powershell

Secured WinRM SSL session and PowerShell WinRM queries – example with a PRTG sensor for CPU, HDD and RAM

Windows Mangement Remote Mangement / WinRM can be configured as HTTPS / encrypted connection instead of using clear text transfer of the provided information. In order to do this you need to configure it accordingly and have a valid machine certificate installed on the system.

Now – the advantage here is clearly the added security layer while you request and receive those information. More information on how to do this can be found here: https://support.microsoft.com/en-us/help/2019527/how-to-configure-winrm-for-https

Only it becomes a challenge when you want to use PowerShell and e.g. PRTG to use this HTTPS encrypted system. I came across this request and had to create a script that actually works with such an HTTPS encrypted SSL session to WinRM. You can find it below.

What it does is rather simple:

set the CimSessionOptions to use SSL
- additionally it bypasses the certification checks by default – you might want to adjust this depending on your network configuration
it creates a new CimSession to your target system using the UseSSL option
and finally it executes a few queries against this session
the data in this example is then translated in to a PRTG compatible XML structure so you could use it in a Advanced EXE/XML sensor within PRTG

The data in this example combines information about the CPU(s), HardDrives / HDD(s) (only installed drives, not USB) and Memory usage to PRTG in a single sensor while using channels.

Due to some dynamic of the script, you want to make sure you have fixed upper and lower error limits on especially the channel Total Disks – so if something changes you can re-create the sensor due to it’s fixed channels once it did run the first time.

In theory you could provide limits within the XML response to PRTG – this is up to you – I always liked it more to configure them solely in PRTG in the sensor channels so I could adjust them per device.

PS: This was originally posted in the private PRTG channel on SpiceWorks here.

param(
[string]$device
)
#$cred = Get-Credential #you need to somehow get them in - from a file or as parameters... up to you actually... in theory the PRTG Probe would do that already and you wouldn't need it
$CIMSessionOptions = New-CimSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck -UseSsl #-UseSSL is important - the rest - well - I bypassed the certificate checks.. up to your environment in the end...
$CIMSession = New-CimSession -ComputerName $Server -SessionOption $CIMSessionOptions #-Credential $cred

$WMI_OS = Get-CimInstance -CimSession $CIMSession -ClassName Win32_OperatingSystem 
$WMI_CPU = Get-CimInstance -CimSession $CIMSession -ClassName  win32_processor
$WMI_DISK = Get-CimInstance -CimSession $CIMSession -ClassName  Win32_LogicalDisk


#CPU table processing
foreach ($CPU in $WMI_CPU){
    $CPUsTotal += 1
    $XMLCPUs += "<result><channel>CPU Load #$CPUsTotal</channel><value>" + $CPU.LoadPercentage + "</value><unit>Percent</unit></result>"
}

#DISK table processing
foreach ($Disk in $WMI_DISK){
    if ($Disk.DriveType -eq 3) { #DriveType = 3 means it is a LOCAL FIXED DISK
        $DISKsTotal += 1
        $XMLDisks += "<result><channel>Drive " + $Disk.DeviceID + "</channel><value>" + $Disk.FreeSpace + "</value><VolumeSize>Byte</VolumeSize></result>"
        $XMLDisks += "<result><channel>Drive " + $Disk.DeviceID + "</channel><value>" + [math]::Round(($Disk.FreeSpace/$Disk.Size)*100,2).tostring("###") + "</value><float>1</float><unit>Percent</unit></result>"
    }
}

$XML="<prtg>
    <result>
        <channel>Total CPUs</channel>
        <value>" + $CPUsTotal + "</value>
        <unit>Count</unit>
    </result>
    $XMLCPUs  
    <result>
        <channel>Total Disks</channel>
        <value>" + $DISKsTotal + "</value>
        <unit>Count</unit>
    </result>
    $XMLDisks
    <result>
        <channel>Memory total</channel>
        <value>" + $WMI_OS.TotalVisibleMemorySize + "</value>
        <VolumeSize>Bytes</VolumeSize>
    </result>
    <result>
        <channel>Memory free</channel>
        <value>" + $WMI_OS.FreeVirtualMemory + "</value>
        <VolumeSize>Bytes</VolumeSize>
    </result>
    <result>
        <channel>Memory used</channel>
        <value>" + ($WMI_OS.TotalVisibleMemorySize - $WMI_OS.FreeVirtualMemory) + "</value>
        <VolumeSize>Bytes</VolumeSize>
    </result>
    <result>
        <channel>Memory free in percent</channel>
        <value>" + [math]::Round(($WMI_OS.FreePhysicalMemory/$WMI_OS.TotalVisibleMemorySize)*100,2) + "</value>
        <float>1</float> 
        <unit>Percent</unit>
    </result>
    <result>
        <channel>Memory used in percent</channel>
        <value>" + [math]::Round(100-(($WMI_OS.FreePhysicalMemory/$WMI_OS.TotalVisibleMemorySize)*100),2) + "</value>
        <float>1</float> 
        <unit>Percent</unit>
    </result>
</prtg>
"

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen "$XML"

param(

[string]$device

)

#$cred = Get-Credential #you need to somehow get them in - from a file or as parameters... up to you actually... in theory the PRTG Probe would do that already and you wouldn't need it

$CIMSessionOptions = New-CimSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck -UseSsl #-UseSSL is important - the rest - well - I bypassed the certificate checks.. up to your environment in the end...

$CIMSession = New-CimSession -ComputerName $Server -SessionOption $CIMSessionOptions #-Credential $cred

$WMI_OS = Get-CimInstance -CimSession $CIMSession -ClassName Win32_OperatingSystem

$WMI_CPU = Get-CimInstance -CimSession $CIMSession -ClassName win32_processor

$WMI_DISK = Get-CimInstance -CimSession $CIMSession -ClassName Win32_LogicalDisk

#CPU table processing

foreach ($CPU in $WMI_CPU){

$CPUsTotal += 1

$XMLCPUs += "<result><channel>CPU Load #$CPUsTotal</channel><value>" + $CPU.LoadPercentage + "</value><unit>Percent</unit></result>"

}

#DISK table processing

foreach ($Disk in $WMI_DISK){

if ($Disk.DriveType -eq 3) { #DriveType = 3 means it is a LOCAL FIXED DISK

$DISKsTotal += 1

$XMLDisks += "<result><channel>Drive " + $Disk.DeviceID + "</channel><value>" + $Disk.FreeSpace + "</value><VolumeSize>Byte</VolumeSize></result>"

$XMLDisks += "<result><channel>Drive " + $Disk.DeviceID + "</channel><value>" + [math]::Round(($Disk.FreeSpace/$Disk.Size)*100,2).tostring("###") + "</value><float>1</float><unit>Percent</unit></result>"

}

$XML="<prtg>

<channel>Total CPUs</channel>

<value>" + $CPUsTotal + "</value>

<unit>Count</unit>

</result>

$XMLCPUs

<channel>Total Disks</channel>

<value>" + $DISKsTotal + "</value>

<unit>Count</unit>

</result>

$XMLDisks

<channel>Memory total</channel>

<value>" + $WMI_OS.TotalVisibleMemorySize + "</value>

<VolumeSize>Bytes</VolumeSize>

</result>

<channel>Memory free</channel>

<value>" + $WMI_OS.FreeVirtualMemory + "</value>

<VolumeSize>Bytes</VolumeSize>

</result>

<channel>Memory used</channel>

<value>" + ($WMI_OS.TotalVisibleMemorySize - $WMI_OS.FreeVirtualMemory) + "</value>

<VolumeSize>Bytes</VolumeSize>

</result>

<channel>Memory free in percent</channel>

<value>" + [math]::Round(($WMI_OS.FreePhysicalMemory/$WMI_OS.TotalVisibleMemorySize)*100,2) + "</value>

<unit>Percent</unit>

</result>

<channel>Memory used in percent</channel>

<value>" + [math]::Round(100-(($WMI_OS.FreePhysicalMemory/$WMI_OS.TotalVisibleMemorySize)*100),2) + "</value>

<unit>Percent</unit>

</result>

</prtg>

Function WriteXmlToScreen ([xml]$xml) #just to make it clean XML code...

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen "$XML"

PRTG 911 call alerts – ShoreTel

This is a PRTG 911 calls sensor script that I wrote a long time ago – it seems like there is quite some interest in it so I decided to write a blog post about it.

ShoreTel writes by default Windows Eventlog entries for 911 calls. The challenge we had is to inform HR / Human Resources and Facilities about such calls and let them know from which phone it was initiated.

While engaging PRTG we solved this while constantly checking for the specific Windows Eventlog EnventID 1319 in the Application log and raising an Error if the Event happened. We had to put a script in between and filter the event entry out to gather minimal data in the end for the event and notification that is send out to the specific HR and Facilities members.

First the script here:

Param(
	$arg_Host=$args[0],
    $arg_Interval=$args[0]
)

$str_Date = Get-Date
$str_Date = $str_Date.AddMinutes(-$arg_Interval)

$str_EventMsg = Get-EventLog -Computer "$arg_Host" -LogName "Application" -EntryType "Warning" -After $str_Date -OutVariable $str_EventMsg | Where-Object {$_.EventID -eq 1319} | fl Message | Out-String

If ($str_EventMsg.Length -gt 0)
{
    $str_EventMsg = $str_EventMsg.Replace("Message : ","")
    $str_EventMsg = $str_EventMsg.Replace(":"," ")
    $str_EventMsg = $str_EventMsg.Replace("'","")
    $str_EventMsg = $str_EventMsg.Replace("`r","")
    $str_EventMsg = $str_EventMsg.Replace("`n","")
    $str_EventMsg = $str_EventMsg.Replace("`t","")
    $str_EventMsg = $str_EventMsg.Replace("  ","")
    $str_EventMsg = $str_EventMsg.Replace("The description for Event ID 1319 in Source ShoreWare cannot be found.","")
    $str_EventMsg = $str_EventMsg.Replace("The local computer may not have the necessary registry information or","")
    $str_EventMsg = $str_EventMsg.Replace("message DLL files to display the message, or you may not have permission to access them.","")
    $str_EventMsg = $str_EventMsg.Replace("The following information is part of the event","")
    $str_EventMsg = $str_EventMsg.Trim()
    Write-Host $("1:")$($str_EventMsg)
    Exit 1
}
else
{
    Write-Host "0:No detected 911 calls"
    Exit 0
}

Param(

$arg_Host=$args[0],

$arg_Interval=$args[0]

)

$str_Date = Get-Date

$str_Date = $str_Date.AddMinutes(-$arg_Interval)

$str_EventMsg = Get-EventLog -Computer "$arg_Host" -LogName "Application" -EntryType "Warning" -After $str_Date -OutVariable $str_EventMsg | Where-Object {$_.EventID -eq 1319} | fl Message | Out-String

If ($str_EventMsg.Length -gt 0)

{

$str_EventMsg = $str_EventMsg.Replace("Message : ","")

$str_EventMsg = $str_EventMsg.Replace(":"," ")

$str_EventMsg = $str_EventMsg.Replace("'","")

$str_EventMsg = $str_EventMsg.Replace("`r","")

$str_EventMsg = $str_EventMsg.Replace("`n","")

$str_EventMsg = $str_EventMsg.Replace("`t","")

$str_EventMsg = $str_EventMsg.Replace(" ","")

$str_EventMsg = $str_EventMsg.Replace("The description for Event ID 1319 in Source ShoreWare cannot be found.","")

$str_EventMsg = $str_EventMsg.Replace("The local computer may not have the necessary registry information or","")

$str_EventMsg = $str_EventMsg.Replace("message DLL files to display the message, or you may not have permission to access them.","")

$str_EventMsg = $str_EventMsg.Replace("The following information is part of the event","")

$str_EventMsg = $str_EventMsg.Trim()

Write-Host $("1:")$($str_EventMsg)

Exit 1

}

else

{

Write-Host "0:No detected 911 calls"

Exit 0

}

Save the script in this path:

C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXE

Now add a custom EXE sensor (not the advanced) to PRTG and select the script. The expected parameters are the SERVERNAME and an INTERVAL – suggestions: SHORETELSERVER and 2 – 2 as interval assuming you scan every minute / 60 seconds / this will look for entries in the logfile within the last 120 seconds while accounting for any slack and keeping the error state alive for 2 to 3 minutes in PRTG.

Set the channel upper limit to 0 – if the script detects the Windows event you will get a 1 one back that indicates the error.

Set the scan-interval to 1 minute respective 60 seconds

Further might you want to add a special e-mail notification with the format TEXT WITH CUSTOM CONTENT and a target email recipient group for whom it concerns. See the screenshots below for some examples…

The email message body looks like this (example):

1 # (Value) is above the error limit of 0.90 # in Value (Emergency Services Call to 911 on port 10.10.10.10 from user ADDRESSBOOK NAME at 1234 (Extenstion))

October 24, 2018 by Florian Rossmark monitoring prtg scripts

PowerShell – custom tables or objects

Powershell sometimes can be challenging. One of the more confusing things is collecting data and having them in proper formatted tables / objects to process them further.

The below script is a sheer example on how you can accomplish this while creating a table, adding the needed columns and then filling the table with rows – in this specific example while reading network adapters and filling in IP information – if available – partly multiple rows (one row per IP and adapter) and partly single rows for adapters with not IPs.

Custom tables or custom PowerShell objects example with foreach loops to fill them up and combine values from various commands in to single tables for further processing.

