>Count</unit></result>"
$XML += "<text>$ErrorText</text>"
$XML += "</prtg>"

Function WriteXmlToScreen ([xml]$xml)
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen $XML

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

Param(

$Community,

$IP

)

$TotalErrors = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.1.0

$Error1 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.1

$Error2 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.2

$Error3 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.3

$Error4 = Get-SnmpData -IP $IP -Community $Community -OID 1.3.6.1.4.1.318.1.1.13.4.3.2.1.3.4

$SubstractError = 0

if ($Error1.Data.length -gt 0) {

if ($Error1.Data -ne "NoSuchInstance") {

if ($Error1.Data -eq "No Backup Units Available Alarm") {

$SubstractError += 1

}

$ErrorText = $Error1.Data

}

if ($Error2.Data.length -gt 0) {

if ($Error2.Data -ne "NoSuchInstance") {

if ($Error2.Data -eq "No Backup Units Available Alarm") {

$SubstractError += 1

}

$ErrorText += " - " + $Error2.Data

}

if ($Error3.Data.length -gt 0) {

if ($Error3.Data -ne "NoSuchInstance") {

if ($Error3.Data -eq "No Backup Units Available Alarm") {

$SubstractError += 1

}

$ErrorText += " - " + $Error3.Data

}

if ($Error4.Data.length -gt 0) {

if ($Error4.Data -ne "NoSuchInstance") {

if ($Error4.Data -eq "No Backup Units Available Alarm") {

$SubstractError += 1

}

$ErrorText += " - " + $Error4.Data

}

$TotalErrors.Data = $TotalErrors.Data - $SubstractError

$XML = "<prtg>"

$XML += "<result><channel>Total Errors</channel><value>" + $TotalErrors.Data + "</value><unit>Count</unit></result>"

$XML += "<text>$ErrorText</text>"

$XML += "</prtg>"

Function WriteXmlToScreen ([xml]$xml)

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen $XML

July 19, 2019 by Florian Rossmark monitoring prtg scripts

Move user Documents and Desktop to OneDrive

The PowerShell script below was design to move Documents, Music, Videos, Pictures, Favorites and Desktop to a sub-folder in a connected OneDrive. In theory the script does not depend on OneDrive and could be adjusted to any other destination.

While it normally is wise to engage GPOs to adjust those paths to internal server resources, this is not possible easily while using OneDrive. The script therefor works better here.

What it does

is the current path per folder accessible
does the target path exist
1. YES: adjust the registry respective folder targets to the target path – FINISHED
2. NO: create the target folders – see 3.
is the source path on the same volume / partition – like C:
1. YES: see below – 4.
2. NO: check if there is enough free space for the amount of data needed to be moved
  1. YES: see below – 4.
  2. ALMOST: YELLOW warning – see below 4.
  3. NO: RED error – you could still proceed or simply close the script
move the data to the new target folder
remove the old folder – if not possible rename it

The script retains the special icons for the folders and engages the Windows API to adjust the folder paths.

What you need to do

Adjust the target-path in the top of the script
If desired, adjust the minimum free space value (2 GB by default) for the warning in regards to the free space – this only matters if the source and target volume / partition aren’t the same

To start the script, either right click and say run with PowerShell or run it directly in a PowerShell. This script will need to execute in the user-context and does NOT need administrative rights.

Clear
$NewRootPath = "$env:USERPROFILE\OneDrive - MYDOMAIN\User Profile"
$regUSF = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
$regSF = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" 

$Folders = "Personal,My Pictures,My Music,My Video,Favorites,Desktop"
$Folders = $Folders.Split(",")
$FolderNames = "Documents,Pictures,Music,Videos,Favorites,Desktop"
$FolderNames = $FolderNames.Split(",")

$AddSize = 2000000000 #free space in Bytes to add if files are on a different volume (2000000000 = about 2 GB)

$ArrayPosition = -1

Function Move-KnownFolderPath {
    Param (
            [Parameter(Mandatory = $true)]
            [ValidateSet('Desktop', 'Documents', 'Downloads', 'Favorites', 'Music', 'Pictures', 'Videos')]
            [string]$KnownFolder,
            [Parameter(Mandatory = $true)]
            [string]$Path
    )

    # Known Folder GUIDs
    $KnownFolders = @{
        'Desktop' = @('B4BFCC3A-DB2C-424C-B029-7FE99A87C641');
        'Documents' = @('FDD39AD0-238F-46AF-ADB4-6C85480369C7','f42ee2d3-909f-4907-8871-4c22fc0bf756');
        'Downloads' = @('374DE290-123F-4565-9164-39C4925E467B','7d83ee9b-2244-4e70-b1f5-5393042af1e4'); #not in use - just in case you want to use it..
        'Favorites' = '1777F761-68AD-4D8A-87BD-30B759FA33DD';
        'Music' = @('4BD8D571-6D19-48D3-BE97-422220080E43','a0c69a99-21c8-4671-8703-7934162fcf1d');
        'Pictures' = @('33E28130-4E1E-4676-835A-98395C3BC3BB','0ddd015d-b06c-45d5-8c4c-f59713854639');
        'Videos' = @('18989B1D-99B5-455B-841C-AB7C74E4DDFC','35286a68-3c57-41a1-bbb1-0eae73d76c95');
    }

    $FolderGUID = ([System.Management.Automation.PSTypeName]'KnownFolders').Type
	#create the Type entry if it does not yet exist / relates to the Registry eventually
    If (-not $FolderGUID) {
        $KnownFolderGUID = @'
[DllImport("shell32.dll")]
public extern static int SHSetKnownFolderPath(ref Guid folderId, uint flags, IntPtr token, [MarshalAs(UnmanagedType.LPWStr)] string path);
'@
        $FolderGUID = Add-Type -MemberDefinition $KnownFolderGUID -Name 'KnownFolders' -Namespace 'SHSetKnownFolderPath' -PassThru
    }

    If(!(Test-Path $Path)){
		#in case folder does yet exist, we create it
		Try {
			New-Item -Path $Path -Type Directory -Force -ErrorAction SilentlyContinue
		} Catch {}
    }
	#set the new folder path
	ForEach ($TmpGUID in $KnownFolders[$KnownFolder]) {
		$tmp = $FolderGUID::SHSetKnownFolderPath([ref]$TmpGUID, 0, 0, $Path)	
	}	
	Attrib +r $Path	#needed to retain the icon 
}

ForEach ($Folder In $Folders)
{	
	$ArrayPosition += 1
    Write-Host "Working on folder"$FolderNames[$ArrayPosition] -BackgroundColor DarkGreen
    $SourcePath = (Get-ItemProperty -Path $regUSF -Name $Folder).$Folder
    If ($SourcePath.Length -gt 0)
    {
		Write-Host "..checking source path: $SourcePath"
		If ((Test-Path -Path $SourcePath)){
			Write-Host "....path is accessible"
			$CompSource = Get-Item -Path $SourcePath
			$CompareResult = $false
			If ((Test-Path -Path ($NewRootPath + "\" + $CompSource.Name))){
				$CompTarget = Get-Item -Path ($NewRootPath + "\" + $CompSource.Name)
				Write-Host "..Comparing Source Path: "$CompSource.FullName
				Write-Host "....with Target Path:    "$CompTarget.FullName
				If ($CompSource.FullName.ToLower() -eq $CompTarget.FullName.ToLower()){
					$CompareResult = $true
				} Else {
					$CompareResult = $false
				}
			} Else {
				Write-Host "..Target Path does not exist"
			}
			If ($CompareResult -eq $true){
				Write-Host "..Source and Target path are identical: $CompTarget" -ForegroundColor Yellow
				Write-Host "....Not applying any changes!" -ForegroundColor Yellow
				Pause
			} Else {
				$SourceFolder = Get-Item -Path $SourcePath
				Write-Host "..accessing source folder $SourceFolder" -ForegroundColor Green
				If (!(Test-Path -Path ($NewRootPath + '\' + $SourceFolder.Name))){
					Move-KnownFolderPath -KnownFolder ("" + $FolderNames[$ArrayPosition] + "") -Path ($NewRootPath + '\' + $FolderNames[$ArrayPosition])
					$TargetPath = Get-Item -Path ("$NewRootPath\" + $FolderNames[$ArrayPosition])
					Write-Host "..created new folder $TargetPath"
					
					#compare source size with target free space here
					Write-Host "..Comparing Source and Target drive letters"
					If ($NewRootPath.SubString(0,2).ToLower() -ne $SourcePath.SubString(0,2).ToLower())
					{
						#source drives are different.. we need to obey the SourceSize against the free space on the target
						Write-Host "....Source and Target drive letters are different"
						Write-Host "......Please wait while calculating the source size"
						$SourceSize = (Get-ChildItem -Path $SourcePath -Recurse | Measure-Object -Property Length -Sum -ErrorAction SilentlyContinue).Sum
						$TargetFree = Get-PSDrive $NewRootPath.SubString(0,1) | Select-Object Free
						If ($SourceSize -gt $TargetFree.Free) {
							Write-Host "......The Source size of $SourceSize Bytes is bigger then the free space on the Target of $TargetFree.Free Bytes" -ForegroundColor Red
						} ElseIf (($SourceSize + $AddSize) -gt $TargetFree.Free) {
							Write-Host "......The Source size of $SourceSize Bytes is close to the free space on the Target of $TargetFree.Free Bytes" -ForegroundColor Yellow
						} Else {
							Write-Host "......The Source size of $TargetFree.Free Bytes is sufficient to hold the data from the Source of $SourceSize Bytes" -ForegroundColor Green
						}
						Pause
					} Else {
						Write-Host "....Source and Targets are on the same drive, all good"
					}
					
