Whenever a computer is added to a windows domain, by default account will get created under Computers container. It is located right below the domain name in dsa.msc. The pull of it is, <domainName>\Computers.

Today one of my friend has asked to know if there any quick script using which he can move all computers from default computers container to OU of his choice in same domain. Since I don’t have a script already authored for this purpose, I quickly made the below.

This is a very basic version of computer accounts movement script. There might be some conditions processing like if name contains XYZ move to one OU or if name contains ABC move to different OU. You can accommodate such conditions in this script if you have little powershell knowledge(or let me know I can help you given some time).

Here is the code.

[cmdletbinding()]            

param (
[parameter(mandatory=$true)]
$TargetOU
)            

Import-Module ActiveDirectory
$Domain = [ADSI]""
$DN=$domain.distinguishedName
$SourcePath = "CN=Computers," + $DN
$Computers = Get-ADComputer -Filter * -SearchBase $SourcePath
if(!$Computers) {
 write-host "No Computers are found in default container"
 return
}
foreach ($Computer in $Computers) {
 if(!(Move-ADObject $Computer -TargetPath $TargetOU)) {
  $Status = "SUCCESS"
 } else {
  $Status = "FAILED"
 }
 $OutputObj = New-Object -TypeName PSobject
 $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.Name.tostring()
 $OutputObj | Add-Member -MemberType NoteProperty -Name SourcePath -Value $SourcePath
 $OutputObj | Add-Member -MemberType NoteProperty -Name DestinationPath -Value $TargetOU
 $OutputObj | Add-Member -MemberType NoteProperty -Name Status -Value $Status
 $OutputObj
}

When I executed this script in my test domain for testing purpose it went fine and generated below output. This script is not depending on any external modules/cmdlets like quest tools. I uses ActiveDirectory module which comes with RSAT(or windows 2008 domain controllers). Needless to say that you need ADWS(active directory web services) installed if all your domain controllers are Windows 2003. This is not required if atleast one DC is having windows 2008 R2 OS where ADWS is default.

Output:

I am a very bad user of my PC. I open many IE, notepad and other application windows sand leave them like that. I only care to close them only when my computer starts behaving crazy :-/

Today I did the same exercise of closing old/unused application windows to give some breathing room for my computer. While doing it I was curios to know what is the count of each process running on my computer so that I can see the top processes and close the ones which are high in number. And immediately, I authored this script.

[cmdletbinding()]            

param(
$ComputerName = $env:computername
)
$Processes = Get-Process -ComputerName $ComputerName
$myprocesses = @()
foreach($process in $processes) {
  $myprocesses = $myprocesses + $process.Name
}
$hash =@{}
$myprocesses | % {$hash[$_] = $hash[$_] + 1 }
$hash.getenumerator() | ? { $_.value -gt 1 } | sort value

All I am doing is reading the process names into a array called $myprocesses and applying the one of my previous powershell inventions which can detect the duplicates in an array and give the count. This one proved to be handy for me many times.

So, after executing the script, I can see that too many notepad.exe processes are running….. Thank you PS. I will close them first. 🙂

Thank you for reading. Let me know if you come across this small tip handy anywhere.

Happy reading…

As I mentioned in one of the recent posts, MS has released a PST capture tool that helps you migrate your users PST to Exchange 2010 archive mailboxes or Exchange online storage. Though I read some documentation of this tool to understand what it is and how it works, I could able to get clear idea only after reading below articles.

They covers the good amount of details in installing PST central service and deploying the agents for scanning the PST files on computers.

Part I – http://www.telnetport25.com/2012/02/installing-using-the-microsoft-pst-capture-toolpart-1/

Part II – http://www.telnetport25.com/2012/02/installing-using-the-microsoft-pst-capture-toolpart-2/

Happy reading…

What are the IP address details of remote computer? When even I came across this question while troubleshooting some problem, I do nothing but logging on to the servers to see the details. Isn’t this a time consuming process? what if I want to get these details using some automation. Unfortunately, there is no windows built-in command like ipconfig /system:mypc1 to get the IP details. So, I decided to make a powershell script which addresses this purpose.

