Monthly archives for May, 2012

Powershell Code: Discover a Local Global Catalog for Forest Queries

May30
2012 Leave a Comment

Written by Sean Metcalf

Sometimes it is necessary to query a Global Catalog (port 3268) for forest-wide data (such as checking for a ServicePrincipalName). Finding a local online GC is the best method for this. The script method prefers 2008 DCs.

Here’s the code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

Import-Module ActiveDirectory
IF ($TargetGC)
{ ## OPEN IF TargetGC has a value
$GCInfo = Get-ADDomainController $TargetGC
IF ($GCInfo.OperatingSystemVersion -lt 6.0)
{ ## OPEN IF TargetGC is not running Windows 2008 or higher
$LocalSite = (Get-ADDomainController -Discover).Site
$NewTargetGC = Get-ADDomainController -Discover -Service 6 -SiteName $LocalSite
IF (!$NewTargetGC)
{ $NewTargetGC = Get-ADDomainController -Discover -Service 6 -NextClosestSite }
$LocalGC = $NewTargetGC.HostName + ":3268"
} ## CLOSE IF TargetGC is not running Windows 2008 or higher

ELSE { $LocalGC = $GCInfo.HostName + ":3268" }
} ## CLOSE IF TargetGC has a value

ELSE
{ ## OPEN ELSE TargetGC is not set
Write-Output "Discover Local GC running ADWS `r "
$LocalSite = (Get-ADDomainController -Discover).Site
$NewTargetGC = Get-ADDomainController -Discover -Service 6 -SiteName $LocalSite
IF (!$NewTargetGC)
{ $NewTargetGC = Get-ADDomainController -Discover -Service 6 -NextClosestSite }
$LocalGC = $NewTargetGC.HostName + ":3268"
} ## CLOSE ELSE TargetGC is not set

Posted in Microsoft Products, Powershell Code, Tech - Tagged Active Directory, Code, Domain Controller, FindLocalGC, GlobalCatalog Query, Powershell

Powershell Code: Discover local DC running ADWS

May23
2012 Leave a Comment

Written by Sean Metcalf

Often it is necessary to use the same DC to perform updates or errors will occur.
Here’s a way to do this which provides connection testing (is the DC online) that you don’t get with Get-ADDomainController.

This method finds a local DC running ADWS (Active Directory Powershell Web Service that runs on a DC) first, then checks a nearby site, then rolls through all the DCs (operating as GCs) until one is found.

Here’s the code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

import-module activedirectory
Write-Output "Discovering local DC running Powershell ADWS `r "
$TargetDC = (Get-ADDomainController -Discover -ForceDiscover -Service 6 ).HostName
TRY { $DCCheck = Test-Path "\\$TargetDC\SYSVOL" }
CATCH { Write-Output "Unable to connect to $TargetDC - Discovering a new DC `r " ; $DCCheck = $False }

IF ($DCCheck -eq $False)
{ ## OPEN IF TargetGC is not set
Write-Output "Discover DC running ADWS `r "
$LocalSite = (Get-ADDomainController -Discover).Site
$LocalDCs = Get-ADDomainController -Filter { (Site -eq $LocalSite) }
ForEach ($DC.HostName in $LocalDCs)
{ ## OPEN ForEach DCHostName in LocalDCs
$DCHostName = $DC.HostName
$DCCheck = Test-Path "\\$DCHostName\SYSVOL"
IF ($DCCheck -eq $True) { $TargetDC = $DCHostName ; break }
} ## CLOSE ForEach DCHostName in LocalDCs
} ## CLOSE IF TargetGC is not set

IF (!$TargetDC)
{ ## OPEN IF TargetGC is not set
Write-Output "Discover DC running ADWS `r "
$AllDCs = Get-ADDomainController -Filter { IsGlobalCatalog -eq $True }
ForEach ($DC.HostName in $AllDCs)
{ ## OPEN ForEach DCHostName in LocalDCs
$DCHostName = $DC.HostName
$DCCheck = Test-Path "\\$DCHostName\SYSVOL"
IF ($DCCheck -eq $True) { $TargetDC = $DCHostName ; break }
} ## CLOSE ForEach DCHostName in LocalDCs
} ## CLOSE IF TargetGC is not set

Write-Output "Setting DC target to $TargetDC `r "

Posted in Microsoft Products, Powershell Code, Tech - Tagged Active Directory, ADWS, Code, discoverDC, Domain Controller, Powershell

Powershell Code: Fix Journal Wrap

May16
2012 Leave a Comment

Written by Sean Metcalf

One of my customers has an issue with DCs in far flung locations impacted by older hardware and power instability. For this (and other reasons) there are many, many Journal Wrap issues.