					Write-Host "..Moving data from: $SourcePath"
					Write-Host "....to folder:      $TargetPath"
					Write-Host "....This can take several minutes..."
					Move-Item -Path ("" + $SourcePath + "\*") -Destination $TargetPath -Force -ErrorAction SilentlyContinue
					Write-Host "....Done moving data"
				} Else {
					Write-Host "..Warning - Target Path exists already: $CompTarget" -ForegroundColor Yellow
					Write-Host "....Files will not be moved, registry still will be adjusted to the target path!" -ForegroundColor Yellow
					Pause
					Move-KnownFolderPath -KnownFolder ("" + $FolderNames[$ArrayPosition] + "") -Path ($NewRootPath + '\' + $FolderNames[$ArrayPosition])
					Write-Host "....Finished adjusting registry"
				}
				Write-Host "..Trying to remove $SourcePath"
				Pause
				Try {
					Attrib -r -s $SourceFolder.FullName	
					Remove-Item -Path $SourceFolder.FullName -Force -Confirm:$false -Recurse -ErrorAction SilentlyContinue
				} Catch {}	
				Try {
					Attrib -r -s ($SourceFolder + "\desktop.ini")	
					Remove-Item -Path ($SourceFolder + "\desktop.ini") -Force -Confirm:$false -ErrorAction SilentlyContinue
				} Catch {}						
				Try {
					Rename-Item -Path $SourceFolder -NewName ($SourceFolder.Name + ".old") -Force -ErrorAction SilentlyContinue
				} Catch {}		
			}
		} Else {
			Write-Host "....SourceFolder Path invalid: $SourcePath" -ForegroundColor Red
		}
    } 
	Write-Host "..Done processing"$FolderNames[$ArrayPosition] -BackgroundColor Blue
	Pause
}
Write-Host "Script finished processing" -ForegroundColor Green
Pause

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

Clear

$NewRootPath = "$env:USERPROFILE\OneDrive - MYDOMAIN\User Profile"

$regUSF = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"

$regSF = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"

$Folders = "Personal,My Pictures,My Music,My Video,Favorites,Desktop"

$Folders = $Folders.Split(",")

$FolderNames = "Documents,Pictures,Music,Videos,Favorites,Desktop"

$FolderNames = $FolderNames.Split(",")

$AddSize = 2000000000 #free space in Bytes to add if files are on a different volume (2000000000 = about 2 GB)

$ArrayPosition = -1

Function Move-KnownFolderPath {

Param (

[Parameter(Mandatory = $true)]

[ValidateSet('Desktop', 'Documents', 'Downloads', 'Favorites', 'Music', 'Pictures', 'Videos')]

[string]$KnownFolder,

[Parameter(Mandatory = $true)]

[string]$Path

)

# Known Folder GUIDs

$KnownFolders = @{

'Desktop' = @('B4BFCC3A-DB2C-424C-B029-7FE99A87C641');

'Documents' = @('FDD39AD0-238F-46AF-ADB4-6C85480369C7','f42ee2d3-909f-4907-8871-4c22fc0bf756');

'Downloads' = @('374DE290-123F-4565-9164-39C4925E467B','7d83ee9b-2244-4e70-b1f5-5393042af1e4'); #not in use - just in case you want to use it..

'Favorites' = '1777F761-68AD-4D8A-87BD-30B759FA33DD';

'Music' = @('4BD8D571-6D19-48D3-BE97-422220080E43','a0c69a99-21c8-4671-8703-7934162fcf1d');

'Pictures' = @('33E28130-4E1E-4676-835A-98395C3BC3BB','0ddd015d-b06c-45d5-8c4c-f59713854639');

'Videos' = @('18989B1D-99B5-455B-841C-AB7C74E4DDFC','35286a68-3c57-41a1-bbb1-0eae73d76c95');

}

$FolderGUID = ([System.Management.Automation.PSTypeName]'KnownFolders').Type

#create the Type entry if it does not yet exist / relates to the Registry eventually

If (-not $FolderGUID) {

$KnownFolderGUID = @'

[DllImport("shell32.dll")]

public extern static int SHSetKnownFolderPath(ref Guid folderId, uint flags, IntPtr token, [MarshalAs(UnmanagedType.LPWStr)] string path);

'@

$FolderGUID = Add-Type -MemberDefinition $KnownFolderGUID -Name 'KnownFolders' -Namespace 'SHSetKnownFolderPath' -PassThru

}

If(!(Test-Path $Path)){

#in case folder does yet exist, we create it

Try {

New-Item -Path $Path -Type Directory -Force -ErrorAction SilentlyContinue

} Catch {}

}

#set the new folder path

ForEach ($TmpGUID in $KnownFolders[$KnownFolder]) {

$tmp = $FolderGUID::SHSetKnownFolderPath([ref]$TmpGUID, 0, 0, $Path)

}

Attrib +r $Path #needed to retain the icon

}

ForEach ($Folder In $Folders)

{

$ArrayPosition += 1

Write-Host "Working on folder"$FolderNames[$ArrayPosition] -BackgroundColor DarkGreen

$SourcePath = (Get-ItemProperty -Path $regUSF -Name $Folder).$Folder

If ($SourcePath.Length -gt 0)

{

Write-Host "..checking source path: $SourcePath"

If ((Test-Path -Path $SourcePath)){

Write-Host "....path is accessible"

$CompSource = Get-Item -Path $SourcePath

$CompareResult = $false

If ((Test-Path -Path ($NewRootPath + "\" + $CompSource.Name))){

$CompTarget = Get-Item -Path ($NewRootPath + "\" + $CompSource.Name)

Write-Host "..Comparing Source Path: "$CompSource.FullName

Write-Host "....with Target Path: "$CompTarget.FullName

If ($CompSource.FullName.ToLower() -eq $CompTarget.FullName.ToLower()){

$CompareResult = $true

} Else {

$CompareResult = $false

}

} Else {

Write-Host "..Target Path does not exist"

}

If ($CompareResult -eq $true){

Write-Host "..Source and Target path are identical: $CompTarget" -ForegroundColor Yellow

Write-Host "....Not applying any changes!" -ForegroundColor Yellow

Pause

} Else {

$SourceFolder = Get-Item -Path $SourcePath

Write-Host "..accessing source folder $SourceFolder" -ForegroundColor Green

If (!(Test-Path -Path ($NewRootPath + '\' + $SourceFolder.Name))){

Move-KnownFolderPath -KnownFolder ("" + $FolderNames[$ArrayPosition] + "") -Path ($NewRootPath + '\' + $FolderNames[$ArrayPosition])

$TargetPath = Get-Item -Path ("$NewRootPath\" + $FolderNames[$ArrayPosition])

Write-Host "..created new folder $TargetPath"

#compare source size with target free space here

Write-Host "..Comparing Source and Target drive letters"

If ($NewRootPath.SubString(0,2).ToLower() -ne $SourcePath.SubString(0,2).ToLower())

{

#source drives are different.. we need to obey the SourceSize against the free space on the target

Write-Host "....Source and Target drive letters are different"

Write-Host "......Please wait while calculating the source size"

$SourceSize = (Get-ChildItem -Path $SourcePath -Recurse | Measure-Object -Property Length -Sum -ErrorAction SilentlyContinue).Sum

$TargetFree = Get-PSDrive $NewRootPath.SubString(0,1) | Select-Object Free

If ($SourceSize -gt $TargetFree.Free) {

Write-Host "......The Source size of $SourceSize Bytes is bigger then the free space on the Target of $TargetFree.Free Bytes" -ForegroundColor Red

} ElseIf (($SourceSize + $AddSize) -gt $TargetFree.Free) {

Write-Host "......The Source size of $SourceSize Bytes is close to the free space on the Target of $TargetFree.Free Bytes" -ForegroundColor Yellow

} Else {

Write-Host "......The Source size of $TargetFree.Free Bytes is sufficient to hold the data from the Source of $SourceSize Bytes" -ForegroundColor Green

}

Pause

} Else {

Write-Host "....Source and Targets are on the same drive, all good"

}

Write-Host "..Moving data from: $SourcePath"

Write-Host "....to folder: $TargetPath"

Write-Host "....This can take several minutes..."

Move-Item -Path ("" + $SourcePath + "\*") -Destination $TargetPath -Force -ErrorAction SilentlyContinue

Write-Host "....Done moving data"

} Else {

Write-Host "..Warning - Target Path exists already: $CompTarget" -ForegroundColor Yellow

Write-Host "....Files will not be moved, registry still will be adjusted to the target path!" -ForegroundColor Yellow

Pause

Move-KnownFolderPath -KnownFolder ("" + $FolderNames[$ArrayPosition] + "") -Path ($NewRootPath + '\' + $FolderNames[$ArrayPosition])

Write-Host "....Finished adjusting registry"

}

Write-Host "..Trying to remove $SourcePath"

Pause

Try {

Attrib -r -s $SourceFolder.FullName

Remove-Item -Path $SourceFolder.FullName -Force -Confirm:$false -Recurse -ErrorAction SilentlyContinue

} Catch {}

Try {

Attrib -r -s ($SourceFolder + "\desktop.ini")

Remove-Item -Path ($SourceFolder + "\desktop.ini") -Force -Confirm:$false -ErrorAction SilentlyContinue

} Catch {}

Try {

Rename-Item -Path $SourceFolder -NewName ($SourceFolder.Name + ".old") -Force -ErrorAction SilentlyContinue

} Catch {}

}

} Else {

Write-Host "....SourceFolder Path invalid: $SourcePath" -ForegroundColor Red

}

Write-Host "..Done processing"$FolderNames[$ArrayPosition] -BackgroundColor Blue

Pause

}

Write-Host "Script finished processing" -ForegroundColor Green

Pause

Please be advised – the script will by default not try to move e.g. DOWNLOADS.

