Summary: Microsoft Scripting Guy, Ed Wilson, shows how to use Windows PowerShell to troubleshoot a “provider load failure.”

Hey, Scripting Guy!

I ran across what may be an interesting issue for you. In one of our audit scripts last night, we received the following error:

Test-Connection : Provider load failure 

At SomePowerShellScript.PS1:26 char:24

+     if (test-connection <<<<  $srv -q -count 1) {

    + CategoryInfo          : InvalidOperation: (:) [Test-Connection], ManagementException

    + FullyQualifiedErrorId : TestConnectionException,Microsoft.PowerShell.Commands.TestConnectionCommand

What provider does Test-Connection use? I'm trying to research the failure. I know that another scan, which uses compiled code, did a whole slew of ping sweeps after this failed, so I don't think the problem is at a network/network interface layer. Also, with no changes to the system, the scripts ran fine this morning.

I've done a few Internet searches for the issue and have gotten no closer, hence the email to the guru.

Sincerely, 

BK

Microsoft Scripting Guy, Ed Wilson, is here. I am still in Redmond, Washington today. This morning I am going to have coffee (well, maybe just a cup of tea) with the scripting manager. So I am sitting in the building 43 coffee shop, working through my email. Lo and behold! I look up, and it is Jeffrey Snover coming over to say hi to me! We chat about the Hey, Scripting Guy! Blog for a bit, he confirms our meeting for this afternoon, and he heads off to his first meeting of the day. Wow. I know I have said this before (probably even yesterday), but I LOVE my job!

First find the provider

BK, I happen to know that the Test-Connection Windows PowerShell cmdlet uses the Win32_PingStatus WMI class to perform the ping. I found this out by using the Get-Help cmdlet to look up Test-Connection. In the description, it says that the cmdlet returns an instance of the Win32_PingStatus WMI class. This is shown in the image that follows.

To find the provider of a WMI class, there are several approaches. Perhaps the easiest way is to use wbemtest. This is shown here.

Another way to find the provider of a WMI class is to use the Get-CimClass cmdlet as shown here.

PS C:\> Get-CimClass win32_pingstatus | select -expand cimclassqualifiers

Name                                 Value              CimType                Flags

----                                 -----              -------                -----

dynamic                               True              Boolean ...rride, ToSubclass

provider                   WMIPingProvider               String ...rride, ToSubclass

When I know the WMI class and the WMI provider, there are a couple things I can do. I can look the information up on MSDN. The WMIPingProvider and the Win32_PingStatus class are both documented.

Start a trace

With the name of the WMI provider and the name of the WMI class, it is time to start a trace log. I have written a week’s worth of Hey, Scripting Guy! Blogs about this, and you should review those posts for fundamental concepts. Here are the steps:

1. Open the Windows Event Viewer utility.
2. On the View menu, check Show Analytic and Debug Logs.
3. Navigate to Microsoft/Windows/WMI-Activity.
4. Right-click the Operational log, and select Enable Log from the Actions menu.
5. Right-click the Trace log, and select Enable Log from the Actions menu.

Wait for the problem to occur again

BK, now you need to wait for the problem to surface again. When the error occurs again, go back to the Event Viewer utility, navigate to the WMI-Activity log, and search through the Operational logs and Trace logs. Hopefully, you will be able to find what is causing the problem. If not, you need to enable the Debug log by using the previous procedure. Unfortunately, the Debug logs require expert WMI skills and detailed knowledge that is rarely found outside of Microsoft Customer Service and Support (CSS). Therefore, you would need to open a case with Microsoft CSS to get to the root cause.

Join me tomorrow when I will talk about more cool Windows PowerShell stuff.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy 

Summary: Use a one-line command to obtain WMI class schema (MOF) information.

 How can I use Windows PowerShell to display the MOF of a WMI class?

 Use the WMIClass type accelerator, and then call the static GetText method whilst supplying the word MOF:

            ([wmiclass]"Win32_Pingstatus").gettext("MOF")

Summary: Microsoft Scripting Guy, Ed Wilson, shows how to use Windows PowerShell 3.0 to read XML files.

Microsoft Scripting Guy, Ed Wilson, is here. Tomorrow, we have the speaker’s dinner at the house that script built. The Scripting Wife and I have invited all the Windows PowerShell Saturday speakers for the Charlotte Windows PowerShell Saturday event to our house for a cook-out. We are also having a Windows PowerShell slumber party. It will be cool—sitting around a camp fire, making s'mores, writing Windows PowerShell scripts. Dude!

First create an XML document

The first thing to do is to create an instance of the XML document class. This is really easy by using the [XML] type accelerator. The XmlDocument class is documented on MSDN. To obtain an instance of the XmlDocument class, use the Get-Content cmdlet to read the XML file, and then cast the content to XML. This is shown here.

[xml]$books = Get-Content C:\fso\Books.XML

Note   To practice working with an XML document, it is important to have a well-formed XML document. You can obtain a sample XML document on MSDN.

When working with XML, I like to use XML Notepad. It is a free download from the Microsoft Download Center. (Unfortunately, it has not been updated since 2007, but it installs and works great on Windows 8, so I guess an update is not really needed).

The Books.XML XML document in XML Notepad is shown in the following image. This is a great way to explore an XML document prior to using Windows PowerShell to explore the document.

Use dotted notation to walk through the nodes

After you have an XML document, it is easy to walk through the nodes. This is especially true with Windows PowerShell 3.0 because it has the “automatic foreach” feature that I talked about in My Five Favorite PowerShell 3.0 Tips and Tricks.

After you use Get-Content to read the content of the XML file, you can use the GetType method to see that it is an XMLDOCUMENT that returns. This is shown here.

PS C:\> [xml]$books = Get-Content C:\fso\Books.XML

PS C:\> $books.GetType()

IsPublic IsSerial Name                                     BaseType

-------- -------- ----                                     --------

True     False    XmlDocument                              System.Xml.XmlNode

In the previous image, there is the catalog node, a book node, and each book has an author node. By using the dotted notation and the automatic foreach, the authors are easily accessible as shown here.

