Personal Blog of Sean “The EnergizedTech” Kearney, Microsoft Premier Field Engineer, and lover of all things PowerShell

Finding the UserID from a PowerShell Remoting session

Sean Kearney (Honorary Scripting Guy) PFE — Thu, 24 May 2018 09:30:29 GMT

A colleague presented a challenge to me the other day which I thought was "do able" but I'd never thought about it before. "A set of user Credentials are in use in an Implicit Remoting Session, the authentication has been performed interactively by a web site.... We won't know who the user is but the client would like to trap the LoginID per session for logging purposes. Could we?" I said to give me a few minutes to poke at it. I received a picture of "Pokey" from "Gumby and Pokey" as a response. I love the humor around here. I did the connection and followed the process to create the implicit remoting session as indicated. I remembered that if I exported the PowerShell session as a module I could reuse, it always remembered at LEAST the login ID. I tried that first Export-PSsession -session $s -outputmodule test I pulled open the PSM1 file and examined it for the login ID I used. Sure enough it was embedded. "Somewhere.... this object is stored in the session...." But where? First we grab the current sessions $S=Get-PsSession Now we have a list. In this case I need to grab the credentials from an Exchange Session. I can filter on that in the following manner. $S=(Get-PSSession | Where { $_.ConfigurationName -eq 'Microsoft.Exchange' }) Now that I have the session I was able to pull up a Get-Member and found the "Runspace" object. I started digging deeper and found an additional property called "ConnectionInfo" Suddenly this all seemed possible. "ConnectionInfo" had some additional objects, but most importantly …. "Credential" So at this point it was a matter digging in an grabbing that username object off Credential as you would normally do before. $UserName=$S.Runspace.Connectioninfo.Credential.Username Now the cool part is all PowerShell Sessions work this way. Direct, Implicit.... Even with an MFA setup you should be able to pull the UserID out in this fashion! Just remember, the Power of Shell is in YOU Sean The EnergizedTech Microsoft PFE

The parsing mystery of my HERE-STRING

Sean Kearney (Honorary Scripting Guy) PFE — Mon, 14 May 2018 14:38:28 GMT

I was helping a friend re-write a script to make it visually more appealing. For some scenarios I LOVE using Here-Strings. If you've never encountered one a Here-String looks like this $Somedata=@' Here is something I am writing This is what it will look like at the end Isn't this cool? '@ And literally it will output to the scene just the way it looks. Like this. I like to think of them as "Here, this is what it will look like String" Another form of Here-String uses double quotes. This allows the internal content to be evaluated and parsed which means you can plug in variables. It's a bit slower because you are parsing the content but allows you to neat things, like a simple form letter when welcoming an Employee $Welcome=@" Hello $FirstName $LastName and welcome to Contoso! Your login ID is $LoginID Your Temporary password is $SecretPassword "@ Here's what that might look like. But here is where I ran into a problem. I can also do THIS in a Here-String. $Stuff=@" $($FirstName.Substring(0,4)) is the first Four letters of your First Name. "@ So when you see $() in a String it's say "Run this code and the output of this will be injected into the string...." This works fine if the output is a pure string. But what if you have some really cool stuff like Event logs, content from Active Directory or anything that's output is a pinch more than a String. Initially if you do this. $Output=@" Woohoo! Check out my cool event logs! $(Get-EventLog -logname System -newest 15) " You end up with this mess. That's because a Here-String (just like a regular String object) can ONLY deal with "String" data and this is a .NET Object that was produced by Get-EventLog. So you just need to help it all. You can (in most cases!) Convert that into something perfectly useful by piping the results into an OUT-String Cmdlet. $Output=@" Woohoo! Check out my cool event logs! $(Get-EventLog -logname System -newest 15| Out-String) " Now you'll get something much more useful like below! This is not just isolated to Here-Strings but regular strings as well. But the same trick works both ways. Neat eh? Just a little something fun I thought I'd share out today! Cheers all and remember, the Power of Shell is in YOU! Sean the EnergizedTech, Microsoft PFE

Using PowerShell to Easily Build LBFO teams

Sean Kearney (Honorary Scripting Guy) PFE — Thu, 05 Apr 2018 13:32:26 GMT

Here's an interesting challenge. It's not actually DIFFICULT but it is OH so IRRITATING on any operating system. I want to Team up some network cards for Load Balancing. So I pick two at the back of the server, try to figure out which two it is that lit up, then remember those two (or actually more sometimes) to make them into a team. In Server 2012 we have had the ability to build these teams. The challenge is still there. "How to identify and build the team" PowerShell makes this so must easier. We can use PowerShell to FIRST identify cards that are attached to a live switch using the Get-NetAdapter Cmdlet. Using the following line I can see only the PHYSICAL adapters (vs VPN, Hyper-V and others) Get-NetAdapter -Physical I can also examine the properties of this adapter and say "Show me only the ones that are connected" Get-NetAdapter -Physical | Where-Object { $_.Status -ne 'Disconnected' } What this means, at the VERY least is I have a way of seeing what wires are already connected as an object and having PowerShell tell me after (if I want) who was added. We can do this easily by grabbing and Storing the Name of all the Network connections already attached. $ExistingName=Get-NetAdapter -Physical | Where-Object { $_.Status -ne 'Disconnected' } | Select-object Name We can then obtain and store (After attaching the new lan cables) a set of Network Cards that have been added. We can compare and use a -notcontains to compare the original array and the new array. $AllNetworkCards=Get-NetAdapter -Physical | Where-Object { $_.Status -ne 'Disconnected' } $NewNetworkCards=$AllNetworkCards | Where-object { $_.Name -notcontains $ExistingName.Name } We now, without trying to REMEMBER what network cards we attached, have a way to track them. At this point, if you wanted to create a network team you could simply do this New-NetLBFOTeam -name 'LBFOTeamTest' -teammembers ($NewNetworkCards.Name) -confirm:$False A neat little trick in PowerShell. I hope this helps you in all your Network teaming tasks :) Cheers Sean The Energized Tech Microsoft PFE

Hey! What happened to my DHCP Server?

Sean Kearney (Honorary Scripting Guy) PFE — Tue, 30 Jan 2018 10:16:49 GMT

Like many IT Professionals and enthusiasts, I have a lab. Mind happens to sit on my laptop and various components will be spun up / down / torn apart as I need. One I happened to keep together was my Domain Controller. Sure they're not difficult to spin up and bring online with Windows PowerShell. But this particular one I had MDT and WDS on there. I used it as a standalone appliance for Deploying Server 2016 as I needed. It works and works well. Last night I fired it up and went to deploy a Server 2016 box only to find out nothing was grabbing an IP address. I checked over logs and scanned through. Active Directory was good but over and over DHCP was complaining it couldn't find an Active Directory controller... on the same box. I did a bit of digging in our local forums and ran across a user with a similar issue. If you looked at the DHCP Server it showed up as a 169.x.x.x (IPIPA) address. Running Ipconfig I couldn't see it anywhere but this user mentioned that the issue turned out to be a second network card, with no cable attached. The answer was "Disable the NIC" Sure enough on my Virtual box I had a second NIC I installed and forgot about. Disabled it internally on the server, bounced once and life was good. Silly me, I should have cleaned up my old NIC's :) Cheers! Sean

PowerShell - Easily get Error Codes for Try Catch Finally

Sean Kearney (Honorary Scripting Guy) PFE — Wed, 10 Jan 2018 10:53:54 GMT

I was poking about with the whole Try Catch Finally segment in PowerShell. Beautiful little scriptblock. The stumbling block I kept hitting was getting the Error Code names. How to get the default Exception has been documented online in various places. However what I encountered was some Errors didn't match up with the examples provided. Turns out in some cases you have a sort of "Main error" (your Exception) and then in SOME cases a second more exacting error (InnerException). Then there is the 3rd really weird situation where NEITHER value is populated and you need to run a GetBaseException() method. To make this easy on people (especially Us non Dev speaking IT Pros) I whipped together a little function in PowerShell to do the dirty work. Enjoy! Sean The EnergizedTech Microsoft PFE <# .Synopsis Return string values for Exception and InnerException from $Error records .DESCRIPTION This Cmdlet will return the Exception code and (if available) the Inner Exception values needed for a Try Catch Finally statement .EXAMPLE # Return values from the most recent Error record Get-ErrorRecord .EXAMPLE # Get 4th record in PowerShell Error Array $V=$Error[3] #Retrieve Error Codes needed Get-ErrorValue -ErrorRecord $v #> Function Get-ErrorValue { [cmdletbinding()] param ( $ErrorRecord=$Error[0] ) [string]$Exception=$NULL [string]$InnerException=$NULL # Get Current Exception Value If ($ErrorRecord.Exception -ne $NULL) { [String]$Exception=$ErrorRecord.exception.gettype().fullname } # Check if there is a more exacting Error code in Inner Exception If ($ErrorRecord.exception.InnerException -ne $NULL) { [String]$InnerException=$ErrorRecord.Exception.InnerException.gettype().fullname } # If No InnerException or Exception has been identified # Use GetBaseException Method to retrieve object if ($Exception -eq '' -and $InnerException -eq '') { $Exception=$ErrorRecord.GetBaseException().gettype().Fullname } # Return values to user [pscustomobject]@{'Exception'=$Exception;'InnerException'=$InnerException} }