$tbl = New-Object System.Data.DataTable "NetworkAdaptersAndIPs"
$col1 = New-Object System.Data.DataColumn Name
$col2 = New-Object System.Data.DataColumn Interface
$col3 = New-Object System.Data.DataColumn Status
$col4 = New-Object System.Data.DataColumn MACAddress
$col5 = New-Object System.Data.DataColumn IPAddress
$col6 = New-Object System.Data.DataColumn LinkSpeed
$tbl.Columns.Add($col1)
$tbl.Columns.Add($col2)
$tbl.Columns.Add($col3)
$tbl.Columns.Add($col4)
$tbl.Columns.Add($col5)
$tbl.Columns.Add($col6)


foreach ($Adapter in Get-NetAdapter)
{
    If ($Adapter.Status -eq 'Up') 
    {
        foreach ($IP in Get-NetIPAddress -InterfaceIndex $Adapter.InterfaceIndex)
        {
            $row = $tbl.NewRow()
            $row.Name = $Adapter.Name
            $row.Interface = $Adapter.InterfaceDescription
            $row.Status = $Adapter.Status
            $row.MACAddress = $Adapter.MacAddress
            $row.IPAddress = $IP.IPAddress
            $row.LinkSpeed = $Adapter.LinkSpeed
            $tbl.Rows.Add($row)
        }
    } else {
        $row = $tbl.NewRow()
        $row.Name = $Adapter.Name
        $row.Interface = $Adapter.InterfaceDescription
        $row.Status = $Adapter.Status
        $row.MACAddress = $Adapter.MacAddress
        $row.LinkSpeed = $Adapter.LinkSpeed
        $tbl.Rows.Add($row)
    }
    
}

$tbl | fl

$tbl = New-Object System.Data.DataTable "NetworkAdaptersAndIPs"

$col1 = New-Object System.Data.DataColumn Name

$col2 = New-Object System.Data.DataColumn Interface

$col3 = New-Object System.Data.DataColumn Status

$col4 = New-Object System.Data.DataColumn MACAddress

$col5 = New-Object System.Data.DataColumn IPAddress

$col6 = New-Object System.Data.DataColumn LinkSpeed

$tbl.Columns.Add($col1)

$tbl.Columns.Add($col2)

$tbl.Columns.Add($col3)

$tbl.Columns.Add($col4)

$tbl.Columns.Add($col5)

$tbl.Columns.Add($col6)

foreach ($Adapter in Get-NetAdapter)

{

If ($Adapter.Status -eq 'Up')

{

foreach ($IP in Get-NetIPAddress -InterfaceIndex $Adapter.InterfaceIndex)

{

$row = $tbl.NewRow()

$row.Name = $Adapter.Name

$row.Interface = $Adapter.InterfaceDescription

$row.Status = $Adapter.Status

$row.MACAddress = $Adapter.MacAddress

$row.IPAddress = $IP.IPAddress

$row.LinkSpeed = $Adapter.LinkSpeed

$tbl.Rows.Add($row)

}

} else {

$row = $tbl.NewRow()

$row.Name = $Adapter.Name

$row.Interface = $Adapter.InterfaceDescription

$row.Status = $Adapter.Status

$row.MACAddress = $Adapter.MacAddress

$row.LinkSpeed = $Adapter.LinkSpeed

$tbl.Rows.Add($row)

}

$tbl | fl

October 5, 2018 by Florian Rossmark scripts solutions

Read the UEFI stored Windows key and activate Windows

The following script will read the UEFI stored Windows licensing key and show it – it then will attempt to activate Windows and probably even e.g. your Microsoft Office installation – this is not necessarily intentional by the script, rather then a coincidence that I discovered by using this script to activate Windows after it was automatically deployed from an image that had a pre-injected volume license key. Office likely got activated along with Windows.

In any case – it helps you to activate Windows or simply read out your license key.

$service = get-wmiObject -query 'select * from SoftwareLicensingService'
if($key = $service.OA3xOriginalProductKey){
	Write-Host 'Product Key:' $service.OA3xOriginalProductKey
	$service.InstallProductKey($key)
}else{
	Write-Host 'Key not found.'
}

$service = get-wmiObject -query 'select * from SoftwareLicensingService'

if($key = $service.OA3xOriginalProductKey){

Write-Host 'Product Key:' $service.OA3xOriginalProductKey

$service.InstallProductKey($key)

}else{

Write-Host 'Key not found.'

}

October 4, 2018 by Florian Rossmark scripts

Updated domain join script including KeePass / Pleasant Password server entries for local admins

ns a website from a systems administrator for systems administrators Home IT-Admins CMDB IT-Admins tool IT Search EOL Solutions Blog Contact Links Updated domain join script including KeePass / Pleasant Password server entries for local admins

Today I post an updated version of the domain-join script I initially posted here.

In theory you can just replace the script with the new version – assuming you did not make any changes other then adjusting it to your domain / server-names.

What changed in the newer version:

the top lines in the script hold the basic configuration parameters
- line 1: NetBIOS name of your Active Directory domain
- line 2: your DNS domain name
- line 3: your distinguished domain name / root DN of your domain
- line 4: your default OU for new workstations
- line 5: empty
- line 6: KeePass / Pleasant Password Server URL
- line 7: KeePass folder to store the password in
the script now relies on the above parameters rather then specifying them in various areas in the script, making the whole use / adjustment of the script way easier
advanced error handling
- after the user entered the computer name and his domain admin credentials the systems checks if it can connect to the domain and if the computer name already exists
  - if the domain credentials are invalid (can be a non-admin – as long they are valid) you get a message explaining that the script will stop due to wrong credentials
  - if the computer name already exists in the domain, you get a message about it and the script stops
- KeePass or Pleasant Password Server connection – if it fails to connect with the credentials provided, you get a message about it and the script will stop
adjusted messages with various colours
- white text – standard as it was before
- yellow text – highlighted information so it sticks better out for the end-user
- magenta text – handled error / failure message – this is an explanation that something stopped the script from going further
- red text – those are real PowerShell error messages – either due to not handled errors or if the error was handled plotted out to the screen as additional reference and help

For additional information, please look at the original post here.

This script is also mentioned on the API Examples page on the Pleasant Solutions web site here.

$MyDomainNetBIOS="CONTOSO"
$MyDomain="contoso.local"
$MyDomainDN="dc=contoso,dc=local"
$MyDomainOU="OU=Computers,OU=USA,DC=contoso,DC=local"

$KeepassURL = "https://pwdbserver01v.contoso.local:10001"
$PWFolder = "Local Admins"

$ScriptVersion = "1.4 - 9/5/2018 - Florian Rossmark"
Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Welcome to the Domain-Join script"
Write-Host "================================="
Write-Host ""
Write-Host ""
Write-Host "This script will do the following Steps:"
Write-Host "----------------------------------------"
Write-Host "- You enter the Computer Name / Host Name" -ForegroundColor Yellow
Write-Host "- You enter Domain Admin credentials for a Domain-Join" -ForegroundColor Yellow
Write-Host "- You enter credentials to access KeyPass Password server" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Note: always type credentials without any domain-information ($MyDomainNetBIOS\) - the script will fail otherwise."
Write-Host ""
Write-Host ""
Write-Host ""
Write-Host "- The script will automatically create a KeyPass entry with all information" -ForegroundColor Yellow
Write-Host "- The script will automatically create a specific local admin account for this machine" -ForegroundColor Yellow
Write-Host "- The script will automatically rename the system to the given name" -ForegroundColor Yellow
Write-Host "- The script will automatically join the system to the domain $MyDomain" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Script Version: $ScriptVersion"
Write-Host ""
Write-Host ""
pause

#Upper area holds functions..
Function MakeUp-String([Int]$Size = 8, [Char[]]$CharSets = "ULNS", [Char[]]$Exclude) {
    $Chars = @(); $TokenSet = @()
    If (!$TokenSets) {$Global:TokenSets = @{
        U = [Char[]]'ABCDEFGHJKLMNPQRSTUVWXYZ'                                #Upper case
        L = [Char[]]'abcdefghijkmnpqrstuvwxyz'                                #Lower case
        N = [Char[]]'23456789'                                                #Numerals
        S = [Char[]]'!@$!@$!@$!@$'                         #Symbols
    }}
    $CharSets | ForEach {
        $Tokens = $TokenSets."$_" | ForEach {If ($Exclude -cNotContains $_) {$_}}
        If ($Tokens) {
            $TokensSet += $Tokens
            If ($_ -cle [Char]"Z") {$Chars += $Tokens | Get-Random}             #Character sets defined in upper case are mandatory
        }
    }
    While ($Chars.Count -lt $Size) {$Chars += $TokensSet | Get-Random}
    ($Chars | Sort-Object {Get-Random}) -Join ""                                #Mix the (mandatory) characters and output string
}; 
#avoid certificate issues
Add-Type @"
    using System;
    using System.Net;
    using System.Net.Security;
    using System.Security.Cryptography.X509Certificates;
    public class ServerCertificateValidationCallback
    {
        public static void Ignore()
        {
            ServicePointManager.ServerCertificateValidationCallback += 
                delegate
                (
                    Object obj, 
                    X509Certificate certificate, 
                    X509Chain chain, 
                    SslPolicyErrors errors
                )
                {
                    return true;
                };
        }
    }
"@
[ServerCertificateValidationCallback]::Ignore();

#Script starts here...
Clear-Host
Write-Host ""
Write-Host ""
Write-Host "This script must be executed in a power-shell with elevated rights!" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Stop the script with: CTRL + C any time..."
Write-Host ""
Write-Host ""
Pause
Clear-Host

$ComputerName = Read-Host "Please enter new Computer Name"
$DomainJoinCredentials = Get-Credential -Message "Enter your credentials for the domain join ($MyDomainNetBIOS) without the domain part"

Try{
    $ADSISearcherDE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$MyDomain",$($DomainJoinCredentials.UserName),$($DomainJoinCredentials.GetNetworkCredential().password))
    $ADSISearcher = New-Object System.DirectoryServices.DirectorySearcher($ADSISearcherDE,"(&(objectCategory=Computer)(name=$ComputerName))")
    $ADSISearcherResults = $ADSISearcher.FindAll()
    if ($ADSISearcherResults.Count -gt 0)
    {
        Clear-Host
        Write-Host ""
        Write-Host ""
        Write-Host "Computer account with this name '$ComputerName' already exists in the domain '$MyDomain'." -ForegroundColor Magenta
        Write-Host ""
        Write-Host ""
        Write-Host "You need to delete the account first or make sure you entered the right name." -ForegroundColor Magenta
        Write-Host ""
        Write-Host ""
        Write-Host "Script will stop now." -ForegroundColor Magenta
        Write-Host ""
        Write-Host ""
        Pause
        Exit
    }
} Catch {
    Clear-Host
    Write-Host ""
    Write-Host ""
    Write-Host "Your Domain Admin credentials where wrong." -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host "Script will stop now." -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host ""
    Write-Host "================================================================================================================"
    Write-Host "Error Details:"
    Write-Host "=============="
    write-host "Caught exception:" -ForegroundColor Red
    write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red
    write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red
    Write-Host "================================================================================================================"
    Write-Host ""
    Write-Host ""
    Pause
    Exit
}

$KeePassCredentials = Get-Credential -Message “Enter your credentials to access Keepass Server without the domain part” 
$localAdminUser = $("$ComputerName" + "_Admin")
$PW = MakeUp-String(12)
$PWencrypted = ConvertTo-SecureString $PW -AsPlainText -Force

Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Checking KeePass to see if those credentials already exist"
Write-Host ""
Write-Host ""

#Collecting MACs
$colMACItems = get-wmiobject Win32_NetworkAdapter | Where-Object {$_.MACAddress -like "*:*"}
foreach ($objMACItem in $colMACItems) {  
    $MACobj = $objMACItem |select Description,MACAddress   
    $MACs += $MACobj.MACAddress + " - " + $MACobj.Description + "
"
}
#Collecting SN/ServiceTag and HW information
$SN = "ServiceTag / SN: "+(Get-WmiObject win32_bios | select SerialNumber).SerialNumber
$Model = "Model: "+(Get-WmiObject win32_computersystem | select Model).Model
$Manufacturer = "Manufacturer: "+(Get-WmiObject win32_computersystem | select Manufacturer).Manufacturer
$UEFIKey = wmic path softwarelicensingservice get OA3xOriginalProductKey
$PWName = "Individual Admin Account on $ComputerName"
$PWUser = $localAdminUser
$PWPassword = $PW
$PWDescription = "Hardware information:
=====================
$Manufacturer
$Model
$SN

UEFI BIOS Windows Key:
======================
$UEFIKey

Known MAC Addresses:
====================
$MACs
(MACs might be subject to change with Docking-Stations)"

$tokenParams = @{
    grant_type='password';
    username=$KeePassCredentials.UserName;
    password=$KeePassCredentials.GetNetworkCredential().password;}

Try{
    $JSON = Invoke-WebRequest -Uri "$KeepassURL/OAuth2/Token" -Method POST -Body $tokenParams -ContentType "application/x-www-form-urlencoded" -UseBasicParsing 
    $Token = (ConvertFrom-Json $JSON.Content).access_token
} Catch {
    Clear-Host
    Write-Host ""
    Write-Host ""
    Write-Host "Your KeePass credentials did not work." -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host "Script will stop now." -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host ""
    Write-Host "================================================================================================================"
    Write-Host "Error Details:"
    Write-Host "=============="
    write-host "Caught exception:" -ForegroundColor Red
    write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red
    write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red
    Write-Host "================================================================================================================"
    Write-Host ""
    Write-Host ""
    Pause
    Exit
}