PS C:\> $books.catalog.book.author

Gambardella, Matthew

Ralls, Kim

Corets, Eva

Corets, Eva

Corets, Eva

Randall, Cynthia

Thurman, Paula

Knorr, Stefan

Kress, Peter

O'Brien, Tim

O'Brien, Tim

Galos, Mike

To find all of the titles, use the title note as shown here.

PS C:\> $books.catalog.book.title

XML Developer's Guide

Midnight Rain

Maeve Ascendant

Oberon's Legacy

The Sundered Grail

Lover Birds

Splish Splash

Creepy Crawlies

Paradox Lost

Microsoft .NET: The Programming Bible

MSXML3: A Comprehensive Guide

Visual Studio 7: A Comprehensive Guide

PS C:\>

Keep in mind that Tab expansion does not work for the nodes under book. To see the available properties (nodes) without using XML Notepad, pipe the results to Get-Member. This is shown here.

PS C:\> $books.catalog.book | gm -MemberType Property

   TypeName: System.Xml.XmlElement

Name         MemberType Definition

----         ---------- ----------

author       Property   string author {get;set;}

description  Property   string description {get;set;}

genre        Property   string genre {get;set;}

id           Property   string id {get;set;}

price        Property   string price {get;set;}

publish_date Property   string publish_date {get;set;}

title        Property   string title {get;set;}

Well, that is about it for today. Join me tomorrow when I will talk about more cool Windows PowerShell stuff.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy 

Summary: Use the [xml] type accelerator to greatly simplify reading XML documents.

 How can I easily read an XML file?

 Use the [XML] type accelerator to convert results from Get-Content into an XML document, and then use dotted notation to access the nodes:

[xml]$books = Get-Content C:\fso\Books.XML

$books.catalog.book.title

Summary: Microsoft Scripting Guy, Ed Wilson, shows how to use Windows PowerShell to unblock all files in a directory.

Microsoft Scripting Guy, Ed Wilson, is here. Today is the day. As those of you who have been reading the Hey, Scripting Guy! Blog on a regular basis know, today is the speaker’s dinner (and scripting slumber party) for Windows PowerShell Saturday in Charlotte, North Carolina. The speaker’s dinner and slumber party take place at the house that script built, and the Scripting Wife and I are the hosts. Check the website to see if any tickets remain—they have been flying off the shelves this week. If at all possible, you do not want to miss Windows PowerShell Saturday in Charlotte because there is an all-star lineup of speakers, and with three tracks and lots of sessions to choose from, it will be a learning extravaganza. Having just returned from Redmond (or the “mother ship” as some of my more sarcastic friends refer to the Microsoft headquarters), I am definitely pumped up, psyched-out, hyped-up (or whatever enthusiastic adverb you wish to use to describe me). Teresa will have a hard time restraining me as I deliver my two presentations on Windows PowerShell cool stuff!

The problem with blocked files

So, when I was getting ready to head out to Redmond for the week, I needed to ensure I had my Hey, Scripting Guy! Blog template copied on my corporate laptop. I do not normally use this laptop to write my blog because it simplifies things if I use a machine connected to my test lab instead of having to demonstrate alternate credentials for every single command.

So I copied my template file to a USB drive from my lab environment computer, and pasted the template to my corporate network-joined laptop. Cool, sneaker net rules! Then I opened the file, and I was greeted with a non-working file. The Microsoft Word document had a big yellow bar across the top informing me that I am in Protected View. Well, that may be fine for reading a document, but when you are a Scripting Guy with lots of people with whom to meet, and lots of blogs to write, suffice to say, the Protected View does not work. Sure, I can click Enable Editing, but that is just annoying. This view is shown in the image that follows.

Unblocking all files in a folder

Luckily, Windows PowerShell 3.0 in Windows 8 has the Unblock-File cmdlet. In the past, I have used the Streams utility to perform this operation—in fact, I showed the Scripting Wife how to do this in Scripting Wife Learns About Unblocking Files in PowerShell. If you do not have Windows 8, you can still use the technique from that post to unblock files. It works great (even if the Scripting Wife did accuse me of breaking her computer).

To unblock all the files in a folder, I first use the Get-ChildItem cmdlet to return a list of FileInfo objects from the directory, and then I pipe them to the Unblock-File cmdlet. Because I am changing system state (modifying a potentially great number of files), I want to first ensure that the command does what I want it to do, so I use the WhatIf parameter. This is shown here. (gci is an alias for the Get-ChildItem cmdlet.)

That looks like exactly what I want to accomplish, so I remove the WhatIf parameter and run the following command.

gci c:\fso | Unblock-File

Like I said, nothing returns. So I need to perform a test to see if the command worked. I open my HSG-Template.docx file, and as you can see here, the yellow blocking bar is now removed.

That is about all there is to unblocking files with Windows PowerShell 3.0. If you want to control which files to unblock, use the parameters of the Get-ChildItem cmdlet to modify the way you return files.

Join me tomorrow when I will talk about more cool Windows PowerShell stuff.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy 

Summary: Determine the source of a particular Windows PowerShell cmdlet.

 How can I tell if a Windows PowerShell cmdlet comes from one module or from another module?

 Use the Get-Command cmdlet, and select the module property:

Get-Command unblock-file | select name, module

Summary: Microsoft Scripting Guy, Ed Wilson, talks about identifying what a Windows PowerShell module exposes to the user.

