≡ Menu

PowerShell: Resolve IP address to name and export to CSV

In this article, we find out how to use PowerShell to read a list of IP addresses from a text file and resolve them to hostnames and then export to a CSV file for further reviewing.

A lot of systems like Windows Event logs, Firewall logs or IIS logs etc will store the connection information with IP addresses. Barely looking at the IP address may not give a good idea of what systems are connecting and resolving them to hostnames is much easier to process the data. The script that we are going to discuss will read a list of IP addresses from a text file, resolves them to hostnames, and finally exports them to CSV file.

We are going to use [System.Net.DNS] DotNet class for this purpose. The GetHostbyAddress() method available in this class will help us in resolving names to IP addresses.

Code

[CmdletBinding()]
param(
    [Parameter(Mandatory=$True)]
    [string[]]$IPAddress,
    [switch]$ExportToCSV
)

$outarr = @()
foreach($IP in $IPAddress) {
    $result = $null
    try {
        $Name = ([System.Net.DNS]::GetHostByAddress($IP)).HostName
        $result = "Success"

    } catch {
        $result = "Failed"
        $Name="NA"
    }

    $outarr += New-Object -TypeName PSObject -Property @{
        IPAddress = $IP
        Name = $Name
        Status = $result
    } | Select-Object IPAddress, Name, Status
}

if($ExportToCSV) {
    $outarr | export-csv -Path "c:\temp\iptoname.csv" -NoTypeInformation
} else {
    $outarr
}

Some of the readers of my blog might ask why to use GetHostbyAddress method when Resolve-DNSName can do the task. It is simple; the .Net method works from most of the windows computers in use today, including Windows XP. Using Resolve-DNSName requires you to run from Windows8/Windows Server 2012 or above computers. However, use Resolve-DNSName where you can, because it is simply the latest and lets you query other types of records too. The .Net method lets you query A, AAA and PTR records only.

Usage

You can use this script by passing list of IP addresses to -IPAddress parameter as shown below. The Name column indicates the name the ip resolved to, and the Status column contains whether name resolution is successful or not.

.\Resolve-IpToName.ps1 -IPAddress 69.163.176.252,98.137.246.8

You can input the list of IPAddress using text file as well.

.\Resolve-IpToName.ps1 -IPAddress (get-content c:\temp\ips.txt)

By default, the script shows the output on the screen. If you want to export them to CSV, use -ExportToCSV switch.

.\Resolve-IpToName.ps1 -IPAddress (get-content c:\temp\ips.txt) -ExportToCsv

Above CSV file gets generated when you use -ExportToCSV switch.

Hope you find this article useful. Please write in the comment section if you are looking for additional functionality. We will try to make it on the best effort basis.

{ 2 comments }

PowerShell: Get random elements from an array

In this post, we will see how to use Get-Random cmdlet to get random elements or items from a list(aka array) in PowerShell. Along with that we will also see other use cases of Get-Random and find out where else we can use it.

This cmdlet is available in previous versions of PowerShell, so there is no specific version requirement for this. For the ease of demonstration, I will use an array of numbers from 1 to 10 and use Get-Random cmdlet to display a random number out of it.

@(1,2,3,4,5,6,7,8,9,10) | Get-Random

In the above example, the list can be anything. I mean it can be a list of strings, numbers or any other items. Look at the below example to understand it better.

$services = Get-Service
$services | Get-Random

This will display a service randomly from the array of service objects. So, it is very clear that the input list can be an array of any kind of object. For the sake of further exploration, I will limit this to numbers only as some of the arguments works with numbers only.

Let us say if you need to get a random number below 100 in your scripts, do you need to generate an array first that contains numbers from 1 to 100 first? No, you don’t need to do that. You can use -Maximum parameter for this purpose.

Get-Random -Maximum 100

You can use -Minimum Parameter to specify if your range doesn’t start from 1. The below command generates a random number between 50 and 100.

