Search results for 'app:weblogs' matching tags 'BATCHman' and 'guest blogger'

BATCHman Uses PowerShell to Identify and Unlock User Accounts

Anonymous — Sun, 11 Sep 2011 05:00:00 GMT

Summary: BATCHman shows how to use Windows PowerShell to locate and unlock user accounts in Active Directory.

Microsoft Scripting Guy Ed Wilson here. In the continuing saga of the world’s first Windows PowerShell superhero, BATCHman, and his faithful sidekick, Cmdlet, I once again present Windows PowerShell MVP and Honorary Scripting Guy Sean Kearney.

Whenever trouble happens in systems and people will call,

And darkness rolls out causing your fall,

Creatures of bits roam in the night,

Shine to the sky, the bright bluish Light,

And call to…BATCHman !

…and, oh yes, his sidekick Boy Blunder Cmdlet, too.

Shock! Terror! The Redmond Police office has been rendered useless! A dark shadow has crossed over the LAN!

“Our accounts! Every account in Active Directory locked out!” the police chief stared blankly at the computer screen. He then glared darkly across the hallway at the culprit who is dressed in all black, hissing back at the police chief.

It was the dreaded Script Kitty, Madame CatFile’s only daughter. For years, there was a chance of her not assuming her mother’s role of foul villainry, and then the worst happened: she saw the cool clothes evil villains wore, and that was that. She was another victim of fashion.

Tonight, she had somehow slipped into the office in the guise of one of the cleaning staff and plugged her laptop into an unwatched LAN jack. She ran her “AttackCityHall.vbs” script in the hopes of unlocking at least one account. Fortunately for the city of Redmond and unfortunately for her, neither time nor password complexity rules was on her side.

Unfortunately, the city had for security reasons designed its Active Directory to not automatically unlock. Thus, the poor police chief found himself in a predicament.

“Hiiiiissssss,” Script Kitty hissed again at the chief.

How dare he walk in on her while she was attempting to hack all of the accounts in the city of Redmond? She would have gotten away, too, if it weren’t for that oh-so-cute little mouse. She just had to pounce on it! After all, it was a pink Arc mouse. “So rare! Purrrrr,” her mind raced and then she was quickly caught and locked up.

There was only one account that Script Kitty missed. She, in her haste, somehow overlooked an administrator account.

The police chief looked over at the blue box on the wall with a small hammer marked, “In case of network emergency, break glass and press button.”

The glass shattered, the police chief did the one thing he never thought he’d need to do: he summoned the BATCHman Klaxons.

He pressed the Get-Help button, and moments later, 1,000 loudspeakers inside his office began pumping out a 1,000-decibel warning siren along with a blinding light.

Covering his ears and eyes, he stumbled across the room looking at the deputy. Taking a hammer to the Get-Help button and many sparks later, the sound and light disappeared.

Staring at his deputy, he cursed, “I told you, have them mount the BATCHman warning system outside the office, not inside!” He quickly grabbed his cell phone and dialed BATCHman’s private line.

***Moments later with a THUD and WHUMP***

“Never fear, BATCHman is here!” announced BATCHman.

The police chief looked up still recovering from the massive assault of sound and light. “Yes! Thank goodness you’re here! We are in dire need of your help!” he shouted above the imagined din.

BATCHman looked. “No need to yell, good citizen. We can h…”

The police chief gestured to all the loudspeakers in the office as well as the broken BATCHman blue box.

“Ahhhh, not again. Must remember, outside not inside.”

Quickly the Police chief guided him to the workstation “We’re locked out of Active Directory! Only one good account! Need to get in! GUI slow! Ears hurt, too!”

BATCHman thought for a moment. With Windows PowerShell, they could solve this easily. Nevertheless, they’d have to identify the locked-out accounts to make this quick.

Quickly, he entered the Windows PowerShell console and loaded up the ActiveDirectory module.

IMPORT-MODULE ActiveDirectory

Cmdlet looked over. “BATCHman, can we just pull up a user and have it show us whether they are locked out?”

Enjoying his sidekick’s enthusiasm BATCHman noted, “Yes, it is possible using the Properties parameter, but the ActiveDirectory module has a far more powerful feature called SEARCH-ADACCOUNT. To find all users locked out in Active Directory, we type this.”

SEARCH-ADACCOUNT –lockedout

“But, Cmdlet, if we need to make this go faster and unlock only the computers in a particular organizational unit or OU, we can specify parameters such as –searchbase.”

