Well without further ado, here it is! 

# Get the current settings

$admin = [adsi]'LDAP://CN=Administrator,CN=Users,DC=extestdc,DC=extest,DC=microsoft,DC=com'

$admin.psbase.InvokeGet('MaxIdleTime')

$admin.psbase.InvokeGet('MaxConnectionTime')

$admin.psbase.InvokeGet('MaxDisconnectionTime')

# Update to new values in minutes...

$admin.psbase.InvokeSet('MaxIdleTime', 5)

$admin.psbase.InvokeSet('MaxConnectionTime', 1000)

$admin.psbase.InvokeSet('MaxDisconnectionTime', 200)

$admin.psbase.CommitChanges()

# Validate

$admin = [adsi]'LDAP://CN=Administrator,CN=Users,DC=extestdc,DC=extest,DC=microsoft,DC=com'

$admin.psbase.InvokeGet('MaxIdleTime')

$admin.psbase.InvokeGet('MaxConnectionTime')

$admin.psbase.InvokeGet('MaxDisconnectionTime')

So that is how you do it in powershell.  Hopefully someone searching for this topic in the future will find this.

-B

PS C:\> get-winevent -ComputerName Server1 -LogName "Microsoft-Exch..."
Get-WinEvent : A security package specific error occurred
At line:1 char:13
+ get-winevent <<<< -ComputerName Server1 -LogName "Microsoft-Exch"
+ CategoryInfo : NotSpecified: (:) [Get-WinEvent], EventLogException
+ FullyQualifiedErrorId : System.Diagnostics.Eventing.Reader.EventLogException,Microsoft.PowerShell.Commands.GetWinEventCommand
<snip>

Log Name: System

Source: Microsoft-Windows-Security-Kerberos

Date: 3/2/2011 6:06:04 PM

Event ID: 4

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer: ClientComputer1.capacity.contoso.com

Description:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server . The target name used was host/Server1. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain () is different from the client domain (mgt.contoso.com), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

If we used the FQDN of the server though it worked fine:

PS C:\> get-winevent -ComputerName Server1.capacity.contoso.com -LogName "Microsoft-Exch..."

TimeCreated ProviderName Id Message
----------- ------------ -- -------
3/2/2011 4:34:39 PM Microsoft-... 325 Active...
3/2/2011 1:34:29 PM Microsoft-... 325 Active...
3/2/2011 1:19:46 PM Microsoft-... 221 Trunc ...

Solution:

1) Delete the stale computer accounts from the forest where your credentials are coming from.

2) Use the FQDN of the server name when trying to connect to the server instead of the flat name.

It kind of makes senses once you see all the pieces in play. By default the LDAP connection is binding to the user forest and finding the wrong spn based on the sort name. 

Hope this helps someone.

Here’s the solution, that could work for any INT64 value that is returned from the directory (that wouldn't convert with [datetime]):

   
function Grab-RidWaterMark           
{           
    param ($domainDN)           
    $de = [ADSI]"LDAP://CN=RID Manager$,CN=System,$domainDN"           
    $return = new-object system.DirectoryServices.DirectorySearcher($de)           
    $property= ($return.FindOne()).properties.ridavailablepool           
           
    #get the high/low parts of int64 value, which is the samething that "large integer converter: in LDP is doing.           
    [int32]$totalSIDS = $($property) / ([math]::Pow(2,32))           
    [int64]$temp64val = $totalSIDS * ([math]::Pow(2,32))           
    [int32]$currentRIDPoolCount = $($property) - $temp64val           
           
    Write-Host "Total SIDs that can be created: $totalSIDS"           
    Write-Host "Latest RID pool high water mark: $currentRIDPoolCount"           
}

Results:

PS C:\> Grab-RidWaterMark -domainDN "dc=brad,dc=forest,dc=test"
Total SIDs that can be created: 1073741823
Latest RID pool high water mark: 12271600

Cheers.

PS C:\> get-wmiobject win32_processor | select=object currentclock*,max* | format-table -automatic

CurrentClockSpeed MaxClockSpeed
----------------- -------------
             1999          2332
             1999          2332

So with a bit of digging on the internet I found a page referencing the Enhanced Intel SpeedStep Technology:

SpeedStep is a trademark for a series of dynamic frequency scaling technologies (including SpeedStep, SpeedStep II, and SpeedStep III) built into some Intel microprocessors that allow the clock speed of the processor to be dynamically changed by software. This allows the processor to meet the instantaneous performance needs of the operation being performed, while minimizing power draw and heat dissipation.