Microsoft Scripting Guy, Ed Wilson, is here. This is it; today is the day for Windows PowerShell Saturday in Charlotte, North Carolina. If you are in the area of the Microsoft Office today, come on by and at least say hi. There are nearly 250 people attending the event, and it is like Woodstock, Burning Man, and the World’s Fair all rolled into one huge scripting geek fest. (Oh, by the way, if you are unable to attend the Charlotte, North Carolina Windows PowerShell Saturday, there is another one in Atlanta, Georgia on October 27, 2012. In the coming weeks, I will be posting pictures from the Windows PowerShell Saturday event and from the scripting slumber party (which means finding time to upload the pictures to my computer and sorting through literally hundreds of pics).

One of the cool things about Windows PowerShell modules is that they can contain a number of items. These items include aliases, cmdlets, and functions. To find these things, first use the Get-Module cmdlet to retrieve the module, and then examine the properties. A good place to start is to look at the members of the PSModuleInfo object. This is shown here. (gm is an alias for get-Member.)

PS C:\> Get-Module *management | gm -MemberType property ex*

   TypeName: System.Management.Automation.PSModuleInfo

Name                MemberType Definition

----                ---------- ----------

ExportedAliases     Property   System.Collections.Generic.Dictionary[string,Syste...

ExportedCmdlets     Property   System.Collections.Generic.Dictionary[string,Syste...

ExportedCommands    Property   System.Collections.Generic.Dictionary[string,Syste...

ExportedFormatFiles Property   System.Collections.ObjectModel.ReadOnlyCollection[...

ExportedFunctions   Property   System.Collections.Generic.Dictionary[string,Syste...

ExportedTypeFiles   Property   System.Collections.ObjectModel.ReadOnlyCollection[...

ExportedVariables   Property   System.Collections.Generic.Dictionary[string,Syste...

ExportedWorkflows   Property   System.Collections.Generic.Dictionary[string,Syste...

When I see that there are properties for the various things a module might export, I want to examine them. First, notice that these are all collections. This has implications for the way that information returns from the Get-Module cmdlet. I like to see what properties are returning anything at all, so an easy way to do that is to pipe the results to the Format-Table cmdlet as shown here. (ft is an alias for Format-Table, and I am choosing properties that begin with the letters ex.)

PS C:\> Get-Module *management | ft ex*

ExportedFu ExportedCm ExportedCo ExportedVa ExportedAl ExportedW ExportedF ExportedT

nctions    dlets      mmands     riables    iases      orkflows  ormatFile ypeFiles

                                                                 s

---------- ---------- ---------- ---------- ---------- --------- --------- ---------

{}         {[Add-C... {[Add-C... {}         {}         {}        {}        {}

It appears that only two of the properties return information for the *management module, the ExportedCmdlets and the ExportedCommands properties. Let me hone in on them by using the command shown here.

PS C:\> Get-Module *management | ft exportedc*

ExportedCmdlets                            ExportedCommands

---------------                            ----------------

{[Add-Computer, Add-Computer], [Add-Con... {[Add-Computer, Add-Computer], [Add-Co...

I see that both properties, ExportedCmdlets and ExportedCommands return exactly the same information. Therefore, I will focus my efforts on ExportedCmdlets. Here is the command I use.

PS C:\> Get-Module *management | Select ExportedCmdlets

ExportedCmdlets

---------------

{[Add-Computer, Add-Computer], [Add-Content, Add-Content], [Checkpoint-Computer, ...

PS C:\>

Bummer! I do not see all of the exported cmdlets. The reason goes back to the fact that we have a collection, and we are limited by the value of the automatic preference variable, $FormatEnumerationLimit (it is set to 4 by default. (For more information about this variable, see Change a PowerShell Preference Variable to Reveal Hidden Data.) Without changing the value of $FormatEnumerationLimit, the easiest way to see all of the cmdlets is to add the ExpandParameter parameter to the Select-Object command. This is shown here.

Get-Module *management | Select -expand ExportedCmdlets

The command and associated output are shown in the image that follows.

Join me tomorrow when I will talk about more cool Windows PowerShell stuff.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy

Summary: Use Windows PowerShell to identify updates applied to a computer system.

 How can I find which updates are applied to my computer?

Use the Get-Hotfix cmdlet. To find updates, use the Description parameter and specify Update:

Get-HotFix -Description Update

To find a specific hotfix by ID number, use the Id parameter:

Get-HotFix -id kb2741530 

Summary: Microsoft Scripting Guy, Ed Wilson, talks about using a preference variable to provide detailed Windows PowerShell command lifecycle information.

Microsoft Scripting Guy, Ed Wilson, is here. This has certainly been an interesting Windows PowerShell week. Yes indeed, it has been a fine Windows PowerShell week. The week began with a trip to Redmond to meet with the members of the Windows PowerShell team, my manager, and other teammates; and it ended with Windows PowerShell Saturday in Charlotte, North Carolina. In between, I had a few minutes to play around with Windows PowerShell 3.0 (on the plane going to and coming from Seattle, in my room at night, and between meetings). I was also able to catch up a bit on some email. So yes, all-in-all it was a fine Windows PowerShell week!

Examining Windows PowerShell preference variables

There are 30 Windows PowerShell 3.0 preference variables. These variables change and control the way that Windows PowerShell behaves. In fact, I would say that in 99.99 percent of the cases, the default values are perfect. For special situations or for unique requirements, I need to know what the preference variables are, what they do, and how to change them.

Luckily, there is About Help. In Windows PowerShell, there are two types of Help, the cmdlet Help (these topics get all the good press) and About Help. About Help is conceptual in nature. Many of these topics have quite detailed information (I know because I wrote some of them). About Help is ignored by the majority of Windows PowerShell users, but these topics should be read by anyone who desires to have a deeper understanding of how Windows PowerShell works.

I still find myself reading certain topics again and again just to verify that I have not forgotten some particular nuance about the way Windows PowerShell works or picked up any “bad habits” (I had to retype this sentence because Word autocorrected to “bad hobbits.” Personally, I have never met a bad hobbit.”) To find all About Help, use the Get-Help cmdlet, and supply about* to it (the Help function contains more, and it therefore pages results one at a time). The command is shown here.

Help about*

Logging Windows PowerShell commands

To log the lifecycle of Windows PowerShell commands to the Windows PowerShell event log, set the value of LogCommandLifecycleEvent to true as shown here.

$LogCommandLifecycleEvent = $true

I do not need to restart Windows, nor do I need to restart Windows PowerShell—all I need to do is to type a command. At that point, the lifecycle of the command writes to the Windows PowerShell log. I can, of course, use Windows PowerShell to obtain the information. To query the Windows PowerShell event log, I can use the Get-EventLog cmdlet. Keep in mind, that there is a space in Windows PowerShell, and therefore, you need quotation marks around the log name. The command is shown here.

Get-EventLog -LogName "windows powershell"

Command lifecycle Started are Event ID 500. Command lifecycle Stopped are Event ID 501. Therefore, typing a simple command like Get-Process generates a number of events. These events are shown here.

Get-EventLog -LogName "windows powershell" | ft timegenerated, instanceid, message -auto –Wrap

The command and the associated output are shown here.

To get a better idea of what is going on, select only the Message property as shown here.

Get-EventLog -LogName "windows powershell" | select message

When I do this, I see the lifecycle.  Get-Process starts, then Out-Lineoutput, then Format-Default. This is shown here. The commands appear in reverse order, so read from bottom to top.

Command "format-default" is Started. ...

Command "out-lineoutput" is Started. ...

Command "Get-Process" is Started. ...

Next, the same commands stop. This is shown here.

Command "out-lineoutput" is Stopped. ...

Command "format-default" is Stopped. ...

Command "Get-Process" is Stopped. ...

Can this information help me troubleshoot a Windows PowerShell issue? Who knows, but it is interesting; and I can definitely say that if I had not run across it, I would not be able to use it if or when an issue did arise. Play with the preference variables, see what you can come up with that will help, and then share your results with the community. After all, that is what community is all about.

Join me tomorrow when I will talk about more cool Windows PowerShell stuff.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy

Summary:  Use the Get-Help cmdlet to find the Windows PowerShell 3.0 preference variables.

 How can you easily find a listing of all the Windows PowerShell 3.0 preference variables?

 Use the Get-Help cmdlet to display about_Preference_Variables Help.

You do not need to type the entire command—the following command opens the Help:

help about_pref*

Summary: Learn about using Windows PowerShell to manage the new User Access Logging feature in Windows Server 2012.

Microsoft Scripting Guy, Ed Wilson, is here. Today we have as our guest blogger, Brent Forman. Here is a little bit about Brent.

Brent Forman is senior program manager in the Windows Server division at Microsoft. Brent has extensive experience in large scale IT operations and management through working in Windows Server for more than eight years and providing leadership to internal R&D datacenter operations across the Microsoft Server and Tools business.

User Access Logging (UAL) in Windows Server 2012 presents new opportunities to IT Pros by providing an at-a-glance view of server role client demand within an enterprise environment. This can help IT Pros understand and optimize server resource usage and identify potential bottlenecks and gaps across an IT infrastructure. User Access Logging fundamentally aggregates basic usage tracking of a server’s roles by measuring client requests over time of a local Windows Server 2012 installation. This blog post is intended to show how using a few quick Windows PowerShell cmdlets can give you the data you need to easily quantify client requests over time, for a specific role or application, on a specific server.

UAL architecture

The UAL service logs unique client access requests, in the form of IP addresses and user names, of server roles on the local Windows Server 2012. Client access request events are aggregated and stored locally in near real time (a separate database is not required). This information can then be queried locally or remotely via Windows PowerShell or WMI, by a user with administrative privileges.

Notes  By design, there is a default 24-hour delay before events can be retrieved by Windows PowerShell cmdlets or WMI queries. The UAL service’s default configuration is to start, run, and collect data. No UAL data is sent to Microsoft. This service is intended for administrators only.

UAL Windows PowerShell cmdlets

The following are the main cmdlets you will use.

• Get-UalOverview  Retrieves and displays basic UAL data for all installed server roles (except DNS and Hyper-V, which have separate, dedicated UAL cmdlets)
• Get-UalUserAccess  Retrieves and displays UAL data by client user names and roles
• Get-UalDailyUserAccess  Retrieves and displays UAL data by client user name and date
• Get-UalDeviceAccess  Retrieves and displays UAL data by client device IP and roles
• Get-UalDailyDeviceAccess  Retrieves and displays UAL data by client device IP and date

See Managing User Access Logging for a complete list of UAL cmdlets.

Note  Be sure to check out Get-UalSystemId to see what is provided there that might meet your needs.

Of particular interest to the IT Pro would be the ActivityCount and AccessCount output for the last four cmdlets in the previous list. For remote administrator retrieval, exposing this data is a potential gold mine to assist with planning server resources efficiently.

Data that is retrieved with these cmdlets can help an administrator answer questions like:

• Which server is getting the most requests from clients?
• Which server is getting the most requests from unique clients vs. generic clients?
• What server roles are getting the most activity and at what point in the cycle (for example: day, week, quarter, or year)?
• Coupled with performance tool data, at what point do new resources need to be brought to bear, or at what point in the cycle?
• Which clients are the most active in my environment?
• How efficiently are my current servers being used? Does the load warrant a separate dedicated server?

UAL Windows PowerShell cmdlet examples and output

Get-UalOverview is meant as a quick inventory of what is installed on a server and what is active. Most of the server roles will appear in the output, but only those with an entry for FirstSeen and LastSeen are installed and actively servicing client requests. The use of this cmdlet and a typical output are shown here (for brevity, only File Server and BranchCache are shown in the output). In this example, File Server is installed and actively servicing client requests, and BranchCache is not.