Script Wars : The Farce Awakens - the Complete series

Sean Kearney (Honorary Scripting Guy) PFE — Fri, 22 Dec 2017 12:11:45 GMT

On "Hey! Scripting Guy!" you may have heard of the Holiday Specials. This year was no different and the 5th episode just wrapped up today. To save you hunting around for Hyperlinks and just for fun, here's all five (5) links the series from this year's offering. Script Wars : the Farce Awakens Script Wars : the Farce Awakens - Part 1 Script Wars : the Farce Awakens - Part 2 Script Wars : the Farce Awakens - Part 3 Script Wars : the Farce Awakens - Part 4 Script Wars : the Farce Awakens - Part 5 Have a Happy Holidays Everyone! Sean "The Energized Tech" Premier Field Engineer

7 Years of "Hey! Scripting Guy!" Holiday specials!

Sean Kearney (Honorary Scripting Guy) PFE — Tue, 19 Dec 2017 15:02:36 GMT

So for those of you who may not have realized it, 7 years ago on “Hey! Scripting Guy!” a little idea started out which was to have a fun PowerShell based Holiday special. If you’re curious here are all 7 in Reverse order including the badly written and horribly sung Parody theme tunes. Happy Holidays and Rock on with Windows PowerShell! Sean, the Energized Tech Microsoft Premier Field Engineer <- I love that I get to say that now! :)

Start-Post "Hello World!"

Sean Kearney (Honorary Scripting Guy) PFE — Thu, 24 Aug 2017 12:13:13 GMT

This feels both strange and wonderful at the same time. My first official Blog post within Microsoft. If you've been wondering, I disappeared from the Blog scene for a bit. Things got interesting and busy over the past Ten (10) months. Now it's starting to settle and I have time to breathe and get creative again ! First if you followed my personal blogs at www.powershell.ca, www.energizedtech.com and ye110wbeard.wordpress.com, you may have noticed I got hired by Microsoft (thus notice the title of this post ^^^ on TechNet!) The first seven months have been amazing. It has been a dream come true. Although I *DO* miss being a PowerShell MVP, this was the best way to lose my MVP status.... with Honor. :) I've been (as my Manager likes to say) hit the ground running. Diving into technologies left right and center, ramping up for my customers and getting myself set up for training. The people here and the diversity are here (in my personal opinion) something amazing to behold. It is a job better than I ever imagined. Also for my Dad watching from up above... "Thanks" :) What will you see here? I'll probably end up cross posting a bit to my personal sites from time to time, but overall I'll try to put a bit of content I might have put in ScriptingGuys that would be work a "Weekend Scripter" like those crazy Hexadecimal Clocks (What was I thinking?). Maybe even the odd "Weird and wonderful thing" I've encountered in the field. As I stretch my fingers creatively, I'll have some content going out to "Hey Scripting Guy!" again as well as maybe the odd posting on the "Ask Premier Field Engineering (PFE) Platforms" If you're REALLY wondering.... "Is this Sean?" Yes it is.... Just look up at the name of the blog. "ENERGIZEDTECH" Cheers And remember, with Great PowerShell comes Great Responsibility.[bing_translator]

Personal Blog of Sean “The EnergizedTech” Kearney, Microsoft Premier Field Engineer, and lover of all things PowerShell

Finding the UserID from a PowerShell Remoting session

The parsing mystery of my HERE-STRING

Using PowerShell to Easily Build LBFO teams

Hey! What happened to my DHCP Server?

PowerShell - Easily get Error Codes for Try Catch Finally

Script Wars : The Farce Awakens - the Complete series

7 Years of "Hey! Scripting Guy!" Holiday specials!

Curly Blue and the Meaning of Scripting

Rusty the Red-eyed Scripter

Oliver Script

‘Twas the Night Before Scripting

It’s a Wonderful Shell!

How Mr. Finch Learned Scripting

A PowerShell Carol

Start-Post "Hello World!"