Well that seemed promising, so I found out that you can turn this off in power options in the control panel, setting the minimum processor state to 100%:

PS C:\> gwmi win32_processor | select-object currentclock*,max* | ft -au

CurrentClockSpeed MaxClockSpeed
----------------- -------------
             2332          2332
             2332          2332

In the end I just turned it back on as this does save power and will dynamically increase to full usage when needed.  Another mystery solved…

I ran LODCTR /Q and saw that it looked wrong:

C:\Windows\system32>lodctr /q:NTDS
Performance Counter ID Queries [PERFLIB]:
    Base Index: 0x00000737 (1847)
    Last Counter Text ID: 0x00001792 (6034)
    Last Help Text ID: 0x00001793 (6035)

Looking into it further I found it was missing the whole performance key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Performance

Once I found that, I exported the performance registry key from another domain controller and imported to the server missing the values and ran LODCTR /R and then the counters were back where they belonged…

C:\Windows\system32>lodctr /q:NTDS
Performance Counter ID Queries [PERFLIB]:
    Base Index: 0x00000737 (1847)
    Last Counter Text ID: 0x00001794 (6036)
    Last Help Text ID: 0x00001795 (6037)

[NTDS] Performance Counters (Enabled)
    DLL Name: %systemroot%\system32\ntdsperf.dll
    Open Procedure: OpenNtdsPerformanceData
    Collect Procedure: CollectNtdsPerformanceData
    Close Procedure: CloseNtdsPerformanceData
    First Counter ID: 0x000009DE (2526)
    Last Counter ID: 0x000009DE (2526)
    First Help ID: 0x000009DF (2527)
    Last Help ID: 0x000009DF (2527)

In an earlier post I talked about some new features for Windows 2008 and Vista.  One of those new features that is often overlooked are the data collector sets (DCS).  One particular role that leverages data collector sets is active directory.  Active directory has put “hooks” into tracing that can really take a lot of the thinking out of the question “why is my domain controller sluggish”.  For those of you still running Windows 2003 I go over a similar concept called Server Performance Advisor. 

Anyways, you can play around with DCS by typing perfmon and then traversing to the section called Data Collector Sets (shocking).  If you have performance issues, go here first as it’s like combining a netmon capture with a kernel trace and then handing you the smoking gun. 

Challenge:

In my current role, we have a need to automate things quite a bit and so one of the actions I was looking at solving was collecting diagnostic information when a server is performing poorly.  Usually when a high CPU alert comes in, someone would need to logon to the server and go to perfmon and start at DCS collection.  More often is the case that by the time someone had been alerted and went to the server the sluggish behavior had subsided (the dreaded “close ticket, no problem found”).

My solution was to try and figure out a way to start a DCS collection remotely at the time of event so that the data was present when an actual human became engaged.

After some hard work, here is the code to do so!  You can create your own XML file (your own DCS template) and pass it in, but more than likely you’ll be happy at just kicking off one of the built-in templates (AD/System Perf/System Diags).

Running it via powershell:

First, how to do it on the fly:

## PLA.dll lives under system32 on Vista and 2k8.  This will create a powershell com object.
$datacollectorset = new-object -COM Pla.DataCollectorSet
##This is the name of the predefined DCS collector.  It's read-only and will always be System\<something>
$name = "System\Active Directory Diagnostics"
##If you make the second param $null it will be the local machine.
$datacollectorset.Query($name,"serverA") 
$datacollectorset.start($false)
## Status ReturnCodes: 0=stopped 1=running 2=compiling 3=queued (legacy OS) 4=unknown (usually autologger)
$datacollectorset.status
##When you're ready to stop it call stop.
$datacollectorset.stop($false)
##If you call status here, it will probably be '2' for a while as the server compiles the report.
$datacollectorset.status

And like so, you started and stopped a collection for Active Directory on you’re local computer or a remote server!  Like I said though, you can create you’re own templates too.  You might want to do this if you want to setup a built-in template to be scheduled to run daily, or perhaps you want to send the data to a network location, run more tasks at completion, etc.  If you do want to create a custom template then the code changes a bit:

$datacollectorset = new-object -COM Pla.DataCollectorSet
## If you're making you're own (shows up under user defined).  
$xml = get-content C:\custom.xml #You're custom exported XML file.
$datacollectorset.SetXml($xml)
##Commit codes: https://msdn.microsoft.com/en-us/library/aa371873(VS.85).aspx this is add or modify.  Can't do this on a system created PLA instances (read only).
$datacollectorset.Commit($DCSPath , $null , 0x0003)     
$datacollectorset.Query($DCSPath,$null)
$datacollectorset.start($false)
#Runs...
$datacollectorset.stop($false)

Scripting a solution:

Finally if you wanted to script this you could do something like what I’ve done below.  This would collect for a desired interval (in seconds) and then when compilation completed display the path to the report.  I wrote this in CTP3, but you can easily take the concepts and backport them.  If the destination server is inaccessible, or you don't have permissions, then the script will blow up…

<#
    .SYNOPSIS
    This will fire up a PLA (Data Collector Set collection on a server and then copy it to the proper debug server
 
    .DESCRIPTION
    This is a proof of concept and only acceppts System defined collections.  No error handling so I hope you type well.

#>

##Inputs
[CmdletBinding()]
param(
   [Parameter(Mandatory = $true)]
   <#A system provided report to run like "System\System Performance", System\System Diagnostics, etc. #>
   [string]$DCSPath,
   [Parameter(Mandatory = $true)]
   <# This is how long you want the DCS collection to run in seconds#>
   [int32]$time,
   [Parameter(Mandatory = $false)]
   <#If you don't pass in a server name it will be $null and run on the local system#>
   [string]$serverName
    )

    $datacollectorset = new-object -COM Pla.DataCollectorSet  
    $datacollectorset.Query($DCSPath,$serverName)
    $datacollectorset.start($false)
    Start-Sleep $time
    $datacollectorset.stop($false)
    
    ##Now we'll loop while the report compiles.
    $retries = 0
    do 
        {sleep 30; $returnCode = $datacollectorset.Status ; $retries++} 
    while ($returnCode -eq 2 -and $retries -lt 60)
    
    if ($retries -eq 60)
    {
        Write-Warning "Compiling has been running on the server for 30 minutes!  You'll need to check the following location on the server later for the report:"
        Write-Warning $datacollectorset.OutputLocation
        break
    }
    
    ##Compiling has finished, now we can copy the folder to some location
    $path = $datacollectorset.OutputLocation
    if ($serverName)
    {
    $path = $path.Replace(":","$")
    Write-Host "`nReport complete and can be viewed at \\$serverName\$path\report.html on the server.`n" 
    }
    else
    {
    Write-Host "`nReport complete and can be viewed at $path\report.html`n"
    }
    
   

The result:

More info:

PLA reference: https://msdn.microsoft.com/en-us/library/aa372634(VS.85).aspx

https://blogs.msdn.com/powershell/archive/2008/12/23/early-christmas-present-from-powershell-team-community-technology-preview-3-ctp3-of-windows-powershell-v2.aspx

Happy Holidays.

Overview:

Ever run into cluster issues and wanted to see if the driver file versions matched on all the nodes of the cluster to rule out a mismatch on a driver level?  Well I did!  The basic gist is that you can show all the file versions for each node by just running the script against a node name.  If you want to see only the drivers that don’t match then you’d use the pipeline with where-object (?).

Typical output:

When All drivers match:
PS C:\Debuggers> Test-MSCluster.ps1 ServerSQL11 | ?{!$_.IsSame}
Getting Nodes via WMI
Getting the drivers on: ServerSQL11
Getting the file versions for the drivers on: ServerSQL11
Getting the drivers on: ServerSQL12
Getting the file versions for the drivers on: ServerSQL12
PS C:\Debuggers>

One Mismatch:
PS C:\Debuggers> Test-MSCluster.ps1 ServerAX | ?{!$_.IsSame}
Getting Nodes via WMI
Getting the drivers on: ServerAX
Getting the file versions for the drivers on: ServerAX
Getting the drivers on: ServerBX
Getting the file versions for the drivers on: ServerBX