PS C:\> Get-UalOverview

FirstSeen   : 7/14/2012 11:41:21 AM

GUID      : 10a9226f-50ee-49d8-a393-9a501d47ce04

LastSeen    : 8/18/2012 10:41:01 PM

ProductName  : Windows Server 2012 Datacenter

RoleName    : File Server

PSComputerName :

FirstSeen   :

GUID      : 910cbaf9-b612-4782-a21f-f7c75105434a

LastSeen    :

ProductName  : Windows Server 2012 Datacenter

RoleName    : BranchCache

PSComputerName :

…………

Get-UalDeviceAccess and Get-UalUserAccess output data that is centric to client users and client devices that are specific to server roles and applications. They provide first and last “seen” data per client. The use of these cmdlets and typical output is shown here. This example shows all the data that is unique to testuser1, and separately, all the data that is unique to testuser2.

PS C:\> Get-UalUserAccess –RoleName “File Server”

ActivityCount  : 18

FirstSeen    : 7/14/2012 11:41:21 AM

LastSeen     : 8/18/2012 10:41:00 PM

ProductName   : Windows Server 2012 Datacenter

RoleGuid     : 10a9226f-50ee-49d8-a393-9a501d47ce04

RoleName     : File Server

TenantIdentifier : 00000000-0000-0000-0000-000000000000

UserName     : testdomain\testuser1

PSComputerName  :

ActivityCount  : 83

FirstSeen    : 7/14/2012 11:51:11 AM

LastSeen     : 8/18/2012 10:41:01 PM

ProductName   : Windows Server 2012 Datacenter

RoleGuid     : 10a9226f-50ee-49d8-a393-9a501d47ce04

RoleName     : File Server

TenantIdentifier : 00000000-0000-0000-0000-000000000000

UserName     : testdomain\testuser2

PSComputerName  :

Although the Device and User “Access” cmdlets are paired with “Daily” versions, their intended use and output can be quite different. The “Daily” cmdlets, Get-UalDailyUserAccess and Get-UalDailyDeviceAccess, are provided to allow administrators to query a specific day or date range. To use these cmdlets to query a range, we must call into WMI from Windows PowerShell (for brevity, only the output for one user, on one day, is shown).

PS C:\> GWMI MsftUal_DailyUserAccess –ns root\AccessLogging –filter "AccessDate >= '7/14/2012' and AccessDate <= '8/15/2012'"

__GENUS     : 2

__CLASS     : MsftUal_DailyUserAccess

__SUPERCLASS   :

__DYNASTY    : MsftUal_DailyUserAccess

__RELPATH    : MsftUal_DailyUserAccess.UserName="testdomain\\testuser1"

__PROPERTY_COUNT : 6

__DERIVATION   : {}

__SERVER     : testcomputer

__NAMESPACE   : root\AccessLogging

__PATH      : \\testcomputer\root\AccessLogging:MsftUal_DailyUserAccess.UserName="testdomain\\testuser1"

AccessCount   : 32

AccessDate    : 20120714184121.000000+000

ProductName   : Windows Server 2012 Datacenter

RoleGuid     : 10a9226f-50ee-49d8-a393-9a501d47ce04

RoleName     : File Server

UserName     : testdomain\testuser1

PSComputerName  : testcomputer

……………

UAL does not measure or expose the relative impact of any client activity or access on a system; however, for any role, an administrator could correlate this data with performance data for an infrastructure system and develop custom metrics that are specific to their environment.

Additional references

For more documentation about UAL, see the following topics in the Windows Server TechCenter:

User Access Logging Overview

Manage User Access Logging

User Access Logging and Resulting Internet Communication in Windows Server 2012

Also see the following topic in the Windows Dev Center:

User Access Logging

In addition, the Microsoft Assessment and Planning Toolkit enables you to consume, aggregate across a deployment of many servers, and generate reports of the data. To download this toolkit, see Microsoft Assessment and Planning Toolkit in the Microsoft Download Center.

~Brent

Thank you, Brent! This is a way cool feature and a great explanation.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy 

Summary: Learn how to identify automatic variables.

 How many types of automatic variables exist by default? And how would you discover such a thing?

 There are five types of automatic variables that exist by default.

To discover them, use the variable provider and the Get-Member cmdlet:

PS C:\> dir variable: -Force | gm | select typename | sort typename -Unique

TypeName

--------

System.Management.Automation.LocalVariable

System.Management.Automation.NullVariable

System.Management.Automation.PSVariable

System.Management.Automation.QuestionMarkVariable

System.Management.Automation.SessionStateCapacityVariable

Summary: Learn how to create a Windows PowerShell scheduled job.

Microsoft Scripting Guy, Ed Wilson, is here. Well, the Scripting Wife and I are about to straighten up the scripting house after the Windows PowerShell Saturday luau we had on Friday and the scripting slumber party we had over the weekend. Frankly, it is an awful lot of work to put on a Windows PowerShell Saturday event, and it would not have been possible without Windows PowerShell Charlotte User Group president (and Windows PowerShell MVP), Jim Christopher; Windows PowerShell Charlotte user member, Brian Wilhite; and the Scripting Wife. In all sincerity, if it were not for these three completely awesome people, Windows PowerShell Saturday in Charlotte would not have happened.

We are also looking forward to Windows PowerShell Saturday in Atlanta on October 27, 2012. In fact, all of us will attend the Atlanta Windows PowerShell Saturday event. Registration opens soon, and it will sell out (as did the Columbus and the Charlotte Windows PowerShell Saturday events). So you should stand by to register to ensure a seat.

Creating a PowerShell scheduled job

One of the cool new features of Windows PowerShell is the updatable Help. This enables Help to update to the latest content easily. In fact, as we speak, Help is being updated. Therefore, it is important to update the Help on a regular basis. The problem is that I sometimes forget to do this. This is where Windows PowerShell scheduled jobs come into play. I created a scheduled job to update Help for me. To look at the cmdlets available in the PSScheduledJob module, I use the Get-Command cmdlet. This is shown here.