You can adjust this, while adding the folder to the two parameter, see sample below.

$Folders = "Personal,My Pictures,My Music,My Video,Favorites,Desktop<strong>,Downloads</strong>" 
$Folders = $Folders.Split(",") 
$FolderNames = "Documents,Pictures,Music,Videos,Favorites,Desktop<strong>,Downloads</strong>" 
$FolderNames = $FolderNames.Split(",")

1

2

3

4

$Folders = "Personal,My Pictures,My Music,My Video,Favorites,Desktop<strong>,Downloads</strong>"

$Folders = $Folders.Split(",")

$FolderNames = "Documents,Pictures,Music,Videos,Favorites,Desktop<strong>,Downloads</strong>"

$FolderNames = $FolderNames.Split(",")

If you want more folder, the script would need some special adjustments. It can be used as a base script, if you want.

April 18, 2019 by Florian Rossmark o365 / m365 recommendations scripts windows

Compare a TRACEROUTE against an expected route

Some times it is important to know if a route to a specific target changed. The best way to check this is for sure to engage a monitoring software. But there might not be a real standard solution in the monitoring software. Now you end up wondering how should you approach this and find a solution to monitor a traceroute result and the hops between you and the target and find out if something changed.

For this exact case I wrote a PowerShell script that expects the following two parameter:

a target IP address or DNS name
a list of IP addresses in order as they should come up in the traceroute (comma separated)
1. include the target IP address as a final HOP

The script then will execute a tracert or traceroute to the target and compare the results step by step against the IP address list you injected. If a HOP is different at a certain position from what was expected an error will be reported back which IP was found and which was expected.

If there are no differences as for the injected IP list, it still could be the case that the traceroute to the target was e.g. longer or shorter – if there then is a difference in the HOP count between the actual traceroute results and the injected IP address list you still will get an error raised and a report back on the amount of found hops and expected hops.

Since the whole output is optimized to be processed by Paessler’s PRTG you also get an error from the sensor / script when the target was not reachable.

Additionally some information on the round-trip-time (RTT) and total HOPs is reported back to the sensor, ending up in a total of four channels:

Target reached
Round Trip Time
Total HOPs
Route matches expected route

As of September 2020 there are two versions of this script. First see the original script, after this I detail out the second version, see further below please.

param(
  [string]$Target,
  [string]$ExpectedRoute
)

$ER = $ExpectedRoute.Split(",");

$Trace=TNC $Target -TraceRoute;
$Count=[string]$Trace.TraceRoute.Count;

$Message = "";
$asexpected = 1;
[int]$i = 0;
ForEach ($IP in $Trace.TraceRoute) {
    If ($i -lt $ER.Length){
        If ($IP.Trim() -ne $ER[$i].Trim()) {
            $Message = "Route change at HOP #" + ($i + 1).ToString() + " - IP expected: " + $ER[$i] + " - IP found: $IP";
            $asexpected = 0;
            break;
        }
    }
    $i += 1;
}

If ($Trace.TraceRoute.Count -ne $ER.Length) {
    If ($asexpected -eq 1) {
        $Message = "Route changed - expected HOP count: " + $ER.Length + " - detected HOP count: " + $Trace.TraceRoute.Count;
        $asexpected = 1;
    }
}

$reached = 0;
If ($Trace.PingSucceeded) {
    $reached = 1;
}


$XML = "<prtg>
    <result>
        <channel>Target reached</channel>
        <value>$reached</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
    </result>
    <result>
        <channel>Round Trip Time</channel>
        <value>" + $Trace.PingReplyDetails.RoundtripTime + "</value>
    </result>
    <result>
        <channel>Total HOPs</channel>
        <value>" + $Trace.TraceRoute.Count + "</value>
    </result>
    <result>
        <channel>Route matches expected route</channel>
        <value>$asexpected</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
        <LimitErrorMsg>$Message</LimitErrorMsg>
    </result>
</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen "$XML"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

param(

[string]$Target,

[string]$ExpectedRoute

)

$ER = $ExpectedRoute.Split(",");

$Trace=TNC $Target -TraceRoute;

$Count=[string]$Trace.TraceRoute.Count;

$Message = "";

$asexpected = 1;

[int]$i = 0;

ForEach ($IP in $Trace.TraceRoute) {

If ($i -lt $ER.Length){

If ($IP.Trim() -ne $ER[$i].Trim()) {

$Message = "Route change at HOP #" + ($i + 1).ToString() + " - IP expected: " + $ER[$i] + " - IP found: $IP";

$asexpected = 0;

break;

}

$i += 1;

}

If ($Trace.TraceRoute.Count -ne $ER.Length) {

If ($asexpected -eq 1) {

$Message = "Route changed - expected HOP count: " + $ER.Length + " - detected HOP count: " + $Trace.TraceRoute.Count;

$asexpected = 1;

}

$reached = 0;

If ($Trace.PingSucceeded) {

$reached = 1;

}

$XML = "<prtg>

<channel>Target reached</channel>

<value>$reached</value>

</result>

<channel>Round Trip Time</channel>

<value>" + $Trace.PingReplyDetails.RoundtripTime + "</value>

</result>

<channel>Total HOPs</channel>

<value>" + $Trace.TraceRoute.Count + "</value>

</result>

<channel>Route matches expected route</channel>

<value>$asexpected</value>

<LimitErrorMsg>$Message</LimitErrorMsg>

</result>

</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

As mentioned further above, after a request in September 2020 in the Paessler KB a version 2 of the script was created. This version includes a third needed parameter – Expected IP address. This also introduces a new channel, that will indicate if the expected IP was found or not (error status).

This can possibly help, as the requestor stated, to determine if route still goes over a primary gateway or a backup gateway. Sometimes you a route might change further below, but a certain router needs to be active. You could also easily change the expected IP behavior to not expected IP behavior, by changing the $ExpectedIPFound value in line 33 to 1 and in line 36 to 0. This will invert the script behavior for this function and therefor only alert (indicate) IF this IP suddenly appears on the route, besides the fact that the route will have changed anyways.

param(
  [string]$Target,
  [string]$ExpectedRoute,
  [string]$ExpectedIP
)

$ER = $ExpectedRoute.Split(",");

$Trace=TNC $Target -TraceRoute;
$Count=[string]$Trace.TraceRoute.Count;

$Message = "";
$asexpected = 1;
[int]$i = 0;
ForEach ($IP in $Trace.TraceRoute) {
    If ($i -lt $ER.Length){
        If ($IP.Trim() -ne $ER[$i].Trim()) {
            $Message = "Route change at HOP #" + ($i + 1).ToString() + " - IP expected: " + $ER[$i] + " - IP found: $IP";
            $asexpected = 0;
            break;
        }
    }
    $i += 1;
}

If ($Trace.TraceRoute.Count -ne $ER.Length) {
    If ($asexpected -eq 1) {
        $Message = "Route changed - expected HOP count: " + $ER.Length + " - detected HOP count: " + $Trace.TraceRoute.Count;
        $asexpected = 1;
    }
}

$ExpectedIPFound = 0
ForEach ($IP in $Trace.TraceRoute) {
	If ($IP.Trim() -eq $ExpectedIP.Trim()) {
		$ExpectedIPFound = 1;
		break;
	}
}

$reached = 0;
If ($Trace.PingSucceeded) {
    $reached = 1;
}

$XML = "<prtg>
    <result>
        <channel>Target reached</channel>
        <value>$reached</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
    </result>
    <result>
        <channel>Round Trip Time</channel>
        <value>" + $Trace.PingReplyDetails.RoundtripTime + "</value>
    </result>
    <result>
        <channel>Total HOPs</channel>
        <value>" + $Trace.TraceRoute.Count + "</value>
    </result>
    <result>
        <channel>Expected IP Found</channel>
        <value>$ExpectedIPFound</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>		
    </result>	
    <result>
        <channel>Route matches expected route</channel>
        <value>$asexpected</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
        <LimitErrorMsg>$Message</LimitErrorMsg>
    </result>
	<text>$Message</text>
</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen "$XML"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

param(

[string]$Target,

[string]$ExpectedRoute,

[string]$ExpectedIP

)

$ER = $ExpectedRoute.Split(",");

$Trace=TNC $Target -TraceRoute;

$Count=[string]$Trace.TraceRoute.Count;

$Message = "";

$asexpected = 1;

[int]$i = 0;

ForEach ($IP in $Trace.TraceRoute) {

If ($i -lt $ER.Length){

If ($IP.Trim() -ne $ER[$i].Trim()) {

$Message = "Route change at HOP #" + ($i + 1).ToString() + " - IP expected: " + $ER[$i] + " - IP found: $IP";

$asexpected = 0;

break;

}

$i += 1;

}

If ($Trace.TraceRoute.Count -ne $ER.Length) {

If ($asexpected -eq 1) {

$Message = "Route changed - expected HOP count: " + $ER.Length + " - detected HOP count: " + $Trace.TraceRoute.Count;

$asexpected = 1;

}

$ExpectedIPFound = 0

ForEach ($IP in $Trace.TraceRoute) {

If ($IP.Trim() -eq $ExpectedIP.Trim()) {

$ExpectedIPFound = 1;

break;

}

$reached = 0;

If ($Trace.PingSucceeded) {

$reached = 1;

}

$XML = "<prtg>

<channel>Target reached</channel>

<value>$reached</value>

</result>

<channel>Round Trip Time</channel>

<value>" + $Trace.PingReplyDetails.RoundtripTime + "</value>

</result>

<channel>Total HOPs</channel>

<value>" + $Trace.TraceRoute.Count + "</value>

</result>

<channel>Expected IP Found</channel>

<value>$ExpectedIPFound</value>

</result>

<channel>Route matches expected route</channel>

<value>$asexpected</value>

<LimitErrorMsg>$Message</LimitErrorMsg>

</result>

<text>$Message</text>

</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

March 6, 2019 by Florian Rossmark monitoring prtg scripts

Request a DNS based web site directly from an IP address

If you are using multiple web servers and some more advanced DNS configuration like e.g. Round-Robin (and other) to load balance and possibly even GEO divide traffic to those web servers while those are all hosting the same web site you might as well want to monitor if this is all working as expected.