Here’s a script that will fix a local DC’s Journal Wrap issue by performing a D2 (nonauthoritative restore).

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

Param
(
[switch] $Fix
)

Import-Module activedirectory

$Today = Get-Date -uformat "%m/%d/%y"

###############
# Get DC Info #
###############
$DCInfo = Get-ADDOmainController -Identity $DCName
$DCHostName = $DCInfo.HostName
$DCOS = $DCInfo.OperatingSystem

##########################
# Check for Journal Wrap #
##########################
##
Write-Output "Restarting NTFRS Service to verify that the DC is in Journal Wrap `r "
Restart-Service "NTFRS"

##
Write-Output "Check the FRS event log for Journal Wrap events on $DCHostName... `r"
IF ($DCOS -like "*2008*")
{ ## OPEN IF DC OS is 2008 or newer, use Get-WinEvent
$DCEvents = Get-WinEvent -LogName "File Replication Service" -MaxEvents 25
$DCFRSEvents = $DCEvents | Select-Object TimeCreated,ID,ProviderName,Message | Where { $_.TimeCreated -like "*$Today*" }
} ## CLOSE IF DC OS is 2008 or newer, use Get-WinEvent
ELSE
{ ## OPEN ELSE DC OS is not 2008 or newer, use Get-EventLog
$DCEvents = Get-EventLog -LogName "File Replication Service" -after (get-date).AddHours(-1)
$DCFRSEvents = $DCEvents | Select-Object TimeGenerated,EventID,Source,Message | Where { $_.TimeCreated -like "*$Today*" }
} ## CLOSE ELSE DC OS is not 2008 or newer, use Get-EventLog

[switch]$DCJournalWrap = $False
ForEach ($Event in $DCFRSEvents)
{ ## OPEN ForEach Event in DCFRSEvents
IF ($Event.ID -eq "13568")
{ ## OPEN IF Event.ID = "13568" aka "Journal Wrap"
$Event13568 = $True
$EventDateTime = $Event.TimeCreated
$EventID = $Event.ID
[array]$JournalWrapEvents += $EventDateTime
$DCJournalWrap = $True
Write-Host "$DCHostName has logged a Journal Wrap in the event log. `r " -fore Red
} ## CLOSE IF Event.ID = "13568" aka "Journal Wrap"

IF ($Event.EventID -eq "13568")
{ ## OPEN IF Event.EventID = "13568" aka "Journal Wrap"
$Event13568 = $True
$EventDateTime = $Event.TimeGenerated
$EventID = $Event.EventID
[array]$JournalWrapEvents += $EventDateTime
$DCJournalWrap = $True
Write-Host "$DCHostName has logged a Journal Wrap in the event log. `r " -fore Red
} ## CLOSE IF Event.EventID = "13568" aka "Journal Wrap"
} ## CLOSE ForEach Event in DCFRSEvents

IF ( ($DCInJournalWrap -eq $True) -AND ($Fix -eq $True) )
{ ## OPEN IF $DCInJournalWrap = $True AND $Fix = $True
###################################
# Perform Journal Wrap Resolution #
###################################
##
Write-Output "Discovered the DC is currently in Journal Wrap. Performing Resolution Steps... `r "

Write-Output "Stopping the NTFRS service `r "
Stop-Service "NTFRS"

Write-Output "Setting the NTFRS BurFlags to D2 (nonauthoritative restore) on $DCHostName `r "
$key = "System\CurrentControlSet\Services\NTFRS\Parameters\Backup/Restore\Process at Startup"
$valuename = "BurFlags"
$reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $DCHostName)
$regkey = $Reg.opensubkey($key,$true)
$RegKeyValue = $regkey.getvalue($valuename)
$regkey.SetValue("BurFlags","D2")

Write-Output "Stopping the NTFRS service `r "
Start-Service "NTFRS"

##
Write-Output "Waiting for the NTFRS service to start on $DCHostName `r "
Start-Sleep -seconds 30

##
Write-Output "Checking event log for FRS NonAuthoritative Restore `r "
IF ($DCOS -like "*2008*")
{ ## OPEN IF DC OS is 2008 or newer, use Get-WinEvent
$DCEvents = Get-WinEvent -ComputerName $DCHostName -LogName "File Replication Service" -MaxEvents 25
$DCFRSEvents = $DCEvents | Select-Object TimeCreated,ID,ProviderName,Message | Where { $_.TimeCreated -like "*Today*" }
} ## CLOSE IF DC OS is 2008 or newer, use Get-WinEvent
ELSE
{ ## OPEN ELSE DC OS is not 2008 or newer, use Get-EventLog
$DCEvents = Get-EventLog -ComputerName $DCHostName -LogName "File Replication Service" -after (get-date).AddHours(-1)
$DCFRSEvents = $DCEvents | Select-Object TimeGenerated,EventID,Source,Message | Where { $_.TimeCreated -like "*Today*" }
} ## CLOSE ELSE DC OS is not 2008 or newer, use Get-EventLog