$headers = @{
    "Accept" = "application/json"
    "Authorization" = "$Token"}
    
$GroupSearch = @{“search” = $PWFolder}
$Group = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $GroupSearch) -Headers $headers -ContentType 'application/json' -UseBasicParsing
$GroupID = $Group.Groups.Id

$SearchPhrase = $PWUser
$searchbody = @{“search” = $SearchPhrase}
$Search = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $searchbody) -Headers $headers -ContentType 'application/json' -UseBasicParsing
$SearchID = $Search.Credentials.Id

$KeePassResultscnt = 0
ForEach($Result in $Search.credentials)
{
    $CredentialID = $Result.id
    If ($Result.GroupId -eq $GroupID)
    {
        $KeePassResultscnt += 1
    }        
}
If ($KeePassResultscnt -ge 1)
{
    Write-Host "Total number of results found: $cnt" -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host "ALERT - KeePass already has credentials for this system - can not proceed." -ForegroundColor Magenta
    Write-Host "==========================================================================" -ForegroundColor Magenta
    Write-Host ""
    Write-Host "Search-Phrase: $SearchPhrase" -ForegroundColor Magenta
    Write-Host "Search-Folder: $PWFolder" -ForegroundColor Magenta
    Write-Host "Amount of results found: $KeePassResultscnt" -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host ""
    Write-Host "Next Steps:" -ForegroundColor Magenta
    Write-Host "===========" -ForegroundColor Magenta
    Write-Host "- This script will exit now!" -ForegroundColor Magenta
    Write-Host "- No changes to the system of KeePass have been applied" -ForegroundColor Magenta
    Write-Host "- Go to KeePass and check if this is an old entry and can be renamed/moved" -ForegroundColor Magenta
    Write-Host "- Execute the script again" -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    pause
    EXIT
} Else {
    Write-Host ""
    Write-Host ""
    Write-Host "Writing new credentials to the KeePass server/database"
    Write-Host ""
    Write-Host ""
    $PWEntryDT = Get-Date -Format "O"
    $CredEntry = @{
        Id = "00000000-0000-0000-0000-000000000000"
        Name = "$PWName"
        Username = "$PWUser"
        Password = "$PWPassword"
        Created = "$PWEntryDT"
        Modified = "$PWEntryDT"
        GroupId = "$GroupID"
        Notes = "$PWDescription"
        Url = "$ComputerName"
    }
    Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/credential/00000000-0000-0000-0000-000000000000"-body @(ConvertTo-Json $CredEntry) -Headers $headers -ContentType 'application/json' -UseBasicParsing
    Write-Host ""
    Write-Host ""
    Write-Host "Finished writing to KeePass server/database"
    Write-Host ""
    Write-Host ""
}
pause

Clear-Host
Write-Host ""
Write-Host ""
Write-Host "Please check the following information:"
Write-Host "======================================="
Write-Host ""
Write-Host "Computer Name: $ComputerName" -ForegroundColor Yellow
Write-Host "local Admin: $localAdminUser" -ForegroundColor Yellow
Write-Host "Admin-PW: $PW" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Make sure the information above are correct!"
Write-Host ""
Write-Host ""
Write-Host "Verify the local Admin and Admin-PW in KeePass!" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
pause
Write-Host ""
Write-Host ""
Write-Host "All information are verified?"
Write-Host ""
Write-Host ""
pause

Clear-Host
Write-Host "Checking and removing (if exists) old local user: $localAdminUser"
Get-LocalUser -Name $localAdminUser | Remove-LocalUser 
Clear-Host
Write-Host "Adding new local administrator account: $localAdminUser"
New-LocalUser -Name $localAdminUser -Password $PWencrypted -AccountNeverExpires -PasswordNeverExpires -Description "System specific local administrator account"
$NewUser = Get-LocalUser -Name $localAdminUser
$AdminGroup = Get-LocalGroup -Name "Administrators"
Add-LocalGroupMember -Name $AdminGroup -Member $NewUser

Write-Host ""
Write-Host ""
Write-Host "Finished."
Write-Host ""
Write-Host ""
pause

Write-Host ""
Write-Host ""
Write-Host "Joining this system to the domain and reboot automatically - stay put" -ForegroundColor Yellow
Write-Host ""
Write-Host ""
Write-Host "Note: The system will not reboot if an error occurs. Check the error message in case you see an error." -ForegroundColor Yellow
Write-Host ""
Write-Host ""

Try{
    Add-Computer -Domain $MyDomain -Credential $DomainJoinCredentials -NewName $ComputerName -Restart -Force -OUPath $MyDomainOU
} Catch {
    Write-Host ""
    Write-Host ""
    Write-Host "Domain-Join did not work - Error:" -ForegroundColor Magenta
    Write-Host ""
    Write-Host ""
    Write-Host ""
    Write-Host "================================================================================================================"
    Write-Host "Error Details:"
    Write-Host "=============="
    write-host "Caught exception:" -ForegroundColor Red
    write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red
    write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red
    Write-Host "================================================================================================================"
    Write-Host ""
    Write-Host ""
    Pause
} Finally {
    Exit
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

$MyDomainNetBIOS="CONTOSO"

$MyDomain="contoso.local"

$MyDomainDN="dc=contoso,dc=local"

$MyDomainOU="OU=Computers,OU=USA,DC=contoso,DC=local"

$KeepassURL = "https://pwdbserver01v.contoso.local:10001"

$PWFolder = "Local Admins"

$ScriptVersion = "1.4 - 9/5/2018 - Florian Rossmark"

Clear-Host

Write-Host ""

Write-Host "Welcome to the Domain-Join script"

Write-Host "================================="

Write-Host ""

Write-Host "This script will do the following Steps:"

Write-Host "----------------------------------------"

Write-Host "- You enter the Computer Name / Host Name" -ForegroundColor Yellow

Write-Host "- You enter Domain Admin credentials for a Domain-Join" -ForegroundColor Yellow

Write-Host "- You enter credentials to access KeyPass Password server" -ForegroundColor Yellow

Write-Host ""

Write-Host "Note: always type credentials without any domain-information ($MyDomainNetBIOS\) - the script will fail otherwise."

Write-Host ""

Write-Host "- The script will automatically create a KeyPass entry with all information" -ForegroundColor Yellow

Write-Host "- The script will automatically create a specific local admin account for this machine" -ForegroundColor Yellow

Write-Host "- The script will automatically rename the system to the given name" -ForegroundColor Yellow

Write-Host "- The script will automatically join the system to the domain $MyDomain" -ForegroundColor Yellow

Write-Host ""

Write-Host "Script Version: $ScriptVersion"

Write-Host ""

pause

#Upper area holds functions..

Function MakeUp-String([Int]$Size = 8, [Char[]]$CharSets = "ULNS", [Char[]]$Exclude) {

$Chars = @(); $TokenSet = @()

If (!$TokenSets) {$Global:TokenSets = @{

U = [Char[]]'ABCDEFGHJKLMNPQRSTUVWXYZ' #Upper case

L = [Char[]]'abcdefghijkmnpqrstuvwxyz' #Lower case

N = [Char[]]'23456789' #Numerals

S = [Char[]]'!@$!@$!@$!@$' #Symbols

}}

$CharSets | ForEach {

$Tokens = $TokenSets."$_" | ForEach {If ($Exclude -cNotContains $_) {$_}}

If ($Tokens) {

$TokensSet += $Tokens

If ($_ -cle [Char]"Z") {$Chars += $Tokens | Get-Random} #Character sets defined in upper case are mandatory

}

While ($Chars.Count -lt $Size) {$Chars += $TokensSet | Get-Random}

($Chars | Sort-Object {Get-Random}) -Join "" #Mix the (mandatory) characters and output string

};

#avoid certificate issues

Add-Type @"

using System;

using System.Net;

using System.Net.Security;

using System.Security.Cryptography.X509Certificates;

public class ServerCertificateValidationCallback

{

public static void Ignore()

{

ServicePointManager.ServerCertificateValidationCallback +=

delegate

(

Object obj,

X509Certificate certificate,

X509Chain chain,

SslPolicyErrors errors

)

{

return true;

};

}

[ServerCertificateValidationCallback]::Ignore();

#Script starts here...

Clear-Host

Write-Host ""

Write-Host "This script must be executed in a power-shell with elevated rights!" -ForegroundColor Yellow

Write-Host ""

Write-Host "Stop the script with: CTRL + C any time..."

Write-Host ""

Pause

Clear-Host

$ComputerName = Read-Host "Please enter new Computer Name"

$DomainJoinCredentials = Get-Credential -Message "Enter your credentials for the domain join ($MyDomainNetBIOS) without the domain part"

Try{

$ADSISearcherDE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$MyDomain",$($DomainJoinCredentials.UserName),$($DomainJoinCredentials.GetNetworkCredential().password))

$ADSISearcher = New-Object System.DirectoryServices.DirectorySearcher($ADSISearcherDE,"(&(objectCategory=Computer)(name=$ComputerName))")

$ADSISearcherResults = $ADSISearcher.FindAll()

if ($ADSISearcherResults.Count -gt 0)

{

Clear-Host

Write-Host ""

Write-Host "Computer account with this name '$ComputerName' already exists in the domain '$MyDomain'." -ForegroundColor Magenta

Write-Host ""

Write-Host "You need to delete the account first or make sure you entered the right name." -ForegroundColor Magenta

Write-Host ""

Write-Host "Script will stop now." -ForegroundColor Magenta

Write-Host ""

Pause

Exit

}

} Catch {

Clear-Host

Write-Host ""

Write-Host "Your Domain Admin credentials where wrong." -ForegroundColor Magenta

Write-Host ""

Write-Host "Script will stop now." -ForegroundColor Magenta

Write-Host ""

Write-Host "================================================================================================================"

Write-Host "Error Details:"

Write-Host "=============="

write-host "Caught exception:" -ForegroundColor Red

write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red

write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red

Write-Host "================================================================================================================"

Write-Host ""

Pause

Exit

}

$KeePassCredentials = Get-Credential -Message “Enter your credentials to access Keepass Server without the domain part”

$localAdminUser = $("$ComputerName" + "_Admin")

$PW = MakeUp-String(12)

$PWencrypted = ConvertTo-SecureString $PW -AsPlainText -Force

Clear-Host

Write-Host ""

Write-Host "Checking KeePass to see if those credentials already exist"

Write-Host ""

#Collecting MACs

$colMACItems = get-wmiobject Win32_NetworkAdapter | Where-Object {$_.MACAddress -like "*:*"}

foreach ($objMACItem in $colMACItems) {

$MACobj = $objMACItem |select Description,MACAddress

$MACs += $MACobj.MACAddress + " - " + $MACobj.Description + "

}

#Collecting SN/ServiceTag and HW information

$SN = "ServiceTag / SN: "+(Get-WmiObject win32_bios | select SerialNumber).SerialNumber

$Model = "Model: "+(Get-WmiObject win32_computersystem | select Model).Model

$Manufacturer = "Manufacturer: "+(Get-WmiObject win32_computersystem | select Manufacturer).Manufacturer

$UEFIKey = wmic path softwarelicensingservice get OA3xOriginalProductKey

$PWName = "Individual Admin Account on $ComputerName"

$PWUser = $localAdminUser

$PWPassword = $PW

$PWDescription = "Hardware information:

=====================

$Manufacturer

$Model

$SN

UEFI BIOS Windows Key:

======================

$UEFIKey

Known MAC Addresses:

====================

$MACs

(MACs might be subject to change with Docking-Stations)"

$tokenParams = @{

grant_type='password';

username=$KeePassCredentials.UserName;

password=$KeePassCredentials.GetNetworkCredential().password;}

Try{

$JSON = Invoke-WebRequest -Uri "$KeepassURL/OAuth2/Token" -Method POST -Body $tokenParams -ContentType "application/x-www-form-urlencoded" -UseBasicParsing

$Token = (ConvertFrom-Json $JSON.Content).access_token

} Catch {

Clear-Host

Write-Host ""

Write-Host "Your KeePass credentials did not work." -ForegroundColor Magenta

Write-Host ""

Write-Host "Script will stop now." -ForegroundColor Magenta

Write-Host ""

Write-Host "================================================================================================================"

Write-Host "Error Details:"

Write-Host "=============="

write-host "Caught exception:" -ForegroundColor Red

write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red

write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red

Write-Host "================================================================================================================"

Write-Host ""

Pause

Exit

}

$headers = @{

"Accept" = "application/json"

"Authorization" = "$Token"}

$GroupSearch = @{“search” = $PWFolder}

$Group = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $GroupSearch) -Headers $headers -ContentType 'application/json' -UseBasicParsing

$GroupID = $Group.Groups.Id

$SearchPhrase = $PWUser

$searchbody = @{“search” = $SearchPhrase}

$Search = Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/search"-body (ConvertTo-Json $searchbody) -Headers $headers -ContentType 'application/json' -UseBasicParsing

$SearchID = $Search.Credentials.Id

$KeePassResultscnt = 0

ForEach($Result in $Search.credentials)

{

$CredentialID = $Result.id

If ($Result.GroupId -eq $GroupID)

{

$KeePassResultscnt += 1

}

If ($KeePassResultscnt -ge 1)

{

Write-Host "Total number of results found: $cnt" -ForegroundColor Magenta

Write-Host ""

Write-Host "ALERT - KeePass already has credentials for this system - can not proceed." -ForegroundColor Magenta

