Search results for 'app:weblogs' matching tag 'Scripting Games'

Scripting Games 2012 comments: #20 multiple ifs

RichardSiddaway — Thu, 17 May 2012 05:00:00 GMT

An if statement is used to test a condition and if is true do one thing and do another if it is false. It can be written generically as

if (<condition>){ do stuff}
else {do other stuff}

Sometimes we need to test numerous alternatives. We could use multiple if statements, sometimes we have to nest them which can lead to code like this

Get-WmiObject -Class Win32_LogicalDisk -Filter "DriveType=3" |            
foreach {            
 if ($_.FreeSpace -gt 1tb){Write-Host "Over 1TB of disk space free"}            
 else {             
   if ($_.FreeSpace -ge 500gb){Write-Host "Over 500GB of disk space free"}            
   else {            
     if ($_.FreeSpace -ge 300gb){Write-Host "Over 300GB of disk space free"}            
     else {            
      if ($_.FreeSpace -ge 200gb){Write-Host "Over 300GB of disk space free"}            
      else {            
        if ($_.FreeSpace -ge 100gb){Write-Host "Over 100GB of disk space free"}            
        else {            
          Write-Host "Insufficient disk space"            
        }            
     }            
     }            
   }            
 }             
 }

That’s not fun to write and its even less fun to debug or change

The code can be simplified by using if – elseif – else

Get-WmiObject -Class Win32_LogicalDisk -Filter "DriveType=3" |            
foreach {            
 if ($_.FreeSpace -gt 1tb){Write-Host "Over 1TB of disk space free"}            
 elseif ($_.FreeSpace -ge 500gb){Write-Host "Over 500GB of disk space free"}            
 elseif ($_.FreeSpace -ge 300gb){Write-Host "Over 300GB of disk space free"}            
 elseif ($_.FreeSpace -ge 200gb){Write-Host "Over 300GB of disk space free"}            
 elseif ($_.FreeSpace -ge 100gb){Write-Host "Over 100GB of disk space free"}            
 else{Write-Host "Insufficient disk space"}            
 }

This much more compact and understandable. We can do a better job if we use a switch statement which is similar in concept to if-elseif-else

Get-WmiObject -Class Win32_LogicalDisk -Filter "DriveType=3" |            
foreach {            
 switch ($_.FreeSpace) {            
 {$_ -gt 1tb}   {Write-Host "Over 1TB of disk space free"; break}            
 {$_ -ge 500gb} {Write-Host "Over 500GB of disk space free"; break}            
 {$_ -ge 300gb} {Write-Host "Over 300GB of disk space free"; break}            
 {$_ -ge 200gb} {Write-Host "Over 300GB of disk space free"; break}            
 {$_ -ge 100gb} {Write-Host "Over 100GB of disk space free"; break}            
 default {Write-Host "Insufficient disk space"}            
 }            
 }

We select the object to test and use $_ as a placeholder. Each line in the switch statement is a single test. The default statement is for anything that doesn’t pass any of the preceding tests

One difference between the if statements and switch is that with the if statements as soon as a condition is true testing stops. With switch testing would continue through all tests – break is used to stop that

When you need to perform multiple tests consider using a switch statement – it is less typing and easier to debug

Scripting Games 2012 comments: #19 default parameters

RichardSiddaway — Wed, 16 May 2012 05:00:00 GMT

I often saw scripts that did something like this

function test1 {            
 param (            
   [string]$computername            
 )            
            
if (!$computername){            
  $computername = $env:COMPUTERNAME            
}            
            
Get-WmiObject -Class Win32_OperatingSystem -ComputerName $computername              
}

A function, or script, defines a parameter. The first thing the function does it test the value of the parameter and if it doesn’t exist it sets it to a default value.

No, no, no – you are making work for yourself.

Get PowerShell to do the work for you

function test2 {            
 param (            
   [string]$computername = $env:COMPUTERNAME            
 )            
            
Get-WmiObject -Class Win32_OperatingSystem -ComputerName $computername              
}

See the difference?

The parameter definition now contains a default value. If you don’t specify the parameter and a value the default kicks in and the function works.

Cuts down typing and gets PowerShell to do the work.

Scripting Games 2012 comments: #18 computer names

RichardSiddaway — Tue, 15 May 2012 05:00:00 GMT

I have mentioned computer names a few times. One oddity is accessing the local machine.

There are three options

dot .
localhost
$env:COMPUTERNAME

There are a number of occasions when . and localhost fail.

For example

PS> Get-EventLog -List -ComputerName .

