[cmdletbinding()]
param(
    [parameter(Mandatory=$true)]
    [ValidatePattern('.*(.xml)')]
    [String]
    $XMLFile,

    [switch]
    $Import,

    [parameter(Mandatory=$true)]
    [string]
    $SiteCode,

    [parameter(Mandatory=$true)]
    [string]
    $CMProvider = "."
)

$CIMProps = @{
    ComputerName = $CMProvider
    Namespace = "root\sms\site_$($SiteCode)"
}

$TodaysDate = get-date -Format "yyyy-MM-dd-HHmmss"

$ExportClientHardwareInventoryClasses = {

    $File = $XMLFile -split '.xml'
    $File = "$($XMLFile)-$($TodaysDate).xml"
    $ExportHWInvClasses = @()    

    $ClientSettings = Get-CimInstance @CIMProps -ClassName SMS_ClientSettings | Get-CimInstance

    $DefaultClientSettings =  Get-CimInstance @CIMProps -ClassName SMS_ClientSettingsDefault | Get-CimInstance
    $DefaultClientSettings | Add-Member -NotePropertyName AgentConfigurations -NotePropertyValue @{}
    $DefaultClientSettings.AgentConfigurations.Add('AgentID',15)
    $DefaultClientSettings.AgentConfigurations.Add('InventoryReportID','{00000000-0000-0000-0000-000000000001}')
    $ClientSettings += $DefaultClientSettings

    Foreach ($ClientSetting in $ClientSettings) {
        if ($HWInvSetting = $ClientSetting.AgentConfigurations | where {$_.AgentID -eq 15}) {
            write-verbose $HWInvSetting.InventoryReportID 
            $HWInvDetails = @{
                ClientSetting = $ClientSetting
                AgentConfiguration = $HWInvSetting
                InventoryReport =  Get-CimInstance @CIMProps -ClassName SMS_InventoryReport -Filter ('InventoryReportID = "' + $HWInvSetting.InventoryReportID + '"') | Get-CimInstance
            }
            $ExportHWInvClasses += $HWInvDetails
        }
    }

    Export-Clixml -InputObject $ExportHWInvClasses -Path $File
}

$ImportClientHardwareInventoryClasses = {
    $ImportedHWInvClasses = Import-Clixml $XMLFile

    foreach ($ClientSetting in $ImportedHWInvClasses) {
        $InventoryReport = Get-CimInstance @CIMProps -ClassName SMS_InventoryReport -Filter ('InventoryReportID = "'+ $ClientSetting.InventoryReport.InventoryReportID + '"') | Get-CimInstance
        $InventoryReport.ReportClasses = $ClientSetting.InventoryReport.ReportClasses
        $InventoryReport | Set-CimInstance
    }
}

If ($Import) {
    Invoke-Command $ImportClientHardwareInventoryClasses
} else {
    Invoke-Command $ExportClientHardwareInventoryClasses
}

• HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client
• HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server
• HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client
• HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server
• HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
• HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server
• HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client
• HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server
• HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client
• HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server

• https://gallery.technet.microsoft.com/scriptcenter/SChannel-SSL-and-TLS-d2e1ff3f

dir .\Administrator -r

dir .\Administrator -r | Measure-Object -Property Length -Sum

dir .\Administrator -r | Measure-Object -Property Length -Sum | select -ExpandProperty Sum

((dir .\Administrator -r | Measure-Object -Property Length -Sum | select -ExpandProperty Sum)/1024/1024)

dir . | where-object {$_.PSIsContainer -eq $True}

dir . | where-object {$_.PSIsContainer -eq $True} | % {((dir $_ -r | Measure-Object -Property Length -Sum | select -ExpandProperty Sum)/1024/1024)}

dir . | where-object {$_.PSIsContainer -eq $True} | % {"{0:n2}" -f ((dir $_ -r | Measure-Object -Property Length -Sum | select -ExpandProperty Sum)/1024/1024)}

$FolderSize = @{}

dir . | where-object {$_.PSIsContainer -eq $True} | % {$FolderSize.Add($_.FullName, "{0:n2}" -f ((dir $_ -r | Measure-Object -Property Length -Sum | select -ExpandProperty Sum)/1024/1024))}

$FolderSize = @{}

dir . | where-object {$_.PSIsContainer -eq $True} | % {$FolderSize.Add($_.FullName, "{0:n2}" -f ((dir $_ -r | Measure-Object -Property Length -Sum | select -ExpandProperty Sum)/1024/1024))}

$FolderSize

A customer was trying to extract some data from the netstat command.  The customer had already formed part of the syntax, but needed some additional assistance with filtering out the values they wished to see.

Let’s take a look at the results of the netstat –nao command

In this case, the customer wanted to filter only on “Listening” ports.  They had already accomplished this by piping the netstat –nao command to the select-string cmdlet

Netstat –nao | select-string “Listening”

They wanted to further filter down the list by looking for only certain ports.  Again, this was accomplished by piping the resulting into another select-string cmdlet.

netstat -nao | Select-String "Listening" | Select-String ":80|:3389|:445" 

The next part is where the big challenge comes in.  The customer only wanted the data from Columns 2 and 5.  This would be the bound IP and listening Port and the associated PID.  Since we are using netstat the data returned is just text, there is not native way to select those columns.

In order to do this, we need to extract the data we want from the lines.  We came up with two solutions, the 1 liner and turning the data into an object.