PS C:\> gcm -Module PSScheduledJob

CommandType     Name                                               ModuleName

-----------     ----                                               ----------

Cmdlet          Add-JobTrigger                                     PSScheduledJob

Cmdlet          Disable-JobTrigger                                 PSScheduledJob

Cmdlet          Disable-ScheduledJob                               PSScheduledJob

Cmdlet          Enable-JobTrigger                                  PSScheduledJob

Cmdlet          Enable-ScheduledJob                                PSScheduledJob

Cmdlet          Get-JobTrigger                                     PSScheduledJob

Cmdlet          Get-ScheduledJob                                   PSScheduledJob

Cmdlet          Get-ScheduledJobOption                             PSScheduledJob

Cmdlet          New-JobTrigger                                     PSScheduledJob

Cmdlet          New-ScheduledJobOption                             PSScheduledJob

Cmdlet          Register-ScheduledJob                              PSScheduledJob

Cmdlet          Remove-JobTrigger                                  PSScheduledJob

Cmdlet          Set-JobTrigger                                     PSScheduledJob

Cmdlet          Set-ScheduledJob                                   PSScheduledJob

Cmdlet          Set-ScheduledJobOption                             PSScheduledJob

Cmdlet          Unregister-ScheduledJob                            PSScheduledJob

I used three steps to create a Windows PowerShell scheduled job (although you do not need to perform all three steps if you do not want or need to do so).

Create a trigger

First, I decided I wanted to create a trigger—something that will kick off my Windows PowerShell scheduled job. Because I want to do this every day, it is easy—I use the Daily parameter and specify a specific time. After I create the new job trigger, I need to store the returned job trigger in a variable so I can supply it to the Register-ScheduledJob cmdlet. Here is the command I used to create the job trigger.

$dailyTrigger = New-JobTrigger -Daily -At "2:00 PM"

Create options for the scheduled job

Next, to specify options for the Windows PowerShell scheduled job, I use the New-ScheduledJobOption cmdlet. The two options that I want to specify are StartIfOnBattery and StartIfIdle. I want the job to run even if the computer is running on battery (by default, the job will not run if on battery). In addition, I want to start the job only if the laptop is idle (for example, if I am actively writing a Windows PowerShell script, I do not want the laptop to begin the process of downloading and installing new Windows PowerShell Help.) When creating the scheduled job options, I store the resulting object to a variable that I will use when I create the actual scheduled job. Here is the command.

$option = New-ScheduledJobOption -StartIfOnBattery –StartIfIdle

Register the scheduled job

Now it is time to register the Windows PowerShell scheduled job. (Yes, you use Register-ScheduledJob to register the Windows PowerShell scheduled job.) When I register the scheduled job, I first provide a decent name for the job. Then I specify my command as a ScriptBlock. Finally I supply the trigger and the options I stored previously in variables. The complete command is shown here.

Register-ScheduledJob -Name UpdateHelp -ScriptBlock `

{Update-Help -Module * -Force} -Trigger $dailyTrigger -ScheduledJobOption $option

Look at the scheduled job

To look at the scheduled job, open the Task Scheduler MMC by typing the following command.

Taskschd.msc

To find the Windows PowerShell scheduled jobs, navigate to the following node in the Task Scheduler: Task Scheduler Library\Microsoft\Windows\PowerShell\Scheduled Jobs. Under the Scheduled Jobs node, I find a folder for each Windows PowerShell scheduled job as shown in the following image.

Well, that is about it for now. Join me tomorrow when I will talk about more cool Windows PowerShell 3.0 stuff.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy

Summary: Use Show-Command to display interactive Windows PowerShell parameter Help.

 How do you display the parameters and parameter sets of Windows PowerShell cmdlets in an interactive fashion?

 Use the Show-Command cmdlet from the Windows PowerShell console or the Windows PowerShell ISE:

            Show-Command –name cmdletname

For example:

Show-Command get-process

Summary: Windows PowerShell 3.0 introduces the PSDefaultParameterValues automatic variable, which permits creating custom default values.

Microsoft Scripting Guy, Ed Wilson, is here. Life is returning to normal—at least for this week. Next week, the Scripting Wife and I head north where I will be speaking at the Central Ohio PowerShell User Group (COPUG) on October 2, 2012. There are only a few tickets left for this free event, so if you are in the area and you want to catch up with us while we are there, you will need to register soon.

For today, I am sitting at my desk, checking email, and sipping a nice cup of Gunpowder Green Tea with a bit of lemon grass and a cinnamon stick for sweetness. Outside, there has been a cool steady drizzle of rain, and the wind has been whistling through the trees causing the leaves to rustle like crinolines on prom night.

Finding custom Windows PowerShell default values

In Windows PowerShell 3.0, a new automatic variable exists called PSDefaultParameterValues. This variable is shown here.

PS C:\> Get-Variable PSDefaultParameterValues

Name                           Value

----                           -----

PSDefaultParameterValues       {}

As you can see, the value of the PSDefaultParameterValues automatic variable accepts an object. This information also appears in Get-Member.

PS C:\> Get-Variable PSDefaultParameterValues | Get-Member  -Name value

   TypeName: System.Management.Automation.PSVariable

Name  MemberType Definition

----  ---------- ----------

Value Property   System.Object Value {get;set;}

Note   Remember that when setting a value or retrieving a value for a variable, the dollar sign ($) identifies the variable. But when using cmdlets such as Get-Variable, Set-Variable, or New-Variable, the dollar sign does not come into play. This is because the dollar sign is not actually part of the variable name.

Setting custom Windows PowerShell default values

So what good is the PSDefaultParameterValues automatic variable? Suppose I have a cmdlet that I use on a regular basis, and every time I use the cmdlet, I am typing the same parameter values. A useful example of this might be if I use the Send-MailMessage cmdlet to send mail notifications from scripts—I would typically use the same SMTP server for each calling of the cmdlet. In fact, this scenario appears in about_Parameters_Default_Values in the Microsoft TechNet Library.

