Power Tips

Finding Email of Logged On User

2012-02-08T12:00:00Z

In an Active Directory environment, PowerShell can easily find the currently logged on user and retrieve AD information about that user, for example, his or her email address:

$searcher = [adsisearcher]"(samaccountname=$env:username)"
$searcher.FindOne().Properties.mail

A logon script could then process this information.

ReTweet this Tip!

Remotely Launching Processes

2012-02-07T12:00:00Z

Unfortunately, the Start-Process cmdlet has no -ComputerName parameter so you cannot use it to launch processes on remote machines.

Use WMI instead! This line will run calc.exe on your local machine:

PS> (Invoke-WmiMethod Win32_Process Create calc.exe).ReturnValue -eq 0
True

And this slight adaption will run calc.exe on a computer named "storage1" with Administrator credentials (adjust machine name and user name to your needs):

PS> (Invoke-WmiMethod Win32_Process Create calc.exe -ComputerName storage1
-Credential Administrator).ReturnValue -eq 0
True

Note that calc.exe will run but is not visible to anyone. So in real life, you'd use this technique to launch command line tools or applications that are designed to run unattended.

ReTweet this Tip!

Keeping Remote Programs Running

2012-02-06T12:00:00Z

When you use PowerShell Remoting (like the Enter-PSSession cmdlet) to connect to another machine and then start a program using Start-Process, the program is automatically associated to your remote session. Once you leave and discard your remote session, all programs you previously started with Start-Process will also be killed.

While this is a reasonable cleanup strategy for most scenarios, you sometimes want programs to continue to run, even after you discarded your remoting session. To do that, use WMI rather than Start-Process to run the program:

(Invoke-WmiMethod Win32_Process Create calc.exe).ReturnValue -eq 0

ReTweet this Tip!

Converting TABs to Spaces

2012-02-03T12:00:00Z

When you want to publish PowerShell code, you may want to make sure that all TAB characters are converted to one or more spaces to save space.

Here's the code that turns TAB characters to spaces:

PS> $text = "This is a`tTAB-delimited`tText"
PS> $text
This is a       TAB-delimited   Text
PS> $text -replace '\t', '  '
This is a  TAB-delimited  Text

ReTweet this Tip!

Removing Multiple White Spaces

2012-02-02T12:00:00Z

Removing multiple white spaces from text is easy in PowerShell. Simply use -replace operator and look for whitespaces ("\s") that occur one or more time ("+"), then replace them all with just one whitespace:

PS> '[     Man,     it works!     ]' -replace '\s+', ' '
[ Man, it works! ]

ReTweet this Tip!

Removing Options from Command String (Enhancement)

2012-02-01T12:00:00Z

In a previous tip we showed how you can remove options from a command line text using -replace. Here is a more versatile approach. It will remove any character or word that starts with "/" and then remove all trailing spaces as well:

PS> $command = 'somecommand "C:\Some Folder" "C:\Some New Folder Name" /y /r /quiet /simple'
PS> ($command -replace '/\w*', $null).trim()
somecommand "C:\Some Folder" "C:\Some New Folder Name"

ReTweet this Tip!

Remove Options from Command String

2012-01-31T12:00:00Z

Let's assume you'd like to remove all options from a raw text command such as this one:

xcopy "C:\Some Folder" "C:\Some New Folder Name" /y /r /Q

Since all options start with "/" and are a single character, you can derive a pattern and use a regular expression replace operation. Have a look:

PS> 'xcopy "C:\Some Folder" "C:\Some New Folder Name" /y /r /Q' -replace '/.', $null
xcopy "C:\Some Folder" "C:\Some New Folder Name"

All options are removed. -replace was looking for a "/" and then any other character (".") and replacing every occurrence with nothing ($null).

ReTweet this Tip!

Using Shared Variables

2012-01-30T12:00:00Z

By default, all variables created in functions are local, so they only exist within that function and all functions that are called from within this function.

Sometimes, you'd like to examine variables defined in a function after that function executed. Or you'd like to persist a variable, so next time the function is called it can increment some counter or continue to work with that variable rather than creating a brand new variable each time.

To achieve this, use shared variables by prepending 'Script:' to a variable name. Here's a sample:

PS> function Call-Me { $script:counter ++; "You called me $script:counter times!" }
PS> Call-Me
You called me 1 times!
PS> Call-Me
You called me 2 times!
PS> Call-Me
You called me 3 times!

Note that the variable $counter now does not exist inside the function anymore. Instead, it is created in the context of the caller (the place where you called Call-Me). If you prepended a variable name with 'global:', the variable would be created in the topmost context and thus available everywhere.

ReTweet this Tip!

Catching Errors

2012-01-27T12:00:00Z

In forums, people often get confused with error handling. For example, this code does not call the error handler. Instead, the red PowerShell error message pops up:

try { Remove-Item \\$name\c$\windows\temp\filename.exe }
catch {Write "Not able to access files on $name"}

When you want to catch errors produced by cmdlets, always make sure you add the parameter -ErrorAction Stop to it. Only then will the cmdlet emit an exception that your script can handle. So this works:

try { Remove-Item \\$name\c$\windows\temp\filename.exe -ErrorAction Stop }
catch {Write "Not able to access files on $name"}

If you want error handling for all cmdlets, you can also change the default mode like this:

$ErrorActionPreference = 'Stop'

ReTweet this Tip!

Analyzing System Restarts (Alternative)

2012-01-26T12:00:00Z

In a previous tip we showed how to use Get-EventLog to extract all events related to system reboots. In PowerShell v2, a new cmdlet called Get-WinEvent was added. With it, you can not only access and read the "classic" event logs but also the application event logs introduced in Windows Vista.