Get-Random -Minimum 50 -Maximum 100

What if I am no longer interested in generating a single random number but I need 3 random numbers from the given range. The -Count parameter is very helpful in such scenarios.

1..100 | Get-Random -Count 3

The above command displays 3 random numbers between 1 and 100. However, there is a limitation here. You can not use -Maximum & -Minimum parameters with -Count parameter. I wonder why Microsoft placed such limitation. Anyways, it is the way it is.

So far we have seen several ways you can use Get-Random cmdlet for random numbers generation. Before I conclude, I want to share another tip that helps you to display all elements in array but with their order changed. This is useful if you want to shuffle the items in an array.

1..10 | Get-Random -Count 10

Have you noticed that the number we provided to the Count parameter is the size of the input? It can be size of the input array or more than that.

Hope this article is helpful. Let me know if you have any questions or more innovative ways of using Get-Random cmdlet.

{ 0 comments }

PowerShell: Find my public IP

Every computer requires a public IP address to connect to the internet. Some individuals/organizations buys public IP addresses from their Internet Service Provider(ISP) and some uses ISPs proxy to connect to the internet. In any case, traffic(web) from your computer need to flow through a public IP address in order to communicate with web sites/servers/computers that are in the internet. This article will show a quick PowerShell way of finding this public IP address.

There are many websites like whatismyip.com etc which can give you this information. It can be queried from any programming languages using REST API provided as well. For demonstration, I am using http://ipinfo.io services and I will query it using Invoke-RestMethod (irm in short) cmdlet in PowerShell.

Invoke-RestMethod -Uri "http://ipinfo.io"

And the output will look similar to below.

I have hidden the information intentionally, but when you run this command from PowerShell window on your computer, you should see the IP address and other details. You can access these details individually as well if you like.

#To get IP address only
(Invoke-RestMethod -Uri "http://ipinfo.io").IP

#To get City Name
(Invoke-RestMethod -Uri "http://ipinfo.io").City

#To get Country Name
(Invoke-RestMethod -Uri "http://ipinfo.io").Country

One thing to keep in mind here is, the City & Country information may look incorrect sometimes as it is totally depends on how your internet provider is routing the traffic. Also if your computer is using any VPN to connect to internet, these details will change as well.

Hope this information is useful.

{ 1 comment }

Install DFS or DFS-R Management tools using PowerShell

DFS Management console is used for managing DFS namespaces and DFS-R replication. You can install it in a Windows server or desktop by running below command which will install DFS Management Console & related PowerShell modules.

add-WindowsFeature -Name RSAT-DFS-Mgmt-Con

Above command will install the DFS Management tools on the local computer, you can use the same command with a combination of PowerShell remoting to install on a remote server.

Invoke-Command -ComputerName tiblab.local -ScriptBlock { add-WindowsFeature -Name RSAT-DFS-Mgmt-Con }

Do you have any other scenario to install Windows Feature and not sure how to do it with PowerShell?; post in the comments section. We will do our best to get back.

{ 0 comments }

PowerShell: Simple way to generate random passwords

In this post we will see the simplest way I came across to generate random passwords using PowerShell. There are other methods available with large features set but this one is good enough for most requirements

First let us look at the simplest way. The GeneratePassword method of System.Web.Security.Membership class simplifies the password generation.

Add-Type -AssemblyName System.Web
[System.Web.Security.Membership]::GeneratePassword(8,3)
Generate random password

As you can see from the above screen, these 2 simple lines of code generated a random password of length 8.

The GeneratePassword() method takes 2 arguments. First one is length of password and second one is number of non-alphanumerics you want in the random password. In my example, I have provided 8 as password length and 3 as number of non-alphanumeric characters I need.

You can use this approach to generate as many number of random passwords you want. Look at the below example.

1..10 | % { [System.Web.Security.Membership]::GeneratePassword(8,3) }
Generate multiple random passwords

There are other ways available as well. I am sharing some of the links that I came across.

