Richard Siddaway's Blog

Archive for October, 2008


without comments

Just bought a new laptop for my son.  Good machine from a well known manufacturer at a very good price.  All great but for the sheer amount of JUNK I have had to clear off the machine to make it anything like usable.

The worst is the so called assistant that claims it can manage my wireless connections for me.  It couldn’t manage its way out of a paper bag.  I had to uninstall it to get the wireless working.


Please make these junk utilities optional – let me set up the machine the way I want and stop filling them up with junk.


Share this post :


Technorati Tags: Rant,New machine

Written by richardsiddaway

October 26th, 2008 at 1:38 pm

Posted in Rant

W2KSG: Asynchronous log access

without comments

Script Center Home > Microsoft Windows 2000 Scripting Guide > Scripting Solutions for System Administration > Logs > Managing Logs > Querying Event Logs Asynchronously Retrieving Event Log Statistics

Listing 12.11contains a script to asynchronously access the event logs. Rather than follow the WMI methods we can use the background jobs functionality in PowerShell version 2

Start-PSJob -Name job1 -Command "Get-EventLog -LogName application"


Receive-PSJob -Name job1 -Keep

Get-PSJob -Name job1 | Remove-PSJob

We create the job using Start-PSJob.  Give it a name and the command we want to run.  Get-PSJob can be used to view the status of jobs.  Check the state for completed jobs.

Receive-PSJob pulls the data out of the job. Using the -keep parameter leaves the data available to be accessed again otherwise it is removed.

The job can be removed using Remove-PSJob as shown. 


Share this post :


Technorati Tags: PowerShell,Version 2,Asynchronous Jobs

Written by richardsiddaway

October 22nd, 2008 at 8:50 am

SQL Server PowerShell provider

without comments

I have been looking at PowerShell in SQL Server again recently as I’m working on chapters involving PowerShell and SQL Server for a couple of books. I had had a vague understanding that the PowerShell provider could access remote machines but had not really followed up on it. PowerShell is getting to be such as big topic considering the number of products it is built into.

When you open up the SQL Server mini-shell and perform

cd sqlserver:\sql


to step into the database engine and display the contents all you will see is  the current machine.  You can access remote machines by typing

cd server_name

and you will be connected to them.  This also works in the management Studio in that you can right click on a remote registered server and point the provider to that particular server. In effect sqlps has its own remoting system.

Thanks to Dan for pointing that out to me.


Share this post :


Technorati Tags: PowerShell,SQL Server,SMO

Written by richardsiddaway

October 21st, 2008 at 2:27 am

W2KSG: Reading Event Logs

without comments

The scripting guide use WMI to read classic event logs.  We have get-eventlog.  Much easier.

# Listing 12.8
Get-EventLog -LogName System

# Listing 12.9
Get-EventLog -LogName System | Where {$_.EventId -eq 7036}

Listing 12.10
Get-EventLog -LogName System | Where {$_.Timewritten -gt ((Get-Date).Adddays(-2))}

Listing 12.8 shows how to read a specific log.  There could be a lot of data there!!  We can restrict the data by eventid (Listing 12.9) or date (Listing 12.10)


Share this post :


Technorati Tags: PowerShell,Event Logs

Written by richardsiddaway

October 19th, 2008 at 2:31 pm

TechNet event scripts

without comments

The scripts from my demos at the PowerShell event on Tuesday are available from here


Share this post :


Technorati Tags: PowerShell,event,scripts,demos

Written by richardsiddaway

October 18th, 2008 at 12:10 pm

Auditing with WMI

without comments

If you have been following the series of posts I’ve been doing regarding the use of WMI to dig into a machine’s configuration you will have realised that you could string them together to produce a script that audits the machine and produces a file recording the configuration information. 

Alan, of the UK PowerShell User Group, has done just that – and he has taken it a step further to produce the output as an html file – very nice display.  I recommend having a look at what he’s done with this.