FileName                                                                   ServerAX                                                                 ServerBX
--------                                                                   ----------                                                                 ----------
rmcast.sys                                                                 6.0.6001.18000                                                             6.0.6001.18069

Many nodes, many mismatches:

PS C:\Debuggers> Test-MSCluster.ps1 Server-Clus--11 | ?{!$_.IsSame} 
Getting Nodes via WMI
Getting the drivers on: Server-Clus--10
Getting the file versions for the drivers on: Server-Clus--10
Getting the drivers on: Server-Clus--11
Getting the file versions for the drivers on: Server-Clus--11
Getting the drivers on: Server-Clus--15
Getting the file versions for the drivers on: Server-Clus--15
Getting the drivers on: Server-Clus--16
Getting the file versions for the drivers on: Server-Clus--16
Getting the drivers on: Server-Clus--13
Getting the file versions for the drivers on: Server-Clus--13
Getting the drivers on: Server-Clus--12
Getting the file versions for the drivers on: Server-Clus--12

FileName   : Dbgv.sys
Server-Clus--10 : 4.60
Server-Clus--11 : FileMissing
Server-Clus--15 : FileMissing
Server-Clus--16 : FileMissing
Server-Clus--13 : FileMissing
Server-Clus--12 : FileMissing
IsSame     : False

FileName   : HpCISSs2.sys
Server-Clus--10 : FileMissing
Server-Clus--11 : FileMissing
Server-Clus--15 : FileMissing
Server-Clus--16 : 6.8.0.64 Build 9 (x86-64)
Server-Clus--13 : 6.8.0.64 Build 9 (x86-64)
Server-Clus--12 : 6.8.0.64 Build 9 (x86-64)
IsSame     : False

FileName   : USBSTOR.SYS
Server-Clus--10 : FileMissing
Server-Clus--11 : FileMissing
Server-Clus--15 : FileMissing
Server-Clus--16 : FileMissing
Server-Clus--13 : 6.0.6001.18000
Server-Clus--12 : 6.0.6001.18000
IsSame     : False

FileName   : mrxsmb10.sys
Server-Clus--10 : 6.0.6001.18000
Server-Clus--11 : 6.0.6001.18000
Server-Clus--15 : 6.0.6001.18000
Server-Clus--16 : 6.0.6001.18068
Server-Clus--13 : 6.0.6001.18000
Server-Clus--12 : 6.0.6001.18000
IsSame     : False

FileName   : nm3.sys
Server-Clus--10 : 03.02.0764.0001
Server-Clus--11 : FileMissing
Server-Clus--15 : FileMissing
Server-Clus--16 : FileMissing
Server-Clus--13 : FileMissing
Server-Clus--12 : FileMissing
IsSame     : False

######################################################################
#Test-MSCluster.ps1
Param($ClusterNode)

# I am using this hashtable to store a unique list of file names. 
$Files = @{}
# I am using this array to store my custom objects we create later.
$FileObjects = @()

Write-Host "Getting Nodes via WMI"
$nodes = gwmi -q "Select name from MSCluster_Node" -namespace root\mscluster -computername $ClusterNode -Authentication PacketPrivacy | %{$_.Name}

# Here we process each node and get all the drivers from the node and add it to our $Files HashTable to be processed
foreach ( $node in $nodes )
{
    Write-Host "Getting the drivers on:"  $node
    # Here we are getting a list of the .sys files. Notice I am only getting the names
    $filelistFinal = get-childitem "\\$node\admin$\system32\drivers" *.sys | %{$_.name}
    
    Write-Host "Getting the file versions for the drivers on:" $node
    foreach($file in $filelistFinal)
    {
        # foreach file found we add it to the hasttable, but hashtables can only have a key once
        # so we need check if the key already exist. I do this because it is possible you could have
        # unique drivers per node.
        if(!$Files.$file)
        {
            $Files.Add($file,"added")
        }
    }
}

# Ok... now we have all our files time to process the hashtable and create our custom objects
foreach($FileName in $Files.Keys)
{
    # This is how I create an object for each file
    $myFileObj = New-Object System.Object
    
