I’ve been using these for a C# project I’m working on, but I thought I’d write a short post to show how easy they are to use from PowerShell.

If you want to follow along with the examples, you’ll need to install the following:

PowerShell v1.0  (I used v2.0 on Windows 7, but don’t see any reason why v1.0 won’t do just as well)

.NET Framework 3.5

Microsoft Chart Controls for Microsoft .NET Framework 3.5

I’ll build a simple example script step-by-step.  To use it, simply copy the individual sections into a file called something like “Chart.ps1”, then execute from the PowerShell command window.

To create a chart the first thing you need to do is to load the appropriate .NET assemblies:

# load the appropriate assemblies
[void][Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
[void][Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms.DataVisualization")

System.Windows.Forms gives you the standard forms classes.  While not necessary in order to use the Chart Controls, I’ll be using a form later to display the chart.  System.Windows.Forms.DataVisualization is the main namespace for the chart controls.

Next you’ll need to create a Chart object and set some basic properties:

# create chart object
$Chart = New-object System.Windows.Forms.DataVisualization.Charting.Chart
$Chart.Width = 500
$Chart.Height = 400
$Chart.Left = 40
$Chart.Top = 30

Next you must define a ChartArea to draw on and add this to the Chart:

# create a chartarea to draw on and add to chart
$ChartArea = New-Object System.Windows.Forms.DataVisualization.Charting.ChartArea
$Chart.ChartAreas.Add($ChartArea)

Now for some data to display:

# add data to chart
$Cities = @{London=7556900; Berlin=3429900; Madrid=3213271; Rome=2726539;
            Paris=2188500}
[void]$Chart.Series.Add("Data")
$Chart.Series["Data"].Points.DataBindXY($Cities.Keys, $Cities.Values)

For simplicity, I’ve hard-coded some data on European cities taken from WikiPedia.  As you’ll see later, it is just as easy to use data gathered or generated by the script itself.

The final step is to display the chart on a Windows Form:

# display the chart on a form
$Chart.Anchor = [System.Windows.Forms.AnchorStyles]::Bottom -bor [System.Windows.Forms.AnchorStyles]::Right -bor
                [System.Windows.Forms.AnchorStyles]::Top -bor [System.Windows.Forms.AnchorStyles]::Left
$Form = New-Object Windows.Forms.Form
$Form.Text = "PowerShell Chart"
$Form.Width = 600
$Form.Height = 600
$Form.controls.add($Chart)
$Form.Add_Shown({$Form.Activate()})
$Form.ShowDialog()

If you put all of this together and run it, you should see a Window similar to the one below:

The chart will re-size when you pull the edges of the form around.  In fact, when displayed on a form like this the charts can be quite interactive and, for example, can be updated with live data.  I’ll leave that as an exercise for the reader!

So, we’ve got a fairly basic chart, but what tweaks can we make to improve it?

First thing is to add a title and some labels to the axes:

# add title and axes labels
[void]$Chart.Titles.Add("Top 5 European Cities by Population")
$ChartArea.AxisX.Title = "European Cities"
$ChartArea.AxisY.Title = "Population"

Although it is quite clear in this example which item is the largest, in some instances it might not be as obvious, so it is possible to highlight that item (as well as the smallest):

# Find point with max/min values and change their colour
$maxValuePoint = $Chart.Series["Data"].Points.FindMaxByValue()
$maxValuePoint.Color = [System.Drawing.Color]::Red

$minValuePoint = $Chart.Series["Data"].Points.FindMinByValue()
$minValuePoint.Color = [System.Drawing.Color]::Green

Let's get rid of the extra white space around the chart:

# change chart area colour
$Chart.BackColor = [System.Drawing.Color]::Transparent

Finally, those flat looking bars aren’t too interesting, so let’s give them a slightly 3D appearance:

# make bars into 3d cylinders
$Chart.Series["Data"]["DrawingStyle"] = "Cylinder"

Now, you should have something like this:

A nice little chart, with minimal effort. 

This is all good, but your chart is gone once you close the form.  Wouldn’t it be great if you could save a copy?  Well, the good news is that you can.  The code below adds a button to the form that saves the chart to your desktop when clicked:

# add a save button
$SaveButton = New-Object Windows.Forms.Button
$SaveButton.Text = "Save"
$SaveButton.Top = 500
$SaveButton.Left = 450
$SaveButton.Anchor = [System.Windows.Forms.AnchorStyles]::Bottom -bor [System.Windows.Forms.AnchorStyles]::Right
$SaveButton.add_click({$Chart.SaveImage($Env:USERPROFILE + "\Desktop\Chart.png", "PNG")})

$Form.controls.add($SaveButton)

A couple of points about this button:

• I also reduced the height of the chart to make room for the button, by changing the chart height set earlier in the script: $Chart.Height = 450
• As it happens, this button is not necessary, and you can call the save method directly from PowerShell, like this:

# save chart to file
$Chart.SaveImage($Env:USERPROFILE + "\Desktop\Chart.png", "PNG")

• You should call “$Form.controls.add($SaveButton)” after creating the form object.  This seems obvious, but I just wanted to be clear as the snippet above doesn’t show the rest of the code for the form and depending on where you paste it in, it may fail.