The challenge in this case is – your monitoring system might get just a single IP that might even change every now and then back from DNS when it requests it from DNS. So you would end up needing to use the target IP addresses of the individual web servers instead. But those expect you that your request for the web site goes through the domain name, since the servers aren’t supposed to answer on direct host-name / IP address requests or another web-site might be hosted there.

In order to accomplish this – I wrote the script below. It allows you to request a website directly from an IP address while injecting the DNS host in the header section of the Invoke-WebRequest (IWR) in PowerShell.

If you need to target a specific target site you can inject of just the IP address additional information, for example:

Standard parameters
- -DomainName “google.com” -IP “8.8.8.8”
  - this will request the web-root / default page
Sub-Page parameters
- -DomainName “google.com” -IP “8.8.8.8/monitoring.html”
  - this will request the content of /monitoring.html on the IP 8.8.8.8 with the DNS name google.com

PS: Please be aware – the above will not work – 8.8.8.8 is a Google-DNS server and not one of their web-servers. The above is only an example to show what is possible.

The below script output was optimized to be used in PRTG.

param(
    [string] $DomainName = "",
    [string] $IP = "",
    [string] $KeyWord = " ",
    [int] $MinimumResponseSizeInByte = 1,
    [bool] $useHTTPS = $true
)
add-type @"
    using System.Net;
    using System.Security.Cryptography.X509Certificates;
    public class TrustAllCertsPolicy : ICertificatePolicy {
        public bool CheckValidationResult(
            ServicePoint srvPoint, X509Certificate certificate,
            WebRequest request, int certificateProblem) {
            return true;
        }
    }
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

If ($useHTTPS -eq $true) { 
    $Prefix = "https://" 
} Else { 
    $Prefix = "http://" 
}

$IWRResponse = "";
$IWRError = 0;
$IWRErrorMessage = "";

$IWRResponse = Try {
    Invoke-WebRequest -Uri "$Prefix$IP" -Headers @{Host="$DomainName"} -ErrorAction Stop
} Catch {
    $IWRError = $_.Exception.GetHashCode()        
    If ($IWRError -eq 0) {
        $IWRError = 1 
    }
    $IWRErrorMessage = $_.Exception.Message
}
Try {
    $IWRResponse = $IWRResponse.ToString()
} Catch {}

$KeyWordFound = 0
Try {
    If ($IWRResponse.Contains($KeyWord)) { 
        $KeyWordFound = 1 
    } 
} Catch {}

$ResponseSufficient = 0 
Try {
    If ($IWRResponse -gt $MinimumResponseSizeInByte) { 
        $ResponseSufficient = 1 
    }  
} Catch {}

$XML = "<prtg>
    <result>
        <channel>Check result</channel>
        <value>$IWRError</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>0</LimitMinError>
        <LimitMaxError>0</LimitMaxError>
        <LimitErrorMsg>$IWRErrorMessage</LimitErrorMsg>
    </result>
    <result>
        <channel>Keyword found</channel>
        <value>$KeyWordFound</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
        <LimitErrorMsg>Keyword was not found in response</LimitErrorMsg>
    </result>
    <result>
        <channel>Response Length</channel>
        <value>" + $IWRResponse.Length + "</value>
        <VolumeSize>Byte</VolumeSize>
        <NotifyChanged>1</NotifyChanged>
    </result>
    <result>
        <channel>Reponse Length sufficient</channel>
        <value>$ResponseSufficient</value>
        <LimitMode>1</LimitMode>
        <LimitMinError>1</LimitMinError>
        <LimitErrorMsg>Response size not sufficient</LimitErrorMsg>
    </result>
</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen "$XML"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

param(

[string] $DomainName = "",

[string] $IP = "",

[string] $KeyWord = " ",

[int] $MinimumResponseSizeInByte = 1,

[bool] $useHTTPS = $true

)

add-type @"

using System.Net;

using System.Security.Cryptography.X509Certificates;

public class TrustAllCertsPolicy : ICertificatePolicy {

public bool CheckValidationResult(

ServicePoint srvPoint, X509Certificate certificate,

WebRequest request, int certificateProblem) {

return true;

}

"@

[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

If ($useHTTPS -eq $true) {

$Prefix = "https://"

} Else {

$Prefix = "http://"

}

$IWRResponse = "";

$IWRError = 0;

$IWRErrorMessage = "";

$IWRResponse = Try {

Invoke-WebRequest -Uri "$Prefix$IP" -Headers @{Host="$DomainName"} -ErrorAction Stop

} Catch {

$IWRError = $_.Exception.GetHashCode()

If ($IWRError -eq 0) {

$IWRError = 1

}

$IWRErrorMessage = $_.Exception.Message

}

Try {

$IWRResponse = $IWRResponse.ToString()

} Catch {}

$KeyWordFound = 0

Try {

If ($IWRResponse.Contains($KeyWord)) {

$KeyWordFound = 1

}

} Catch {}

$ResponseSufficient = 0

Try {

If ($IWRResponse -gt $MinimumResponseSizeInByte) {

$ResponseSufficient = 1

}

} Catch {}

$XML = "<prtg>

<channel>Check result</channel>

<value>$IWRError</value>

<LimitErrorMsg>$IWRErrorMessage</LimitErrorMsg>

</result>

<channel>Keyword found</channel>

<value>$KeyWordFound</value>

<LimitErrorMsg>Keyword was not found in response</LimitErrorMsg>

</result>

<channel>Response Length</channel>

<value>" + $IWRResponse.Length + "</value>

</result>

<channel>Reponse Length sufficient</channel>

<value>$ResponseSufficient</value>

<LimitErrorMsg>Response size not sufficient</LimitErrorMsg>

</result>

</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

March 6, 2019 by Florian Rossmark monitoring prtg scripts web

Find user account lockout events

There are various ways and tools to tackle this – in the end it boils down to a few facts

account lockouts are logged per domain controller – to be more specific – only on the DC where the lockout happened
- this can be complicated in bigger environments
the lockout event 4771 does not necessarily reveal the initial reason – but it should give you enough information about where it occurred to further investigate

The manual way via Eventlog / Eventviewer in Windows on a DC

right click on the SECURITY eventlog
select Filter Current Log
go to the register card XML
check the box Edit query manually
Insert the XML code below – make sure you replace the USERNAMEHERE value with the actual username
1. no domain
2. exact username
3. NOT case sensitive

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4771)]][EventData[Data[@Name='TargetUserName'] and (Data='USERNAMEHERE')]]</Select>
  </Query>
</QueryList>

1

2

3

4

5

<Select Path="Security">*[System[(EventID=4771)]][EventData[Data[@Name='TargetUserName'] and (Data='USERNAMEHERE')]]</Select>

</Query>

</QueryList>

This results in to a filtered eventlog view for the event id 4771 and the username you specified.

Using PowerShell to automate this

PowerShell can execute a script that would give you the same output – I wrote the script below. It expects at least the parameter UserName – see below for more information.

UserName
- this parameter is mandatory – the exact username without the domain, this is NOT case sensitive
DomainController
- specify this to narrow it down to a single DC – otherwise all domain controllers will be contacted (might take a while)
FullDetails
- set it to $true if you want to see details – otherwise you get only the table format
Example
- Find-AccountLockoutOnDCForUser.ps1 -FullDetails $true -UserName JDoe

param(
    [string] $DomainController = "",
    [string] $UserName = "",
    [bool]   $FullDetails = $false
)

$Query = @"
<QueryList>
    <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4771)]][EventData[Data[@Name='TargetUserName'] and (Data='$UserName')]]</Select>
  </Query>
</QueryList>
"@

If ($DomainController.Length -eq 0) {
    Import-Module ActiveDirectory
    $DomainControllers = Get-ADDomainController -Filter * | Select-Object -ExpandProperty Name
    ForEach($DC In $DomainControllers) {
        Write-Host "checking DC: $DC"
        If ($FullDetails) {
            Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | fl
        } Else {
            Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | ft
        }
    }
} Else {
    If ($FullDetails) {
        Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | fl
    } Else {
        Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | ft
    }
}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

param(

[string] $DomainController = "",

[string] $UserName = "",

[bool] $FullDetails = $false

)

$Query = @"

<Select Path="Security">*[System[(EventID=4771)]][EventData[Data[@Name='TargetUserName'] and (Data='$UserName')]]</Select>

</Query>

</QueryList>

"@

If ($DomainController.Length -eq 0) {

Import-Module ActiveDirectory

$DomainControllers = Get-ADDomainController -Filter * | Select-Object -ExpandProperty Name

ForEach($DC In $DomainControllers) {

Write-Host "checking DC: $DC"

If ($FullDetails) {

Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | fl

} Else {

Get-WinEvent -ComputerName $DC -FilterXml $Query -ErrorAction SilentlyContinue | ft

}

} Else {

If ($FullDetails) {

Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | fl

} Else {

Get-WinEvent -ComputerName $DomainController -FilterXml $Query -ErrorAction SilentlyContinue | ft

}

February 20, 2019 by Florian Rossmark scripts security server

Windows Search Index monitoring

While rolling out Windows Search Indexing I bumped in to quite a few issues and things I wanted to monitor. One of the main information I actually was after is the amount of files in the Windows Search Index. I could see this information in the Indexing Options of the system and it was constantly updating, but I was not able to find the same information per WMI, PowerShell cmdlets, Performance Counters etc.