Write-Host "==========================================================================" -ForegroundColor Magenta

Write-Host ""

Write-Host "Search-Phrase: $SearchPhrase" -ForegroundColor Magenta

Write-Host "Search-Folder: $PWFolder" -ForegroundColor Magenta

Write-Host "Amount of results found: $KeePassResultscnt" -ForegroundColor Magenta

Write-Host ""

Write-Host "Next Steps:" -ForegroundColor Magenta

Write-Host "===========" -ForegroundColor Magenta

Write-Host "- This script will exit now!" -ForegroundColor Magenta

Write-Host "- No changes to the system of KeePass have been applied" -ForegroundColor Magenta

Write-Host "- Go to KeePass and check if this is an old entry and can be renamed/moved" -ForegroundColor Magenta

Write-Host "- Execute the script again" -ForegroundColor Magenta

Write-Host ""

pause

EXIT

} Else {

Write-Host ""

Write-Host "Writing new credentials to the KeePass server/database"

Write-Host ""

$PWEntryDT = Get-Date -Format "O"

$CredEntry = @{

Id = "00000000-0000-0000-0000-000000000000"

Name = "$PWName"

Username = "$PWUser"

Password = "$PWPassword"

Created = "$PWEntryDT"

Modified = "$PWEntryDT"

GroupId = "$GroupID"

Notes = "$PWDescription"

Url = "$ComputerName"

}

Invoke-RestMethod -Method post -Uri "$KeepassURL/api/v4/rest/credential/00000000-0000-0000-0000-000000000000"-body @(ConvertTo-Json $CredEntry) -Headers $headers -ContentType 'application/json' -UseBasicParsing

Write-Host ""

Write-Host "Finished writing to KeePass server/database"

Write-Host ""

}

pause

Clear-Host

Write-Host ""

Write-Host "Please check the following information:"

Write-Host "======================================="

Write-Host ""

Write-Host "Computer Name: $ComputerName" -ForegroundColor Yellow

Write-Host "local Admin: $localAdminUser" -ForegroundColor Yellow

Write-Host "Admin-PW: $PW" -ForegroundColor Yellow

Write-Host ""

Write-Host "Make sure the information above are correct!"

Write-Host ""

Write-Host "Verify the local Admin and Admin-PW in KeePass!" -ForegroundColor Yellow

Write-Host ""

pause

Write-Host ""

Write-Host "All information are verified?"

Write-Host ""

pause

Clear-Host

Write-Host "Checking and removing (if exists) old local user: $localAdminUser"

Get-LocalUser -Name $localAdminUser | Remove-LocalUser

Clear-Host

Write-Host "Adding new local administrator account: $localAdminUser"

New-LocalUser -Name $localAdminUser -Password $PWencrypted -AccountNeverExpires -PasswordNeverExpires -Description "System specific local administrator account"

$NewUser = Get-LocalUser -Name $localAdminUser

$AdminGroup = Get-LocalGroup -Name "Administrators"

Add-LocalGroupMember -Name $AdminGroup -Member $NewUser

Write-Host ""

Write-Host "Finished."

Write-Host ""

pause

Write-Host ""

Write-Host "Joining this system to the domain and reboot automatically - stay put" -ForegroundColor Yellow

Write-Host ""

Write-Host "Note: The system will not reboot if an error occurs. Check the error message in case you see an error." -ForegroundColor Yellow

Write-Host ""

Try{

Add-Computer -Domain $MyDomain -Credential $DomainJoinCredentials -NewName $ComputerName -Restart -Force -OUPath $MyDomainOU

} Catch {

Write-Host ""

Write-Host "Domain-Join did not work - Error:" -ForegroundColor Magenta

Write-Host ""

Write-Host "================================================================================================================"

Write-Host "Error Details:"

Write-Host "=============="

write-host "Caught exception:" -ForegroundColor Red

write-host "Exception Type: $($_.Exception.GetType().FullName)" -ForegroundColor Red

write-host "Exception Message: $($_.Exception.Message)" -ForegroundColor Red

Write-Host "================================================================================================================"

Write-Host ""

Pause

} Finally {

Exit

}

September 6, 2018 by Florian Rossmark recommendations scripts server solutions web

Gathering profile information from computer

Every now an then you might need to know who logged on and when was the last logon of which user to a specific workstation as well as the size of each user profile. For this I once wrote the PowerShell script you can find below. It does a WMI query against a list of one or more target computers and reads out the information reporting it back.

As input parameter use a comma separated list of computer names – those must be reachable and administrative accessible (you need at least admin rights on the target system). You then get a output set per profile.

The output can e.g. be transformed with the parameter |ft to see it in table format – like typical in PowerShell.

Output values are:

ComputerName
ProfileName
ProfilePath
ProfileType
- Temporary
- Roaming
- Mandatory
- Corrupted
- local
IsinUse
IsSystemAccount
Size
- this needs to most processing time – it is a manual size check including even temp files.. – other then what Windows shows you
LastUseTime

[cmdletbinding()]
[cmdletbinding()]
param (
[parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
[string[]]$ComputerName = $env:computername
)            
 
foreach ($Computer in $ComputerName) {
 $Profiles = Get-WmiObject -Class Win32_UserProfile -Computer $Computer -ea 0
 foreach ($profile in $profiles) {
  try {
      $objSID = New-Object System.Security.Principal.SecurityIdentifier($profile.sid)
      $objuser = $objsid.Translate([System.Security.Principal.NTAccount])
      $objusername = $objuser.value
  } catch {
        $objusername = $profile.sid
  }
  switch($profile.status){
   1 { $profileType="Temporary" }
   2 { $profileType="Roaming" }
   4 { $profileType="Mandatory" }
   8 { $profileType="Corrupted" }
   default { $profileType = "LOCAL" }
  }
  $size = 0
  try{
    $profilepath=$profile.localpath -replace "C:","\\$Computer\C$"
    $size=(dir $profilepath -recurse -force -ea silentlycontinue | Measure-Object ‘length’ -sum -Maximum).sum
    $size=[math]::Round(($size/1GB),2)
    #$size={{0:n2} -f $size}
    $size2=[string]::Format("{0:0.00} GB", $size)
  } catch {
    $size = -1
  }

  $User = $objUser.Value
  try {
	$ProfileLastUseTime = ([WMI]"").Converttodatetime($profile.lastusetime)
  } catch {
	$ProfileLastUseTime = ""
  }
  $OutputObj = New-Object -TypeName PSobject
  $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.toUpper()
  $OutputObj | Add-Member -MemberType NoteProperty -Name ProfileName -Value $objusername
  $OutputObj | Add-Member -MemberType NoteProperty -Name ProfilePath -Value $profile.localpath
  $OutputObj | Add-Member -MemberType NoteProperty -Name ProfileType -Value $ProfileType
  $OutputObj | Add-Member -MemberType NoteProperty -Name IsinUse -Value $profile.loaded
  $OutputObj | Add-Member -MemberType NoteProperty -Name IsSystemAccount -Value $profile.special
  $OutputObj | Add-Member -MemberType NoteProperty -Name Size -Value $size2
  $OutputObj | Add-Member -MemberType NoteProperty -Name LastUseTime -Value $ProfileLastUseTime
  $OutputObj
  
 }
}

[cmdletbinding()]

param (

[parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]

[string[]]$ComputerName = $env:computername

)

foreach ($Computer in $ComputerName) {

$Profiles = Get-WmiObject -Class Win32_UserProfile -Computer $Computer -ea 0

foreach ($profile in $profiles) {

try {

$objSID = New-Object System.Security.Principal.SecurityIdentifier($profile.sid)

$objuser = $objsid.Translate([System.Security.Principal.NTAccount])

$objusername = $objuser.value

} catch {

$objusername = $profile.sid

}

switch($profile.status){

1 { $profileType="Temporary" }

2 { $profileType="Roaming" }

4 { $profileType="Mandatory" }

8 { $profileType="Corrupted" }

default { $profileType = "LOCAL" }

}

$size = 0

try{

$profilepath=$profile.localpath -replace "C:","\\$Computer\C$"

$size=(dir $profilepath -recurse -force -ea silentlycontinue | Measure-Object ‘length’ -sum -Maximum).sum

$size=[math]::Round(($size/1GB),2)

#$size={{0:n2} -f $size}

$size2=[string]::Format("{0:0.00} GB", $size)

} catch {

$size = -1

}

$User = $objUser.Value

try {

$ProfileLastUseTime = ([WMI]"").Converttodatetime($profile.lastusetime)

} catch {

$ProfileLastUseTime = ""

}

$OutputObj = New-Object -TypeName PSobject

$OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.toUpper()

$OutputObj | Add-Member -MemberType NoteProperty -Name ProfileName -Value $objusername

$OutputObj | Add-Member -MemberType NoteProperty -Name ProfilePath -Value $profile.localpath

$OutputObj | Add-Member -MemberType NoteProperty -Name ProfileType -Value $ProfileType

$OutputObj | Add-Member -MemberType NoteProperty -Name IsinUse -Value $profile.loaded

$OutputObj | Add-Member -MemberType NoteProperty -Name IsSystemAccount -Value $profile.special

$OutputObj | Add-Member -MemberType NoteProperty -Name Size -Value $size2

$OutputObj | Add-Member -MemberType NoteProperty -Name LastUseTime -Value $ProfileLastUseTime

$OutputObj

}

August 20, 2018 by Florian Rossmark recommendations scripts solutions

Monitor user accounts in Active Directory with PRTG

The following script will read through your current Active Directory and filter for user accounts with the following specific conditions:

Lockedout users – please read below for further information about this
- all users that are lockedout
- must be an enabled user
- that is not expired
disabled users
- all users that have been disabled
expired users
- must be an enabled user
- the expiration date is set and past the current date
users with password never expires set
- must be an enabled user

This will give you a pure counter output per channel in an for PRTG Extended script sensor XML result.

But there is a theoretical flaw in one of the methods – the locked out users. Now, user accounts get locked out in Active Directory due to too many logon attempts with an invalid password. This causes Active Directory to set the lockedout bit in the object properties. The issue here is that this bit will not be set back to 0 after the defined lockout duration (GPO) is past, the property will only be set back to 0 once the lockout duration is passed and he successfully logged on.

This means, the counter might give you more results then currently true, it might count users that have been locked out but the lockout-duration passed – but they did not yet logon successfully. This is somehow a false positive, while not totally false. In any case, you need to be aware of this.

The script could be more efficient as well in the way it filters a few things, so far I optimized it as far as I could – the LockedOut value can not be set as a -Filter, in theory it might be possible to speed it up with a -Filter to the UserAccountControl (if that is even possible – not tested) – but I am not certain this would work. If you really want to speed it up you would need to work with -LDAPFilter – but this actually needs to completely replace the internal filter capabilities of Get-ADUser – you can’t use both – it is one or the other.

Import-Module ActiveDirectory

#you could add - filters, a OU limitation or a server against whom this would be executed.. see Get-ADUser options for more details
#$Server = ""
#$OU = ""
#Get-ADUser -Server $Server -Filter
#Get-ADUser -SearchBase $OU -Filter

#all locked users that aren't disabled or expired
$LockedOutUsers=Get-ADUser -Filter {Enabled -eq $True -and objectCategory -eq "person" -and objectClass -eq "user"} -Properties sAMAccountName,DisplayName,LockedOut,LockoutTime,Enabled,AccountExpirationDate | where {$_.lockedout -eq $True -and (($_.AccountExpirationDate -gt (Get-Date) -or ($_.AccountExpirationDate -eq $null)))} 

#all users that are disabled - this is a manual action in Active Directory
$DisabledUsers=Get-ADUser -Filter {Enabled -eq $False -and objectCategory -eq "person" -and objectClass -eq "user"} -Properties sAMAccountName,DisplayName,LockedOut,LockoutTime,Enabled,AccountExpirationDate

#all users that are not disabled but expired already
$ExpiredUsers=Get-ADUser -Filter {Enabled -eq $True -and objectCategory -eq "person" -and objectClass -eq "user"} -Properties sAMAccountName,DisplayName,LockedOut,LockoutTime,Enabled,AccountExpirationDate | where {(($_.AccountExpirationDate -lt (Get-Date) -and ($_.AccountExpirationDate -ne $null)))} 

#users with not expiring passwords and are enabled and not expired
$NotExpiringPWD=Get-ADUser -Filter {Enabled -eq $True -and PasswordNeverExpires -eq $True -and objectCategory -eq "person" -and objectClass -eq "user"} -Properties sAMAccountName,DisplayName,LockedOut,LockoutTime,Enabled,AccountExpirationDate 


If ($LockedOutUsers.count -eq $null -and $LockedOutUsers -eq $null){
    $cntLockedOutUsers=0
}Elseif ($LockedOutUsers.count -eq $null -and $LockedOutUsers -ne $null){
    $cntLockedOutUsers=1
}Else{
    $cntLockedOutUsers=@($LockedOutUsers.count)
}

If ($DisabledUsers.count -eq $null -and $DisabledUsers -eq $null){
    $cntDisabledUsers=0
}Elseif ($DisabledUsers.count -eq $null -and $DisabledUsers -ne $null){
    $cntDisabledUsers=1
}Else{
    $cntDisabledUsers=@($DisabledUsers.count)
}

If ($ExpiredUsers.count -eq $null -and $ExpiredUsers -eq $null){
    $cntExpiredUsers=0
}Elseif ($ExpiredUsers.count -eq $null -and $ExpiredUsers -ne $null){
    $cntExpiredUsers=1
}Else{
    $cntExpiredUsers=@($ExpiredUsers.count)
}