[switch]$DCD2Event = $False
ForEach ($Event in $DCFRSEvents)
{ ## OPEN ForEach Event in DCFRSEvents
IF ($Event.ID -eq "13565")
{ $DCD2Event = $True }
IF ($Event.EventID -eq "13565")
{ $DCD2Event = $True }
} ## CLOSE ForEach Event in DCFRSEvents

IF ($DCD2Event -eq $True)
{ Write-Output "The FRS D2 NonAuthoritative Restore was Initiated on $DCHostName and this can take anywhere from 5 minutes up to several hours. You can check in later on the status. `r " }
ELSE { Write-Output "No event was found in the FRS log for the FRS D2 NonAuthoritative Restore. Check this log for event ID #13565 `r " }
##

Posted in Microsoft Products, Powershell Code, Tech - Tagged Active Directory, Code, Domain Controller, Event ID 13565, Event ID 13568, Journal Wrap Fix, Powershell

Powershell Code: Update the Registry on a Remote Computer

May09
2012 Leave a Comment

Written by Sean Metcalf

Sometimes you have to script something instead of using a GPO. In these instances, it can be helpful to update the registry on a remote computer.

The easy way is using Powershell (New-ItemProperty or Set-ItemProperty) on a local box with Powershell 2.0. Modifying the registry on a remote computer is a little more complicated.

Here are some ways I found to do this (with examples):

Windows 2003/2008 (Remote)
(the example is only relevant for 2003 DCs in order to set SiteCostedReferrals)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

[string] $RegistryPath = "System\CurrentControlSet\Services\DFS\Parameters"
[string] $RegistryKeyName = "SiteCostedReferrals"
[string] $RegistryValue = "1"
[string] $RegistryType = "dword"

# DELETE VALUE
Write-output "Connecting to $Computer for registry value removal `r "
$Registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $Computer)
$RegistryKey = $Registry.opensubkey($RegistryPath,$true) ## $True = Write
$RegistryKeyValue = $RegistryKey.getvalue($RegistryKeyName)
Write-output "Attempting to delete $RegistryKeyName on $Computer `r "
$RegistryKey.DeleteValue("$RegistryKeyName")
Write-Output "Removed registry key ($RegistryKeyName) on $Computer `r "

# VALIDATE REG VALUE
Write-output "Connecting to $Computer for registry Check `r "
$Registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $Computer)
$RegistryKey = $Registry.opensubkey($RegistryPath,$False) ## $False = ReadOnly
$RegistryKeyValue = $RegistryKey.getvalue($RegistryKeyName)
IF ($RegistryKeyValue -eq $RegistryValue) { $RegKeyValueSet = $True ; Write-Output "Registry key on $Computer is already set ($RegistryKeyName has a value of $RegistryKeyValue) `r " }

# MODIFY VALUE
Write-output "Connecting to $Computer for registry modification `r "
$Registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $Computer)
$RegistryKey = $Registry.opensubkey($RegistryPath,$true) ## $True = Write
$RegistryKeyValue = $RegistryKey.getvalue($RegistryKeyName)
$RegistryKey.SetValue("$RegistryKeyName","$RegistryValue")

Windows 2008 (Local)
(sometimes you have to delete a key in order to change it)

1
2
3
4

Remove-ItemProperty -Path 'HKLM:System\CurrentControlSet\Services\NTFRS\Parameters\Backup/Restore\Process at Startup'-Name 'BurFlags'
New-ItemProperty -Path 'HKLM:System\CurrentControlSet\Services\NTFRS\Parameters\Backup/Restore\Process at Startup'-Name 'BurFlags' -Value '210' -PropertyType "DWORD"
[string]$BurFlagsKeyValue = (Get-ItemProperty -Path 'HKLM:System\CurrentControlSet\Services\NTFRS\Parameters\Backup/Restore\Process at Startup'-Name 'BurFlags' ).BurFlags
Write-OutPut "Burflags is set to $BurFlagsKeyValue on $DCHostName `r "

Windows 2008 Remote (with Powershell Remoting)