If you’re more interested in a fully automated script with no GUI or user interaction, then you’ll be glad to hear that the Windows Form is not necessary at all – you can create, populate, configure and save the chart to file without ever displaying it.  This  is useful if you don’t actually want to see it there and then, but need it for a report or presentation later.

Ok, so you’re not interested in European demography.  In that case, let’s look at an example that is more useful if you’re a SysAdmin.

As you know, with PowerShell it is trivial to gather certain system information.  For example, here is how to gather information on running processes and display it in a (truncated) table:

PS C:\Windows\system32> Get-Process | Format-Table

Handles  NPM(K)    PM(K)      WS(K) VM(M)   CPU(s)     Id ProcessName
-------  ------    -----      ----- -----   ------     -- -----------
    128      10    15848      15556    52            5580 audiodg
    909      40    19888      33372   128     5.79   2368 CcmExec
   1324      79    45556      53780   351    26.96   3924 communicator
     57       7     2356       6404    74     0.06    668 conhost
    665      13     1976       4128    48     2.56    364 csrss
    509      19     3972      18040   112     9.86    452 csrss
    116      15    29240      26832   139    43.98   3064 dwm
   1171     148    56664      66612   307    38.08   1256 explorer

Tables are good, but often a simple graph is better, especially in presentations.  Let’s assume you want to show the top 5 consumers of physical memory (WS – Working set – in the table above).  Normally, to show this in a table, you’d do something like this:

Get-Process | Sort-Object -Property WS | Select-Object Name,WS,ID -Last 5 | Format-Table -AutoSize

To add this to a chart, do this instead:

# add data to chart
$Processes = Get-Process | Sort-Object -Property WS | Select-Object Name,WS,ID -Last 5
$ProcNames = @(foreach($Proc in $Processes){$Proc.Name + "_" + $Proc.ID})
$WS = @(foreach($Proc in $Processes){$Proc.WS/1MB})

[void]$Chart.Series.Add("Data")
$Chart.Series["Data"].Points.DataBindXY($ProcNames, $WS)

Apart from this change to how the data is gathered (and the chart titles), everything else in our script remains the same as before.  This is great - once we have a script that shows a chart, we can easily re-use it to show other data.  Obviously, if you’re going to use a lot of charts, then you probably want to organise the charting part as a separate function you can call when needed.  So, this time, your chart should look something like this:

As before, the largest and smallest columns are highlighted.  If your data does not come pre-sorted, as it is in the example, the chart control can sort the data after it is bound to the control, like this:

$Chart.Series["Data"].Sort([System.Windows.Forms.DataVisualization.Charting.PointSortOrder]::Descending, "Y")

This chart is pretty clear and easy to understand, but not all data benefits from a Column view.  Although not ideal for the current example, let’s assume a pie chart would be better.  How do you draw one of those?  Easy.

Remove these code sections from your script:

$Chart.Series["Data"].Sort([System.Windows.Forms.DataVisualization.Charting.PointSortOrder]::Descending, "Y")

$ChartArea.AxisX.Title = "Process"
$ChartArea.AxisY.Title = "Working Set (MB)"

# Find point with max/min values and change their colour
$maxValuePoint = $Chart.Series["Data"].Points.FindMaxByValue()
$maxValuePoint.Color = [System.Drawing.Color]::Red

$minValuePoint = $Chart.Series["Data"].Points.FindMinByValue()
$minValuePoint.Color = [System.Drawing.Color]::Green

# make bars into 3d cylinders
$Chart.Series["Data"]["DrawingStyle"] = "Cylinder"

Substitute the following:

# set chart type
$Chart.Series["Data"].ChartType = [System.Windows.Forms.DataVisualization.Charting.SeriesChartType]::Pie

Which gives you a basic pie chart:

To improve the appearance, add the following code:

# set chart options
$Chart.Series["Data"]["PieLabelStyle"] = "Outside"
$Chart.Series["Data"]["PieLineColor"] = "Black"
$Chart.Series["Data"]["PieDrawingStyle"] = "Concave"
($Chart.Series["Data"].Points.FindMaxByValue())["Exploded"] = $true

Now, your chart should look like this:

Well, that’s it for this short tutorial, but if you’re hungry for more (and there is a lot more) on using the Chart Controls, download the Chart Control documentation and samples:

Microsoft Chart Controls for .NET Framework Documentation
Samples Environment for Microsoft Chart Controls

The good news is that Bitlocker can also secure removable drives.  Admittedly, this makes the drive somewhat less portable, but it does allow you to create a secure backup that you can carry with you.  Here's how to do it:

• Insert the USB drive and format using NTFS.  If you already have files on the drive, either temporarily copy these elsewhere and run a normal format then copy the files back, or use the convert command at the command-line to change the format with the files in place.
• Open the Bitlocker Drive Encryption tool from the Control Panel.  Notice that the removable drive is shown as a valid drive for Bitlocker encryption:

The drive used in the above example is a simple 4GB USB drive.