  1. https://activedirectoryfaq.com/2017/08/creating-individual-random-passwords/
  2. https://gallery.technet.microsoft.com/scriptcenter/Password-Generator-using-0f99f008
  3. https://4sysops.com/archives/generate-complex-passwords-with-powershell/
  4. https://gist.github.com/indented-automation/2093bd088d59b362ec2a5b81a14ba84e

Hope this article helps. Let me know if you come across any easy and better way.

{ 2 comments }

Information in this article helps you to query a certificates expiry date, issued date, subject, issuer and other details remotely using PowerShell. Another good thing is, you don’t need admin rights to do that.

There are cases where you want to continuously monitor validity of a certificate remotely. For example, you have a bunch of web servers for which you want to monitor the certificate used by Web Service or you have a rest API which is using SSL cert and you want to monitor and alert when it expires. This script will solve such issues. Since this script relies on TCP steam data to validate the certificate details, it doesn’t need administrator rights on remote computer.

NOTE: If you are looking for a script that checks the expiry dates of all certificates in your remote systems cert store, then this script is of no use. The purpose of this script is to get certificate details using using application ports remote(like 443 for HTTPS)

This script requires two arguments,

  1. ComputerName : It can be a single computer name or list of computer names separate by coma.
  2. Port: Port number on which your application listens. For example 443 for HTTPS application. This parameter is optional and defaults to 443 when not specified.
  3. ExportToCSV: This switch parameter helps you export the output to CSV file for your convenience.

Code:

Copy below code to a file and save it as Get-SSLCert.ps1.

[CmdletBinding()]
param(
[parameter(Mandatory=$true)]
[string[]]$ComputerName,
[parameter(Mandatory=$true)]
[int]$Port = 443,
[switch]$ExportToCSV
)

$Outarr = @()
foreach($Computer in $ComputerName) {
Write-Host "Working on retrieving cert for $Computer" -ForegroundColor Green
try {
$tcpsocket = New-Object Net.Sockets.TcpClient($Computer,$Port)
$tcpstream = $tcpsocket.GetStream()
$sslStream = New-Object System.Net.Security.SslStream($tcpstream,$false)
$sslStream.AuthenticateAsClient($computer)
$CertInfo = New-Object system.security.cryptography.x509certificates.x509certificate2($sslStream.RemoteCertificate)
$SubjectName = @{Name="SubjectName";Expression={$_.SubjectName.Name}}
$OutObj = $CertInfo | Select-Object FriendlyName,$SubjectName,HasPrivateKey,EnhancedKeyUsageList,DnsNameList,SerialNumber,
Thumbprint,NotAfter,NotBefore,@{Name='IssuerName';Expression = {$_.IssuerName.Name}}
if($ExportToCSV) {
$Outarr += $OutObj
} else {
$OutObj
}

} catch {
Write-Warning "Unable to get cert details for `"$Computer`". $_"
}
}

if($ExportToCSV) {

$Outarr | Export-Csv c:\certdetails.csv -NoTypeInformation
}

Usage:

Query certificate details of single web server.

.\Get-SSLCert.ps1 -ComputerName google.com -Port 443

Query certificate details of multiple web server

.\Get-SSLCert.ps1 -ComputerName google.com,google1.com,yahoo.com -Port 443

Export cert details to CSV

.\Get-SSLCert.ps1 -ComputerName google.com,google1.com,yahoo.com -Port 443 -ExportToCSV

Query certificate details of another application which uses TLS

.\Get-SSLCert.ps1 -ComputerName myserver.fqd.com -Port 123

Output

Hope this helps.

 

{ 1 comment }

VMware ESX host stores good amount of information about Hardware and it sensor’s values. These values are extremely useful in troubleshooting any peformance/hardware issues. In this article, I will show you how to query these values using PowerCLI.

This function assumes that you already connected to VCenter. You need to provide list of VMhost names as parameter to this script. The script also takes optional -ExportToCSV in case you want to export the data to CSV file for further processing.