This caused me headache cause it was clear that the index a) had to grow till it reached a fully indexed system and b) if the index-size dropped below a certain amount (once finished) I surely had an issue – I saw the database rebuilding out of no where – due to pagefile-issues or space on the partition where the index-database resided.

All of this made it clear that monitoring was inherent – but I did not want to play around with EventIDs – clearly the amount of files in the index was a way better indicator.

This caused me to write the following PowerShell script – it will invoke a command to a target system and count the files currently in the index. This has to be invoked, though the OLEDB provider of the Search Index allows remote-requests, it does not give you accurate numbers for the overall scope of the index on the system using remote requests. Getting to a point to even get this information was quite a challenge, I am certain who ever finds this here will know already, assuming you did some research. Hope it helps, though.

param(
    $TargetServer
)
Invoke-Command -Computer $TargetServer -ScriptBlock {
    $value = 0;
    try{
        $objConn = New-Object System.Data.OleDb.OleDbConnection("Provider=Search.CollatorDSO;Extended Properties='Application=Windows'")
        $sqlCommand = New-Object System.Data.OleDb.OleDbCommand("GROUP ON workid [0] AGGREGATE COUNT() as 'Total' OVER (SELECT workid FROM systemindex)")
        $sqlCommand.Connection = $objConn
        $objConn.open()
        $reader = $sqlCommand.ExecuteReader()
        try{
            $ignore = $reader.Read() #will cause an error but we can ignore it... without this we won't have data
        } catch {}
		$value = $reader[2]
	} catch {}
	$XML = "<prtg>"
	$XML += "<result>"
	$XML += "<channel>indexed files count</channel>"
	$XML += "<value>$value</value>"
	$XML += "</result>"
	$XML += "</prtg>"

	Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
	{
		$StringWriter = New-Object System.IO.StringWriter;
		$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
		$XmlWriter.Formatting = "indented";
		$xml.WriteTo($XmlWriter);
		$XmlWriter.Flush();
		$StringWriter.Flush();
		Write-Output $StringWriter.ToString();
	}

	WriteXmlToScreen $XML;
}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

param(

$TargetServer

)

Invoke-Command -Computer $TargetServer -ScriptBlock {

$value = 0;

try{

$objConn = New-Object System.Data.OleDb.OleDbConnection("Provider=Search.CollatorDSO;Extended Properties='Application=Windows'")

$sqlCommand = New-Object System.Data.OleDb.OleDbCommand("GROUP ON workid [0] AGGREGATE COUNT() as 'Total' OVER (SELECT workid FROM systemindex)")

$sqlCommand.Connection = $objConn

$objConn.open()

$reader = $sqlCommand.ExecuteReader()

try{

$ignore = $reader.Read() #will cause an error but we can ignore it... without this we won't have data

} catch {}

$value = $reader[2]

} catch {}

$XML = "<prtg>"

$XML += "<result>"

$XML += "<channel>indexed files count</channel>"

$XML += "<value>$value</value>"

$XML += "</result>"

$XML += "</prtg>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen $XML;

}

An update to this or what I learned

Of course you wouldn’t just monitor the amount of indexed files with the script above. You likely have a dedicated drive / partition where the index resides. You definitive want to monitor the used or free drive space there as well. What you will discover especially in the beginning but as well later if many files are moved or copied to the server, is that the Windows Search Index database will grow after the indexing of huge amounts of files is done and shrink again. As far as I understand this, there is some maintenance and deduplication going on.

On a server with about 14 million files that took about 1 week to index, I ended up with a 250 GB index database, the second it finished it took another 12 hours while the database grew another 100 GB and then shrunk back to actually 200 GB.

Don’t let those numbers scare you, we talk about 10 TB (terra byte) of data in those 14 million files. This is quite a bit. Most other file servers won’t have such huge databases and you won’t see such huge increases while the index database is doing some kind of clean up, nor will it take a week for the initial index to finish.

What I wanted to show with this is simply that you really want to monitor all those information and keep a close eye on it. I saw the database make huge jumps in size in very very short periods of time. If the drive then is full your index possibly would get corrupted and Windows will start from zero again. You want to avoid this. Once the index is finished and no huge incoming file operations take place you won’t see to many jumps anymore. It will calm down. But still, always make sure you have enough space on the partition where the index database resides and proper monitoring on it to be able to react quickly (going as far as automating a service stop for the Windows Search index while the space goes down to avoid database corruption).

February 20, 2019 by Florian Rossmark monitoring prtg scripts server

Monitor the total amount of sessions on your RDS farm

ins a website from a systems administrator for systems administrators Home IT-Admins CMDB IT-Admins tool IT Search EOL Solutions Blog Contact Links Monitor the total amount of sessions on your RDS farm

This script is designed for PRTG and will allow you to go through all your RDS hosts and result back the total amount of sessions and active sessions.

You have various options as server name source, see the parameter section on top of the script.

This was also posted here: https://kb.paessler.com/en/topic/83151-total-user-count-rds-windows-2016

Please note that I grabbed the original script and re-wrote it completely, adjust some issues I encountered and tried to make it as variable as possible.

param(
    $ServerNameSource, #Numeric script config parameter: 1 = Parameter ServerNames list / 2 = Parameter InputFile / 3 = LDAP query with name-prefix / 4 = LDAP query with filter on OU / 5 = LDAP query with name-prefix and OU filter
    $ServerNames, #depending on ServerNameSource (1) - a simple, coma separated list of server names e.g. @("server1", "server2", "server3")
    $ServerNamesInputFile, #depending on ServerNameSource (2) - path and name of a file that holds the server names, one servername per line - e.g.: "C:\servernames.txt"
    $ServerNamesLDAPnameFilter, #depending on ServerNameSource (3 and/or 5) - name search string - can hold wildcards (*) e.g.: "RDS*"
    $ServerNamesLDAPOUFilter, #depending on ServerNameSource (4 and/or 5) - e.g.: "OU=RDS hosts,DC=domain,DC=local"
    $SubstractSessionsPerHost = 2, #substract this amount of sessions per host - due to e.g. two RDS listeners (would make 2 sessions) or additional e.g. 1x ICA listener (would make 3 sessions) etc...
    $UseWMI = $false #use WMI - if not set it will use QWINSTA by default: enable with: $true
)

#function to convert a string to proper XML and write it as output/screen
Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

$ServerNameList;

If ($ServerNameSource -gt 0 -and $ServerNameSource -lt 6) {

    Switch ($ServerNameSource) {
        1 {
            $ServerNameList = $ServerNames;
        }
        2 {
            $ServerNameList = Get-Content $ServerNamesInputFile;
        }
        3 {
            $ServerNameList = (Get-ADComputer -LDAPFilter "(name=$ServerNamesLDAPnameFilter)" | Select Name).Name;
        }
        4 {
            $ServerNameList = (Get-ADComputer -Filter "*" -SearchBase $ServerNamesLDAPOUFilter | Select Name).Name;
        }
        5 {
            $ServerNameList = (Get-ADComputer -LDAPFilter "(name=$ServerNamesLDAPnameFilter)" -SearchBase $ServerNamesLDAPOUFilter | Select Name).Name;
        }
    }
} Else {
    Write-Output "Missing Parameter or wrong value for: ServerNameSource";
    Exit;
}
  
#if the array holds entries
If ($ServerNameList.Count -gt 0) {
 
    $SessionsTotal = 0;
    $SessionsActive = 0;
    $ServersNotReached = 0;

    #go through the list
    ForEach ($ServerName in $ServerNameList) {
        #try to connect - on error jump to catch
        Try {
            $FoundTotal = 0;
            $FoundActive = 0;
            
            
            If ($UseWMI -eq $false) {
                #less control in theory - due to reformatting and searching through the results
                #single execution of the query / command
                $QWinstaResults = qwinsta /server $ServerName | ForEach-Object {
                        $_.Trim() -replace "\s+",","
                    } | ConvertFrom-Csv -Header "SessionName","UserName","ID","State","Type","Device"; #we add manual headers here, since this otherwise can cause issues with the filter later on
                $FoundTotal = $QWinstaResults.Count-1;  #if we use QWINSTA we need to substract one more session from the results
                $FoundActive = ($QWinstaResults | ? { $_.State -eq "Active" }).Count;
            } else {            
                #more control - but might run slower
                #in theory you can invoke all server-names at once, but then you need to run through the table and you lose some control over what was reached and what wasn't - first run might always be slowest depending on amount of servers
                $FoundTotal = (Get-WmiObject -Query "SELECT TotalSessions FROM Win32_TerminalService" -ComputerName $ServerName | Select TotalSessions).TotalSessions;
                $FoundActive = (Get-WmiObject -Query "SELECT ActiveSessions FROM Win32_PerfFormattedData_LocalSessionManager_TerminalServices" -ComputerName $ServerName | Select ActiveSessions).ActiveSessions;
            }

