Bruce Adamczak

Windows 2012 Core Survival Guide – Netmon capturing

2013-05-03T13:56:00Z

Learn about my 2012 Core Survival Guide here.

Netmon capturing

In this blog we are going to look at collecting a network capture using the NetSh.exe command. This tool will produce an .etl trace that can be read in Netmon. While in Netmon you will need to make the active parser "Windows" in order to parse the file correctly.

How to collect a network Trace

Command:

netsh trace start capture=yes tracefile=.\mytrace.etl maxsize=300

In the output below we have started collecting data in a 300mb Circular log. In order to review this data you will need to stop the collection and move the data to a box that has NetMon installed.

How to stop the network trace

Command:

netsh trace stop

In the output below we stopped the network trace. Notice the location of the final output.

I hope you found this useful. Please leave me a comment. Let me know if there are any core tasks you would like me to cover.

Bruce

Windows 2012 Core Survival Guide – Perfmon capturing

2013-04-16T02:36:00Z

Learn about my 2012 Core Survival Guide here.

Perfmon capturing

At this time there are no PowerShell commands for the management of perfmon. PowerShell does have three commands for accessing perfmon counters: get-counter, export-counter, import-counter.

For this reason we will still need to use the old Logman.exe command to manipulate perfmon.

Seeing a list of defined data collectors

Command:

Logman query

This command will list all of the data collector sets on the targeted server.

Viewing details on a single data collector set

In order to view details on a single data collect set you must know the exact spelling. If there is a space in the name you must place quotes around the name.

Command:

Logman query LogmanCapture

Creating a Data Collector Set

There are several ways to create a collector set. The example below was selected because it can simply be copied and pasted without requiring any additional files. This command will collect the necessary objects needed to do a quick performance analysis. To analyze this output you will need to move the blg file off of the core box onto a workstation with a GUI. You can use Perfmon which ships with the OS to review the data manually or PAL (found at: http://pal.codeplex.com/) which is a PowerShell script that can analyze the blg file based on Microsoft's recommended thresholds.

Command:

Logman create counter LogmanCapture -v mmddhhmm -c "\LogicalDisk(*)\*" "\Memory\*" "\Netlogon(*)\*" "\Paging file(*)\*" "\PhysicalDisk(*)\*" "\Process(*)\*" "\Processor(*)\*" "\System\*" -si 00:00:30 -f bincirc -o "c:\Perflogs\LogmanCapture_%computername%" -max 250

Starting the Data Collector Set

Command:

Logman start logmancapture

Notice in the output below the data collector is orignially in the stopped state. After the command has been run it is in the running state.

Stopping the Data Collector Set

Command:

Logman stop logmancapture

Notice the data collector below has gone from the running state to the stopped state.

I hope you found this useful. Please leave me a comment. Let me know if there are any core tasks you would like me to cover.

Bruce

Windows 2012 Core Survival Guide – Firewalls

2013-04-03T02:14:00Z

Learn about my 2012 Core Survival Guide here.

In this blog I am going to covers the very basic of viewing, enabling and disabling existing firewall rules.

How to view firewall settings

It is important to know the name of the rule you wish to enable or disable. The Get-NetFirewallRule cmdlet is used to list out all of the rules. You will need to know the exact spelling of the rules "Name" to manage a single rule or the exact spelling of the "DisplayGroup" to manage a group of rules.

PowerShell Command:

Get-netfirewallrule | format-table name, displaygroup, action, direction, enabled -autosize

The output below shows each rule, its Name, DisplayGroup, and if it is enabled or not.

Discovering where the Firewall Logs are located

Each firewall profile has a log. In order to discover where they are located you can use the cmdlet Get-netfirewallprofile.

PowerShell Command:

Get-netfirewallprofile | format-table name, enabled, logfilename -autosize

The output below shows the location of the firewall logs.

Displaying a single firewall rule settings

In order to discover all properties of a rule you can use the cmdlet show-netfirewallrule.