1
2
3
4

Invoke-Command -ComputerName $Computer -ScriptBlock { Remove-ItemProperty -Path 'HKLM:System\CurrentControlSet\Services\NTFRS\Parameters\Backup/Restore\Process at Startup'-Name 'BurFlags' }
Invoke-Command -ComputerName $Computer -ScriptBlock { New-ItemProperty -Path 'HKLM:System\CurrentControlSet\Services\NTFRS\Parameters\Backup/Restore\Process at Startup'-Name 'BurFlags' -Value '210' -PropertyType "DWORD" }
[string]$BurFlagsKeyValue = Invoke-Command -ComputerName $Computer -ScriptBlock ({ Get-ItemProperty -Path 'HKLM:System\CurrentControlSet\Services\NTFRS\Parameters\Backup/Restore\Process at Startup'-Name 'BurFlags' }).BurFlags
Write-OutPut "Burflags is set to $BurFlagsKeyValue on $Computer `r "

Posted in Microsoft Products, Powershell Code, Tech - Tagged Code, Powershell, Remote Registry

Powershell Code: Using Powershell to Hash files

May02
2012 1 Comment

Written by Sean Metcalf

I had a requirement to replace a config file on every workstation and not touch the file if it already exists. I thought about several ways to do this and ultimately ended up deciding to hash my “template” file and hash the existing file, only updating files that didn’t match. The code below is flexible regarding hash type: MD5, SHA1, & SHA256 (on supported OSs).

Here’s the powershell code for getting file hashes:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

Param
(
[string]$HashType,
[string]$TemplateFilePath,
[string]$FilePath

)

Switch ($HashType)
{ ## OPEN Switch HashType
"SHA1" { $HashMethod = New-Object System.Security.Cryptography.SHA1CryptoServiceProvider }
"SHA256" { $HashMethod = New-Object System.Security.Cryptography.SHA256CryptoServiceProvider }
"MD5" { $HashMethod = New-Object System.Security.Cryptography.MD5CryptoServiceProvider }
Default { $HashMethod = New-Object System.Security.Cryptography.MD5CryptoServiceProvider }
} ## CLOSE Switch HashType

Write-output "Perform File Hash using $HashType `r "
IF ($TemplateFileHash) { clear-variable TemplateFileHash }
$File = [System.IO.FileInfo]$TemplateFilePath
$Stream = $null
$HashAlgorithm = new-object $HashMethod
$Stream = $File.OpenRead()
$HashByteArray = $HashAlgorithm.ComputeHash($stream)
$Stream.Close()

ForEach ($Byte in $HashByteArray)
{ $TemplateFileHash += $Byte.ToString("X2") }
Write-output "Template File Hash set to $TemplateFileHash `r "

Write-output "Perform File Hash using $HashType `r "
IF ($FileHash) { Clear-Variable FileHash }
$File = [System.IO.FileInfo]$file
$Stream = $null
$HashAlgorithm = new-object $HashMethod
$Stream = $File.OpenRead()
$HashByteArray = $HashAlgorithm.ComputeHash($stream)
$Stream.Close()

ForEach ($Byte in $HashByteArray)
{ $FileHash += $Byte.ToString("X2") }

IF ( $FileHash -ne $TemplateFileHash)
{ ## OPEN IF FileHash NotEqual to TemplateFileHash
Write-output "The existing file hash ($FileHash) is NOT the same as the Template File Hash ($TemplateFileHash). `r "
$FileHashComparison = $False
} ## CLOSE IF FileHash NotEqual to TemplateFileHash
ELSE
{ ## OPEN ELSE FileHash = TemplateFileHash
$FileHashComparison = $True
Write-output "The existing file hash ($FileHash) is the SAME as the Template File Hash ($TemplateFileHash). `r "
} ## CLOSE ELSE FileHash = TemplateFileHash

Posted in Microsoft Products, Powershell Code, Tech - Tagged Code, File hash, Powershell, Security

Monthly archives for May, 2012

Powershell Code: Discover a Local Global Catalog for Forest Queries

Powershell Code: Discover local DC running ADWS

Powershell Code: Fix Journal Wrap

Powershell Code: Update the Registry on a Remote Computer

Powershell Code: Using Powershell to Hash files

Recent Posts

Categories

Archives

Active Directory

Exchange

Microsoft Blog

Powershell

Security

SharePoint

Virtualization

VMWare

Windows Server

Monthly archives for May, 2012

Powershell Code: Discover a Local Global Catalog for Forest Queries

Powershell Code: Discover local DC running ADWS

Powershell Code: Fix Journal Wrap

Powershell Code: Update the Registry on a Remote Computer

Powershell Code: Using Powershell to Hash files

Recent Posts

Categories

Tags

Archives

Active Directory

Exchange

Microsoft Blog

Powershell

Security

SharePoint

Virtualization

VMWare

Windows Server