Code:

function Get-VMHostSensorsInfo {
[CmdletBinding()]
param(
    [parameter(mandatory=$true)]
    [string[]]$VMHostName,
    [switch]$ExportToCSV
)

    $OutArr = @()
    foreach($VMHost in $VMHostName) {
        Write-Verbose "Fetching data from $VMHost"
        try {
            $VMHostObj = Get-VMHost -Name $VMHost -EA Stop | Get-View
            $sensors = $VMHostObj.Runtime.HealthSystemRuntime.SystemHealthInfo.NumericSensorInfo
            foreach($sensor in $sensors){
                $object = New-Object -TypeName PSObject -Property @{
                    VMHost = $VMHost
                    SensorName = $sensor.Name
                    Status = $sensor.HealthState.Key
                    CurrentReading = $sensor.CurrentReading 
                } | Select-Object VMHost, SensorName, CurrentReading, Status
                $OutArr += $object
            }
         } catch {
            $object = New-Object -TypeName PSObject -Property @{
                VMHost = $VMHost
                SensorName = "NA"
                Status = "FailedToQuery"
                CurrentReading = "FailedToQuery"
            } | Select-Object VMHost, SensorName, CurrentReading, Status
            $OutArr += $object
         }

    }

    if($ExportToCSV) {
        Write-Verbose "Exporting to c:\temp\sensorsinfo.csv"
        $OutArr | export-csv c:\temp\sensorsinfo.csv -NoTypeInformation
    } else {
        return $OutArr
    }
}

Usage:

Using this code is very simple. First open your PowerCLI and connect the VCenter using the credentials that can query the host information. Then copy and paste the above function to the PowerCLI shell and start running commands below as per your needs.

Get Sensors status of single host

Get-VMHostSensorsInfo -VMHostName server1

Get sensors status of multiple hosts

Get-VMHostSensorsInfo -VMHostName server1, server2

Get sensors status of hosts from file

Get-VMHostSensorsInfo -VMHostName (Get-Content c:\temp\servers.txt)

Export sensors status to CSV

Get-VMHostSensorsInfo -VMHostName (Get-Content c:\temp\servers.txt) -ExportToCSV

Hope this helps…

{ 2 comments }

PowerShell: Creating self signed certificate

Let us learn today how to generate a self signed certificate quickly using PowerShell. There are many ways available to do this but using New-SelfSignedCertificate is much easier.

You need to have at least Windows Server 2012/Windows 8 to use this approach. Once the cert is generated you can use it anywhere you want.

First you need to run below command to generate the certificate. Subject name can be anything of your choice. You can use DnsName parameter if you want.


$cert = New-SelfSignedCertificate -Subject "techibee-test-cert"

It creates the cert by default in LocalMachine\MY cert store. If you wish to create in any other store, you can do so.

Now you can export it to a file(PFX format) using Export-PFXCertificate cmdlet. To export the cert, password is mandatory.

$password = ConvertTo-SecureString "mypassword" -AsPlainText -Force

Export-PfxCertificate -Cert $cert -FilePath c:\mycert.pfx -Password $password

The above command will export the cert in PFX format with password protection and it will be placed in c:\ drive with mycert.pfx name. Change FilePath values if you want to store at different location.

Now you can use this cert for your testing etc.

Below is the screenshot of the execution.

Hope it helps.

{ 3 comments }

PowerShell: Verify or test AD account credentials

We prompt for credentials in many of our scripts. Have you ever wondered if the entered credentials is right or wrong? It is always good idea to verify that entered credentials is correct before proceeding with further execution of the script.

The function discussed in this article will provide a easy way to verify if the entered credentials are valid or not. This function uses classes and methods in System.DirectoryServices.AccountManagement name space, especially ValidateCredentials method.

The Test-ADCredential function takes PSCredential argument as input. This is optional one. If you don’t specify it, a prompt will appear for you enter the credentials. That means we can use this function in our scripts as well as for adhoc testing needs.