If ($NotExpiringPWD.count -eq $null -and $NotExpiringPWD -eq $null){
    $cntNotExpiringPWD=0
}Elseif ($NotExpiringPWD.count -eq $null -and $NotExpiringPWD -ne $null){
    $cntNotExpiringPWD=1
}Else{
    $cntNotExpiringPWD=@($NotExpiringPWD.count)
}

$XML += "<prtg>"
$XML += "<result>" 
$XML += "<channel>Locked Out Users</channel>" 
$XML += "<value>$cntLockedOutUsers</value>" 
$XML += "</result>"
$XML += "<result>" 
$XML += "<channel>Disabled Users</channel>" 
$XML += "<value>$cntDisabledUsers</value>" 
$XML += "</result>"
$XML += "<result>" 
$XML += "<channel>Expired Users - not disabled</channel>" 
$XML += "<value>$cntExpiredUsers</value>" 
$XML += "</result>"
$XML += "<result>" 
$XML += "<channel>Users with password never expires</channel>" 
$XML += "<value>$cntNotExpiringPWD</value>" 
$XML += "</result>"
$XML += "</prtg>"

Function WriteXmlToScreen ([xml]$xml)
{
    $StringWriter = New-Object System.IO.StringWriter;
    $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
    $XmlWriter.Formatting = "indented";
    $xml.WriteTo($XmlWriter);
    $XmlWriter.Flush();
    $StringWriter.Flush();
    Write-Output $StringWriter.ToString();
}

WriteXmlToScreen $XML

Import-Module ActiveDirectory

#you could add - filters, a OU limitation or a server against whom this would be executed.. see Get-ADUser options for more details

#$Server = ""

#$OU = ""

#Get-ADUser -Server $Server -Filter

#Get-ADUser -SearchBase $OU -Filter

#all locked users that aren't disabled or expired

$LockedOutUsers=Get-ADUser -Filter {Enabled -eq $True -and objectCategory -eq "person" -and objectClass -eq "user"} -Properties sAMAccountName,DisplayName,LockedOut,LockoutTime,Enabled,AccountExpirationDate | where {$_.lockedout -eq $True -and (($_.AccountExpirationDate -gt (Get-Date) -or ($_.AccountExpirationDate -eq $null)))}

#all users that are disabled - this is a manual action in Active Directory

$DisabledUsers=Get-ADUser -Filter {Enabled -eq $False -and objectCategory -eq "person" -and objectClass -eq "user"} -Properties sAMAccountName,DisplayName,LockedOut,LockoutTime,Enabled,AccountExpirationDate

#all users that are not disabled but expired already

$ExpiredUsers=Get-ADUser -Filter {Enabled -eq $True -and objectCategory -eq "person" -and objectClass -eq "user"} -Properties sAMAccountName,DisplayName,LockedOut,LockoutTime,Enabled,AccountExpirationDate | where {(($_.AccountExpirationDate -lt (Get-Date) -and ($_.AccountExpirationDate -ne $null)))}

#users with not expiring passwords and are enabled and not expired

$NotExpiringPWD=Get-ADUser -Filter {Enabled -eq $True -and PasswordNeverExpires -eq $True -and objectCategory -eq "person" -and objectClass -eq "user"} -Properties sAMAccountName,DisplayName,LockedOut,LockoutTime,Enabled,AccountExpirationDate

If ($LockedOutUsers.count -eq $null -and $LockedOutUsers -eq $null){

$cntLockedOutUsers=0

}Elseif ($LockedOutUsers.count -eq $null -and $LockedOutUsers -ne $null){

$cntLockedOutUsers=1

}Else{

$cntLockedOutUsers=@($LockedOutUsers.count)

}

If ($DisabledUsers.count -eq $null -and $DisabledUsers -eq $null){

$cntDisabledUsers=0

}Elseif ($DisabledUsers.count -eq $null -and $DisabledUsers -ne $null){

$cntDisabledUsers=1

}Else{

$cntDisabledUsers=@($DisabledUsers.count)

}

If ($ExpiredUsers.count -eq $null -and $ExpiredUsers -eq $null){

$cntExpiredUsers=0

}Elseif ($ExpiredUsers.count -eq $null -and $ExpiredUsers -ne $null){

$cntExpiredUsers=1

}Else{

$cntExpiredUsers=@($ExpiredUsers.count)

}

If ($NotExpiringPWD.count -eq $null -and $NotExpiringPWD -eq $null){

$cntNotExpiringPWD=0

}Elseif ($NotExpiringPWD.count -eq $null -and $NotExpiringPWD -ne $null){

$cntNotExpiringPWD=1

}Else{

$cntNotExpiringPWD=@($NotExpiringPWD.count)

}

$XML += "<prtg>"

$XML += "<result>"

$XML += "<channel>Locked Out Users</channel>"

$XML += "<value>$cntLockedOutUsers</value>"

$XML += "</result>"

$XML += "<result>"

$XML += "<channel>Disabled Users</channel>"

$XML += "<value>$cntDisabledUsers</value>"

$XML += "</result>"

$XML += "<result>"

$XML += "<channel>Expired Users - not disabled</channel>"

$XML += "<value>$cntExpiredUsers</value>"

$XML += "</result>"

$XML += "<result>"

$XML += "<channel>Users with password never expires</channel>"

$XML += "<value>$cntNotExpiringPWD</value>"

$XML += "</result>"

$XML += "</prtg>"

Function WriteXmlToScreen ([xml]$xml)

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

WriteXmlToScreen $XML

This script updated with a corrected version as of February 2019 and was also posted in the PRTG knowledge base here.

July 19, 2018 by Florian Rossmark monitoring prtg scripts security server

Prevent ScreenSaver coming up with a PowerShell script

In our daily business, we often have the issue that a GPO enforces a screensaver after a certain amount of time. This can become very annoying and actually even be an issue if you are remote in on a end-user system and don’t know their password. After doing quite some research I found out that PowerShell actually is able to help here and I wrote a script to prevent the screensaver from coming up.

First I thought, let’s see if I can control the mouse cursor, cause I thought it would be less invasive, this is actually possible – but interestingly did not have the expected effect and the screensaver kept coming up. So I did go with keystrokes, but of course I was worried about what key would be save to send. Doing some research on Microsoft websites (here the link), I found the F16 – testing around with it I found it the least invasive key to send periodically to a system – it does not even exist on a regular keyboard and can only be simulated with a key-combination. To simulate F16 you need to press SHIFT + F4 – there might be a Windows 10 (may be even earlier) combination out of WINDOWS + SHIFT + F4 respective WINDOWS + F16 what would cause a shutdown. Once I found out about that, I decided to adjust the script to F17 what seemed to bypass even that small chance of an issue that would be more problematic then the screensaver itself – you sure don’t want the system to shutdown :-).

The script you find below can be simply executed. It has a setting $minutes that you could add as a parameter and therefor adjust it when you start it – by default it will use 9999 what is a pretty long time. To be clear – this is actually not a minute interval, it is a 30 second interval and ends up in half minutes. Why? Simple – Windows has a minimum setting of 1 minute that an screensaver can come up. If the script would fire in a minute interval, there is a theoretical chance the screensaver would still win.

This is further not pure PowerShell code – well it is but actually the key stroke is send via a Windows Scripting Host WSH / WScript command SendKeys. The PowerShell only surrounds to command. It has the nice habit of having a PowerShell window open that you simply can close to end the script. If you would do the same in WSH you would need to execute the script more manual with CSCRIPT rather then just double-clicking the file what would execute it via VBSCRIPT instead causing a hidden window / process and you would need to identify it in the task-manager to kill the process. Therefor, PowerShell was the best choice in the end to accomplish the task.

param($minutes = 9999)

$myShell = New-Object -com "Wscript.Shell"

for ($i = 0; $i -lt $minutes; $i++) {
Start-Sleep -Seconds 30
$myShell.sendkeys("{F13}")
}

param($minutes = 9999)

$myShell = New-Object -com "Wscript.Shell"

for ($i = 0; $i -lt $minutes; $i++) {

Start-Sleep -Seconds 30

$myShell.sendkeys("{F13}")

}

Additionally you could use the below more advanced script that will control the screensaver only during a defined time window. This is a more advanced way and more usable in certain situation, cause it would automatically allow the screensaver to come up outside the defined time window and minimize the exposure of the system more. It is also more effective then completely disabling any screensaver GPO settings, cause it is more specific and adjustable.

Update: As of 10/202 I updated the script below from F13 to F10, as this works better for most situations. Be aware, it all depends on what your foreground windows will react too. Make sure the keystroke you use does not cause you any harm.

param($minutes = 9999)

$myShell = New-Object -com "Wscript.Shell"

for ($i = 0; $i -lt $minutes; $i++) {
  $min = Get-Date "05:30"
  $max = Get-Date "17:30"
  $now = Get-Date
  if ($min.TimeOfDay -le $now.TimeOfDay -and $max.TimeOfDay -ge $now.TimeOfDay) {
    Write-Host "$now - Time between $min and $max - preventing screensaver" -ForegroundColor DarkGreen -BackgroundColor White
    $i = 0
    $myShell.sendkeys("{F10}")
  } else {
    Write-Host "$now - Time outside off $min and $max - allowing screensaver" -ForegroundColor DarkRed -BackgroundColor White
  }
  Start-Sleep -Seconds 30
}

param($minutes = 9999)

$myShell = New-Object -com "Wscript.Shell"

for ($i = 0; $i -lt $minutes; $i++) {

$min = Get-Date "05:30"

$max = Get-Date "17:30"

$now = Get-Date

if ($min.TimeOfDay -le $now.TimeOfDay -and $max.TimeOfDay -ge $now.TimeOfDay) {

Write-Host "$now - Time between $min and $max - preventing screensaver" -ForegroundColor DarkGreen -BackgroundColor White

$i = 0

$myShell.sendkeys("{F10}")

} else {

Write-Host "$now - Time outside off $min and $max - allowing screensaver" -ForegroundColor DarkRed -BackgroundColor White

}

Start-Sleep -Seconds 30

}

June 29, 2018 by Florian Rossmark scripts solutions windows

Automate your SUS clean up

Many companies rely on WSUS respective SUS services from Microsoft – aka. Windows Server Update Services as internal source and control of their update deployment to clients and servers within their network.

One of the big challenges for IT is to keep them clean and performant. The Cleanup-Assistant in the SUS management console tends to run forever and in any case means manual labor over and over again.

Below are two scripts – a CMD script that needs to be adjusted with parameters and a powershell script that will be called with those parameters. The scripts acutally will call the same API as the MMC Assistant does, just that this can be automatically performed via a scheduled task in Windows.

It helps you to keep your SUS slim and more performant.

In any way – I highly recommend to not blindly just enable all categories rather then limiting it to the once you have in place as well as once you reached a certain patch-level even actively denying updates you never will need again (keep in mind, new rolled out systems might still need older updates – but you could possibly refresh your base images or rely on Microsoft update services / online updates for those cases).

The combination of making updates obsolete and actually running a cleanup periodically will improve your SUS server performance.

As for the parameters, those are explained in the CMD script header – therefor I will not explain them here again.

@echo off 
REM SUS - CleanUp Script
REM Script start a Windows PowerShell Script that will acces the WSUS API and start a cleanup.
REM All parameters are set in this file, there is no need to change the PS script.
REM An email with results will be generated as well.

REM ScriptPath: Path where this and the PS1 script resides
REM Log: name of the logfile / shouldn't need to be adjusted
REM PSLog: name of PS script logfile, shouldn't need to be adjusted
REM CleanupScript: name of the PS1 script - you shouldn't need to adjust this

REM SUSServerFQDN: FQDN/full DNS name of the SUS Server (hostname.dns.tld)
REM SUSServerPort: Port-Number (80 / 443 / 8530 / 8531 - depending on your installation, check IIS if necessary)
REM SUSContentDrive: Drive-Letter of the partition that holds the WSUS-Content ( C or D or E - without the : )

REM supersededUpdates: 1 or 0 => Decline updates that have not been approved for 30 days or more, are not currently needed by any clients, and are superseded by an aproved update.
REM expiredUpdates: 1 or 0 => Decline updates that aren't approved and have been expired my Microsoft.
REM obsoleteUpdates: 1 or 0 => Delete updates that are expired and have not been approved for 30 days or more.
REM compressUpdates: 1 or 0 => Delete older update revisions that have not been approved for 30 days or more.
REM obsoleteComputers: 1 or 0 => Delete computers that have not contacted the server in 30 days or more.
REM unneededContentFiles: 1 or 0 => Delete update files that aren't needed by updates or downstream servers.