Code

[cmdletbinding()]
param (
 [parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
    [string[]]$ComputerName = $env:computername
)

begin {}
process {
 foreach ($Computer in $ComputerName) {
  if(Test-Connection -ComputerName $Computer -Count 1 -ea 0) {
   try {
    $Networks = Get-WmiObject Win32_NetworkAdapterConfiguration -ComputerName $Computer -EA Stop | ? {$_.IPEnabled}
   } catch {
        Write-Warning "Error occurred while querying $computer."
        Continue
   }
   foreach ($Network in $Networks) {
    $IPAddress  = $Network.IpAddress[0]
    $SubnetMask  = $Network.IPSubnet[0]
    $DefaultGateway = $Network.DefaultIPGateway
    $DNSServers  = $Network.DNSServerSearchOrder
    $WINS1 = $Network.WINSPrimaryServer
    $WINS2 = $Network.WINSSecondaryServer   
    $WINS = @($WINS1,$WINS2)         
    $IsDHCPEnabled = $false
    If($network.DHCPEnabled) {
     $IsDHCPEnabled = $true
    }
    $MACAddress  = $Network.MACAddress
    $OutputObj  = New-Object -Type PSObject
    $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.ToUpper()
    $OutputObj | Add-Member -MemberType NoteProperty -Name IPAddress -Value $IPAddress
    $OutputObj | Add-Member -MemberType NoteProperty -Name SubnetMask -Value $SubnetMask
    $OutputObj | Add-Member -MemberType NoteProperty -Name Gateway -Value ($DefaultGateway -join ",")      
    $OutputObj | Add-Member -MemberType NoteProperty -Name IsDHCPEnabled -Value $IsDHCPEnabled
    $OutputObj | Add-Member -MemberType NoteProperty -Name DNSServers -Value ($DNSServers -join ",")     
    $OutputObj | Add-Member -MemberType NoteProperty -Name WINSServers -Value ($WINS -join ",")        
    $OutputObj | Add-Member -MemberType NoteProperty -Name MACAddress -Value $MACAddress
    $OutputObj
   }
  }
 }
}

end {}

This script is pretty much self explanatory. It uses Win32_NetworkAdapterConfiguration WMI class to get the network configuration details. This script also helps you to get DNS servers, MAC address details, subnetmask and default gateway details. Using this script you can also know the list of network adapters that has DHCP enabled/disabled(means static IPs).

You can save this script to a PS1 fil(say Get-IPDetails.PS1) and run it against list of computers you need. Below is one example.

Hope this helps…

Want to know how to shutdown/restart a remote computer using Powershell? Well, this post is for same purpose. Powershell has built-in cmdlets to shutdown/restart remote computers –i.e shutdown-computer, restart-computer. They servers most purpose, but the problem is that these cmdlets doesn’t provide a way to give shutdown or restart comments and the timeout.

Having the ability to provide comments (or reason for shutdown/restart) is important and useful since we can track how has initiated the reboot.

Now let us jump on to the coding part.

[cmdletbinding()]            

param (            

 [parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]            
 [string[]]$ComputerName = $env:computername,            
 $Timeout = 30,            
 [switch]$Reboot            

)            

begin {            
 $Username = $env:username            
 if($reboot) { $flag = 2 } else { $flag = 1 }             
 if($reboot) {            
  $comment  = "Reboot initiated by $Username using $($MyInvocation.InvocationName). Timeout is $Timeout"            
 } else {            
  $comment  = "Reboot initiated by $Username using $($MyInvocation.InvocationName). Timeout is $Timeout"            
 }            
}            

process {            
 foreach($Computer in $ComputerName) {            
  Write-Verbose "Working on $Computer"            
  if(Test-Connection -ComputerName $Computer -Count 1 -ea 0) {            
   $OS  = Get-WMIObject -Class Win32_OperatingSystem -ComputerName $Computer            
   if( -not $OS.Win32ShutdownTracker($timeout, $comment, 0, $flag)) {            
    $Status  = "FAILED"            
   } else {            
    $Status  = "SUCCESS"            
   }            
  $OutputObj = New-Object -TypeName PSobject             
  $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer            
  $OutputObj | Add-Member -MemberType NoteProperty -Name Status -Value $status            
  $OutputObj | Add-Member -MemberType NoteProperty -Name Timeout -Value $timeout            
  $OutputObj            
  }            
 }            
}            

end {            
}

This script uses WMI class Win32_OperatingSystem to shutdown the computer. This class has a method Win32ShutdownTracker which is available in Vista, Windows 7, Windows 2008(and R2) operating systems that allows us to provide a comment and timeout for the shutdown and restart. This script provides a default timeout of 30s for shutdown/restart operations but you can reduce or increase it by using -Timeout parameter. Setting this parameter to 0(zero) will trigger the graceful shutdown immediately.