To set a default value for a cmdlet, I essentially use a hash table.

Note   If you have not noticed, hash tables are really important. To move beyond basic Windows PowerShell techniques, you need to know how to create a hash table. See this collection of Hey, Scripting Guy! Blogs for more information about creating and using hash tables.

The syntax to assign a new default value is shown here.

In the following example, I create a default value for the Name parameter of the Get-Process cmdlet. This permits me to quickly find information about the Explorer process.

$PSDefaultParameterValues = @{"Get-Process:name"="explorer"}

Now when I run the Get-Process cmdlet, it only returns information about the Explorer process. I can override this by using a wildcard character. This technique is shown here.

gps *

The commands and the output associated with the commands are shown in the image that follows.

If I open a new Windows PowerShell console, the new defaults do not apply. To change the default behavior of a cmdlet, function, or advanced function that happens every time I open the Windows PowerShell console or Windows PowerShell ISE, I need to add the command to my Windows PowerShell profile.

            Note   For more information about profiles, see this collection of Hey, Scripting Guy! Blogs.

That is all there is to creating and to using custom default values in Windows PowerShell 3.0. Join me tomorrow for more cool Windows PowerShell 3.0 stuff.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy 

Summary:  Use the More function to display Windows PowerShell information one page at a time.

 How can you cause Windows PowerShell to easily display information one console screen at a time?

 Use the More function:

            Get-Command –Command cmdlet | select name, module | more

 Wow, the More function is cool. Can I use that inside the Windows PowerShell ISE?

 No. You can only use the More function inside the Windows PowerShell console.

 By the way, how did you know that More was a function, not a cmdlet or a native command?

 Use the Get-Command cmdlet:

           Get-Command more

Summary: Microsoft Scripting Guy Ed Wilson talks about using the new Windows PowerShell redirectioin operators to add flexibility to a script.

 Hey, Scripting Guy! There is something about Windows PowerShell that I don’t get. Normally, I can use the redirection arrows to write to a text file, but sometimes it does not work. Is this a bug in Windows PowerShell, or is there something I don’t understand (probably)?

—TL

 Hello TL,

Microsoft Scripting Guy, Ed Wilson, is here. The Scripting Wife and I spent much of last night working on our three-week European tour itinerary. We will be visiting a number of Windows PowerShell User Groups, and seeing even more Windows PowerShell MVPs. This morning, the Scripting Wife emailed our working itinerary to our various contacts. Stay tuned. Like The Monkeys, we may be coming to your town.

Understanding various output streams

Understanding output might sound complicated, but it is actually easy. Windows PowerShell has various output streams. What most beginning Windows PowerShell users think of as output is only one output stream—the success output; but there are many output streams:

• Success output
• Error message output
• Warning message output
• Verbose message output
• Debug message output

Note   The descriptions of and uses for the various redirection operators are explained in the about_Redirection topic in the TechNet Library. Refer to that topic for a great chart that details all of the redirection operators.

In Windows PowerShell 3.0, there are three new redirection operators. These operators are shown here.

Like other redirection operators, there are the overwrite (>) and the append (>>) versions. The default values for the different streams (configured as preference variables) display errors and warnings, but not verbose and debug. This is shown here.

PS C:\> dir variable: -Include "*preference" -Recurse

Name                           Value

----                           -----

ConfirmPreference              High

DebugPreference                SilentlyContinue

ErrorActionPreference          Continue

ProgressPreference             Continue

VerbosePreference              SilentlyContinue

WarningPreference              Continue

WhatIfPreference               False

When a default preference variable receives a SilentlyContinue value, it means that the stream does not display to the host. Instead, Windows PowerShell silently continues past the command to the next command. When the value is Continue, it means the stream displays to the host, and Windows PowerShell continues to the next command.

To change a value temporarily, I add a value assignment at the top of a Windows PowerShell script. The change affects the host as long as the host remains open. When the host is closed, it reverts to normal. To make the change “permanent,” add the value to the Windows PowerShell profile.

In the DemoRedirectionStream.ps1 script, I first set three preference variables as shown here.

$VerbosePreference = "continue"

$WarningPreference = "continue"

$DebugPreference = "continue"

Next I use the Write-Warning, Write-Verbose, and the Write-Debug cmdlets to emit text strings through the various output streams. The first Write-Warning does not redirect to a text file, and it appears to the Windows PowerShell host. The remaining commands redirect to various text files, and they do not appear in the Windows PowerShell host output. This is shown in the following image.

The three output text files are shown here.

TL, that is all there is to using Windows PowerShell 3.0 redirection operators. Join me tomorrow as I talk about more Windows PowerShell. It will be cool!

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy 

Summary: Use the warning redirection operator to redirect Windows PowerShell warning messages to a text file.

 How can you prevent warning messages from displaying to the Windows PowerShell host, but instead capture them in a text file?

 Use the warning message redirection operator:

$WarningPreference = "continue"

 Write-Warning "this is warning" 3> c:\fso\warning.txt

Summary: Microsoft Scripting Guy, Ed Wilson, shows how to use Windows PowerShell 3.0 to easily download web page links from a blog.

Microsoft Scripting Guy, Ed Wilson, is here. Today the weather outside is beautiful here in Charlotte, North Carolina in the United States. I opened the windows around the scripting house, and from my office, I am looking out on the green trees in our front yard. Our magnolia tree is still in bloom, as are our neighbor’s hibiscus plants. (Luckily for my neighbor, I get my hibiscus flowers from an organic grower on the Internet; otherwise, he might open his door one morning to find my teacup and I in his garden.)

The Scripting Wife continues to hammer away at the details for our three-week European tour, and the emails, Facebook posts, and tweets are flying back-and-forth across the big pond nearly 24-hours a day. When we have everything organized, I will post updates on the Scripting Guys Community page.