REM SMTPServer: DNS-Name of the Mail-Server (hostname.dns.tld)
REM MailFrom: Mail-Sender address
REM MailTo: Mail-Recipient address


REM ****** BEGIN Parameter Configuration ****** 
Set ScriptPath=C:\Batch\SUSCleanUp
Set Log=%ScriptPath%\Logs\wsus-cleanup.log 
Set PSLog=%ScriptPath%\Logs\ps-cleanup.log 
Set CleanupScript=%ScriptPath%\SUSCleanUp.ps1

Set SUSServerFQDN=our-sus-server.domain.local
Set SUSServerPort=8530
Set SUSContentDrive=D

Set supersededUpdates=1
Set expiredUpdates=1
Set obsoleteUpdates=1
Set compressUpdates=1
Set obsoleteComputers=1
Set unneededContentFiles=1

Set SMTPServer=relay.domain.com
Set MailFrom=administrator@domain.com
Set MailTo=suslogfiles@domain.com
REM ****** END Paremeter Configuration ******


REM CleanUp and PreRequirements
MD %ScriptPath%\Logs 1>NUL 2>NUL
REM DEL %Log% 1>NUL 2>NUL
DEL %PSLog% 1>NUL 2>NUL

REM Script Execution
echo. >> "%log%" 
echo ############################################################ >> "%log%" 
echo. >> "%log%"
echo Begin Cleanup Report %wsus-server-01% on %date% %time%: >> "%log%" 
echo ------------------------------------------------------------ >> "%log%" 
"%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe" "%cleanupscript% '%susserverfqdn%' '%pslog%' '%smtpserver%' '%mailfrom%' '%mailto%'" %supersededUpdates% %expiredUpdates% %obsoleteUpdates% %compressUpdates% %obsoleteComputers% %unneededContentFiles% %SUSContentDrive% %SUSServerPort% >> "%log%"
echo ------------------------------------------------------------ >> "%log%"
echo End Cleanup Report %wsus-server-01% on %date% %time%: >> "%log%"

@echo off

REM SUS - CleanUp Script

REM Script start a Windows PowerShell Script that will acces the WSUS API and start a cleanup.

REM All parameters are set in this file, there is no need to change the PS script.

REM An email with results will be generated as well.

REM ScriptPath: Path where this and the PS1 script resides

REM Log: name of the logfile / shouldn't need to be adjusted

REM PSLog: name of PS script logfile, shouldn't need to be adjusted

REM CleanupScript: name of the PS1 script - you shouldn't need to adjust this

REM SUSServerFQDN: FQDN/full DNS name of the SUS Server (hostname.dns.tld)

REM SUSServerPort: Port-Number (80 / 443 / 8530 / 8531 - depending on your installation, check IIS if necessary)

REM SUSContentDrive: Drive-Letter of the partition that holds the WSUS-Content ( C or D or E - without the : )

REM supersededUpdates: 1 or 0 => Decline updates that have not been approved for 30 days or more, are not currently needed by any clients, and are superseded by an aproved update.

REM expiredUpdates: 1 or 0 => Decline updates that aren't approved and have been expired my Microsoft.

REM obsoleteUpdates: 1 or 0 => Delete updates that are expired and have not been approved for 30 days or more.

REM compressUpdates: 1 or 0 => Delete older update revisions that have not been approved for 30 days or more.

REM obsoleteComputers: 1 or 0 => Delete computers that have not contacted the server in 30 days or more.

REM unneededContentFiles: 1 or 0 => Delete update files that aren't needed by updates or downstream servers.

REM SMTPServer: DNS-Name of the Mail-Server (hostname.dns.tld)

REM MailFrom: Mail-Sender address

REM MailTo: Mail-Recipient address

REM ****** BEGIN Parameter Configuration ******

Set ScriptPath=C:\Batch\SUSCleanUp

Set Log=%ScriptPath%\Logs\wsus-cleanup.log

Set PSLog=%ScriptPath%\Logs\ps-cleanup.log

Set CleanupScript=%ScriptPath%\SUSCleanUp.ps1

Set SUSServerFQDN=our-sus-server.domain.local

Set SUSServerPort=8530

Set SUSContentDrive=D

Set supersededUpdates=1

Set expiredUpdates=1

Set obsoleteUpdates=1

Set compressUpdates=1

Set obsoleteComputers=1

Set unneededContentFiles=1

Set SMTPServer=relay.domain.com

Set MailFrom=administrator@domain.com

Set MailTo=suslogfiles@domain.com

REM ****** END Paremeter Configuration ******

REM CleanUp and PreRequirements

MD %ScriptPath%\Logs 1>NUL 2>NUL

REM DEL %Log% 1>NUL 2>NUL

DEL %PSLog% 1>NUL 2>NUL

REM Script Execution

echo. >> "%log%"

echo ############################################################ >> "%log%"

echo. >> "%log%"

echo Begin Cleanup Report %wsus-server-01% on %date% %time%: >> "%log%"

echo ------------------------------------------------------------ >> "%log%"

"%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe" "%cleanupscript% '%susserverfqdn%' '%pslog%' '%smtpserver%' '%mailfrom%' '%mailto%'" %supersededUpdates% %expiredUpdates% %obsoleteUpdates% %compressUpdates% %obsoleteComputers% %unneededContentFiles% %SUSContentDrive% %SUSServerPort% >> "%log%"

echo ------------------------------------------------------------ >> "%log%"

echo End Cleanup Report %wsus-server-01% on %date% %time%: >> "%log%"

# WSUS Connection Parameters:
[String]$WSUSServer = $args[0] 
[Boolean]$useSecureConnection = $False
[Int32]$portNumber = $args[12]
[String]$LogFile = $args[1] 
[String]$SMTPServer = $args[2] 
[String]$MailFrom = $args[3]
[String]$MailTO = $args[4]
[String]$SUSDrive = $args[11]
[String]$WMIDiskSpaceRequest = "\\" + $WSUSServer + "\root\cimv2:Win32_logicalDisk.DeviceID='" + $SUSDrive + ":'"

# Windows PowerShell example to check 'If File Exists'
#$FileExists = Test-Path $LogFile
#If ($FileExists -eq $True) {
#Delete old LogFiles
# Remove-Item $LogFile
#}

# Cleanup Parameters:
# Decline updates that have not been approved for 30 days or more, are not currently needed by any clients, and are superseded by an aproved update.
[Boolean]$supersededUpdates = $True
If ($args[5] = 0) {
$supersededUpdates = $False
}
# Decline updates that aren't approved and have been expired my Microsoft.
[Boolean]$expiredUpdates = $True
If ($args[6] = 0) {
$expiredUpdates = $False
}
# Delete updates that are expired and have not been approved for 30 days or more.
[Boolean]$obsoleteUpdates = $True
If ($args[7] = 0) {
$obsoleteUpdates = $False
}
# Delete older update revisions that have not been approved for 30 days or more.
[Boolean]$compressUpdates = $True
If ($args[8] = 0) {
$compressUpdates = $False
}
# Delete computers that have not contacted the server in 30 days or more.
[Boolean]$obsoleteComputers = $True
If ($args[9] = 0) {
$obsoleteComputers = $False
}
# Delete update files that aren't needed by updates or downstream servers.
[Boolean]$unneededContentFiles = $True
If ($args[10] = 0) {
$unneededContentFiles = $False
}
#EndRegion VARIABLES

#Region SCRIPT
# Load .NET assembly
[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration");

# Connect to WSUS Server
$wsusParent = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer($WSUSServer,$useSecureConnection,$portNumber);

# Log the date first
"Microsoft SUS Server CleanUp" | out-file -filepath $LogFile -append -noClobber;
$date = date
$info = "Start Date / Time: " + $date
$info | out-file -filepath $LogFile -append -noClobber;

# Log the SUS Server Name
$info = "Microsoft SUS Server Name: " + $WSUSServer
$info | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

# Log Current Free DiskSpace
$diskbefore = ([wmi]$WMIDiskSpaceRequest)
"Free disk space before cleanup:" | out-file -filepath $LogFile -append -noClobber;
"Drive " + $SUSDrive + ": has {0:#.0} GB free of {1:#.0} GB Total" -f ($diskbefore.FreeSpace/1GB),($diskbefore.Size/1GB) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

# Perform Cleanup
"Microsoft SUS Server CleanUp Results" | out-file -filepath $LogFile -append -noClobber;
"====================================" | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

$CleanupManager = $wsusParent.GetCleanupManager();

"CleanUp: supersededUpdates = " + $supersededUpdates | out-file -filepath $LogFile -append -noClobber;
"----------------------------------" | out-file -filepath $LogFile -append -noClobber;
date | out-file -filepath $LogFile -append -noClobber;
$CleanupScope_supersededUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($supersededUpdates,$False,$False,$False,$False,$False);
$CleanupManager.PerformCleanup($CleanupScope_supersededUpdates) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: expiredUpdates = " + $expiredUpdates | out-file -filepath $LogFile -append -noClobber;
"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;
date | out-file -filepath $LogFile -append -noClobber;
$CleanupScope_expiredUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$expiredUpdates,$False,$False,$False,$False);
$CleanupManager.PerformCleanup($CleanupScope_expiredUpdates) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: obsoleteUpdates = " + $obsoleteUpdates | out-file -filepath $LogFile -append -noClobber;
"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;
date | out-file -filepath $LogFile -append -noClobber;
$CleanupScope_obsoleteUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$obsoleteUpdates,$False,$False,$False);
$CleanupManager.PerformCleanup($CleanupScope_obsoleteUpdates) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: compressUpdates = " + $compressUpdates | out-file -filepath $LogFile -append -noClobber;
"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;
date | out-file -filepath $LogFile -append -noClobber;
$CleanupScope_compressUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$False,$compressUpdates,$False,$False);
$CleanupManager.PerformCleanup($CleanupScope_compressUpdates) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: obsoleteComputers = " + $obsoleteComputers | out-file -filepath $LogFile -append -noClobber;
"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;
date | out-file -filepath $LogFile -append -noClobber;
$CleanupScope_obsoleteComputers = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$False,$False,$obsoleteComputers,$False);
$CleanupManager.PerformCleanup($CleanupScope_obsoleteComputers) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: unneededContentFiles = " + $unneededContentFiles | out-file -filepath $LogFile -append -noClobber;
"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;
date | out-file -filepath $LogFile -append -noClobber;
$CleanupScope_unneededContentFiles = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$False,$False,$False,$unneededContentFiles);
$CleanupManager.PerformCleanup($CleanupScope_unneededContentFiles) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

# Log Current Free DiskSpace
$diskafter = ([wmi]$WMIDiskSpaceRequest)
"Free disk space after cleanup:" | out-file -filepath $LogFile -append -noClobber;
"Drive " + $SUSDrive + ": has {0:#.0} GB free of {1:#.0} GB Total" -f ($diskafter.FreeSpace/1GB),($diskafter.Size/1GB) | out-file -filepath $LogFile -append -noClobber;
"" | out-file -filepath $LogFile -append -noClobber;

# Log the date after
$date = date
$info = "End Date / Time: " + $date
$info | out-file -filepath $LogFile -append -noClobber;
#EndRegion SCRIPT

# Source: http://gallery.technet.microsoft.com/scriptcenter/90ca6976-d441-4a10-89b0-30a7103d55db#content
# Mail the report...
$message = new-object Net.Mail.MailMessage
$mailer = new-object Net.Mail.SmtpClient($SMTPServer)
$message.From = $MailFrom #"Sender <Sender@Domain.TLD>"
$message.To.Add($MailTo) #("Recipient <Recipient@Domain.TLD>")
$MeinText = "WSUS - Server CleanUp Report " + $WSUSServer
$message.Subject = $MeinText
$message.Body = [string]::join([environment]::NewLine, (get-content $logfile))
$mailer.Send($message)

#Delete Log => will happen at the next run
#Remove-Item $LogFile

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

# WSUS Connection Parameters:

[String]$WSUSServer = $args[0]

[Boolean]$useSecureConnection = $False

[Int32]$portNumber = $args[12]

[String]$LogFile = $args[1]

[String]$SMTPServer = $args[2]

[String]$MailFrom = $args[3]

[String]$MailTO = $args[4]

[String]$SUSDrive = $args[11]

[String]$WMIDiskSpaceRequest = "\\" + $WSUSServer + "\root\cimv2:Win32_logicalDisk.DeviceID='" + $SUSDrive + ":'"

# Windows PowerShell example to check 'If File Exists'

#$FileExists = Test-Path $LogFile

#If ($FileExists -eq $True) {

#Delete old LogFiles

# Remove-Item $LogFile

# Cleanup Parameters:

# Decline updates that have not been approved for 30 days or more, are not currently needed by any clients, and are superseded by an aproved update.

[Boolean]$supersededUpdates = $True

If ($args[5] = 0) {

$supersededUpdates = $False

}

# Decline updates that aren't approved and have been expired my Microsoft.

[Boolean]$expiredUpdates = $True

If ($args[6] = 0) {

$expiredUpdates = $False

}

# Delete updates that are expired and have not been approved for 30 days or more.

[Boolean]$obsoleteUpdates = $True

If ($args[7] = 0) {

$obsoleteUpdates = $False

}

# Delete older update revisions that have not been approved for 30 days or more.

[Boolean]$compressUpdates = $True

If ($args[8] = 0) {

$compressUpdates = $False

}

# Delete computers that have not contacted the server in 30 days or more.

[Boolean]$obsoleteComputers = $True

If ($args[9] = 0) {

$obsoleteComputers = $False

}

# Delete update files that aren't needed by updates or downstream servers.

[Boolean]$unneededContentFiles = $True

If ($args[10] = 0) {

$unneededContentFiles = $False

}

#EndRegion VARIABLES

#Region SCRIPT

# Load .NET assembly

[void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration");

# Connect to WSUS Server

$wsusParent = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer($WSUSServer,$useSecureConnection,$portNumber);

# Log the date first

"Microsoft SUS Server CleanUp" | out-file -filepath $LogFile -append -noClobber;

$date = date

$info = "Start Date / Time: " + $date

$info | out-file -filepath $LogFile -append -noClobber;

# Log the SUS Server Name

$info = "Microsoft SUS Server Name: " + $WSUSServer

$info | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

# Log Current Free DiskSpace

$diskbefore = ([wmi]$WMIDiskSpaceRequest)

"Free disk space before cleanup:" | out-file -filepath $LogFile -append -noClobber;

"Drive " + $SUSDrive + ": has {0:#.0} GB free of {1:#.0} GB Total" -f ($diskbefore.FreeSpace/1GB),($diskbefore.Size/1GB) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

# Perform Cleanup

"Microsoft SUS Server CleanUp Results" | out-file -filepath $LogFile -append -noClobber;

"====================================" | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

$CleanupManager = $wsusParent.GetCleanupManager();

"CleanUp: supersededUpdates = " + $supersededUpdates | out-file -filepath $LogFile -append -noClobber;

"----------------------------------" | out-file -filepath $LogFile -append -noClobber;

date | out-file -filepath $LogFile -append -noClobber;

$CleanupScope_supersededUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($supersededUpdates,$False,$False,$False,$False,$False);

$CleanupManager.PerformCleanup($CleanupScope_supersededUpdates) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: expiredUpdates = " + $expiredUpdates | out-file -filepath $LogFile -append -noClobber;

"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;

date | out-file -filepath $LogFile -append -noClobber;

$CleanupScope_expiredUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$expiredUpdates,$False,$False,$False,$False);

$CleanupManager.PerformCleanup($CleanupScope_expiredUpdates) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: obsoleteUpdates = " + $obsoleteUpdates | out-file -filepath $LogFile -append -noClobber;

"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;

date | out-file -filepath $LogFile -append -noClobber;

$CleanupScope_obsoleteUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$obsoleteUpdates,$False,$False,$False);

$CleanupManager.PerformCleanup($CleanupScope_obsoleteUpdates) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: compressUpdates = " + $compressUpdates | out-file -filepath $LogFile -append -noClobber;

"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;

date | out-file -filepath $LogFile -append -noClobber;

$CleanupScope_compressUpdates = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$False,$compressUpdates,$False,$False);

$CleanupManager.PerformCleanup($CleanupScope_compressUpdates) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: obsoleteComputers = " + $obsoleteComputers | out-file -filepath $LogFile -append -noClobber;

"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;

date | out-file -filepath $LogFile -append -noClobber;

$CleanupScope_obsoleteComputers = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$False,$False,$obsoleteComputers,$False);

$CleanupManager.PerformCleanup($CleanupScope_obsoleteComputers) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

"CleanUp: unneededContentFiles = " + $unneededContentFiles | out-file -filepath $LogFile -append -noClobber;

"---------------------------------------" | out-file -filepath $LogFile -append -noClobber;

date | out-file -filepath $LogFile -append -noClobber;

$CleanupScope_unneededContentFiles = New-Object Microsoft.UpdateServices.Administration.CleanupScope($False,$False,$False,$False,$False,$unneededContentFiles);

$CleanupManager.PerformCleanup($CleanupScope_unneededContentFiles) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

# Log Current Free DiskSpace

$diskafter = ([wmi]$WMIDiskSpaceRequest)

"Free disk space after cleanup:" | out-file -filepath $LogFile -append -noClobber;

"Drive " + $SUSDrive + ": has {0:#.0} GB free of {1:#.0} GB Total" -f ($diskafter.FreeSpace/1GB),($diskafter.Size/1GB) | out-file -filepath $LogFile -append -noClobber;

"" | out-file -filepath $LogFile -append -noClobber;

# Log the date after

$date = date

$info = "End Date / Time: " + $date

$info | out-file -filepath $LogFile -append -noClobber;

#EndRegion SCRIPT

# Source: http://gallery.technet.microsoft.com/scriptcenter/90ca6976-d441-4a10-89b0-30a7103d55db#content

# Mail the report...

$message = new-object Net.Mail.MailMessage

$mailer = new-object Net.Mail.SmtpClient($SMTPServer)

$message.From = $MailFrom #"Sender <Sender@Domain.TLD>"

$message.To.Add($MailTo) #("Recipient <Recipient@Domain.TLD>")

$MeinText = "WSUS - Server CleanUp Report " + $WSUSServer

$message.Subject = $MeinText

$message.Body = [string]::join([environment]::NewLine, (get-content $logfile))

$mailer.Send($message)

#Delete Log => will happen at the next run

#Remove-Item $LogFile

June 26, 2018 by Florian Rossmark scripts server solutions

Solarwinds Web Helpdesk – Slack alerts

This was originally posted here by myself: https://thwack.solarwinds.com/thread/114863

Solarwinds WebHelpDesk is very powerful, but for those who use Slack as communication and alerting platform, there still is no integration.

We as a IT team struggled a bit keeping up with the immense flow of emails and filtering them out as well as being really pro-active on new tickets (first response time) as well as realizing we got new tickets assigned or a user / client wrote a new note.

To overcome those challenges and due to the fact that we all have Slack on all our systems from workstation to smartphone, we decided to integrate this. Since I spend a bit of time on those scripts and thought they might be helpful for others as well, I am sharing them here now and explain on how to implement this.

Please note: Those scripts are a version 1 – I am very aware that they could be further cleaned up and simplified.. but I wanted to share them already… bugs are possible as well…

Requirements:

You need Solarwinds WebHelpDesk
The scripts use the field “Pager” in “Techs” for the Slack-Username – put all the Slack-Usernames of your Techs in this field – no @ – just the name
The scripts assumes you are executing it directly on the server that has the PostgreSQL database installed
The scripts assumes the database user/pw is defaulted to WHD

How to implement them:

Create the 5x files as show further below in e.g. “C:\Scripts\WHD” on the PostresSQL server
Create a new Windows Task that starts the WebHelpDesk_SlackAlerts.cmd file every 30 minutes
- this file actually executes the PowerShell Scripts – it is just a work-around – it bypasses any PowerShell Script execution restritions
download the PostgesSQL ODBC drivers from the following link – assuming you haven’t installed them on the system already
- PostgreSQL: File Browser
- Text link: https://www.postgresql.org/ftp/odbc/versions/msi/
Edit the PRTGSlackWebHookNotificationPSv2.ps1
- This file was originally from our PRTG installation and modified there already. It was further modified for WHD alerts – I do not claim to have invented this script nor do I want to abuse any copyrights on it! source: www.paessler.com for monitoring solutions
- Line 41: adjust the URL for the FavIcon.ico to your external WebHelpDesk URL
Create a new WebHook-Application in your Slack Account
- Incoming Webhooks | Slack
- Text link: https://api.slack.com/incoming-webhooks
- You will need the WebHook URL for the scripts now
Edit the CheckNewTicketsFirstResponse.ps1
- This script posts to a generic channel in our case – we want to see new tickets as a group – assuming assigned tech is currently unavailable and couldn’t touch it…
- adjust the PostgresSQL settings – if needed – IP / Port / User etc…
- Line 7 – ticket_age_minutes = 88
  - this is a minute value – we alert on a Slack-Group “helpdesk” if there is a ticket older than 88 minutes – we fire the script every 30 minutes, so it could be up to two hours old..
- Line 9 – $channel – adjust this to the Slack-Group channel you want to use for those alerts
- Line 77 – adjust the URL to your external WebHelpdesk URL
- Line 99 – adjust the Link to your own WebHook URL
Edit the CheckTicketAssigned.ps1
- This will send the message to the Tech directly through the SlackBot channel – only he will see it
- This will only fire if the Tech did not yet put a Tech-Note in the ticket after it was assigned to him
- adjust the PostgresSQL settings – if needed – IP / Port / User etc…
- Line 7 – entry_age_minutes = 32
  - this is a minute value – we run the scripts every 30 minutes – the alert due to some variable time can not be older than 32 minutes by default…
- Line 74 – adjust the URL to your external WebHelpdesk URL
- Line 97 – adjust the Link to your own WebHook URL
Edit the CheckTicketNewClientNote.ps1
- This will send the message to the Tech directly through the SlackBot channel – only he will see it
- This will only fire if the Tech did not yet put a Tech-Note in the ticket after the client / user did leave a comment or note
- adjust the PostgresSQL settings – if needed – IP / Port / User etc…
- Line 7 – entry_age_minutes = 32
  - this is a minute value – we run the scripts every 30 minutes – the alert due to some variable time can not be older than 32 minutes by default…
- Line 74 – adjust the URL to your external WebHelpdesk URL
- Line 97 – adjust the Link to your own WebHook URL

After that you should be all set.

We have further integration in to PRTG while monitoring the database for “new tickets older than 120 minutes” and looking for the logfile “SlackLogErrorDetails.txt” indicating that a Slack notification did not go through by the script – most likely due to special characters that the scripts already should take care off, but in case it happens again this file would appear. You can integrate that as well with your monitoring system, but this is beyond the scope of the simple notifications.

Other logfiles show just what was send out and indicate that everything is working well.

Click here to download the scripts archive WebHelpdeskSlackFiles.zip

June 1, 2018 by Florian Rossmark scripts solutions

Monitoring Shadow-Copies with PRTG

This was originally posted here by myself: https://kb.paessler.com/en/topic/65026-monitor-shadow-copies-age#reply-247626

This is my solution for it – we monitor specific drives we enabled for shadow copy and wanted to see amount of shadows, newest should be within x hours and oldest should be at a minimum n hours – those limits can be configured with the limitations rather easily.

Main issue is – we talk about WMI modules that are only available in x64 if you use a x64 system. Now PRTG is executing sensors in x86, even thought it is installed on x64. Now, played around a while and came up with this simple solution.

Parameters for the parser-script (the one you need to execute) are: %host C: %host D: etc.

Parser script, needs to be in EXEXML directory: Name: Get-ShadowCopyStatsXMLx64parser.cmd

@"%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -c "&'C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\Get-ShadowCopyStatsXML.ps1' -Servername %1 -Driveletter %2"

1	@"%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -c "&'C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\Get-ShadowCopyStatsXML.ps1' -Servername %1 -Driveletter %2"

PS1 script, should to be in EXEXML directory – if not, adjust path in parser script: Name: Get-ShadowCopyStatsXML.ps1

Param(
	$ServerName,
    $DriveLetter
)
Begin
{	$script:CurrentErrorActionPreference = $ErrorActionPreference
    $ShadowCopyStats = @()

	Function GetShadowCopyStats
	{	Param($Computer)

try
{
        Import-Module @("Microsoft.PowerShell.Management","PSDiagnostics")
		$WMITarget = "$Computer"
		Get-WmiObject -Class "Win32_ComputerSystem" -Property "Name" -ComputerName $WMITarget | out-null
		If ($? -eq $False)
		{	$bWMIConnection = $False
			$WMITarget = "$Computer."
			Get-WmiObject -Class "Win32_ComputerSystem" -Property "Name" -ComputerName $WMITarget | out-null
			If($? -eq $False){$bWMIConnection = $False}Else{$bWMIConnection = $True}
		}

            $xml = '<prtg>'
                $Volumes = gwmi Win32_Volume -Property SystemName,DriveLetter,DeviceID -Filter "DriveType=3" -ComputerName $WMITarget |
			        Select SystemName,@{n="DriveLetter";e={$_.DriveLetter.ToUpper()}},DeviceID | Sort DriveLetter

                $ShadowCopies = gwmi Win32_ShadowCopy -Property VolumeName,InstallDate,Count -ComputerName $WMITarget |
				        Select VolumeName,InstallDate,Count,
				        @{n="CreationDate";e={$_.ConvertToDateTime($_.InstallDate)}}

} 
catch [Exception]
{
    #Write-Warning $_.Exception|format-list -force
$Error[0].Exception.StackTrace
$Error[0].Exception.InnerException.StackTrace
$Error[0].StackTrace
write-error "hello"
}

		        If($Volumes)
		        {
                    ForEach($Volume in $Volumes)
		            {
                        If($Volume.DriveLetter -eq $DriveLetter) {

                    
				            $VolumeShares = $VolumeShadowStorage = $DiffVolume = $VolumeShadowCopies = $Null
				            $VolumeShadowCopies = $ShadowCopies | ?{$_.VolumeName -eq $Volume.DeviceID} | Sort InstallDate

				            If($VolumeShadowCopies)
				            {
                                $xml += '<result><channel>ShadowCopyCount</channel><value>' + (($VolumeShadowCopies | Measure-Object -Property Count -Sum).Sum) + '</value></result>'
                                
                                $AgeOldest = New-TimeSpan -Start (($VolumeShadowCopies | Select -First 1).CreationDate) -End (Get-Date) 
                                $AgeLatest = New-TimeSpan -Start (($VolumeShadowCopies | Select -Last 1).CreationDate) -End (Get-Date) 
                        
                                $xml += '<result><channel>OldestShadowCopy</channel><value>' + [math]::Round($AgeOldest.TotalHours,0) + '</value><unit>TimeHours</unit></result>'
                                $xml += '<result><channel>LatestShadowCopy</channel><value>' + [math]::Round($AgeLatest.TotalHours,0) + '</value><unit>TimeHours</unit></result>'
				            }Else{
                                $xml += '<result><channel>ShadowCopyCount</channel><value>0</value></result>'
                                $xml += '<result><channel>OldestShadowCopy</channel><value>0</value><unit>TimeHours</unit></result>'
                                $xml += '<result><channel>LatestShadowCopy</channel><value>0</value><unit>TimeHours</unit></result>'
                            }
				            If($VolumeShadowStorage -Or $ShowAllVolumes){$Output += $Object}
                        }
		            }
                }
            $xml += '</prtg>'
            WriteXmlToScreen $xml
        
	}


    Function WriteXmlToScreen ([xml]$xml)
    {
        $StringWriter = New-Object System.IO.StringWriter;
        $XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;
        $XmlWriter.Formatting = "indented";
        $xml.WriteTo($XmlWriter);
        $XmlWriter.Flush();
        $StringWriter.Flush();
        Write-Output $StringWriter.ToString();
    }
}
Process
{	If($ServerName)
	{ForEach($Server in $ServerName){$ShadowCopyStats += GetShadowCopyStats $Server}}
	Else
	{$ShadowCopyStats += GetShadowCopyStats $_}
}
End
{	$ErrorActionPreference = $script:CurrentErrorActionPreference
	$ShadowCopyStats
}

Param(

$ServerName,

$DriveLetter

)

Begin

{ $script:CurrentErrorActionPreference = $ErrorActionPreference

$ShadowCopyStats = @()

Function GetShadowCopyStats

{ Param($Computer)

try

{

Import-Module @("Microsoft.PowerShell.Management","PSDiagnostics")

$WMITarget = "$Computer"

Get-WmiObject -Class "Win32_ComputerSystem" -Property "Name" -ComputerName $WMITarget | out-null

If ($? -eq $False)

{ $bWMIConnection = $False

$WMITarget = "$Computer."