PowerShell Command:

Show-NetFirewallRule | where name -eq "CoreNet-DHCP-In"

Get-NetFirewallRule | where name -eq "CoreNet-DHCP-In"

The screen shot below shows the attributes for the firewall rule "CoreNet-DHCP-In".

How to enable a single firewall rule

To enable a firewall rule, we first get the object then pipe it to the enable-firewallrule cmdlet.

PowerShell Command:

Get-NetFirewallRule -name CoreNet-DHCP-In | enable-netfirewallrule

The output below shows that CoreNet-DHCP-In starts off disabled then is enabled by the command in yellow.

How to disable a single firewall rule

To disable a firewall rule we first get the object then pipe it to the disable-firewallrule cmdlet.

PowerShell Command:

Get-NetFirewallRule -name CoreNet-DHCP-In | disable-netfirewallrule

The output below shows that CoreNet-DHCP-In starts off enabled then is disabled by the command in yellow.

How to enable a DisplayGroup of firewall rules

To enable a DisplayGroup of firewall rules you must know the exact spelling of the display group and use the Enable-NetfirewallRule cmdlet.

PowerShell Command:

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

The screen shot below shows the current value, followed by the command to edit the value, followed by a command to confirm the settings have been changed.

How to disable a DisplayGroup of firewall rules

To disable a DisplayGroup of firewall rules you must know the exact spelling of the display group and use the disable-NetfirewallRule cmdlet.

PowerShell Command:

Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

In the screen shot below the first command shows the current value, followed by the command to disable the Remote Desktop firewall rules, followed by the command to confirm the setting changed.

I hope you found this useful. Please leave me a comment. Let me know if there are any core tasks you would like me to cover.

Bruce

Windows 2012 Core Survival Guide – Event Logs

2013-03-18T02:58:00Z

Learn about my 2012 Core Survival Guide here.

This blog looks at how to manage event logs. The key to using PowerShell to manage any event log is to know the exact spelling of the event log you wish to manager.

How to view a list of event logs

To get a list of the event logs I will use the Get-Eventlog cmdlet. This is one of those cmdlet where piping it to formant-list does not really change the output. So I left it off.

PowerShell Command:

Get-Eventlog -list

The output below displays a list of event logs active on this computer.

How to view events in an event log

Because event logs hold many events, it does not make sense to simply list all the event in the log. Below are several different ways to view parts of the event log.

Viewing events for the last hour

PowerShell Command:

Get-eventlog system -after (get-date).addhours(-1)

The output below shows the last hour of events in the System Log. You can replace "System" for any of the other event logs. You can also modify the value in ".addhours" to have a larger value like "(-12)" for the last 12 hours.

Viewing events by event type

This command only shows the error events for the last hour.

PowerShell Command:

Get-eventlog system -after (get-date).addhours(-1) | Where entrytype -eq Error

In the command above you can replace "Error" with "Information" or "Warning"

Viewing events by event source

This command show you only the events for the source of "NETLOGON"

PowerShell Command:

Get-eventlog system -after (get-date).addhours(-1) | Where Source -eq NetLogon

You can replace "NETLOGON" with the name of any source: for example "volmgr".

Viewing events by event index

Once you have narrowed down the event you wish to review, take note of the index number. You can display all of the details of that event based on the index number.

PowerShell Command:

Get-Eventlog System | where index -eq 5630 | format-list *

How to export event log to an CSV file

It is often easier to review events by viewing them in a tool like notepad. You can export any event log to a text file.

PowerShell Command:

Get-eventlog system | export-csv -path system.csv

The output below shows that the event log was written to system.csv (opened in Notepad). Excel will be the better tool for reviewing the data.

How to clear event log

PowerShell Command:

Clear-Eventlog "Windows PowerShell" -clear

In the output below, notice the number of entries for the Windows PowerShell log is 392. After the Clear-Eventlog cmdlet has been run the number of entries is zero.