            #SessionsTotal might need a substract depending on the parameter input
            $FoundTotal = $FoundTotal - $SubstractSessionsPerHost;
            #we need to avoid that the substractions is negative, to avoid false substraction
            If ($FoundTotal -le 0){
                $FoundTotal = 0;
            }
            
            #we now add the results to the current counters
            $SessionsTotal += $FoundTotal;
            $SessionsActive += $FoundActive;
        } Catch {
            $ServersNotReached += 1;
        } Finally {
            #nothing to do here
        }
    }

    #Lets put together the results
    $PRTGstring="<prtg>
        <result>
	    <channel>Total Servers checked</channel>
        <value>" +  $ServerNameList.Count + "</value>
	    </result>
        <result>
	    <channel>Total Servers responded</channel>
        <value>" + ($ServerNameList.Count - $ServersNotReached)  + "</value>
	    </result>
        <result>
	    <channel>Total Servers not reached</channel>
        <value>$ServersNotReached</value>
	    </result>
        <result>
	    <channel>Total Sessions found</channel>
        <value>$SessionsTotal</value>
	    </result>
        <result>
	    <channel>Total Sessions active</channel>
        <value>$SessionsActive</value>
	    </result>
        </prtg>"

    #we call the function WriteXmlToScreen to transform the $PRTGstring to XML and output it 
    WriteXmlToScreen "$PRTGstring"

} Else {
    Write-Output "Parameter Error or List did not contain any names / no server names found"
    Exit;
}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

param(

$ServerNameSource, #Numeric script config parameter: 1 = Parameter ServerNames list / 2 = Parameter InputFile / 3 = LDAP query with name-prefix / 4 = LDAP query with filter on OU / 5 = LDAP query with name-prefix and OU filter

$ServerNames, #depending on ServerNameSource (1) - a simple, coma separated list of server names e.g. @("server1", "server2", "server3")

$ServerNamesInputFile, #depending on ServerNameSource (2) - path and name of a file that holds the server names, one servername per line - e.g.: "C:\servernames.txt"

$ServerNamesLDAPnameFilter, #depending on ServerNameSource (3 and/or 5) - name search string - can hold wildcards (*) e.g.: "RDS*"

$ServerNamesLDAPOUFilter, #depending on ServerNameSource (4 and/or 5) - e.g.: "OU=RDS hosts,DC=domain,DC=local"

$SubstractSessionsPerHost = 2, #substract this amount of sessions per host - due to e.g. two RDS listeners (would make 2 sessions) or additional e.g. 1x ICA listener (would make 3 sessions) etc...

$UseWMI = $false #use WMI - if not set it will use QWINSTA by default: enable with: $true

)

#function to convert a string to proper XML and write it as output/screen

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

$ServerNameList;

If ($ServerNameSource -gt 0 -and $ServerNameSource -lt 6) {

Switch ($ServerNameSource) {

1 {

$ServerNameList = $ServerNames;

}

2 {

$ServerNameList = Get-Content $ServerNamesInputFile;

}

3 {

$ServerNameList = (Get-ADComputer -LDAPFilter "(name=$ServerNamesLDAPnameFilter)" | Select Name).Name;

}

4 {

$ServerNameList = (Get-ADComputer -Filter "*" -SearchBase $ServerNamesLDAPOUFilter | Select Name).Name;

}

5 {

$ServerNameList = (Get-ADComputer -LDAPFilter "(name=$ServerNamesLDAPnameFilter)" -SearchBase $ServerNamesLDAPOUFilter | Select Name).Name;

}

} Else {

Write-Output "Missing Parameter or wrong value for: ServerNameSource";

Exit;

}

#if the array holds entries

If ($ServerNameList.Count -gt 0) {

$SessionsTotal = 0;

$SessionsActive = 0;

$ServersNotReached = 0;

#go through the list

ForEach ($ServerName in $ServerNameList) {

#try to connect - on error jump to catch

Try {

$FoundTotal = 0;

$FoundActive = 0;

If ($UseWMI -eq $false) {

#less control in theory - due to reformatting and searching through the results

#single execution of the query / command

$QWinstaResults = qwinsta /server $ServerName | ForEach-Object {

$_.Trim() -replace "\s+",","

} | ConvertFrom-Csv -Header "SessionName","UserName","ID","State","Type","Device"; #we add manual headers here, since this otherwise can cause issues with the filter later on

$FoundTotal = $QWinstaResults.Count-1; #if we use QWINSTA we need to substract one more session from the results

$FoundActive = ($QWinstaResults | ? { $_.State -eq "Active" }).Count;

} else {

#more control - but might run slower

#in theory you can invoke all server-names at once, but then you need to run through the table and you lose some control over what was reached and what wasn't - first run might always be slowest depending on amount of servers

$FoundTotal = (Get-WmiObject -Query "SELECT TotalSessions FROM Win32_TerminalService" -ComputerName $ServerName | Select TotalSessions).TotalSessions;

$FoundActive = (Get-WmiObject -Query "SELECT ActiveSessions FROM Win32_PerfFormattedData_LocalSessionManager_TerminalServices" -ComputerName $ServerName | Select ActiveSessions).ActiveSessions;

}

#SessionsTotal might need a substract depending on the parameter input

$FoundTotal = $FoundTotal - $SubstractSessionsPerHost;

#we need to avoid that the substractions is negative, to avoid false substraction

If ($FoundTotal -le 0){

$FoundTotal = 0;

}

#we now add the results to the current counters

$SessionsTotal += $FoundTotal;

$SessionsActive += $FoundActive;

} Catch {

$ServersNotReached += 1;

} Finally {

#nothing to do here

}

#Lets put together the results

$PRTGstring="<prtg>

<channel>Total Servers checked</channel>

<value>" + $ServerNameList.Count + "</value>

</result>

<channel>Total Servers responded</channel>

<value>" + ($ServerNameList.Count - $ServersNotReached) + "</value>

</result>

<channel>Total Servers not reached</channel>

<value>$ServersNotReached</value>

</result>

<channel>Total Sessions found</channel>

<value>$SessionsTotal</value>

</result>

<channel>Total Sessions active</channel>

<value>$SessionsActive</value>

</result>

</prtg>"

#we call the function WriteXmlToScreen to transform the $PRTGstring to XML and output it

WriteXmlToScreen "$PRTGstring"

} Else {

Write-Output "Parameter Error or List did not contain any names / no server names found"

Exit;

}

January 14, 2019 by Florian Rossmark monitoring prtg scripts server

SNMP was deprecated

Microsoft deprecated the SNMP in Windows 2012 (R2). As of Windows 10 1809 respective Windows 2016 this feature is pretty much hidden. The decision likely was made due to security risks related to SNMP, in any case – as of right now it is still available if you really need it – but not via the good old Control Panel – Add Remove Features function. The following should even work on Windows 2019, since there is no indication that Microsoft finally removed the feature itself.

The following link is for Windows Server 2012 (R2) – it clearly states that SNMP is deprecated: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831568(v=ws.11)

Windows client and server operating systems share the same kernel in the background – for the most part.

Alternate ways to enable the feature:

using Apps & Features will help you getting SNMP via Optional Features
- then use Add a feature
PowerShell commands:
- Either those commands
  PowerShell
  Get-WindowsCapability -Online -Name "SNMP*" Add-WindowsCapability -Online -Name "SNMP.Client~~~~0.0.1.0"
  1
  2
  Get-WindowsCapability -Online -Name "SNMP*"
  Add-WindowsCapability -Online -Name "SNMP.Client~~~~0.0.1.0"
- or the following version of commands
  PowerShell
  Get-WindowsCapability -Online | ? Name -like 'SNMP.Client*' Add-WindowsCapability -Online | ? Name -like 'SNMP.Client*'
  1
  2
  Get-WindowsCapability -Online | ? Name -like 'SNMP.Client*'
  Add-WindowsCapability -Online | ? Name -like 'SNMP.Client*'
or you use DISM on a command prompt
MS DOS
DISM /online /add-capability /capabilityname:SNMP.Client~~~~0.0.1.0
1
DISM /online /add-capability /capabilityname:SNMP.Client~~~~0.0.1.0

In all cases – you will run in to an possible issue if you use WSUS – you might need to temporarily bypass it in order to install this feature. It is possible that you need to restart the Windows Update service on the system for this setting to take effect.

Open Regedit and adjust the following key
Microsoft Registry
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU key: UseWUServer new / temp value: 0
1
2
3
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
key: UseWUServer
new / temp value: 0

It is pretty obvious that this feature will be removed at one point – but as of now it is still available.

Let’s talk about a few things in regards to SNMP on Windows – or even in general when it comes to all your switches, firewalls, routers and other network components.

using SNMP on a Windows OS is a potential security risk – actually – SNMP itself is in general, cause it is standardized in often not locked down while having as well just limited security features
- see here for a more official statement on this by the US government: https://www.us-cert.gov/ncas/alerts/TA17-156A
I personally don’t see a reason to use SNMP to monitor a Windows Server – the system itself can easily be monitored by WMI and other methods – that might have pro’s and con’s – but it generally works
There are circumstances then you need SNMP enabled – I had this while coming across mostly UPS software that only allowed to interact with it via SNMP – the UPS itself was connected per USB and the software on a Windows server/client allowed no API calls or similar – you had to enable SNMP on Windows and then use SNMP through Windows to grab data for e.g. UPS monitoring
- having said this – this is actually a flaw by the vendor in such a case and should by addressed with the vendor
- there is possibly more then just an UPS software that does behave like this

December 27, 2018 by Florian Rossmark server solutions windows

Read the UEFI stored Windows key and activate Windows

Ever wanted to read out the UEFI stored Windows key and probably automatically try to activate Windows with a single script?