Get-WmiObject -Class "Win32_ComputerSystem" -Property "Name" -ComputerName $WMITarget | out-null

If($? -eq $False){$bWMIConnection = $False}Else{$bWMIConnection = $True}

}

$xml = '<prtg>'

$Volumes = gwmi Win32_Volume -Property SystemName,DriveLetter,DeviceID -Filter "DriveType=3" -ComputerName $WMITarget |

Select SystemName,@{n="DriveLetter";e={$_.DriveLetter.ToUpper()}},DeviceID | Sort DriveLetter

$ShadowCopies = gwmi Win32_ShadowCopy -Property VolumeName,InstallDate,Count -ComputerName $WMITarget |

Select VolumeName,InstallDate,Count,

@{n="CreationDate";e={$_.ConvertToDateTime($_.InstallDate)}}

}

catch [Exception]

{

#Write-Warning $_.Exception|format-list -force

$Error[0].Exception.StackTrace

$Error[0].Exception.InnerException.StackTrace

$Error[0].StackTrace

write-error "hello"

}

If($Volumes)

{

ForEach($Volume in $Volumes)

{

If($Volume.DriveLetter -eq $DriveLetter) {

$VolumeShares = $VolumeShadowStorage = $DiffVolume = $VolumeShadowCopies = $Null

$VolumeShadowCopies = $ShadowCopies | ?{$_.VolumeName -eq $Volume.DeviceID} | Sort InstallDate

If($VolumeShadowCopies)

{

$xml += '<result><channel>ShadowCopyCount</channel><value>' + (($VolumeShadowCopies | Measure-Object -Property Count -Sum).Sum) + '</value></result>'

$AgeOldest = New-TimeSpan -Start (($VolumeShadowCopies | Select -First 1).CreationDate) -End (Get-Date)

$AgeLatest = New-TimeSpan -Start (($VolumeShadowCopies | Select -Last 1).CreationDate) -End (Get-Date)

$xml += '<result><channel>OldestShadowCopy</channel><value>' + [math]::Round($AgeOldest.TotalHours,0) + '</value><unit>TimeHours</unit></result>'

$xml += '<result><channel>LatestShadowCopy</channel><value>' + [math]::Round($AgeLatest.TotalHours,0) + '</value><unit>TimeHours</unit></result>'

}Else{

$xml += '<result><channel>ShadowCopyCount</channel><value>0</value></result>'

$xml += '<result><channel>OldestShadowCopy</channel><value>0</value><unit>TimeHours</unit></result>'

$xml += '<result><channel>LatestShadowCopy</channel><value>0</value><unit>TimeHours</unit></result>'

}

If($VolumeShadowStorage -Or $ShowAllVolumes){$Output += $Object}

}

$xml += '</prtg>'

WriteXmlToScreen $xml

}

Function WriteXmlToScreen ([xml]$xml)

{

$StringWriter = New-Object System.IO.StringWriter;

$XmlWriter = New-Object System.Xml.XmlTextWriter $StringWriter;

$XmlWriter.Formatting = "indented";

$xml.WriteTo($XmlWriter);

$XmlWriter.Flush();

$StringWriter.Flush();

Write-Output $StringWriter.ToString();

}

Process

{ If($ServerName)

{ForEach($Server in $ServerName){$ShadowCopyStats += GetShadowCopyStats $Server}}

Else

{$ShadowCopyStats += GetShadowCopyStats $_}

}

End

{ $ErrorActionPreference = $script:CurrentErrorActionPreference

$ShadowCopyStats

}

PS: yes, the PS1 could be further optimized, but it took me already a while to find out the main issue was the x86/x64 combination, what is not possible – see Microsoft articles in MSDN/KB for more information while the Shadow-Copy WMI modules are only available in x64 on a x64 system.

Hope this helps others with the same challenge 🙂

June 1, 2018 by Florian Rossmark monitoring prtg scripts server

Advanced PRTG Slack notifitications

This PRTG slack notification script was originally posted by myself here: https://kb.paessler.com/en/topic/66113-how-can-prtg-send-notifications-to-slack#reply-249147

This is our version of the script originally provided with PRTG by Paessler. – we are using the #colorstatus as well to determine to current issue and we are using actually icons to show the status – this is working pretty well for us. Besides that, reformatted the whole notification a bit so it is easier to read in the prtg slack notification messages.

It is easy to adjust and even use additional statuses/color-codes if needed..

# ----------------------------------------------------------------------------------------------
# Copyright (c) WCOM AB 2016.
# ----------------------------------------------------------------------------------------------
# This source code is subject to terms and conditions of the The MIT License (MIT)
# copy of the license can be found in the LICENSE file at the root of this distribution.
# ----------------------------------------------------------------------------------------------
# You must not remove this notice, or any other, from this software.
# ----------------------------------------------------------------------------------------------
Param(
    [string]$SlackWebHook,
    [string]$SlackChannel,
    [string]$SiteName,
    [string]$Device,
    [string]$Name,
    [string]$Status,
    [string]$Down,
    [string]$DateTime,
    [string]$LinkDevice,
    [string]$Message,
    [string]$Color
)
string $StatusIcon
string $SlackTextFormatting

Switch ($Color)
{
    '#b4cc38'
    {
        #UP
        $StatusIcon = ':white_check_mark:'
        $SlackTextFormatting = '*'
    }
    '#d71920'
    {
        #DOWN
        $StatusIcon = ':name_badge:'
        $SlackTextFormatting = '`'
    }
    '#ffcb05'
    {
        #WARNING
        $StatusIcon = ':radioactive_sign:'
        $SlackTextFormatting = '`'
    }
    '#447fc1'
    {
        #PAUSE
        $StatusIcon = ':double_vertical_bar:'
        $SlackTextFormatting = '~'
    }
    default 
    {
        $StatusIcon = ':interrobang:'
    }
}


Add-Type -AssemblyName System.Web.Extensions
function ConvertTo-Json ([Object] $value)
{
    [System.Web.Script.Serialization.JavaScriptSerializer] $jsSerializer = New-Object 'System.Web.Script.Serialization.JavaScriptSerializer'
    $jsSerializer.Serialize($value)
}

$postSlackMessage = ConvertTo-Json(@{
    channel      = $SlackChannel;
    unfurl_links = "true";
    username     = "PRTG";
    icon_url     = "https://www.paessler.com/common/files/banner/banner_3s_80x80.png"
    text         = "$($StatusIcon) <$($LinkDevice)|$($Device) $SlackTextFormatting$($Name)$SlackTextFormatting> 
>Status *$($Status) $($Down)* on $($DateTime) 
``````$($Message)``````";
    })

$postSlackMessage | Out-File -FilePath slack.log

[System.Net.WebClient] $webclient = New-Object 'System.Net.WebClient'
$webclient.UploadData($SlackWebHook, [System.Text.Encoding]::UTF8.GetBytes($postSlackMessag

# ----------------------------------------------------------------------------------------------

# This source code is subject to terms and conditions of the The MIT License (MIT)

# copy of the license can be found in the LICENSE file at the root of this distribution.

# ----------------------------------------------------------------------------------------------

# You must not remove this notice, or any other, from this software.

# ----------------------------------------------------------------------------------------------

Param(

[string]$SlackWebHook,

[string]$SlackChannel,

[string]$SiteName,

[string]$Device,

[string]$Name,

[string]$Status,

[string]$Down,

[string]$DateTime,

[string]$LinkDevice,

[string]$Message,

[string]$Color

)

string $StatusIcon

string $SlackTextFormatting

Switch ($Color)

{

'#b4cc38'

{

#UP

$StatusIcon = ':white_check_mark:'

$SlackTextFormatting = '*'

}

'#d71920'

{

#DOWN

$StatusIcon = ':name_badge:'

$SlackTextFormatting = '`'

}

'#ffcb05'

{

#WARNING

$StatusIcon = ':radioactive_sign:'

$SlackTextFormatting = '`'

}

'#447fc1'

{

#PAUSE

$StatusIcon = ':double_vertical_bar:'

$SlackTextFormatting = '~'

}

default

{

$StatusIcon = ':interrobang:'

}

Add-Type -AssemblyName System.Web.Extensions

function ConvertTo-Json ([Object] $value)

{

[System.Web.Script.Serialization.JavaScriptSerializer] $jsSerializer = New-Object 'System.Web.Script.Serialization.JavaScriptSerializer'

$jsSerializer.Serialize($value)

}

$postSlackMessage = ConvertTo-Json(@{

channel = $SlackChannel;

unfurl_links = "true";

username = "PRTG";

icon_url = "https://www.paessler.com/common/files/banner/banner_3s_80x80.png"

text = "$($StatusIcon) <$($LinkDevice)|$($Device) $SlackTextFormatting$($Name)$SlackTextFormatting>

>Status *$($Status) $($Down)* on $($DateTime)

``````$($Message)``````";

})

$postSlackMessage | Out-File -FilePath slack.log

[System.Net.WebClient] $webclient = New-Object 'System.Net.WebClient'

$webclient.UploadData($SlackWebHook, [System.Text.Encoding]::UTF8.GetBytes($postSlackMessag

June 1, 2018 by Florian Rossmark monitoring prtg scripts

Using PowerShell for Text-to-Speech

PowerShell can be used for TTS / Text-to-Speech. In this specific example, PowerShell will be used for Paessler/PRTG (www.paessler.com) text-to-speech notifications. It will actually run against a remote-system in this scenario in a central NOC/Network Operations Center room and announce down sensors/systems. This was originally posted by myself on https://kb.paessler.com/en/topic/79674-can-we-have-the-ability-to-set-audio-notifications-when-sensors-go-down-up.

You simply create the script in the path C:\Program Files (x86)\PRTG Network Monitor\Notifications\EXE and create a new notification for it.

The parameters should be configured like this:

-TargetComputer ‘COMPUTER123’ -Device ‘%device’ -Name ‘%name’ -Status ‘%status’ -Message ‘%message’

Replace the COMPUTER123 with what ever client should play the sound – in our case this is the workstation that shows the MAPs on a TV and the sound actually comes out of the TV.

You might need to enable remote power shell execution on the target system, a hint for this is the following command: Enable-PSRemoting -Force

Here is the script file: Name: PRTGtoWorkstationText2Speach.ps1

#By Florian Rossmark
Param(
	[string]$TargetComputer,
    [string]$Device,
    [string]$Name,
    [string]$Status,
    [string]$Message
)
$TextMessage = "$($Device) $($Name) is $($Status) $($Message)"
Invoke-Command -ComputerName $TargetComputer -ScriptBlock {
	$TextMessage = $args[0]
	Add-Type -AssemblyName System.speech
	$speak = New-Object System.Speech.Synthesis.SpeechSynthesizer
	$speak.Rate = -2
	$speak.Speak($TextMessage)
} -ArgumentList $TextMessage

#By Florian Rossmark

Param(

[string]$TargetComputer,

[string]$Device,

[string]$Name,

[string]$Status,

[string]$Message

)

$TextMessage = "$($Device) $($Name) is $($Status) $($Message)"

Invoke-Command -ComputerName $TargetComputer -ScriptBlock {

$TextMessage = $args[0]

Add-Type -AssemblyName System.speech

$speak = New-Object System.Speech.Synthesis.SpeechSynthesizer

$speak.Rate = -2

$speak.Speak($TextMessage)

} -ArgumentList $TextMessage

June 1, 2018 by Florian Rossmark monitoring prtg scripts solutions windows

powershell

Secured WinRM SSL session and PowerShell WinRM queries – example with a PRTG sensor for CPU, HDD and RAM

PRTG 911 call alerts – ShoreTel

PowerShell – custom tables or objects

Read the UEFI stored Windows key and activate Windows

Updated domain join script including KeePass / Pleasant Password server entries for local admins

Gathering profile information from computer

Monitor user accounts in Active Directory with PRTG

Prevent ScreenSaver coming up with a PowerShell script

Automate your SUS clean up

Solarwinds Web Helpdesk – Slack alerts

Monitoring Shadow-Copies with PRTG

Advanced PRTG Slack notifitications

Using PowerShell for Text-to-Speech

Recent blog posts

Blog Archives

powershell

Recent blog posts

Blog Archives

Tags