Max(K) Retain OverflowAction        Entries Log
------ ------ --------------        ------- ---
20,480      0 OverwriteAsNeeded      21,647 Application
     512      7 OverwriteOlder              0 DemoMate
20,480      0 OverwriteAsNeeded           0 HardwareEvents
     512      7 OverwriteOlder              0 Internet Explorer
20,480      0 OverwriteAsNeeded           0 Key Management Service
   8,192      0 OverwriteAsNeeded          10 Media Center
     512      7 OverwriteOlder              0 MyNewLog
     128      0 OverwriteAsNeeded         364 OAlerts
20,480      0 OverwriteAsNeeded           1 Scripts
                                              Security
20,480      0 OverwriteAsNeeded      56,135 System
15,360      0 OverwriteAsNeeded      10,918 Windows PowerShell

PS> Get-EventLog -List -ComputerName localhost
Get-EventLog : The network path was not found.
At line:1 char:13
+ Get-EventLog <<<< -List -ComputerName localhost
+ CategoryInfo : NotSpecified: (:) [Get-EventLog], IOException
+ FullyQualifiedErrorId : System.IO.IOException,Microsoft.PowerShell.Commands.GetEventLogCommand

PS> Get-EventLog -List -ComputerName 'localhost'
Get-EventLog : The network path was not found.
At line:1 char:13
+ Get-EventLog <<<< -List -ComputerName 'localhost'
+ CategoryInfo : NotSpecified: (:) [Get-EventLog], IOException
+ FullyQualifiedErrorId : System.IO.IOException,Microsoft.PowerShell.Commands.GetEventLogCommand

PS> Get-EventLog -List -ComputerName $env:COMPUTERNAME

Get-EventLog fails with localhost

I always recommend using $env:COMPUTERNAME

Scripting Games 2012 comments: #17 opening a csv file

RichardSiddaway — Mon, 14 May 2012 05:00:00 GMT

Some of the events involved creating a CSV file. While it wasn’t explicitly asked that you opened the file many entrants chose to add that code to their scripts.

There were a number of options presented – most involving opening Excel and importing the CSV file.

There is a much quicker way

Invoke-Item -Path test.csv

Invoke-Item causes any file to open in the default application associated with that file. This will work for Office documents, text files and anything else that you can double click on a get it to open in an application.

If you use Invoke-Item on a .ps1 file – it will open in notepad just as if you’d double clicked it.

Scripting Games 2012 comments: #15 pipelines

RichardSiddaway — Tue, 08 May 2012 05:00:00 GMT

There are a few comments to make about using the pipeline but one of the obvious issues I saw from the games was this type of approach

$p = Get-Process
$p | where {$_.Name -like "powershell*"}

The only time this is valid is if you need to access exactly the same data later in your script.

In all other cases use

Get-Process | where {$_.Name -like "powershell*"}

if you want to split the lines to make it more readable the pipe symbol acts as a line continuation character so

Get-Process |
where {$_.Name -like "powershell*"}

is just as valid

PowerShell is all about the pipeline – use it to your advantage

Scripting Games 2012 comments: #14 local computer name

RichardSiddaway — Mon, 07 May 2012 05:00:00 GMT

There are a number of ways to pass the names of the local machine into a script or function:

use the actual name
use the IP address (if the processing in the script can work with IP addresses)
use 127.0.0.1 – the loop back address (if the processing in the script can work with IP addresses)
use a dot “.” to signify the local machine
use “localhost”
use the environmental variable holding the machine name

Normally we don’t use any of the first three because you either have to type out the name – chance of error or the functionality within the script won’t accept IP addresses. Also the PSsession cmdlets only use computer names by default

Traditionally we have used . or localhost especially when working with WMI

Get-WmiObject -Class Win32_OperatingSystem -ComputerName .
Get-WmiObject -Class Win32_OperatingSystem -ComputerName localhost

There are a number of cmdlets that will accept a computer name as a parameter

PS> Get-Help * -Parameter ComputerName | select name

Name
----
Get-WinEvent
Get-Counter
Test-WSMan
Invoke-WSManAction
Connect-WSMan
Disconnect-WSMan
Get-WSManInstance
Set-WSManInstance
Remove-WSManInstance
New-WSManInstance
Invoke-Command
New-PSSession
Get-PSSession
Remove-PSSession
Receive-Job
Enter-PSSession
Get-EventLog
Clear-EventLog
Write-EventLog
Limit-EventLog
Show-EventLog
New-EventLog
Remove-EventLog
Get-WmiObject
Invoke-WmiMethod
Get-Process
Remove-WmiObject
Register-WmiEvent
Get-Service
Set-Service
Set-WmiInstance
Get-HotFix
Test-Connection
Restart-Computer
Stop-Computer