Use Invoke-WebRequest to obtain links on a page

By using the Invoke-WebRequest cmdlet in Windows PowerShell 3.0, downloading page links from a website is trivial. When I write a Windows PowerShell script using Windows PowerShell 3.0 features, I add a #Requires statement. (I did the same thing in the early days of Windows PowerShell 2.0 also. When Windows PowerShell 3.0 is ubiquitous, I will probably quit doing this.) Here is the #Requires statement.

#requires -version 3.0

The next thing I do is use the Invoke-WebRequest cmdlet to return the Hey, Scripting Guy! Blog. I store the returned object to a variable named $hsg as shown here.

$hsg = Invoke-WebRequest -Uri http://www.scriptingguys.com/blog

The object that is stored in the $hsg variable is an HTMLWebResponseObject object with a number of properties. These properties are shown here.

PS C:\> $hsg | gm -MemberType Property

   TypeName: Microsoft.PowerShell.Commands.HtmlWebResponseObject

Name              MemberType Definition                                                              

----              ---------- ----------                                                              

AllElements       Property   Microsoft.PowerShell.Commands.WebCmdletElementCollection AllElements {...

BaseResponse      Property   System.Net.WebResponse BaseResponse {get;set;}                          

Content           Property   string Content {get;}                                                   

Forms             Property   Microsoft.PowerShell.Commands.FormObjectCollection Forms {get;}          

Headers           Property   System.Collections.Generic.Dictionary[string,string] Headers {get;}     

Images            Property   Microsoft.PowerShell.Commands.WebCmdletElementCollection Images {get;}  

InputFields       Property   Microsoft.PowerShell.Commands.WebCmdletElementCollection InputFields {...

Links             Property   Microsoft.PowerShell.Commands.WebCmdletElementCollection Links {get;}   

ParsedHtml        Property   mshtml.IHTMLDocument2 ParsedHtml {get;}                                  

RawContent        Property   string RawContent {get;}                                                

RawContentLength  Property   long RawContentLength {get;}                                            

RawContentStream  Property   System.IO.MemoryStream RawContentStream {get;}                          

Scripts           Property   Microsoft.PowerShell.Commands.WebCmdletElementCollection Scripts {get;} 

StatusCode        Property   int StatusCode {get;}                                                    

StatusDescription Property   string StatusDescription {get;}        

I decide that I need to use the Links property to return the hyperlinks from the Hey, Scripting Guys! Blog. This command is shown here.

$hsg.Links

As I looked over the returned links, I noticed that their appeared to be several different classes of links. To review the different types of links, I piped the classes to the Sort-Object cmdlet, and I used the Unique switch. This command is shown here, along with the associated output.

PS C:\> $hsg.Links | select class | sort class -Unique

class                                                                                                

-----                                                                                                

external-link view-post                                                                              

internal-link advanced-search                                                                         

internal-link rss                                                                                    

internal-link view-application                                                                       

internal-link view-detail-list                                                                       

internal-link view-group                                                                              

internal-link view-home                                                                              

internal-link view-list                                                                               

internal-link view-post                                                                              

internal-link view-post-archive-list                                                                 

internal-link view-user-profile                                                                       

last                                                                                                 

menu-title                                                                                            

MSTWButtonLink                                                                                       

page                                                                                                 

rss-left                                                                                              

rss-right                                                                                            

selected                                                                                              

sidebar-tile-comments                                                                                

sidebar-tile-contact                                                                                 

sidebar-tile-subscribe                                                                                

tweet-url hashtag                                                                                    

tweet-url username                                                                                    

twtr-fav                                                                                             

twtr-join-conv                                                                                       

twtr-profile-img-anchor                                                                               

twtr-reply                                                                                           

twtr-rt                                                                                               

twtr-timestamp                                                                                       

twtr-user       

From the list, I can see that I am interested in only the “internal-link view-post” class of links. I add a Where-Object command (using the simplified syntax) to return only the “internal-link view-post” class links, and I am greeted with the output shown here. (I have deleted all but one instance of the record.)

PS C:\> $hsg.Links |

 Where class -eq 'internal-link view-post'

innerHTML : <span></span>Use PowerShell Redirection Operators for Script Flexibility

innerText : Use PowerShell Redirection Operators for Script Flexibility

outerHTML : <a class="internal-link view-post" href="http://blogs.technet.com/b/heyscriptingguy/archive/2012/09/20/use-powersh

            ell-redirection-operators-for-script-flexibility.aspx"><span></span>Use PowerShell

            Redirection Operators for Script Flexibility</a>

outerText : Use PowerShell Redirection Operators for Script Flexibility

tagName   : A

class     : internal-link view-post

href      : /b/heyscriptingguy/archive/2012/09/20/use-powershell-redirection-operators-for-script-flex

            ibility.aspx

From this output, I see that I am interested in only the outerText, and the href properties. I select these two properties, and am left with the script that is shown here.

Get-WebPageLinks.ps1

#requires -version 3.0

$hsg = Invoke-WebRequest -Uri http://www.scriptingguys.com/blog

$hsg.Links |

 Where class -eq 'internal-link view-post' |

    select outertext, href

The script and associated output are shown in the image that follows.

One thing that might be interesting is to send the output to the Out-Gridview cmdlet. This would permit easier analysis of the data. To do that would require only adding the Out-GridView command to the end of the script. The modification is shown here.

$hsg.Links |

 Where class -eq 'internal-link view-post' |

    select outertext, href | Out-GridView

Join me tomorrow when I will talk about more cool Windows PowerShell 3.0 stuff.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy

Summary: Change the Intellisense timeout value in Windows PowerShell 3.0 ISE.

 How can I display the Intellisense options for a longer time when I am using the Windows PowerShell 3.0 ISE?

 Change the intellisense timeout value from the default 3 seconds to a greater value.

To do this, click Tools, and then click Options. On the General Settings tab, in the Intellisense section of the form, click the drop-down list to change the Intellisense timeout in seconds value.