Let’s start with the 1 liner.

netstat -nao | Select-String "Listening" | Select-String ":80|:3389|:445" | % {$a = $_ -split '\s\s*' ; write-host "$($a[2]), $($a[5])"  } 

In this case, we are piping the results to a foreach (% - alias) loop, and then splitting the value of each line into an array using the whitespace as a delimiter.  We are using the regular expression (\s\s*) to identify contiguous whitespace between the column.  The remaining values from the split are stored as an array in the $a variable.  We then want to write out columns 2 and 5 to the console.

Although this does provide the desired output, it’s not very pretty.

Let’s see turn these results into an object instead.

$ListeningPort = @()

$GetPorts =  netstat -nao | Select-String "Listening" | Select-String ":80|:3389|:445" 

     Foreach ($Port in $GetPorts) {

    $a = $Port -split '\s\s*'

    $Ports = New-Object System.Object

    $Ports | Add-Member -MemberType NoteProperty -Name 'BoundIP:Port' -Value $a[2]

    $Ports | Add-Member -MemberType NoteProperty -Name 'PID' -Value $a[5]

    $ListeningPort += $Ports

  }

 $ListeningPort

This takes a little more work, put provides much better output.  First, we create a variable ($ListeningPort) as an empty array to hold our objects.

$ListeningPort = @()

Then we take our command to filter the NETSTAT command to the rows we are interested in and store those in the $GetPorts variable.

$GetPorts =  netstat -nao | Select-String "Listening" | Select-String ":80|:3389|:445" 

Now we run the results through a ForEach loop and for each line, we still split on the whitespace ('\s\s*') and store that data into $a. 

Foreach ($Port in $GetPorts) {

       $a = $Port -split '\s\s*'

After that, we create a System.Object and add two properties for the object, BoundPort:IP and PID.  We store the split data in positions 2 and 5 from $a are value in the object.

    $Ports = New-Object System.Object

  $Ports | Add-Member -MemberType NoteProperty -Name 'BoundIP:Port' -Value $a[2]

  $Ports | Add-Member -MemberType NoteProperty -Name 'PID' -Value $a[5]

We then stuff the resulting object $Ports into the array ($ListeningPorts) that we initialized in the beginning. 

$ListeningPort += $Ports

The ForEach loop does this for each line from NETSTAT that matches our Select-String queries.  The resulting array of objects $ListeningPorts provides a nice clean, exportable output.

This Sample Code is provided for the purpose of illustration only and is not intended to be used in a production environment.  THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.  We grant You a nonexclusive, royalty-free right to use and modify the Sample Code and to reproduce and distribute the object code form of the Sample Code, provided that You agree: (i) to not use Our name, logo, or trademarks to market Your software product in which the Sample Code is embedded; (ii) to include a valid copyright notice on Your software product in which the Sample Code is embedded; and (iii) to indemnify, hold harmless, and defend Us and Our suppliers from and against any claims or lawsuits, including attorneys’ fees, that arise or result from the use or distribution of the Sample Code. 

Recently, many of the collections began showing the hourglass icon in the console on a consistent basis.  Upon investigation, it appeared that one of the primary sites was running almost a constant full evaluation cycle of all their collections. 

In the colleval.log, we were able to pick out a message that too out:

spCollBeginIncEvaluation: Too many changes, marking incremental collections for full evaluation

We started looking into why this site was having more changes then the others.  We could not determine any logic reason.

I decided to go to my lab, and take a closer look at the spCollBeginIncEvaluation stored procedure.  I found it runs two queries to determine what items are going to be seen as eligible for incremental evaluation. 

• First, it looks at the number of collections with flag 4 (Incremental) set, have a query rule, and are not currently being evaluated

• Next, a query identifies computer objects from the CollectionNotifications table and gathers machine ID's from devices that match the tables used in the query rules from the collections in the previous query. 

• Finally, the stored procedure multiples the number of collections from the first query by the number of machine ID's from the second query.  If the number is bigger than 10,000,000 (yes, 10 million) then full evaluation will be triggered instead of incremental.

I could not image how we could have more than 10 million “changes” that needed to be updated, but I started watching the data, and the number of machineID's return was growing astronomically between cycles, (up to 20,000 machines that would show up on the list).

In this case, I have more 500 collections found that needed incremental evaluation, and 20,000+ machine ID’s (500 x 20,000 = 10,000,000).  I was over 10 million “changes”, thus the stored procedure was triggering Full Evaluation.

So now we needed to understand why 20,000+ were updating data within a 30-minute window. 

We took the data from the CollectionNotification table and copied it into excel, and found that of the 20,000 record updates, that 18,000 of them were associated with table name v_CH_ClientSummary.

So the question became, what is updating this view for so many clients each 30 minutes.  Turns out, this view/table updates each time a client requests policy.  So, if I have my policy interval set to 60 min, on average, half of my clients are going to request policy within 30 minutes, so If I have 40,000 clients, each 30 minutes, 20,000 clients are going to update policy. 

Now, I wanted to find the collections that are using incremental updates and have queries to the v_CH_ClientSummary view, with this query:

Now that I found the collection(s), I removed the incremental evaluation check box from the collection and the number of machineID's that needed updating each 30 min went from 20,000 to less than 2,000.

The morale of the story, don't create collections that use incremental evaluation from the v_CH_ClientSummary view (wmi class SMS_G_System_CH_ClientSummary or in the query builder 'Client Status')

Also found good reference information here:(https://blogs.technet.com/b/senthilkumar/archive/2014/06/08/configmgr-2012-r2-collection-evaluation-overview.aspx)

There is a District of Columbia Maryland Virginia Management User Group (DMVMUG) Conference on March 14th in the Microsoft office in  Reston, VA. 

Registration is required

dmvmug.eventbrite.com

See you there!

Flyer-RestonVA2015.pdf