This works:

Get-Process -ComputerName .

but this throws an error

PS> Get-Process -ComputerName localhost
Get-Process : Couldn't connect to remote machine.
At line:1 char:12
+ Get-Process <<<< -ComputerName localhost
+ CategoryInfo : NotSpecified: (:) [Get-Process], InvalidOperationException
+ FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.PowerShell.Commands.GetProcessCommand

I’ve seen similar errors with Get-Eventlog

PS> Get-EventLog -List -ComputerName .

Max(K) Retain OverflowAction        Entries Log
------ ------ --------------        ------- ---
20,480      0 OverwriteAsNeeded      21,814 Application
     512      7 OverwriteOlder              0 DemoMate
20,480      0 OverwriteAsNeeded           0 HardwareEvents
     512      7 OverwriteOlder              0 Internet Explorer
20,480      0 OverwriteAsNeeded           0 Key Management Service
   8,192      0 OverwriteAsNeeded           3 Media Center
     512      7 OverwriteOlder              0 MyNewLog
     128      0 OverwriteAsNeeded         357 OAlerts
20,480      0 OverwriteAsNeeded           1 Scripts
                                              Security
20,480      0 OverwriteAsNeeded      56,225 System
15,360      0 OverwriteAsNeeded      10,646 Windows PowerShell

My solution and recommendation is to use the environmental variable for the computer name.

PS> Get-ChildItem -Path env: | where {$_.name -like "*computer*"}

Name                           Value
----                           -----
COMPUTERNAME                   RSLAPTOP01

The environment provider doesn’t allow the use of filters so we have to use where

How do we use this:

Get-WmiObject -Class Win32_OperatingSystem -ComputerName $env:COMPUTERNAME
Get-Process -ComputerName $env:COMPUTERNAME
Get-EventLog -List -ComputerName $env:COMPUTERNAME

It can also be used as the default value on a function parameter that asks for a computername – that way you get the local machine if you don’t specify a value to the parameter.

I have never seen this fail – doesn’t mean it can’t just that I’ve never seen it – and it has the advantage of being easier to read than using a dot

Scripting Games 2012 comments: #13 Default Printer

RichardSiddaway — Sun, 06 May 2012 05:00:00 GMT

In one of the events you had to find the default printer. This can be done using WMI.

The full list of printers can seen using:

Get-WmiObject -Class Win32_Printer

If you want to examine the printer objecy – to determine what information is available - use get-member or select the first printer in the list

Get-WmiObject -Class Win32_Printer | select -f 1 | fl *

you will see that there is a property Default

PS> Get-WmiObject -Class Win32_Printer | Get-Member Default

TypeName: System.Management.ManagementObject#root\cimv2\Win32_Printer

Name    MemberType Definition
----    ---------- ----------
Default Property   System.Boolean Default {get;set;}

which is Boolean i.e. it has to return true or false

Your first thought might ne to do this:

Get-WmiObject -Class Win32_Printer | where {$_.Default -eq $true}

but it would be better coding practice to do this:

Get-WmiObject -Class Win32_Printer | where {$_.Default}

On the local machine this is OK but if you are working remotely than all of the Win32_Printer objects would be returned and the filtering performed locally. Could be an expensive operation.

The better option is to use the –Filter parameter on Get-WmiObject

Get-WmiObject -Class Win32_Printer -Filter "Default = $true"

this only returns a single object

If you want to use WQL then it becomes

Get-WmiObject -Query "SELECT * FROM Win32_Printer WHERE Default = $true"

In either case the filtering is done early to reduce the amount of data you are dealing with.

Remember – Filter early & format late

For more information on working with printers see chapter 10 of PowerShell and WMI – http://www.manning.com/powershellandwmi

Scripting Games 2012 comments: #11–its true

RichardSiddaway — Sat, 05 May 2012 05:00:00 GMT

The games are over for another year. The number of entries was huge – 150% increase over last year. Congratulations to the winners and to everyone who took part.

One thing I noticed was the number of scripts that made testing booleans harder than it needed to be.

A boolean can take one of two values – True or False. These are represented in PowerShell by $true and $false respectively

Lets create a couple of variables

PS> $x = $true
PS> $x
True
PS> $y = $false
PS> $y
False

A common test was:

PS> $a = $true
PS> $b = $false

PS> if ($a -eq $true){"Do something"}
Do something

or you might see

PS> if ($b -ne $true){"Do something else"}
Do something else

These work and are perfectly understandable.

They can be made simpler

PS> if ($a){"Do something"}
Do something

we get two ways of testing false using the –not operator and its alias of !

PS> if (-not $b){"Do something else"}
Do something else
PS> if (! $b){"Do something else"}
Do something else

Just as a final test to show this really works

PS> if ($b){"Do something"}else{"Do something else"}
Do something else

The thing to remember is that on an if statement or anywhere else where a condition is being tested it has to resolve to true or false. In this case the variable (or object property) already carries a boolean value so we can use it directly.

Its not a big saving but will mount up over time – keeps the scripts simpler and therefore keeps the errors down

Scripting Games 2012 comments: #12 date conversions

RichardSiddaway — Sat, 05 May 2012 05:00:00 GMT

A few times in the games you were asked for date time based information. Now WMI has a lot of classes that return WMI information. It is in an awkward format though

PS> Get-WmiObject -Class Win32_OperatingSystem | fl *time*

CurrentTimeZone : 60
LastBootUpTime : 20120505101515.296000+060
LocalDateTime : 20120505192615.170000+060

This translates as:

Year – four digits
Month – two digits
Day - two digits
Hour - two digits
Minute - two digits
Second - two digits
.
millionth of second but is usually constrained to milliseconds
+
minutes difference from GMT (UTC)

Its readable but only if you are used to it.

Ideally we want to convert this to a more reasonable looking date such as

05 May 2012 19:35:03

It is possible to take the WMI information, break it up into its components – its is returned as a string – and create a datetime object. Alternatively you can hunt through the .NET classes and find some date conversion methods.

That’s the hard way.

The easy way is to use the built in functionality on the WMI class!

If you put a WMI class through get-member you will discover a couple of Scriptmethods at the end of the data

PS> Get-WmiObject -Class Win32_OperatingSystem | Get-Member -MemberType ScriptMethod

TypeName: System.Management.ManagementObject#root\cimv2\Win32_OperatingSystem

Name                MemberType   Definition
----                ----------   ----------
ConvertFromDateTime ScriptMethod System.Object ConvertFromDateTime();
ConvertToDateTime   ScriptMethod System.Object ConvertToDateTime();

They are simple to use

If you need the rest of the data on the object

PS> $os = Get-WmiObject -Class Win32_OperatingSystem
PS> $os.ConvertToDateTime($os.LastBootUpTime)

05 May 2012 10:15:15

or if only want the last bootup time

PS> $os = [wmiclass]"\\.\root\cimv2:Win32_OperatingSystem"
PS> $os.ConvertToDateTime($(Get-WmiObject Win32_OperatingSystem | select -ExpandProperty LastBootUpTime))

05 May 2012 10:15:15

There are variations on these themes.

The conversion routines can be used in calculated fields in select and format cmdlets

See PowerShell and WMI chapters 3 and 4 for more details - http://www.manning.com/powershellandwmi

Scripting Games 2012 comments: #10 Advanced event 5

RichardSiddaway — Sat, 21 Apr 2012 05:00:00 GMT

http://blogs.technet.com/b/heyscriptingguy/archive/2012/04/06/2012-scripting-games-advanced-event-5-list-errors.aspx

This is the one I was asked to supply a commentary for

http://blogs.technet.com/b/heyscriptingguy/archive/2012/04/20/expert-commentary-2012-scripting-games-advanced-event-5.aspx

This one has raised an interesting interpretation issues. The last design point asks:

Your output should be organized such that the largest source of errors appears at the top of the output.

The figure shows the data sorted by Event source

I read the design point as log with the largest number of errors comes first. The script I produced for the commentary doesn’t meet that last design point so I’ve revised it

#Requires -Version 2            
function Get-EventEntryCount{             
[CmdletBinding()]             
param (             
 [parameter(Position=0,            
   ValueFromPipeline=$true,             
   ValueFromPipelineByPropertyName=$true)]            
 [Alias("CN", "Computer")]              
 [string[]]$computername="$env:COMPUTERNAME",            
            