I hope you found this useful. Please leave me a comment. Let me know if there are any core tasks you would like me to cover.

Bruce

Windows 2012 Core Survival Guide – User Functions

2013-03-11T01:00:00Z

Learn about my 2012 Core Survival Guide here.

This blog is going to cover some user functions like logging off, shutting down the OS, and launching Task Manager without the GUI.

How to log off

The Logoff command is not a native PowerShell cmdlet but it works from PowerShell.

Command:

Logoff

The screen shot below shows the user logging off their current session.

How to restart server

To restart the computer you can use the PowerShell cmdlet Restart-computer. The computer will shut down and restart using this cmdlet.

PowerShell Command:

Restart-computer

The command below will immediately restart the computer.

How to shutdown server

You can power off the computer using the PowerShell cmdlet Stop-Computer.

PowerShell Command:

Stop-computer

The command below will immediately shutdown and power off the computer.

How to bring up Task Manager

Windows Server 2012 core includes Task Manager. At any time you can simply type Ctrl-Shift-ESC to start the task manager. There is also a command line, and way to launch it from within PowerShell

Command Line:

Taskmgr.exe

PowerShell

Start-Process Taskmgr

The output below shows the PowerShell method for starting Task Manager.

I hope you found this useful. Please leave me a comment. Let me know if there are any core tasks you would like me to cover.

Bruce

Windows 2012 Core Survival Guide – Managing Services

2013-03-04T03:32:00Z

Learn about my 2012 Core Survival Guide here.

Managing Services

This module is going to look at how to manage services. The key to using PowerShell to manage any service is to know the exact spelling of the service name.

How to list services

PowerShell Command:

Get-service | Format-table -autosize

The output below show each services status, name and display name.

How to view a single service

You can use the "NAME" of the service to display a single service's information.

PowerShell Command:

Get-service | where name -eq BITS |Format-list

In the output below we use the format-list (or fl) to show all of the service's attributes.

How to start a single service

To start a service there is a simple PowerShell cmdlet called Start-Service.
Below I use it to start the BITS service.

PowerShell Command:

Start-Service -name BITS

The output below shows the current status of the service, followed by the command to start the service (in yellow), and followed by a command to confirm the status.

How to stop a service

Stopping a service is easy too. I use the Stop-Service cmdlet below to stop the BITS services.

PowerShell Command:

Stop-Services -name BITS

The output below shows the current status of the service, followed by the command to stop the service, and followed by a command to confirm the status.

How view a Service Startup Type

In order to view the startup type I had to make a WMI call.

PowerShell Command:

Get-wmiobject win32_service | where Name -eq WinRM

In the screen shot below "StartMode" is the startup type of the service and it is set to disabled. There are 3 possible values for this setting Manual, Automatic, and Disabled.

How to change the Service Startup Type

The Set-Service cmdlet has three possible settings for "-StartupType" flag: Automatic, Disabled, and Manual.

PowerShell Command:

Set-Service -name WinRM -StartupType Automatic

The output below shows the current status, followed by the command to disable the WinRM service, and followed by the command to confirm the change.

I hope you found this useful. Please leave me a comment. Let me know if there are any core tasks you would like me to cover.

Bruce

Windows 2012 Core Survival Guide – Date and Time settings

2013-02-24T03:10:00Z

Learn about my 2012 Core Survival Guide here.

Date and Time settings

This blog is going to cover the basic of viewing and changing your time settings. If you are like me I seem to always forget to set the correct time zone and need to correct it after the install.

How to view Date and Time settings

Viewing the date and time is very strait forward. This is one of the simplest PowerShell cmdlet to work with.

PowerShell Command:

Get-Date

Get-Date | format-list *

In the sample output below I demonstrate both of the above commands.

How to change Date and time setting

I am not sure why, but this one took me some time to figure out. None of the examples on the Get-Help showed the syntax for just setting the date and time. Below is the syntax I used to set the date and time on this computer.

PowerShell Command:

Set-date "12/12/2012 10:30 PM"

The output below shows the time was changed. Keep in mind that domain joined computers by default will sync their time from a domain controller. This can make your time change short lived.

How to View the current Time Zone

I had to use WMI calls to get the time zone. Below is the syntax I used.

PowerShell Command:

(Get-WmiObject win32_timezone).caption

As you can see below this command show you what time zone this computer is in.

How to Change the Time zone setting

I searched for a simple one line method in PowerShell to set the time zone and came up empty. The only easy way I found to do this in a one liner is using a command line utility tzutil.exe.

Command:

TZUTIL /s "US Eastern Standard Time"

How to get a complete list of Time Zones

Command

TZUTIL /l > timezone.txt

Notepad timezone.txt

Since this output is large and scrolls off the screen I piped it to an output text file and opened the file with notepad

I hope you found this useful. Please leave me a comment. Let me know if there are any core tasks you would like me to cover.

Bruce

Windows 2012 Core Survival Guide – Computer Name Setting

2013-02-19T00:55:00Z

Learn about my 2012 Core Survival Guide here.

Computer Name Setting

This blog is going to cover the basic of viewing and changing your computer name. Setting the computer name is an option when you are installing the OS, or you can let the installer auto name your server. If for some reason you need to rename your computer it can be done using PowerShell.

How to view computer name

I view the computer name by looking at the environment variable "ComputerName".

PowerShell Command:

Get-Content ENV:Computername

In the sample output below I see that this computer name is "CORETEST1"

How to change computer name

I change the computer name by using the Rename-Computer cmdlet.

PowerShell Command:

Rename-Computer -NewName MyCoreBox -restart

In the output below we see that this computer is rename from "CORETEST1" to MyCoreBox. Since the box reboots with this command I have to capture a second screen shot after the reboot to confirm the setting.

Screen shot after reboot

I hope you found this useful. Please leave me a comment. Let me know if there are any core tasks you would like me to cover.

Bruce

Windows 2012 Core Survival Guide – Joining the Domain

2013-02-15T02:38:00Z

Learn about my 2012 Core Survival Guide here.

Joining the Domain

Everybody at some point will need to join their computers to the domain. This blog will cover the basics of viewing your settings, joining the domain and removing your computer from the domain.

How to view Domain Settings

We can view the domain name by using a WMI object Win32_ComputerSystem. I still looking for a good way to do this native with PowerShell 3.0

PowerShell Command:

(Get-WmiObject Win32_ComputerSystem).domain

The output below shows the domain name of the computer. In this case it is "WORKGROUP"

How to join the computer to the Domain

By joining your computer to the domain you will get all of the benefits that the domain has to offer. The PowerShell cmdlet we use is “Add-computer”.

PowerShell Command:

Add-computer -DomainName Contoso.com -Credential Contoso\Administrator -Restart

The output below of the first command shows the current domain name of the computer. In this case it is "WORKGROUP". The second command joins the computer to the domain Contoso.com. In addition, the second command will prompt you for credentials of an account with domain join privileges in the domain you are trying to join.

How to Join a Domain and place the computer in an Organizational Unit (OU)

Most corporations have well defined OU structures and do not want computer objects place in the default folder. By placing the computer object in the correct OU saves you time. Below is the cmdlet that will help us with that. You must know the complete distinguished name (spelling counts here) of the OU you wish to place the computer into. If the distinguished name has any spaces in it you must quote the entire name. I found it makes my life easier to always quote the distinguished name.

PowerShell Command:

Add-computer -DomainName Contoso.com -OUPath "OU=Servers, OU=Assets,DC=Contoso,DC=COM" -Credential Contoso\Administrator -Restart

The output below of the first command shows the current domain name of the computer. In this case it is "WORKGROUP". The second command joins the computer to the domain Contoso.com in the OU "Servers". In addition, the second command will prompt you for credentials of an account with domain join privileges in the domain you are trying to join. The computer will reboot when the command is completed.

How to leave a Domain

When you leave a domain you default back to the “Workgroup”

PowerShell Command:

Remove-Computer -UnjoinDomaincredential Contoso\Administrator -Passthru -Verbose -Restart

The output below of the first command shows the current domain name of the computer. In this case it is "Contoso.Com". The second cmdlet will remove it from the domain. In addition, the second command will prompt you for credentials of an account with domain join privileges in the domain you are trying to leave. Finally when the command completes the computer will reboot.

I hope you found this useful. Please leave me a comment. Let me know if there are any core tasks you would like me to cover.

Bruce

Windows 2012 Core Survival Guide – Remote Desktop

2013-02-13T02:52:00Z

Learn about my 2012 Core Survival Guide here.

Remote Desktop

This is one of the more complex settings to get correct. For remote desktop to work you need to have two registry keys and a firewall rule set up correctly. If the registry key does not exist you will receive an error when you try to view or set it with PowerShell. Remote Desktop is disabled if either of the following two settings are true:

fDenyTSConnections = 1

Remote Desktop application firewall rule is disabled

If "UserAuthentication" has a value of 1 indicates that only secured connections will be used.

How view current Remote Desktop settings

fDenyTSConnections is the registry key that enables or disables Remote Desktop. A value of zero indicates that Remote Desktop is being allowed.

PowerShell Command:

get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server'-name "fDenyTSConnections"

If you receive an error it indicates the property does not exist or you typed the command in correctly.

UserAuthentication is the registry key that will enable secure connections. A value of one indicates that Remote Desktop will only use Secure Connections.

PowerShell Command:

get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "UserAuthentication"

Once again if you receive an error it indicates the property does not exist or you typed the command in correctly.

If the Remote Desktop Firewall Rules is "Enabled", like in the screen shot below, then the firewall rules will allow remote desktop to work.

PowerShell Command:

get-netfirewallrule -DisplayGroup "Remote Desktop" | format-table Name, Enabled -autosize

The screen shot below show that the firewall rules are correct for remote desktop.

How to enable Remote Desktop settings

Setting fDenyTSConnections registry key.

PowerShell Command:

set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server'-name "fDenyTSConnections" -Value 0

If key does not exist this is the command to use.

New-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server'-name "fDenyTSConnections" -Value 0 -PropertyType dword

In the screen shot below you see the current value, followed by the command to modify the value (in yellow), then followed by the command to confirm the setting.

How to enable Remote Desktop Firewall Rules.

PowerShell Command:

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

In the screen shot below you see the current value, followed by the command to change it, then followed by a command to confirm the settings have been changed.

How to enable Secured Remote Desktop Session

This setting determines if all connections are allowed or only Secured Connections. A value of 1 for this setting indicates that only Secured Connections.

PowerShell Command:

set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "UserAuthentication" -Value 1

If key does not exist this is the command to use.

New-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "UserAuthentication" -Value 1 -PropertyType dword

The screen shot below shows the command to view the current setting, followed by the command to modify the setting value (in yellow), then followed by the command to confirm the setting change.

How to Disable Remote Desktop

Setting fDenyTSConnections registry key

PowerShell Command:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server'-name "fDenyTSConnections" -Value 1

If the key did not exist you can use this command to create the key and set the value.

PowerShell Command:

Net-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server'-name "fDenyTSConnections" -Value 1 -PropertyType dword

The screen shot below shows the command to view the current setting, followed by the command to modify the setting value (in yellow), then followed by the command to confirm the setting change.

How to disable Remote Desktop Firewall Rules

PowerShell Command:

Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

In the screen shot below the first command shows the current value, followed by the command to disable the Remote Desktop firewall group, then followed by the command to confirm the setting changed.

I hope you found this useful. Please leave me a comment

Bruce