To illustrate this, here's sample code that uses Get-WinEvent to extract reboot events:

Get-WinEvent -FilterHashtable @{logname='System'; id=1074}  |
  ForEach-Object {
    $rv = New-Object PSObject | Select-Object Date, User, Action, process, Reason, ReasonCode, Comment
    $rv.Date = $_.TimeCreated
    $rv.User = $_.Properties[6].Value
    $rv.Process = $_.Properties[0].Value
    $rv.Action = $_.Properties[4].Value
    $rv.Reason = $_.Properties[2].Value
    $rv.ReasonCode = $_.Properties[3].Value
    $rv.Comment = $_.Properties[5].Value
    $rv
    
  } | Select-Object Date, Action, Reason, User

Note that Get-WinEvent will not work with Windows XP.

ReTweet this Tip!

Analyzing System Restarts

2012-01-25T12:00:00Z

To find out when a system restarted and why, use the below code to extract the relevant information from the System event log:

Get-EventLog -LogName System -ComputerName storage1 |
where {$_.EventId -eq 1074} |
ForEach-Object {

    $rv = New-Object PSObject | Select-Object Date, User, Action, process, Reason, ReasonCode, Comment, Message
    if ($_.ReplacementStrings[4]) {
        $rv.Date = $_.TimeGenerated
        $rv.User = $_.ReplacementStrings[6]
        $rv.Process = $_.ReplacementStrings[0]
        $rv.Action = $_.ReplacementStrings[4]
        $rv.Reason = $_.ReplacementStrings[2]
        $rv.ReasonCode = $_.ReplacementStrings[3]
        $rv.Comment = $_.ReplacementStrings[5]
        $rv.Message = $_.Message
        $rv
    }
} | Select-Object Date, Action, Reason, User

Event ID 1074 represents a restart event. Rather than extracting the relevant information from the event message text, this code uses the ReplacementStrings property which is an array and holds the significant information bits. Accessing the event entries' replacement strings is much easier than parsing the message text.

The code returns information only if the particular event entry has content in ReplacementStrings[4] (the 5th element of the array) because only then does the event entry represent a shutdown or reboot event.

Note that Get-EventLog supports the -ComputerName parameter, so if a remote system is set up for remote access and you own the appropriate privileges, you can also analyze remote systems.

ReTweet this Tip!

Sending Emails Securely (via SSL)

2012-01-24T12:00:00Z

In a previous tip we showed how to use the Send-MailMessage cmdlet to send off emails and preserve special characters by using UTF8 encoding. When you try this with your freemailer, you may run into issues where your SMTP server complains about needing a secure connection.

So, when you receive such an error message, make sure you add the switch parameter -UseSsl. This only works right though if you use PowerShell v3 (the public CTP2 is readily available). In PowerShell v2, Send-MailMessage does not use the correct port for SSL connections.

Here is a sample that uses the live.com freemailer (formally called "Hotmail") which does require a secure connection:

PS> Send-MailMessage -Body 'My mail message can contain special characters: äöüß' -From youraccountname@hotmail.com -to someone@somewhere.com -Credential youraccountname@hotmail.com -SmtpServer smtp.live.com -Subject 'Sending Mail from PowerShell' -Encoding UTF8 -UseSsl

Note that PowerShell v3 Send-MailMessage accepts "UTF8" directly so you no longer need to submit the awkward ([System.Text.Encoding]::UTF8).

There are plenty of websites that list SMTP server URLs for your favorite provider: http://www.e-eeasy.com/SMTPServerList.aspx.

ReTweet this Tip!

Sending Emails with Special Characters

2012-01-23T12:00:00Z

PowerShell has built-in support for sending emails: Send-MailMessage! All you need is an SMTP server. However, with standard encoding you may run into issues where special characters are mangled. Use the -Encoding parameter and specify UTF8 to preserve such characters. Here's a sample with a German freemailer web.de:

Send-MailMessage -Body 'I can send special characters: äöüß' -From youraccountname@web.de -to someone@somewhere.com -Credential (Get-Credential youraccountname@web.de) -SmtpServer smtp.web.de -Subject 'Sending Mail From PowerShell' -Encoding ([System.Text.Encoding]::UTF8)

ReTweet this Tip!

Check Active Internet Connection

2012-01-20T12:00:00Z

If your machine is connected to the Internet more than once, let's say cabled and wireless at the same time, which connection is used? Here's a function that tells you (thanks for inspiration to fellow MVP Richard Siddaway):

function test-ipmetric {
    Get-WmiObject Win32_NetworkAdapter -Filter "AdapterType='Ethernet 802.3'" |
    ForEach-Object { $_.GetRelated('Win32_NetworkAdapterConfiguration') } |
    Select-Object Description, Index, IPEnabled, IPConnectionMetric
}

ReTweet this Tip!

Use WMI and WQL!

2012-01-19T12:00:00Z

WMI is a great information resource, and Get-WmiObject makes it easy to retrieve WMI instances. First, use -List parameter to find WMI class names. For example, find classes that deal with network:

Get-WmiObject -List Win32_*network*

Next, pick one of the classes and enumerate its instances:

Get-WmiObject Win32_NetworkAdapterConfiguration

With WQL, a SQL-type query language for WMI, you can even create more sophisticated queries, such as:

Get-WmiObject -Query 'Select * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=True'

To learn more about the specific WQL format and the keywords you can use, check this reference: http://msdn.microsoft.com/en-us/library/windows/desktop/aa394606(v=vs.85).aspx

ReTweet this Tip!