Share this post :


Technorati Tags: PowerShell,WMI,User Group

Written by richardsiddaway

October 18th, 2008 at 6:31 am

PowerShell & AD Live Meeting

without comments

Tuesday 25 November 2008 — 7pm-8pm GMT

This Live Meeting will cover:

– How to use PowerShell to work with Active Directory

    – Writing scripts

    – Using the AD cmdlets

– It will mainly cover working with OUs, Users and groups.

– If time permits there will be quick coverage of sites, site-links and subnets and the new features in Windows 2008 AD

Note that audio is only available through your computer speakers\head phones

Richard Siddaway has invited you to attend an online meeting using Live Meeting.
Join the meeting.
Audio Information
Computer Audio
To use computer audio, you need speakers and microphone, or a headset.
First Time Users:
To save time before the meeting,
check your system to make sure it is ready to use Microsoft Office Live Meeting.
Unable to join the meeting? Follow these steps:

  1. Copy this address and paste it into your web browser:
  2. Copy and paste the required information:
    Meeting ID: PMHBJ2
    Entry Code: 5b^W@Mk=z

If you still cannot enter the meeting, contact support

Microsoft Office Live Meeting can be used to record meetings. By participating in this meeting, you agree that your communications may be monitored or recorded at any time during the meeting.


Share this post :


Technorati Tags: PowerShell,Active Directory,User Group

Written by richardsiddaway

October 17th, 2008 at 2:57 pm

W2KSG: Unique file names

without comments

Having seen how to back up our event logs we will need to do this periodically so we need to create unique file names for the backups. The obvious candidate is to base it on the date.

Listing 12.7

$date = Get-Date
Get-WmiObject -Class Win32_NTEventLogFile | Where {$_.NumberofRecords -gt 5} | Foreach {
    $file = "c:\test\" + $_.LogFileName + "_{0}_{1}_{2}.evt" -f $date.Year, $date.Month, $date.Day

This adapts the previous script by getting the date. We then push the year, month and day into the string for the file name as shown.  That -f operator pops up in a number of very useful places.

The backup and clearing occur as previously. In this case we are using number of records rather than size. You could use both!


Share this post :


Technorati Tags: PowerShell,WMI,Event logs

Written by richardsiddaway

October 16th, 2008 at 11:46 am

Posted in PowerShell and WMI

W2KSG: Triggered Event Log backups

without comments

We have seen how to backup and clear the event log.  What about checking all of the event logs and doing a backup and clear if they have reached a certain size

Listing 12.6

Get-WmiObject -Class Win32_NTEventLogFile | Where {$_.FileSize -gt 10MB} | Foreach {
    $file = "c:\test\" + $_.LogFileName + ".evt"

Use get-wmiobject to get the event log information. Check the file size. I love been able to just put 10MB as the comparison it just makes life so much easier.  Any log that comes through we can then perform a backup and clear the event log as before.

The comparison could be on NumberofRecords instead of file size if you want to back up after a certain amount of activity.


Share this post :


Technorati Tags: PowerShell,WMI,Event Logs

Written by richardsiddaway

October 16th, 2008 at 11:38 am

Posted in PowerShell and WMI

W2KSG: Backup Event Log

without comments

We have see how to modify event log properties – lets look at backing them up and clearing out the entries. Preferably in that order.

Listing 12.5

$log = Get-WmiObject -Class Win32_NTEventLogFile -Filter  "LogFileName = ‘Application’"
$ret = $log.BackupEventLog("c:\test\applog.evt")
if ($ret.returnvalue -eq 0){$log.ClearEventLog()}
else {Write-Host "could not back up log file"}

Start by getting the event log via WMI as we did before.

We can then backup up the event log to a file.  The return value equals zero if everything works. Any other value is an error. We can check the return value and if it is then we clear the log otherwise we get an error message.


Share this post :


Technorati Tags: PowerShell,WMI,Event logs

Written by richardsiddaway

October 14th, 2008 at 2:27 pm

Posted in PowerShell and WMI