You can read more about the implementation of Win32_OperatingSystem at http://msdn.microsoft.com/en-us/library/windows/desktop/aa394239%28v=vs.85%29.aspx and Win32ShutdownTracker method at http://msdn.microsoft.com/en-us/library/windows/desktop/aa394057%28v=vs.85%29.aspx

Usage:

Copy the above script into a file and save it as shutdown-Computer.ps1

• To shutdown a single computer : Shutdown-Computer.ps1 -ComputerName MyPC1
• To shutdown multiple computers : Shutdown-Computer.ps1 -ComputerName MyPC1, MyPC2
• To trigger the shutdown immediately: Shutdown-Computer.ps1 -ComputerName MyPC1 -Timeout 0
• To trigger restart: Shutdown-Computer -ComputerName.ps1 -Restart

Output:

I welcome your comments….

You might get alerts your DFS-R management pack in SCOM about the DFS-R service inability to register itself with WMI and it can impact the replication. Exact error message is given below.

DFS Replication failed to register itself with WMI. Replication is disabled until WMI registration succeeds.

To resolve this issue, you may need to re-register DFS-R related DLL and other files that belongs to WMI. Before going there, just restart your DFS-R service once to confirm that your problem is not transient and happening all time. You will notice a error message with 6104 event ID in DFS Replication event log after you restart the service. If this event is present, then problem is live and you should fix it.

The following solution worked for me.

CD %windir%\system32\wbem

mofcomp dfsrprov.mof

mofcomp dfsrprov.mfl

wmiprvse /regserver

net stop dfsr

net start dfsr

All it does is re-register the WMI related files of DFS-R.

If you still notice issues, you may want to re-register everything under WBEM folder. This was suggested in Technet Forum.

CD %windir%\system32\wbem
For /f %s in (‘dir /b /s *.dll’) do regsvr32 /s %s
for /f %s in (‘dir /b *.mof *.mfl’) do mofcomp %s
wmiprvse /regserver
net stop dfsr
net start dfsr

if the problem is still not resolved, try rebooting the DFS-R server.

Sometimes, the compilation of MOF files might fail with below errors while performing above steps. In such cases, http://support.microsoft.com/kb/841619 might help you.

C:\WINNT\system32\wbem>mofcomp dfsrprov.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.3959
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: dfsrprov.mof
MOF file has been successfully parsed
Storing data in the repository…
An error occurred while opening the namespace for object 1 defined on lines 4 –
4:
Error Number: 0x8007000e, Facility: Win32
Description: Not enough storage is available to complete this operation.
Compiler returned error 0x8007000e

A few more reference that might be useful for troubleshooting the issue:

1. DFSR Does Not Replicate Temporary Files : http://blogs.technet.com/b/askds/archive/2008/11/11/dfsr-does-not-replicate-temporary-files.aspx
2. http://social.technet.microsoft.com/Forums/en-US/winserverfiles/thread/b8a8f0e6-9fcb-4a98-9951-bce109927dc8/

Thanks for reading my rambling. I wrote this for my quick reference and to help people who is searching for similar information.

WARNING: Above steps involves re-registration of WMI providers. So, test them in your lab and try in production at your own risk. I am not responsible for any damage that caused by above procedure.

Hope this helps…

MS has released a free tool that can help you search PSTs available in your network and export them to Exchange 2010 archive mailboxes of users. This product is originally developed by red gate and MS has acquired this and released as a free tool to encourage its customers to move from PST to exchange archives.

For more details and downloads, refer to below links.

Documentation: http://technet.microsoft.com/en-us/library/hh781036.aspx

Download : http://www.microsoft.com/downloads/details.aspx?FamilyID=f6006c4b-a6a9-4e83-81b3-e770d37f63ff

Video:

Hope this helps….