 [parameter(Position=1)]            
 [ValidateSet("Error", "Information", "FailureAudit", "SuccessAudit", "Warning", "All", "*")]            
 [string]$eventtype="Error"             
)             
BEGIN{            
  $currentUser = [Security.Principal.WindowsIdentity]::GetCurrent()            
  $testadmin = `
  (New-Object Security.Principal.WindowsPrincipal $currentUser).IsInRole(`
  [Security.Principal.WindowsBuiltinRole]::Administrator)            
              
  if (!$testadmin){            
   Throw "Must be run with elevated privileges"            
  }            
}#begin             
PROCESS{            
  foreach ($computer in $computername ){            
    switch ($computer) {            
     "."         {$computer="$env:COMPUTERNAME"}            
     "localhost" {$computer="$env:COMPUTERNAME"}            
    }            
            
    Write-Verbose "Processing computer: $computer"            
                
    $data = @()            
    if (Test-Connection -ComputerName $computer -Count 1 -Quiet){            
            
    Write-Verbose "Starting Remote Registry service on $computer"            
    $origrrsrv = Get-WmiObject -Class Win32_Service -Filter "Name='RemoteRegistry'" `
    -ComputerName $computer            
            
    if ($origrrsrv.StartMode -eq "Disabled") {            
      Set-Service -Name RemoteRegistry -ComputerName $computer -StartupType "Manual"            
    }            
            
    if ($origrrsrv.State -ne "Running") {            
      $origrrsrv.StartService() | Out-Null            
    }            
            
    Write-Verbose "Retrieving logs for $computer"            
                  
    Get-EventLog -List -ComputerName $computer |            
    foreach {            
      $log = $_.Log            
      Write-Verbose "Processing log: $log"            
                    
      if ($_.Entries.Count -gt 0) {            
         Write-Debug "Processing event type $eventtype"            
                      
         $n = Get-EventLog -LogName $($_.Log) -EntryType $eventtype -ComputerName $computer `
         -ErrorAction SilentlyContinue            
                      
         if ($n -ne $null){            
           Write-Debug "Entries found"            
           $n | group Source -NoElement |             
           foreach{            
                       
              $data += New-Object -TypeName PSObject -Property @{            
                 ComputerName = $computer            
                 LogName = $log            
                 EntryType = $eventtype            
                 EntrySource = $($_.Name)            
                 EntryCount = $($_.Count)            
             }            
           }            
         }            
       }  # end if entries            
       else {            
         Write-Verbose "$($computer): $log is empty"            
       }            
                    
            
        if ($origrrsrv.State -eq "Stopped") {            
          $origrrsrv.StopService() | Out-Null            
        }            
            
        if ($origrrsrv.StartMode -eq "Disabled") {            
          Set-Service -Name RemoteRegistry -ComputerName $computer -StartupType "Disabled"            
        }            
            
     } # end of log processing foreach            
   }            
   else {            
     Write-Warning "Cannot contact $computer"            
   } # end if ping            
   Write-Output $data             
 } ## end computer foreach            
}#process             
END{}#end            
            
<# 
.SYNOPSIS
Counts the number of entries of a given type
in the event logs of a system

.DESCRIPTION
One or more computers - from pipeline or parameter -  are
accessed to read the envent logs and count the entries of a 
given type. Empty logs are tested and the count is set to zero

.PARAMETER  computername
Name of computer for which log information
is to be retrieved

.PARAMETER  eventtype
Log entry type to count.
Accepted values are - 
"Error", "Information", "FailureAudit", 
"SuccessAudit", "Warning", "All", "*"

.EXAMPLE
Get-EventEntryCount 

Accesses logs on local machine. Peforms default display

.EXAMPLE
Get-EventEntryCount -computername "." | 
sort LogName, EntryCount -Descending | 
Format-Table EntrySource, EntryCount -GroupBy LogName

Accesses logs on local machine. Format display and group by logname

.EXAMPLE
"dc02", "webr201", "server02" | 
Get-EventEntryCount | 
sort Computer, LogName, EntryCount -Descending | 
Format-Table Logname, EntrySource, EntryCount -GroupBy Computer

Accesses logs on remote machines. Computer names accepted from pipeline.
Format display and group by computer

.EXAMPLE
Get-EventEntryCount -computername "dc02", "webr201", "server02" |
sort Computer, LogName, EntryCount -Descending | 
Format-Table Logname, EntrySource, EntryCount -GroupBy Computer

Accesses logs on remote machines. Computer names accepted as array.
Format display and group by computer

.INPUTS
Computer name - string or string array
Envent type - string. Must be member of set

.OUTPUTS
Returns a custom object with
properties:
ComputerName - name of computer
LogName - name of log
EntryType - Type of log entry
EntryCount - count of entries
EntrySource - event source

.NOTES


.LINK

#>            
            
}