The UEFI stored Windows license key is essential due to the fact that you don’t have a physical license anymore and you should keep it just in case for situations like your motherboard was exchanged and the key not transferred properly. I came across similar situations and was glad that I had the key.

But the script below does more then just reading and displaying the key – it will try to activate Windows as well.

Please note – it is wise to combine the read out of the key with an export and save method – like writing it to a database – this script will only show the basic functionality – but this is the most important part already.

$service = get-wmiObject -query 'select * from SoftwareLicensingService'
if($key = $service.OA3xOriginalProductKey){
	Write-Host 'Product Key:' $service.OA3xOriginalProductKey
	$service.InstallProductKey($key)
}else{
	Write-Host 'Key not found.'
}

1

2

3

4

5

6

7

$service = get-wmiObject -query 'select * from SoftwareLicensingService'

if($key = $service.OA3xOriginalProductKey){

Write-Host 'Product Key:' $service.OA3xOriginalProductKey

$service.InstallProductKey($key)

}else{

Write-Host 'Key not found.'

}

The next two lines help additionally – if you create this batch file as well and store both files in the same directory, you simply can right click the .CMD file and execute it with elevated rights (run as administrator) and it will make your live even easier. This is just a simple trick to bypass some restrictions that you might encounter while trying to execute a PowerShell script with elevated rights and bypassing the execution policy for scripts at the same time.

powershell.exe -executionpolicy unrestricted -file "%~dp0\ReadUEFIWindowsKeyAndActivateWindows.ps1"
pause

1 2	powershell.exe -executionpolicy unrestricted -file "%~dp0\ReadUEFIWindowsKeyAndActivateWindows.ps1" pause

December 11, 2018 by Florian Rossmark recommendations scripts web

VMware alert monitoring with PRTG and PowerShell

There is a way to read out and process ALL alerts of your VMware environment using PowerShell and reporting the results back to PRTG. The script further down in this article does this. What you get is similar to the graphic here.

This show you the following channels:

Overall status
- this will be green as long there aren’t any not acknowledged warnings or alerts in VMware
- if the warning or alert is acknowledged, the sensor / script will return to green cause it is nothing that is new
Total Alerts – amount of alerts acknowledged and not ackowledged
Total Alerts – Acknowledged
Total Alerts – NOT Acknowledged
Total Warnings
Total Warnings – Acknowledged
Total Warnings – NOT Acknowledged
Total Warnings and Alerts
Total Warnings and Alerts – Acknowledged
Total Warnings and Alerts – NOT Acknowledged

As you can see – you can get more granular on your PRTG statuses if you use the channels for Warnings/Alerts that are acknowledged. You could set upper warning or error limits of 0 to keep a warning / error level in PRTG if you want to see them still.

While I was writing the script, I decided to create a new lookup value in PRTG to make it more clear. If you adjust the script in regards to add additional statuses for the channel overall status – you will need to adjust this file as well.

Let’s start with the value lookup file, you need to copy the text from the first script block in to a file you store here: C:\Program Files (x86)\PRTG Network Monitor\lookups\custom

Name the file: vmware.alerts.search.ovl

<?xml version="1.0" encoding="utf-8"?>
  <ValueLookup id="vmware.alerts.search" desiredValue="0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="PaeValueLookup.xsd" undefinedState="Warning">
    <Lookups>
      <SingleInt state="Ok" value="0">Overall Status - Green - OK</SingleInt>
      <SingleInt state="Warning" value="1">Overall Status - Yellow - Warning</SingleInt>
      <SingleInt state="Error" value="2">Overall Status - Red - Error</SingleInt>
    </Lookups>
  </ValueLookup>

1

2

3

4

5

6

7

8

<?xml version="1.0" encoding="utf-8"?>

<SingleInt state="Ok" value="0">Overall Status - Green - OK</SingleInt>

<SingleInt state="Warning" value="1">Overall Status - Yellow - Warning</SingleInt>

<SingleInt state="Error" value="2">Overall Status - Red - Error</SingleInt>

</Lookups>

</ValueLookup>

Now we need to create a custom EXE/XML sensor in this directory: C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML

Name the file: VMwareAlerts.ps1

#make sure the executing user and system has those two commands run
#Find-Module -Name VMware.PowerCLI
#Install-Module -Name VMware.PowerCLI
#useful command 
#Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP:$false -confirm:$false
#Set-PowerCLIConfiguration -InvalidCertificateAction ignore -confirm:$false
#
#alternative look here: https://blogs.vmware.com/PowerCLI/2017/04/powercli-install-process-powershell-gallery.html

param(
    [string] $VCenterServer = "",
	[string] $DomainAndUser = "",
	[string] $Password = ""
)

Import-Module VMware.PowerCLI

#avoid unecessary output
Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP:$false -confirm:$false
#avoid certificate issues
Set-PowerCLIConfiguration -InvalidCertificateAction ignore -confirm:$false
Connect-VIServer $VCenterServer -username "$DomainAndUser" -Password "$Password"
$colAlarms = (Get-DataCenter).ExtensionData.TriggeredAlarmState

$XML = "<PRTG>"

[int] $Warnings = 0
[int] $WarningsAck = 0
[int] $Alerts = 0
[int] $AlertsAck = 0
[int] $OverallStatus = 0 #default green

if ($colAlarms.Count -gt 0) {
    foreach ($entry in $colAlarms) {
        if ($entry.OverallStatus -eq "yellow") {
            $Warnings += 1
            if ($entry.Acknowledged) {
                $WarningsAck =+ 1
            } else { #we only increase the overall status if this alert is not acknowledged
                if ($OverallStatus -lt 1)
                {
                    $OverallStatus = 1
                }
            }
        } elseif ($entry.OverallStatus -eq "red") {
            $Alerts += 1
            if ($entry.Acknowledged) {
                $AlertsAck =+ 1
            } else { #we only increase the overall status if this alert is not acknowledged
                if ($OverallStatus -lt 2)
                {
                    $OverallStatus = 2
                }
            }
        }
    }
}

$XML += "<result><channel>Overwall Status</channel><value>" + $OverallStatus + "</value><ValueLookup>vmware.alerts.search</ValueLookup></result>"
$XML += "<result><channel>Total Warnings and Alerts</channel><value>" + $colAlarms.Count + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Warnings and Alerts - NOT Acknowledged</channel><value>" + ($colAlarms.Count - $WarningsAck + $AlertsAck) + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Warnings and Alerts - Acknowledged</channel><value>" + ($WarningsAck + $AlertsAck) + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Warnings</channel><value>" + $Warnings + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Warnings - NOT Acknowledged</channel><value>" + ($Warnings - $WarningsAck) + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Warnings - Acknowledged</channel><value>" + $WarningsAck + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Alerts</channel><value>" + $Alerts + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Alerts - NOT Acknowledged</channel><value>" + ($Alerts - $AlertsAck) + "</value><CustomUnit>#</CustomUnit></result>"
$XML += "<result><channel>Total Alerts - Acknowledged</channel><value>" + $AlertsAck + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "</PRTG>"


Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}
#Clear
WriteXmlToScreen "$XML"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

#make sure the executing user and system has those two commands run

#Find-Module -Name VMware.PowerCLI

#Install-Module -Name VMware.PowerCLI

#useful command

#Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP:$false -confirm:$false

#Set-PowerCLIConfiguration -InvalidCertificateAction ignore -confirm:$false

#

#alternative look here: https://blogs.vmware.com/PowerCLI/2017/04/powercli-install-process-powershell-gallery.html

param(

[string] $VCenterServer = "",

[string] $DomainAndUser = "",

[string] $Password = ""

)

Import-Module VMware.PowerCLI

#avoid unecessary output

Set-PowerCLIConfiguration -Scope User -ParticipateInCEIP:$false -confirm:$false

#avoid certificate issues

Set-PowerCLIConfiguration -InvalidCertificateAction ignore -confirm:$false

Connect-VIServer $VCenterServer -username "$DomainAndUser" -Password "$Password"

$colAlarms = (Get-DataCenter).ExtensionData.TriggeredAlarmState

$XML = "<PRTG>"

[int] $Warnings = 0

[int] $WarningsAck = 0

[int] $Alerts = 0

[int] $AlertsAck = 0

[int] $OverallStatus = 0 #default green

if ($colAlarms.Count -gt 0) {

foreach ($entry in $colAlarms) {

if ($entry.OverallStatus -eq "yellow") {

$Warnings += 1

if ($entry.Acknowledged) {

$WarningsAck =+ 1

} else { #we only increase the overall status if this alert is not acknowledged

if ($OverallStatus -lt 1)

{

$OverallStatus = 1

}

} elseif ($entry.OverallStatus -eq "red") {

$Alerts += 1

if ($entry.Acknowledged) {

$AlertsAck =+ 1

} else { #we only increase the overall status if this alert is not acknowledged

if ($OverallStatus -lt 2)

{

$OverallStatus = 2

}

$XML += "<result><channel>Overwall Status</channel><value>" + $OverallStatus + "</value><ValueLookup>vmware.alerts.search</ValueLookup></result>"

$XML += "<result><channel>Total Warnings and Alerts</channel><value>" + $colAlarms.Count + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Warnings and Alerts - NOT Acknowledged</channel><value>" + ($colAlarms.Count - $WarningsAck + $AlertsAck) + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Warnings and Alerts - Acknowledged</channel><value>" + ($WarningsAck + $AlertsAck) + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Warnings</channel><value>" + $Warnings + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Warnings - NOT Acknowledged</channel><value>" + ($Warnings - $WarningsAck) + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Warnings - Acknowledged</channel><value>" + $WarningsAck + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Alerts</channel><value>" + $Alerts + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Alerts - NOT Acknowledged</channel><value>" + ($Alerts - $AlertsAck) + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "<result><channel>Total Alerts - Acknowledged</channel><value>" + $AlertsAck + "</value><CustomUnit>#</CustomUnit></result>"