    # This is how we add a property. In this case the FileName property. For these scenarios I chose add-member
    # because you can dynamically add properties (i.e. NodeName with value of File version)
    $myFileobj | add-Member -MemberType NoteProperty -Name FileName -Value $FileName
    
    # Now we need to add properties for each node.
    foreach($node in $nodes)
    {
        # Making sure the file exist on the node
        if(Test-Path \\$node\admin$\system32\drivers\$FileName)
        {
            # Getting ProductVersion Info to use as the value for the Node Property
            $fileInfo = [system.diagnostics.fileversioninfo]::getversioninfo("\\$node\admin$\system32\drivers\$FileName")
            $myFileobj | add-Member -MemberType NoteProperty -Name $node -Value $FileInfo.ProductVersion
        }
        else
        {
            # File not found using FileMissing as the value for the Node Property
            $myFileobj | add-Member -MemberType NoteProperty -Name $node -Value "FileMissing"
        }
    }
    # Outputting Object
    $FileObjects += $myFileObj
}

foreach($result in $FileObjects)
{
    $isSame = $true
    # Getting Server Name from Properties of the custom object
    $servers = $result | Get-Member -MemberType Noteproperty | ?{$_.Name -ne "FileName"} | %{$_.Name}
    
    # Checking the value of each server vs the other servers
    foreach($server in $servers)
    {
        foreach($srv in $servers)
        {
            if($srv -ne $server)
            {
                # If the the value is different we set $isSame to $false
                if($result."$srv" -ne $result."$server"){$isSame = $false}
            }
        }
    }
    # add the isSame property to the object
    $result | add-Member -MemberType NoteProperty -Name IsSame -value $isSame
    
    # output object
    $result 
}
######################################################################

***Note:  This script is not fast, as it is getting the file versions for every driver (*.sys)  on each system,  I'd highly suggest not running this over the WAN...

Man it was hard to find info on using set-acl on a registry key!   I was looking for a way to set an ACL that once set would be inherited by child keys and values.    We needed to give “Local Service” full control on the registry key below and have the subkeys inherit the permission.  You might say:  “Why not use SUBINACL?”, well due to a bug or by design SUBINACL doesn’t work for WIN7 server core (probably should look into that).  Besides, why call an exe when you can do it natively in PS.  Anyways here is the code that ended up working.  Hope next time someone goes looking for this it’ll be the first hit.

PS C:\> $acl= get-acl -path "hklm:\SOFTWARE\Microsoft\Reliability Analysis"

PS C:\> $inherit = [system.security.accesscontrol.InheritanceFlags]"ContainerInherit, ObjectInherit"

PS C:\> $propagation = [system.security.accesscontrol.PropagationFlags]"None"

PS C:\> $rule=new-object system.security.accesscontrol.registryaccessrule "LOCAL SERVICE","FullControl",$inherit,$propagation,"Allow"

PS C:\> $acl.addaccessrule($rule)

PS C:\> $acl|set-acl

And the output of GET-ACL shows local service now:

PS C:\> get-acl -path "hklm:\SOFTWARE\Microsoft\Reliability Analysis" | fl <—Verifying that it got set.

Path   : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Reliability Analysis

Owner  : BUILTIN\Administrators

Group  : DOMAIN\Domain Users

Access : NT AUTHORITY\LOCAL SERVICE Allow  FullControl

         BUILTIN\Users Allow  ReadKey

         BUILTIN\Users Allow  -2147483648

         BUILTIN\Administrators Allow  FullControl

         BUILTIN\Administrators Allow  268435456

         NT AUTHORITY\SYSTEM Allow  FullControl

         NT AUTHORITY\SYSTEM Allow  268435456

         CREATOR OWNER Allow  268435456

Audit  :

Sddl   : O:BAG:DUD:AI(A;OICI;KA;;;LS)(A;ID;KR;;;BU)(A;CIIOID;GR;;;BU)(A;ID;KA;;;BA)(A;CIIOID;GA;;;BA)(A;ID;KA;;;SY)(A;CIIOID;GA;;;SY)(A;CIIOID;GA;;;CO)

This is where I started, its a self paced course on the basics.  Once you walk through this (2 hours) you’ll start seeing the power: https://download.microsoft.com/download/4/7/1/47104ec6-410d-4492-890b-2a34900c9df2/Workshops-EN.zip

Obligatory powershell jpg: