Covers 150 practical techniques Richard Siddaway FOREWORD BY Ed Wilson MANNING PowerShell and WMI PowerShell and WMI RICHARD SIDDAWAY MANNING Shelter Island For online information and ordering of this and other Manning books, please visit www.manning.com. The publisher offers discounts on this book when ordered in quantity. For more information, please contact Special Sales Department Manning Publications Co. 20 Baldwin Road PO Box 261 Shelter Island, NY 11964 Email: [email protected] ©2012 by Manning Publications Co. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by means electronic, mechanical, photocopying, or otherwise, without prior written permission of the publisher. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in the book, and Manning Publications was aware of a trademark claim, the designations have been printed in initial caps or all caps. Recognizing the importance of preserving what has been written, it is Manning’s policy to have the books we publish printed on acid-free paper, and we exert our best efforts to that end. Recognizing also our responsibility to conserve the resources of our planet, Manning books are printed on paper that is at least 15 percent recycled and processed without the use of elemental chlorine. Manning Publications Co. Development editor: Jeff Bleiel 20 Baldwin Road Technical proofreaders: Aleksandar Nikolic PO Box 261 Copyeditor: Andy Carroll Shelter Island, NY 11964 Proofreader: Melody Dolab Typesetter: Gordan Salinovic Cover designer: Marija Tudor ISBN 9781617290114 Printed in the United States of America 1 2 3 4 5 6 7 8 9 10 – MAL – 17 16 15 14 13 12 To my parents, June and Ron Without your help, support, and encouragement I’d never have been able to do this brief contents PART 1 TOOLS OF THE TRADE 1 1 ■ Solving administrative challenges 3 2 ■ Using PowerShell 24 3 ■ WMI in depth 62 4 ■ Best practices and optimization 101 PART 2 WMI IN THE ENTERPRISE...............................................135 5 ■ System documentation 137 6 ■ Disk systems 171 7 ■ Registry administration 200 8 ■ Filesystem administration 224 9 ■ Services and processes 251 10 ■ Printers 271 11 ■ Configuring network adapters 289 12 ■ Managing IIS 316 13 ■ Configuring a server 339 14 ■ Users and security 359 vii viii BRIEF CONTENTS 15 ■ Logs, jobs, and performance 381 16 ■ Administering Hyper-V with PowerShell and WMI 399 PART 3 THE FUTURE: POWERSHELL V3 AND WMI ........................421 17 ■ WMI over WSMAN 423 18 ■ Your own WMI cmdlets 441 19 ■ CIM cmdlets and sessions 459 contents foreword xix preface xxi acknowledgments xxiii about this book xxv about the author xxxiii about the cover illustration xxxiv PART 1 TOOLS OF THE TRADE..............................................1 Solving administrative challenges 3 1 1.1 Administrative challenges 4 Too many machines 5 ■ Too many changes 6 ■ Complexity and understanding 7 1.2 Automation: the way forward 7 1.3 PowerShell overview 10 PowerShell scope 11 ■ PowerShell and .NET 12 ■ Breaking the curve 13 1.4 WMI overview 14 What is WMI? 14 ■ Is WMI really too hard? 16 1.5 Automation with WMI and PowerShell 16 ix x CONTENTS 1.6 Putting PowerShell and WMI to work 19 Example 1: Shutting down a data center 20 ■ Example 2: Auditing hundreds of machines 21 1.7 Summary 23 Using PowerShell 24 2 2.1 PowerShell in a nutshell 26 2.2 Cmdlets 26 Utility cmdlets 27 ■ Where-Object 28 ■ Foreach-Object 30 ■ Aliases 30 2.3 Pipeline 32 2.4 .NET for administrators 34 Objects 34 ■ PowerShell objects 34 ■ Creating .NET objects 34 Creating your own objects 35 2.5 PowerShell scripting language 37 Loops 38 ■ Branching 40 ■ Input and output 41 2.6 Finding help 42 Get-Help 43 ■ Get-Command 44 ■ Get-Member 45 ■ PowerShell community 46 2.7 Code reuse 47 Editors 48 ■ Scripts 49 ■ Functions 50 ■ Modules 53 2.8 PowerShell remoting 55 Remoting by cmdlet 55 ■ PowerShell remote sessions 57 2.9 PowerShell jobs 58 2.10 Summary 60 WMI in depth 62 3 3.1 The structure of WMI 63 Providers 65 ■ Namespaces 66 ■ Classes 69 3.2 Methods and properties 76 Methods 76 ■ Class properties 79 ■ System properties 80 ■ Key properties 81 3.3 Documenting WMI 82 3.4 WMI cmdlets and accelerators 84 Cmdlets 84 ■ Type accelerators 87 3.5 Using WQL 89 Keywords 89 ■ Operators 90 CONTENTS xi 3.6 WMI references and associators 94 3.7 WMI events 96 3.8 Summary 99 Best practices and optimization 101 4 4.1 Security 103 Using internet code 103 ■ Code security 105 ■ Access to code 106 4.2 Optimizing PowerShell code 107 Data input 107 ■ String substitution 111 4.3 Calculated fields, types, and formatting 113 Calculated fields 114 ■ Type files 116 ■ Format files 118 4.4 Debugging and error handling 120 Debugging 121 ■ Error handling 123 ■ WMI return codes 125 4.5 Getting the most from WMI 126 Issues with learning to use WMI 127 ■ WMI configuration settings 128 ■ Authentication 129 ■ Data filtering 131 Data conversions 131 4.6 Summary 134 PART 2 WMI IN THE ENTERPRISE .....................................135 System documentation 137 5 5.1 System hardware and configuration 139 TECHNIQUE 1Get computer system information 140 TECHNIQUE 2Get computer type 142 TECHNIQUE 3 Get domain role 144 TECHNIQUE 4 Get processor information 145 TECHNIQUE 5 Get BIOS information 146 TECHNIQUE 6Get memory configuration 148 5.2 Peripherals 150 TECHNIQUE 7 Get display settings 151 TECHNIQUE 8Get input devices 152 TECHNIQUE 9 Get ports 153 5.3 Power supplies 154 TECHNIQUE 10 Get battery details 155 TECHNIQUE 11 Get battery status 156 TECHNIQUE 12 Test power source 157 TECHNIQUE 13 Get power plans 158 xii CONTENTS 5.4 Operating system 160 TECHNIQUE 14Get operating system version 160 TECHNIQUE 15Discover hotfixes 163 TECHNIQUE 16Get boot configuration 164 TECHNIQUE 17Find recovery configuration 165 TECHNIQUE 18Test system time 167 5.5 Software 168 TECHNIQUE 19Discover installed software 168 5.6 Summary 169 Disk systems 171 6 6.1 Physical disks 172 TECHNIQUE 20 Discover disk controllers 174 TECHNIQUE 21Physical drive information 175 TECHNIQUE 22Link partitions to disk drives 177 TECHNIQUE 23Enumerating disk partitions 179 TECHNIQUE 24Link partitions to logical disks 180 6.2 Logical disks 181 TECHNIQUE 25 Logical disk information 181 TECHNIQUE 26 Root directory data 182 TECHNIQUE 27 Mount points 184 6.3 Volumes 185 TECHNIQUE 28Enumerate volume information 185 TECHNIQUE 29Using volume change events 187 6.4 Managing disks 191 TECHNIQUE 30Formatting a disk 192 TECHNIQUE 31 Performing Chkdsk 194 TECHNIQUE 32Analyzing and removing fragmentation 195 6.5 CD drives 197 TECHNIQUE 33 Enumerating CD drives 198 6.6 Summary 199 Registry administration 200 7 7.1 Accessing the registry 201 TECHNIQUE 34 Test registry size 202 TECHNIQUE 35Discovering registry data types 203 7.2 Reading the registry 206 TECHNIQUE 36Reading registry keys 206 TECHNIQUE 37Reading registry values 208 TECHNIQUE 38Enumerating keys and values 209 CONTENTS xiii 7.3 Creating and modifying registry keys and values 211 TECHNIQUE 39Creating registry keys 211 TECHNIQUE 40 Setting registry values 212 7.4 Deleting registry keys 214 TECHNIQUE 41 Deleting registry values 214 TECHNIQUE 42 Deleting registry keys 215 7.5 Registry access rights 216 TECHNIQUE 43 Reading access rights 216 TECHNIQUE 44Taking ownership of a registry key 219 7.6 Registry events 221 TECHNIQUE 45 Monitoring registry events 221 7.7 Summary 223 Filesystem administration 224 8 8.1 Working with files 226 TECHNIQUE 46 Finding files 227 TECHNIQUE 47Performing actions on files 230 TECHNIQUE 48Compressing files 232 8.2 Folder administration 234 TECHNIQUE 49 Discovering the files in a folder 235 TECHNIQUE 50 Discovering folders with specific attributes 237 TECHNIQUE 51Decoding the access mask 239 8.3 Listing, creating, and modifying shares 240 TECHNIQUE 52Listing shares 241 TECHNIQUE 53Creating shares 242 TECHNIQUE 54Modifying shares 243 8.4 Filesystem events 244 TECHNIQUE 55Working with filesystem events 244 8.5 Page file management 248 8.6 Summary 249 Services and processes 251 9 9.1 Services 252 TECHNIQUE 56Listing services 254 TECHNIQUE 57Configuring services 255 TECHNIQUE 58 Discovering the service load order 257 9.2 Processes 259 TECHNIQUE 59Listing process owners 260 TECHNIQUE 60Creating a process 261 TECHNIQUE 61Terminating a process 263 xiv CONTENTS 9.3 Process-related events 265 TECHNIQUE 62Investigating an event 266 TECHNIQUE 63Monitoring processes 268 9.4 Summary 270 Printers 271 10 10.1 Printer configuration 272 TECHNIQUE 64Discovering printers 272 TECHNIQUE 65 Testing printer capabilities 274 TECHNIQUE 66 Discovering printer ports 276 TECHNIQUE 67 Discovering printer drivers 277 10.2 Printer status 279 TECHNIQUE 68 Testing printer status 279 TECHNIQUE 69 Listing print jobs 280 10.3 Managing printers 282 TECHNIQUE 70Setting a default printer 282 TECHNIQUE 71 Printing a test page 284 TECHNIQUE 72 Controlling printers 285 TECHNIQUE 73 Renaming a printer 287 10.4 Summary 288 Configuring network adapters 289 11 11.1 Discovering network adapters 291 TECHNIQUE 74Identifying network adapters 291 TECHNIQUE 75Discovering adapter configurations 294 TECHNIQUE 76 Listing an adapter’s network protocols 296 TECHNIQUE 77Listing network connections 298 11.2 Configuring network adapters 300 TECHNIQUE 78Enabling network adapters 300 TECHNIQUE 79Disabling network adapters 301 TECHNIQUE 80Renaming network adapters 302 11.3 Enabling and setting network addresses 304 TECHNIQUE