If you are windows administrator, you often come across a requirement to know when a service is started. The most obvious way is to drill through the event log and fetch this information. For this either you need to login to server interactively or verify event viewer remotely. Working interactively or via Event Viewer MMC is a painful process especially if the remote server is located in a remote place with high latency wan connection. I too came across similar situation and felt I should have somewhat easy to get this information. I quickly explored Win32_Service WMI class but I couldn’t find this service start information in any of the attributes/methods. After spending sometime, I came across a “PowerShell Guy” article which took me in right direction. The approach the author used in that post is very simple. Just get the PID of the process and get the process creation time which has that PID. It is matter of just two WMI calls. I found it is easy method and wrote the below script.

[cmdletbinding()]            

param (
 [parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
 [string[]]$ComputerName = $env:computername,            

 [ValidateNotNullOrEmpty()]
 [Alias("ServiceName")]
 [string]$Name            

)            

begin{}            

Process {            

 foreach ($Computer in $ComputerName) {
  if(Test-Connection -ComputerName $Computer -Count 1 -ea 0) {
   Write-Verbose "$Computer is online"
   $Service = Get-WmiObject -Class Win32_Service -ComputerName $Computer -Filter "Name='$Name'" -ea 0
   if($Service) {
    $ServicePID = $Service.ProcessID
    $ProcessInfo = Get-WmiObject -Class Win32_Process -ComputerName $Computer -Filter "ProcessID='$ServicePID'" -ea 0
    $OutputObj  = New-Object -Type PSObject
    $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.ToUpper()
    $OutputObj | Add-Member -MemberType NoteProperty -Name Name -Value $Name
    $OutputObj | Add-Member -MemberType NoteProperty -Name DisplayName -Value $Service.DisplayName
    $OutputObj | Add-Member -MemberType NoteProperty -Name StartTime -Value $($Service.ConvertToDateTime($ProcessInfo.CreationDate))
    $OutputObj
   } else {
    write-verbose "Service `($Name`) not found on $Computer"
   }
  } else {
   write-Verbose "$Computer is offline"
  }
 }            

}            

end {}

Usage examples:

.\Get-ServiceStartTime.ps1 -ComputerName “mytestpc1” -Name spooler

.\Get-ServiceStartTime.ps1 -ComputerName “mytestpc1”, “mytestpc2” -Name spooler

Hope this helps.

Sometimes we want to know when a computer is built. There are different places where we can check to find out the proximate information. Examples include, computer object creation datetime in active directory, build logs if you use any OS deployment softwares, creation date of c:\windows folder, and a WMI query if you are scripting geek etc. Since WMI provides most accurate information about when a Operating System is installed, I wrote a quick script to solve one of my requirement where I want to get installed date of bunch of computers.

Here is the script.

[cmdletbinding()]
param (
 [parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
 [string[]]$ComputerName = $env:computername
)            

begin {}
process {
 foreach ($Computer in $ComputerName) {
  if(Test-Connection -ComputerName $Computer -Count 1 -ea 0) {
   Write-Verbose "$Computer is online"
   $OS    = Get-WmiObject -Class Win32_OperatingSystem -Computer $Computer
   $InstalledDate = $OS.ConvertToDateTime($OS.Installdate)
   $OutputObj  = New-Object -Type PSObject
   $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer
   $OutputObj | Add-Member -MemberType NoteProperty -Name InstalledDate -Value $InstalledDate
   $OutputObj
  } else {
   Write-Verbose "$Computer is offline"
  }            

 }
}            

end {}

You can use this script in variety of ways. Below are the some of the usage examples. Save the above code into Get-InstallDate.ps1 file before you try them.

[PS] C:\>.\Get-InstalledDate.ps1 — get installed date of local computer

[PS] C:\>.\Get-InstalledDate.ps1 -ComputerName “MYtestpc1” — get installed date of local computer

[PS] C:\>”mytestpc1″, “mytestpc2” | .\Get-InstalledDate.ps1 — if you want to do it for multiple computers

[PS] C:\>Get-content .\comps.txt | .\Get-InstalledDate.ps1 — if you want to read the computers list from a text file and find out the information.

Hope this helps…