• Click "Turn on Bitlocker" and follow the prompt to encrypt the drive.  Make sure to save the recovery key to a secure location, which means somewhere other than another USB drive you carry around with you!

Now the drive is fully encrypted by Bitlocker and will be automatically useable on the system it was encrypted on.  So, you can now copy files from your main encrypted system to here and carry the drive around as a secure backup.  If the drive is stolen/lost, the data is inaccessible:

One downside to this is that the increased security has come at the cost of reduced portability.  If all you want is a backup copy of your original files, to be used only when the originals are corrupt or lost, then this is fine as moving between systems isn't really an issue.  However, if you want to use the drive on several machines, say to copy files from a desktop system to your laptop, or vice versa, then the current setup won't do.

To make the drive accessible on another Bitlocker-capable machine, do this:

• Insert the drive as normal.  As mentioned above, it will be inaccessible in Explorer (or via any other means, for that matter), but it is recognised by the system  as being encrypted:

• Open the Bitlocker Drive Encryption tool.  The drive will appear as encrypted and locked:

• Click "Unlock Volume" and follow the prompt to supply the recovery key.  Once unlocked, the data will be accessible as with a normal USB drive. In addition, if the system used to unlock the drive is itself Bitlocker protected, you will see an option to save the recovery key locally:

Using the "Save Keys" option means that each time you insert the drive, it will be automatically unlocked and ready for use, just like a normal USB drive.

You can repeat the steps above on as many systems as you like to make the Bitlocker encryption transparent between these systems, while ensuring that the data on the removable drive remains secure.  Unfortunately, the data is not going to be readable on any system that does not support Bitlocker, but for the scenario I started with (as a secondary, secure, storage for your Vista laptop), then this doesn't really matter.

This suits me fine as I like to get to know new software technologies via their API - I think it really helps to understand the features and what you can do with a technology if you have to write some code using it.  You may think differently, depending on how much coding you do - if you are more of a scripter, then check out my colleague, Ben Pearce's blog, where he does a similar thing to what I'm doing here, but using PowerShell.

Anyway, Hyper-V provides a nice interface for scripting and programming.  The interface is usable from any scripting/coding language that can access WMI.  For example: VBScript, C++, PowerShell, C#, etc.  In this short tutorial I'll look at connecting and querying via C#, but the techniques can be easily adapted to the language of your choice.

UPDATE:  After posting I realised I'd made a classic dev mistake:  I wrote and tested the code while logged in with an account with administrative rights on the Hyper-V server, and just assume you'd do the same  If you have any access problems make sure you use an appropriate account.  Some references to help with setting that up:

Connecting to WMI on a Remote Computer

Hyper-V Remote Management: You do not have the requested permission to complete this task. Contact the administrator of the authorization policy for the computer ‘COMPUTERNAME’

Basic Connection

WMI is the Microsoft implementation of WBEM and has been around since Windows 2000, so you may already be familiar with it from scripting, etc.  If you've used it in C# before, then even better - working with Hyper-V will be a breeze for you.

For this example, we will need to use the Msvm_ComputerSystem class.  This class gives details of a Hyper-V host or virtual machine, including the "state" (i.e. is it running, paused, etc), "runtime" (how long has it been executing), etc.

Using this class, we can easily connect to the local system and grab a list of the VMs.  The important WMI bits are these:

// add this namespace in order to access WMI
// also need to add a reference to System.Management.dll
using System.Management;

// we want to connect locally (".") to the Hyper-V namespace ("root\virtualization")
ManagementScope manScope = new ManagementScope(@"\\.\root\virtualization");

// define the information we want to query - in this case, just grab all properties of the object
ObjectQuery queryObj = new ObjectQuery("SELECT * FROM Msvm_ComputerSystem");

// connect and set up our search
ManagementObjectSearcher vmSearcher = new ManagementObjectSearcher(manScope, queryObj);
ManagementObjectCollection vmCollection = vmSearcher.Get();

// loop through the machines
foreach (ManagementObject vm in vmCollection)
{
    // display VM details
    Console.WriteLine("\nName: {0}\nStatus: {1}\nDescription: {2}\n",
                        vm["ElementName"].ToString(),
                        vm["EnabledState"].ToString(),
                        vm["Description"].ToString());
}

The above code will connect to the local Hyper-V system and pull out details for the host and all VMs.  To connect to a remote system, simply change the management scope:

ManagementScope manScope = new ManagementScope(@"\\RemoteSystem\root\virtualization");

Where "RemoteSystem" is the name of the remote Hyper-V system to manage.

I'm Not Me, I'm Him

The above sample can connect locally and remotely (depending on the scope) and in both cases, it simply uses the credentials of the logged-on user.  However, in the remote case, it is possible to supply alternate credentials to use.  It is a little more work, but not much:

// add this namespace in order to access WMI
// also need to add a reference to System.Management.dll
using System.Management;

// define the information we want to query - in this case, just grab all properties of the object
ObjectQuery queryObj = new ObjectQuery("SELECT * FROM Msvm_ComputerSystem");

// object for storing WMI connection options
// pass the "user", "password" and "domain" from command-line
// don't hard-code these into the application!
ConnectionOptions connOpts = new ConnectionOptions();
connOpts.Username  = user;
connOpts.Authority = "ntlmdomain:" + domain;
connOpts.Password  = password;

// management scope object
ManagementScope manScope = new ManagementScope(@"\\RemoteSystem\root\virtualization", connOpts);

// connect and set up our search
ManagementObjectSearcher vmSearcher = new ManagementObjectSearcher(manScope, queryObj);
ManagementObjectCollection vmCollection = vmSearcher.Get();

// loop through the VMs
foreach (ManagementObject vm in vmCollection)
{
    // display VM details
    Console.WriteLine("\nName: {0}\nStatus: {1}\nDescription: {2}\n",
                      vm["ElementName"].ToString(),
                      vm["EnabledState"].ToString(),
                      vm["Description"].ToString());
}

Trying to use alternate credentials locally will result in an exception.

So, that's it for basic connecting and querying the machines on a Hyper-V system.  For a more complete sample that implements the above code in a more realistic way, grab the download below.

Code Sample

Download a complete working code sample here:

VMStateQuery Code

VMStateQuery is a command-line tool that implements the code snippets discussed above.  Compile in Visual Studio, then use like this:

VMStateQuery [-vhost remoteserver] [-user domain\user] [-pwd password] [-vguest guest] [-sortbystate]

Where:

-vhost remoteserver	specifies the remote hyper-v server to manage
-user	specifies the domain\user to connect as
-pwd password	password for the specified user account
-vguest guest	query the state of a specific virtual machine
-sortbystate	sort the output by the state of the machine

Typical output looks like this:

References

Windows Management Instrumentation Documentation

System.Management Namespace

Virtualization WMI Provider

Note:  Thanks to my colleague, Tushar, who sent some of these links around to our team recently.

Official Hyper-V Web Sites

Hyper-V Homepage

Hyper-V TechCenter

Getting Started with Hyper-V

Top Ten Reasons to Adopt Hyper-V (.docx)

Key Hyper-V Features

Hyper-V FAQ

Hyper-V Release Notes

Hyper-V Step-by-Step Guide: Getting Started

Hyper-V Documents and Articles

Windows Server 2008 Hyper-V Technical Overview (.docx)

Hyper-V Step-by-Step Guide: Testing Hyper-V and Failover Clustering

Solution Accelerator Guide: Windows Server Virtualization

Solution Accelerator Guide: Selecting the Right Virtualization Technology

Microsoft Assessment and Planning Tool

Virtualization and Consolidation with Hyper-V

Hyper-V Installed Help

Quick Migration with Hyper-V (.doc)

Windows Server 2008 Hyper-V and BitLocker Drive Encryption (.docx)

Configuring Hyper-V for Windows Essential Business Server (.pdf)

Virtualisation and Licensing

Windows Server System Licensing for Virtualization Scenarios

Licensing without Hyper-V

Your Ultimate Quick Reference Resource for Licensing and Pricing (.pdf)

Hyper-V Programming and Scripting

Virtualization WMI Provider

Hyper-V Training and Webcasts

Webcasts

Implementing and Managing Windows Server 2008 Hyper-V

Exam 70-652: Windows Server Virtualization, Configuring

Hyper-V Related Blogs

Virtual PC Guy's WebLog

John Howard - Hyper-V and virtualization blog

Rob Larson's blog

Virtual Varia

Virtualisation Team Blog

Miscellaneous

Hyper-V Capable Server Hardware

Hyper-V Discussion Forum

Virtualisation Solution Center

Windows Server 2008 Hyper-V Resource Kit

Performance Tuning Guidelines for Windows Server 2008

System Center Virtual Machine Manager

Windows Server 2008 Evaluation Virtual Hard Drive Images (for Hyper-V)

Msdn Technet Powered By Hyper V (.docx)

Infrastructure Planning and Design

Windows Server Virtualization Technologies

Hyper-V Knowledge Base Articles

949222 - Virtual machines that were created on the beta version of the Hyper-V role do not start after the Hyper-V role is updated to a later version

950050 - Description of the update for the release version of the Hyper-V technology for Windows Server 2008

950792 - When you try to enable, disable, or update Hyper-V technology, the process stops responding

951636 - Description of the Hyper-V Language Pack for Windows Server 2008

952627 - Description of the Windows Vista Service Pack 1 Management Tools update for the release version of Hyper-V

953828 - The NLB host does not converge as expected on Windows Server 2008 Hyper-V virtual machines

954279 - You are not prompted for credentials after you receive an "Access Denied" error message when you try to connect to a virtual machine from the Windows Server 2008 Hyper-V MMC snap-in

954280 - Error message when you try to export a virtual machine on a Windows Server 2008-based computer that uses Hyper-V: "An error occurred while attempting to export the virtual machine"

954281 - After you install Windows 2000 on a virtual machine that is running on a Windows Server 2008-based computer that uses Hyper-V technology, you can only create a maximum startup disk that is 127 GB

954282 - The VMBus device does not load on a virtual machine that is running on a Windows Server 2008-based computer that has Hyper-V installed

954283 - You experience issues after you install Windows Server 2008 Hyper-V Integration Services on a Vista Home Premium virtual machine or a Vista Home Basic virtual machine

954356 - After you deploy a Sysprep prepared image, the Hypervisor layer service does not start automatically in Windows Server 2008

954357 - Error message when you use Vmconnect.exe to connect to a virtual machine in Windows Server 2008: "A connection will not be made because credentials may not be sent to the remote computer."

954358 - Virtual Hard Disk (.vhd file) contents may be accessed by all users after you mount the file as a loopback device in Windows Server 2008

954958 - Guest operating systems that are supported on a Hyper-V virtual machine host

Although I wanted to use Server 2008, I still wanted Vista as my day-to-day desktop for email and the like, so I planned to dual boot with a shared data partition.  However, as I sometimes have sensitive documents on my laptop I wanted to use Bitlocker to secure everything.

At first I wasn't sure what would happen if I just booted to Vista or Server 2008 and Bitlockered all of the drives.  Would the system boot at all?  Would I lose access to one or both operating systems?  What about the shared data?

As it turns out, this dual-boot scenario is no problem for Bitlocker.  In case you're faced with a similar scenario, here's how I installed mine:

1. Installed Vista Ultimate SP1 to C: partition.  Vista Enterprise also supports Bitlocker.
2. Installed Server 2008 Enterprise on D: partition.
3. Created data partition E:.
4. Created a small partition, S:, for the unencrypted boot files.  You can do this manually with Disk Manager or you can use the Bitlocker Drive Preparation Tool (also available as an Ultimate Extra).
5. Booted into Vista and applied Bitlocker to the C: drive, saving the recovery key to a USB drive and setting a boot PIN.
6. Booted into Server 2008 and applied Bitlocker to D:, saving the recovery key to a USB drive and setting a boot PIN.  The PIN is not shared across the two operating systems, but you can use the same number for both.

At this point both operating systems are protected by Bitlocker, both boot fine (using the appropriate PIN) and both can access the unencrypted data partition E:.  However, they cannot access each other's partition.  Next, to protect E: and make it accessible to both operating systems, I did this:

1. Booted into Vista and applied Bitlocker to the E: partition, saving the recovery key to a USB drive.
2. Booted into Server 2008, where E: is now inaccessible.
3. Started the Bitlocker Drive Encryption tool and selected the "Unlock Volume" option for E:
4. Selected to load the volume recovery key from removable media when prompted and inserted the USB drive.
5. Selected the "Save key..." option and unlocked the partition.

Now, partitions C:, D: and E: are all protected by Bitlocker and each OS can boot without problem and can access the shared E: drive without any need to enter the recovery key.  I deliberately left it so that each OS still can't see the other's install partition, so as to avoid accidental changes, but using the "unlock" method above it would be possible to make all drives accessible under each OS.

There is possibly a neater way of doing this, but apart from waiting for the encryption steps to complete it was all very quick and painless.

A couple of notes:

• I used a new system with clean installs of Vista and Server 2008, so if things had gone wrong all I'd have lost is a bit of my time.  If you do this on an existing system, please remember to back up your data first - I'm sure everything will be fine, but you never know ...
• If you follow the method above you will end up with a USB drive with all of your recovery keys on it.  Remember to keep this in a safe place away from your computer (e.g. don't leave it in your bag with your laptop).
• If you're interested in dual-booting with an OS that doesn't support Bitlocker, have a look here.
• Above, I assume you know how to turn on Bitlocker, but if you don't, you can find details in the Windows BitLocker Drive Encryption Step-by-Step Guide.

Relog is built-in for Windows XP and later, and is available to download for Windows 2000. Here are some things it can do:

Converting Logs to Different Formats

The default log format for performance logs is Binary (.blg) and you usually just want to leave it that way as PerfMon can read it just fine.  However, what if you wanted to use another tool (Excel, for example) to analyse the data and the tool doesn't understand binary files?  Relog allows you to take an existing log in, say, .blg format and generate a new file in, say, Comma Separated Value (.csv) format:

Relog OriginalLog.blg -f CSV -o NewLog.csv

This command takes OriginalLog.blg and creates NewLog.csv from it, with this new log containing all of the same datapoints as the original.  You can convert between .blg, .csv, Tab Separated Value (.tsv), and .sql formats.

Resampling the Data

When creating a log file one of the parameters you need to set is the sample interval.  You should set this according to the nature of the troubleshooting or monitoring you're doing, so, for example, you would not set the same sample interval on logs that will run for 3 weeks as you would for one that runs for 3 hours.  However, you can still end up with some unwieldy log files, which are a pain to view in PerfMon.  Relog allows you to resample the data, generating a new log file containing every n-th datapoint.  For example, this command will take OriginalLog.blg and generate NewLog.blg, which contains every 5-th datapoint:

Relog OriginalLog.blg -t 5 -o NewLog.blg

Clearly, you are discarding information here and care needs to be taken or you may end up missing something important from the new dataset - for example, if you originally sampled every 60 seconds, but change this to the equivalent of every 30 minutes, you are likely to miss a transient problem that lasts 5 minutes.  However, this isn't really any worse than if you'd set the sample interval differently in the first place, so better to select the correct interval before logging begins.

If you don't want to lose data, but know that the problem your investigating happened mid-way through the logging period, then you can create a new log of just the datapoints in a given time window.  For example, if we have a log that ran between Midnight on 3rd March to Midnight on 10th Match, we can extract the data for 5th and 6th March using this command:

Relog OriginalLog.blg -b 05/03/2008 00:00:00 -e 06/03/2008 00:00:00 -o NewLog.blg

Relog does its best to match the times specified, but if these do not correspond to specific sample times, then it chooses the closest ones.

Extracting Specific Counters

As an alternative to the above approach of re-sampling the datapoints, you can split your log file into multiple files, each with all the datapoints, but with a subset of the original counters.  For example, the following command will take all of the Memory-related counters from OriginalLog.blg and copy them to NewLog.blg:

Relog OriginalLog.blg -c "\Memory\*" -o NewLog.blg

If you need to do more complex filtering of the counters, then you can list the counters you want in a text file and pass the path to Relog:

Relog Original.blg -cf CounterList.txt -o NewLog.blg

The counter list is specified with a single counter per-line.  For example:

\Memory\Pool Paged Bytes
\Process(*)\Pool Paged Bytes
\Process(*)\Handle Count
\Thread(Explorer*)\% Processor Time 

Merging Logs

If you have several logs you've split out as described above and would like to re-combine two or more of them, say for easier comparison in PerfMon, then Relog can do this as follows:

Relog SeparateLog11.blg SeparateLog2.blg -o CombinedLog.blg

This takes SeparateLog1.blg and combines it with SeparateLog2.blg and writes the result to CombinedLog.blg.  You can do this for more than two logs, but all of them must be in .blg format.

Combining Actions

It is possible to combine some of the actions mentioned above in a single command.  For example:

Resample and convert log type

To convert from .blg to .csv and copy only every 10th datapoint, us this command:

     Relog OriginalLog.blg -f CSV -t 10 -o NewLog.csv

 

Extract Counters, Change Time Window and Resample

To extract every 5th datapoint for just the Memory counters from 5-6th March, use this command:

     Relog OriginalLog.blg -b 05/03/2008 00:00:00 -e 06/03/2008 00:00:00 -c "\Memory\*" -t 5 -o NewLog.blg 

Obviously, analysing the data after you've played around with it is the critical part, and that's beyond the scope of a simple blog post, but to get you started, here are a few resources that you might find useful:

Performance Analysis of Logs (PAL) .   PAL automates the analysis of the logs by applying specified thresholds (supplied) to the data, generating reports with details of what it found.

Windows Performance Guide.  Part of the Server 2003 Resource Kit, this is the place to read up on performance analysis.

Performance Tuning Guidelines for Windows Server 2003.  Provides guidance on parameter to tweak in order to maximise performance in Server 2003.

Performance Tuning Guidelines for Windows Server 2008.  Server 2008 equivalent of the guide mentioned above.

Now, there is an option to export your keys to an XML file, which means you can have them available off-line.  However, XML isn't the most user-friendly format:

Admittedly, XML is great for developers looking for a nice file format to store data in and MSDN subscribers you would assume are developers, but you really don't want to have to write a script or app to read the keys.  So, to save you the trouble I wrote a simple tool, KeyView.exe, that loads the XML file and displays the keys in a more useful format:

Download KeyView as a Visual Studio 2008 project here (get VS 2008 from the MSDN download site):

KeyView C# Code Download  [Updated: 15 March 2008]

Note: you may need to install .NET Framework 3.5 to make KeyView work.

Once compiled, to get KeyView to work, you simply need to export your keys from the MSDN site to a file called MSDNkeys.xml in the same folder as KeyView and it will load the data automatically when it's launched.  Alternatively you can browse to the file if it's stored, say, on a network share.  Also, if you need to, KeyView allows you to export the data to CSV format.

Yes, yes, not the most useful tool in the world, but I was bored one evening while stuck in a hotel on a business trip!

Unfortunately there isn't any public API or scripting interface for this, nor a GPO setting - the only "theme" GPO setting relates to deploying a specific "style" (stored in an 'msstyles' file), which is not the same as the theme (stored in a 'theme' file).

After some work we devised the workaround below.  This isn't ideal, by any means, but does the job.  I thought I'd blog about it in case it's useful to anyone in a similar situation.  The usual caveats apply about hacking the registry, etc.  While this seems to work for the moment, there's no guarantee that a future update may change the behaviour. 

We created these two Aero-based themes:

 

Red.theme - for non-secure systems

 

Blue.theme - for secure systems

To forcibly apply these at logon we: 

• Copied the .theme files to a location on the local disk of the target system
• Changed the "InstallTheme" value in the following registry key to point to the full path of the specifice .theme file:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes

NOTE: A custom ADM file that sets this can be downloaded here.  Using this you can set the registry key centrally in the computer policy for the target system(s).

• Added the following commands to the user's logon script:

reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Themes /v SetupVersion /f
regsvr32 /n /s /I:/UserInstall themeui.dll

When the user logged on, the script forced the custom theme to apply.  With all this in place, we were able to manage the themes centrally in Active Directory to easily change between themes without visiting the clients.

I'd be interested to hear of your experience using this or any better method you have for doing the same thing.

Services generally run with elevated privileges and are therefore very attractive targets for hackers looking for ways to elevate their own privilege level. In Windows Vista several key changes help reduce the security risk when using system services.  Important changes are:

Session 0 Isolation

Previously Windows services would all run in the same session as the first user who logged on to the console. This session is called Session 0.  

Running services and user applications together in Session 0 poses a security risk.  Some services have visible and invisible windows and dialogs that the user or other processes can interact with directly using mouse input or programmatically via window messages.  This makes them vulnerable to certain attacks such as the so-called Shatter Attack.

Vista mitigates the risk by isolating system services in Session 0 and making Session 0 non-interactive; in Vista, only system processes and services run in Session 0 and the first user logs on to Session 1.  Subsequent users log on to sessions 2, 3 ,4 , etc. This means that services never run in the same session as user applications and are therefore protected against attacks from malicious user-mode code.

Figure 1 shows an example service, RegAlert, running on Windows XP.  This service monitors a specific registry value and will display a dialogue box to the user when the contents change.  In XP, the console user sees the dialogue and can interact with it easily, but as I mentioned this means that malware can also interact with it.  Since users and system services no longer "live" in the same session in Vista, this dialogue is not visible to the console user on a Vista system (though there is a workaround, that I'll discuss shortly). 

Figure 1: Service dialogue shown on the XP user desktop

Consequences of Session 0 Isolation

Any service (or service-hosted driver) that assumes the user is running in Session 0 won't work correctly in Windows Vista. Some examples of where this is potentially a problem are:

UI Interaction

As mentioned above, any service that assumes the user is in the same session is going to have problems interacting with users.  Services that show dialogs like this should use alternative methods; for example, use the Terminal Services APIs such as WTSSendMessage to send messages to the appropriate session or use CreateProcessAsUser to create a new process in the user’s session.

Window Messages

If a services and applications use window message functions such as SendMessage and PostMessage to interact they are not going to work as the session isolation means they will have isolated message queues.

Using Named Objects

For services running in Session 0, named objects they create are usually in the \BaseNamedObjects\ namespace. However, user applications that try to open these objects using the default Local\ prefix are going to have problems as the objects are not local to the user session as they were in XP. The proper thing to do here is to create the object with the explicit Global\ prefix.

In actual fact these implications for services are also a problem with Fast User Switching (FUS) in Windows XP because FUS users all run in different sessions. Services that assume that the user is running in Session 0 encounter the same issues as above when subsequent users log on using FUS. Services that work fine with FUS are likely to be ok in Vista, but should be thoroughly tested before migration.

Interactive Service Detection Service

To help work with legacy services that send dialogue boxes to the Session 0 desktop a new system service, the Interactive Service Detection Service (UI0Detect), is available.  

The UI0Detect service notifies the user when a dialogue box or window appears in Session 0. Information about each of the last ten dialogue boxes will appear in turn.

Figure 2 shows the RegAlert service running on a Vista system.  This time, the dialogue is not displayed to the user; instead the UI0detect shows its own dialogue detailing the service that wants to interact with the user.

Figure 2: UI0detect service alerts the user that a dialogue was shown in Session 0

At this point users can:

•    Respond to the dialogue box immediately by clicking the "Show me the message" button to switch to Session 0, interact with the dialogue box, then switch back to their session.

•    Be reminded again in 5 minutes. They will continue to be reminded until the dialogue box closes.

Figure 3 shows what the user will see if they select the "Show me the message" option shown in Figure 2.  The user can then interact with the dialogue as they would in XP, but the critical difference is that other applications running on the user's desktop are prevented from any interaction.

Figure 3: the Session 0 desktop showing the service dialogue

The UI0detect service can notify users logged on at the physical machine or via Remote Desktop.

Privilege Management

Windows Vista now runs many services under accounts that have a lower level of privilege than the LocalSystem account that was typically used in previous Windows versions.  In addition, service developers (and administrators) can have their service declare to the Service Control Manager (SCM) which privileges they actually need and the SCM then gives the service a “filtered” token, with just those privileges. This means that even if the service is compromised the rights gained by the hacker are limited to only those the service uses and not the full set granted to LocalSystem, for example.

Administrators can use the built-in SC command to manage the privileges of a given service, so that legacy services (which don’t declare their privilege needs), can also be restricted:

Querying Service Privileges
The privileges allowed to a particular service can be queried using the qprivs option:

SC [server] qprivs [service name]

Figure 4: Showing the privileges allowed for the Windows Installer Service

Setting Service Privileges
The privileges allowed to a particular service can be set using the privs option:

SC  [server]  privs [service name] [privilege1/privilege2/...]

For example, to allow the Windows Installer service on the local system only the "act as part of the operating system" and "debug programs" rights, use this command:

SC privs msiserver SeTcbPrivilege/SeDebugPrivilege

Or, to clear all privileges set for the Windows Installer, use this command:

SC privs msiserver /

The privileges for a particular service can be set programmatically using the ChangeServiceConfig2 API and are stored in clear text here in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service name>\ RequiredPrivileges

Figure 5: Windows Installer service privileges shown in the registry

 

Service Isolation 

The final tool available for securing services is the ability to restrict object access for system services as if the service itself is a user - this is known as Service Isolation.  In Vista, the SCM can create a new Security Identifier (SID) for the service itself (hence, it's called a per-service SID).  That is, the service will have a new, unique, SID that can be used to grant/deny it permissions to files, etc regardless of the account the service runs under.

The SCM adds the service SID to the security token used when the service is running and it is possible for Administrators to apply a blanket restriction on any “write” operations by the service by setting the SID type. 

The SID type can be:

NONE - new SID type is not used

RESTRICTED - SID is restricted from writing to files, registry, etc unless explicitly granted access

UNRESTRICTED - new SID is created and added to the token, but write operations are not automatically restricted

Again this setting can be managed with the SC command:

Viewing the Current SID Type

To query the current type of the service SID, use this command:

SC [server] qsidtype [service name]

Figure 6: Showing the SID type for the RegAlert service

Setting the SID Type

To set the SID type, use this command:

SC [server] sidtype [service name] [none|restricted|unrestricted]

Once the SID is restricted, the service will not be able to write to any resources. Administrator can then use normal file/registry permissions to allow the service access to only the resources they want it to access.

Figure 7: File permissions for the RegAlert service

Further Reading

This is just a brief look at a couple of changes I found interesting.  For more detail on these and other improvements, have a look at these documents:

Services in Windows Vista

Impact of Session 0 Isolation on Services and Drivers in Windows Vista

How File and Registry Virtualisation Helps

%UserProfile%\AppData\Local\VirtualStore

 

The FARV VirtualStore, showing some redirected folders.

If you navigate to the Windows drectory in Windows Explorer, you will not see the virtual version of the file. Explorer will show the actual content of folder. However, it does alert you to the fact that virtual copies of some files exist by a new button on the taskbar:

Explorer alerts you to the existence of user-specific files in the VirtualStore

Clicking this button takes you to the virtual store mentioned above.

A similar store exists for redirected Registry changes:

HKEY_CLASSES_ROOT\VirtualStore

HKEY_USERS\<user SID>\Software\Classes\VirtualStore
[also accessible via: HKEY_CURRENT_USER\Software\Classes\VirtualStore]

What is Virtualised?

Registry (includes subkeys)

HKEY_LOCAL_MACHINE\Software

Exceptions are:

• HKLM\Software\Microsoft\Windows
• HMLM\Software\Microsoft\Windows NT
• Other subkeys under “Microsoft”

Keys can be excluded by setting the new DONT_VIRTUALIZE flag for the key using the Reg.exe tool.

Filesystem (includes subfolders)

• %SystemRoot% (e.g. C:\Windows)
• %ProgramFiles% (e.g. C:\Program Files)
• %AllUsersProfile% (e.g. C:\ProgramData – previously C:\Documents and Settings\All Users)

Binary executable files (.exe, .dll, .sys, etc) are excluded from virtualisation. Additional extensions can be added here:

HKLM\System\CurrentControlSet\Services\Luafv\Parameters\ExcludedExtensionsAdd

When is File and Registry Virtualisation Enabled?

1. Process Target Architecture. FARV is not enabled for 64-bit applications.
2. Logon Type. Only activity originating from an interactive logon is virtualised. So, for example, any file writes due to file sharing across the network are not subject to FARV.
3. Running as Administrator. If an application was launched with a Full Token, then Windows does not enable FARV since it is assumed that the user has appropriate access permissions for the locations discussed above.
4. Application Manifest. If the application has an associated manifest file (embedded or external) that contains the new requestedExecutionLevel entry, Windows assumes the application has been written specifically for Windows Vista and thus will deal appropriately with security restrictions.
5. User Intervention. If the user decides that FARV is not required, they can disable it using Task Manager:
   
    

Virtualisation status shown in Task Manager

Right-clicking on an entry in Task Manager shows a context menu with an option to toggle FARV on and off.

Limitations of File and Registry Virtualisation

• Target locations. The locations handled by FARV are hard-coded and apart from the Registry exclusions mentioned above users cannot alter this list. Nor can the user specify where the redirected data is stored.
• Machine-wide changes. FARV works on a per-user basis, thus changes stored by one user are not seen by other users. Also, since user-specific data over-ride any actual data, Administrators have no way to make changes for all users at the same time.
• Roaming users. FARV data that is stored in the local filesystem and does not roam with the user when they move to another computer.
• Application functionality. For poorly written applications that may rely on settings stored in the virtualised locations to determine what they allow users to do, etc, this can be by-passed by the user changing data in the virtualised location, which over- rides any “real” settings in the restricted locations. Even if this does not result in a security problem (which it might), it could still lead to unexpected behaviour.