Code

function Test-ADCrential{
    [CmdletBinding()]
    param(
        [pscredential]$Credential
    )
    
    try {
        Add-Type -AssemblyName System.DirectoryServices.AccountManagement
        if(!$Credential) {
            $Credential = Get-Credential -EA Stop
        }
        if($Credential.username.split("\").count -ne 2) {
            throw "You haven't entered credentials in DOMAIN\USERNAME format. Given value : $($Credential.Username)"
        }
    
        $DomainName = $Credential.username.Split("\")[0]
        $UserName = $Credential.username.Split("\")[1]
        $Password = $Credential.GetNetworkCredential().Password
    
        $PC = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::Domain, $DomainName)
        if($PC.ValidateCredentials($UserName,$Password)) {
            Write-Verbose "Credential validation successful for $($Credential.Username)"
            return $True
        } else {
            throw "Credential validation failed for $($Credential.Username)"
        }
    } catch {
        Write-Verbose "Error occurred while performing credential validation. $_"
        return $False
    }
}

Output

Run the function without arguments and it will prompt you to enter credentials

Test-ADCredential

Run the function by passing credential object as argument and it will return the output straightway.

$myCreds = Get-Credential
Test-ADCredential -Credential $Mycreds

Do you have any questions about how this function works? Please write in the comments section, we will get back on that.

{ 1 comment }

Python: Get current date and time

Today’s post is about finding today’s date and time using Python. This script queries local system for today’s date and time in local time zone.

We will be using python built-in module called datetime for this purpose. This module has a function called now() which will return a date time object. Let see how it looks like.

import datetime as dt
dt.datetime.now()

If you execute above lines of code from Python REPL, you will see that it returns a date time object as shown below.

As you can see in the output it returned datetime in object format. It is very convenient to use this object if you are going to consume this further in your scripts. However, at times we want to print the time that humans can easily understand. For example, you want to print date time in MM-DD-YYYY format. To do that we can use strftime() method which is available on the datetime object. Let us see how to use it.

import datetime as dt
date = dt.datetime.now()
print("Today's date time : {0}".format(date.strftime("%d-%m-%Y %H-%M-%S")))
print("Today's date time : {0}".format(date.strftime("%D %T")))

Execute the above code form repl and you will see the below output.
We are using strftime() method to format the date time the way we want. If you want to explore other formats available with strftime(), refer the below table(source: python.org)

 

Directive Meaning Notes
%a Locale’s abbreviated weekday name.
%A Locale’s full weekday name.
%b Locale’s abbreviated month name.
%B Locale’s full month name.
%c Locale’s appropriate date and time representation.
%d Day of the month as a decimal number [01,31].
%H Hour (24-hour clock) as a decimal number [00,23].
%I Hour (12-hour clock) as a decimal number [01,12].
%j Day of the year as a decimal number [001,366].
%m Month as a decimal number [01,12].
%M Minute as a decimal number [00,59].
%p Locale’s equivalent of either AM or PM. (1)
%S Second as a decimal number [00,61]. (2)
%U Week number of the year (Sunday as the first day of the week) as a decimal number [00,53]. All days in a new year preceding the first Sunday are considered to be in week 0. (3)
%w Weekday as a decimal number [0(Sunday),6].
%W Week number of the year (Monday as the first day of the week) as a decimal number [00,53]. All days in a new year preceding the first Monday are considered to be in week 0. (3)
%x Locale’s appropriate date representation.
%X Locale’s appropriate time representation.
%y Year without century as a decimal number [00,99].
%Y Year with century as a decimal number.
%Z Time zone name (no characters if no time zone exists).
%% A literal '%' character.

 

Notes:

  1. When used with the strptime() function, the %p directive only affects the output hour field if the %I directive is used to parse the hour.
  2. The range really is 0 to 61; this accounts for leap seconds and the (very rare) double leap seconds.
  3. When used with the strptime() function, %U and %W are only used in calculations when the day of the week and the year are specified.

Hope this article is helpful.

{ 0 comments }