$XML += "</PRTG>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

#Clear

WriteXmlToScreen "$XML"

Once you have both files created, go to PRTG and add a new sensor called EXE/Script Advanced and select the new created script file. ~~As Parameter you either type the host-name of your vSphere server or if you created it underneath the device in PRTG just use %host.~~

UPDATE: I changed the script cause I found it to be better to go with the following expected parameters and always making sure you have control over username and password used to connect to VMware. Please use the follow parameter moving forward:

<strong>%host "%windowsdomain\%windowsuser" "%windowspassword"</strong>

1	<strong>%host "%windowsdomain\%windowsuser" "%windowspassword"</strong>

There are still a few challenges you might need to overcome on top of this:

install the VMware PowerShell extensions on your PRTG probe server
- in a PowerShell execute
  - Find-Module -Name VMware.PowerCLI
  - Install-Module -Name VMware.PowerCLI
- alternative use the documentation mentioned in the next link
  - https://blogs.vmware.com/PowerCLI/2017/04/powercli-install-process-powershell-gallery.html
~~credentials to connect to VMware can be a challenge as I tested this~~
- ~~you might need to have the service account of the PRTG probe have sufficient access rights – needs working SSO~~
- ~~alternative use a stored credentials file in PowerShell – somewhat secure~~
- ~~or provide the credentials clear text in PowerShell – least secure~~
- ~~please see line 20 respective the command “connect-viserver” for more details~~
updated the script – it now expects username and password as parameter

You might wanna test the script before you add a sensor to PRTG – the best way to do this is directly on the PRTG server with the service account of the PRTG probe to make sure it will work as a sensor later on.

Keep in mind that the script expects a parameter – the VMware vSphere server name / web-address.

This was also posted on the PRTG KB here.

December 3, 2018 by Florian Rossmark monitoring prtg scripts server solutions

Monitor multiple website certificates with a single PRTG sensor

Due to a request on the PRTG KB of someone needing a single sensor that monitors multiple URLs for their certificate expiration I came up with the following script that is posted on this PRTG KB as well. The modified PowerShell script was provided there – it is mentioned it sourced from Stack Overflow – I found it on this link: https://stackoverflow.com/questions/28386579/modifying-ssl-cert-check-powershell-script-to-loop-through-multiple-sites

The result would look like this:

<PRTG>
  <result>
    <channel>google.com</channel>
    <value>66</value>
    <CustomUnit>days</CustomUnit>
    <LimitMinWarning>30</LimitMinWarning>
    <LimitMinError>5</LimitMinError>
  </result>
  <result>
    <channel>aol.com</channel>
    <value>143</value>
    <CustomUnit>days</CustomUnit>
    <LimitMinWarning>30</LimitMinWarning>
    <LimitMinError>5</LimitMinError>
  </result>
  <result>
    <channel>yahoo.com</channel>
    <value>96</value>
    <CustomUnit>days</CustomUnit>
    <LimitMinWarning>30</LimitMinWarning>
    <LimitMinError>5</LimitMinError>
  </result>
  <result>
    <channel>espn.com</channel>
    <value>-999</value>
    <CustomUnit>days</CustomUnit>
    <LimitMinWarning>30</LimitMinWarning>
    <LimitMinError>5</LimitMinError>
  </result>
  <text>Not reached pages: espn.com</text>
</PRTG>

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

<PRTG>

<channel>google.com</channel>

</result>

</result>

<channel>yahoo.com</channel>

</result>

</result>

<text>Not reached pages: espn.com</text>

</PRTG>

To make it more usable – you can input parameters from PRTG like this:

@("domain.com","domain2.com","domain3.com")

1	@("domain.com","domain2.com","domain3.com")

or this for limits – warning 60 and error 10 – you could name them but this should work as well…

@("domain.com","domain2.com","domain3.com") 60 10

1	@("domain.com","domain2.com","domain3.com") 60 10

And here is the modified script:

param(
    $WebsiteURLs= @("google.com","aol.com","yahoo.com","espn.com"),
    $LimitMinDaysWarning=30,
    $LimitMinDaysError=5
)

$WebsitePort=443
$Threshold=120
$Severe=30
$ID=0

$XML = "<PRTG>"
$TextError = ""
foreach ($WebsiteURL in $WebsiteURLs){
    $CommonName=$WebsiteURL
    $ID+=1
    Try{
        $Conn = New-Object System.Net.Sockets.TcpClient($WebsiteURL,$WebsitePort) 
        Try {
            $Stream = New-Object System.Net.Security.SslStream($Conn.GetStream(),$false, {
                param($sender, $certificate, $chain, $sslPolicyErrors) 
                return $true
            })
            $Stream.AuthenticateAsClient($CommonName) 

            $Cert = $Stream.Get_RemoteCertificate()
            $CN=(($cert.Subject -split "=")[1] -split ",")[0]
            $ValidTo = [datetime]::Parse($Cert.GetExpirationDatestring())

            $ValidDays = $($ValidTo - [datetime]::Now).Days
            $MyFontColor="darkgreen"
            if ($ValidDays -lt $Threshold) {
                $MyFontColor="darkyellow"
            } 
            if ($ValidDays -lt $Severe) {
                $MyFontColor="red"
            }
            $XML += "<result><channel>$WebsiteURL</channel><value>$ValidDays</value><CustomUnit>days</CustomUnit><LimitMinWarning>$LimitMinDaysWarning</LimitMinWarning><LimitMinError>$LimitMinDaysError</LimitMinError></result>"
        } Catch { 
            Throw $_ 
        } Finally { 
            $Conn.close() 
        }
    } Catch {
        $XML += "<result><channel>$WebsiteURL</channel><value>-999</value><CustomUnit>days</CustomUnit><LimitMinWarning>$LimitMinDaysWarning</LimitMinWarning><LimitMinError>$LimitMinDaysError</LimitMinError></result>"
        If ($TextError.Length -gt 0) {
            $TextError += " / "
        }
        $TextError += "$WebsiteURL"
    }
}
If ($TextError.Length -gt 0) {
    $XML += "<text>Not reached pages: $TextError</text>"
}
$XML += "</PRTG>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}
WriteXmlToScreen "$XML"

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

param(

$WebsiteURLs= @("google.com","aol.com","yahoo.com","espn.com"),

$LimitMinDaysWarning=30,

$LimitMinDaysError=5

)

$WebsitePort=443

$Threshold=120

$Severe=30

$ID=0

$XML = "<PRTG>"

$TextError = ""

foreach ($WebsiteURL in $WebsiteURLs){

$CommonName=$WebsiteURL

$ID+=1

Try{

$Conn = New-Object System.Net.Sockets.TcpClient($WebsiteURL,$WebsitePort)

Try {

$Stream = New-Object System.Net.Security.SslStream($Conn.GetStream(),$false, {

param($sender, $certificate, $chain, $sslPolicyErrors)

return $true

})

$Stream.AuthenticateAsClient($CommonName)

$Cert = $Stream.Get_RemoteCertificate()

$CN=(($cert.Subject -split "=")[1] -split ",")[0]

$ValidTo = [datetime]::Parse($Cert.GetExpirationDatestring())

$ValidDays = $($ValidTo - [datetime]::Now).Days

$MyFontColor="darkgreen"

if ($ValidDays -lt $Threshold) {

$MyFontColor="darkyellow"

}

if ($ValidDays -lt $Severe) {

$MyFontColor="red"

}

$XML += "<result><channel>$WebsiteURL</channel><value>$ValidDays</value><CustomUnit>days</CustomUnit><LimitMinWarning>$LimitMinDaysWarning</LimitMinWarning><LimitMinError>$LimitMinDaysError</LimitMinError></result>"

} Catch {

Throw $_

} Finally {

$Conn.close()

}

} Catch {

$XML += "<result><channel>$WebsiteURL</channel><value>-999</value><CustomUnit>days</CustomUnit><LimitMinWarning>$LimitMinDaysWarning</LimitMinWarning><LimitMinError>$LimitMinDaysError</LimitMinError></result>"

If ($TextError.Length -gt 0) {

$TextError += " / "

}

$TextError += "$WebsiteURL"

}

If ($TextError.Length -gt 0) {

$XML += "<text>Not reached pages: $TextError</text>"

}

$XML += "</PRTG>"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

November 9, 2018 by Florian Rossmark monitoring prtg scripts security web

powershell

PRTG sensor to monitor a directory for a specific file type and minimum size and age

ActiveDirectory/LDAP result limits – MaxPageSize

Monitor group memberships in Active Directory with PRTG

Monitoring relative printer page counts with PRTG

Office 365 licenses and activated features per user

Amount of locked out accounts

PRTG and VMware 6.7 vCenter host hardware status

Search the Windows Security Eventlog for a string / text

Active Directory password reset events and group change events

APC InRow A/C error monitoring with PRTG

Move user Documents and Desktop to OneDrive

Compare a TRACEROUTE against an expected route

Request a DNS based web site directly from an IP address

Find user account lockout events

Windows Search Index monitoring

Monitor the total amount of sessions on your RDS farm

SNMP was deprecated

Read the UEFI stored Windows key and activate Windows

VMware alert monitoring with PRTG and PowerShell

Monitor multiple website certificates with a single PRTG sensor

Recent blog posts

Blog Archives

powershell

Recent blog posts

Blog Archives

Tags