SEARCH-ADACCOUNT –searchbase ‘OU=Division31,OU=Locations,DC=Police,DC=Redmond,DC=Local’ –lockedout

Now, we can just quickly UNLOCK all the accounts by piping the results into UNLOCK-ADACCOUNT.

SEARCH-ADACCOUNT –searchbase ‘OU=Division31,OU=Locations,DC=Police,DC=Redmond,DC=Local’ –lockedout | UNLOCK-ADACCOUNT

Cmdlet blinked. One single line? “Holy Simple Simon, BATCHman! Windows PowerShell really is powerful!”

“Yes, it is. Now, quickly have the police chief verify that his staff and he can get in.”

The police chief logged in and verified all was well. “Thank you, BATCHman! You have saved the day! You’re our hero!”

BATCHman covered his ears from the shouting. “You’re quite welcome good citizen.”

Forgotten during all of this, Script Kitty looked up at BATCHman and purred, “Your outfit is purrrfectly delightful.”

BATCHman looked over. “Yes, maybe someday you’ll learn about the power of good and of Windows PowerShell. Crime not only doesn’t pay, it has a far worse budget for cool costumes.”

I want to thank Sean for another exciting episode of BATCHman. Join us tomorrow when The Scripting Wife learns about creating a profile for the Windows PowerShell console.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy

Use PowerShell to Manage Office 365

Anonymous — Sat, 10 Sep 2011 05:00:00 GMT

Summary: BATCHman battles The Consultant and uses Windows PowerShell to manage Office 365 easily.

Microsoft Scripting Guy Ed Wilson here. Sean Kearney brings us Episode 8 of the BATCHman series today.

Whenever trouble happens in systems and people will call,

And darkness rolls out causing your fall,

Creatures of bits roam in the night,

Shine to the sky, the bright bluish Light,

And call to…BATCHman !

…and, oh yes, his sidekick Boy Blunder Cmdlet, too.

In Today’s Episode, BATCHman Encounters the Evil of The Consultant

Oh, the times are dangerous and frightening. Somewhere in Redmond, a team of IT people is running about madly with their hands in the air.

“AIAHGIHAIGHIH!!! AIHAGHAHGHAGHIHI!!! We can’t manage anything! The sky is falling the sky is falling! Aihihighighighhghgi!!!!”

Panic (and apparently Henny Penny) has gripped them by the ears. The systems administrator is on the phone madly dialing BATCHman directly.

“BATCHman!!! BATCHman!!! You’ve got to help us!!! HURRY!!! AIGHAIHGHAHGHAH!!!!!”

“Certainly, why we’ll be happy to b…”

He is cut off by more screaming and the sound of breaking glass. “HURRY!!! HURRY!!! It’s all over!!! AIAGIHGAIH” *click*

The phone is dead. Cmdlet without blinking yells, “To the WinMobile!” Cmdlet takes off to the scene in a flash.

BATCHman is left behind to wonder how he should get there. Our hero, looking about scratching his head, finds the only alternate means of transport.

“Well, err,. to the BATCHunicycle!” as he deftly hops on and wobbles his way to the crime scene.

***A good while later***

BATCHman arrives. He sees Cmdlet. “For future reference, the sidekick does not drive the superhero car,” tapping Cmdlet on the nose. “You’ll take the BATCHunicycle home,” he grinned.

Cmdlet has in the meantime gathers the details. “Pretty evil situation. The IT staff came in over the weekend The Consultant migrated them to Office 365.”

BATCHman is puzzled. That doesn’t seem evil. That seems quite nice actually.

“I don’t think you’re getting it. Not *A* Consultant but *THE* Consultant. He walked in, migrated them, left a bill on the table and didn’t tell anybody his plans. They have no instructions or documentation.”

BATCHman suddenly realizes the issue. One of the nastiest, grungiest creatures on the planet simply called “The Consultant” had arrived on the scene. His claim to the evil world would be to improve infrastructure, bill clients, and then leave them with no documentation of what happened. Often doing it as a surprise launch on a weekend, his calling card was nasty: a hefty bill and a panicked IT staff on Monday morning.

However, today The Consultant has met his match. He outdid himself. He used Office 365, and BATCHman and Cmdlet were on the scene.

“Never fear, bring the IT staff in here. Let them know BATCHman is on the scene. We can solve all their woes with Windows PowerShell!”

Moments later, the mob of IT staff and one very frightened cat gather in the boardroom.

BATCHman looks at them. “Was there anything left behind? Other than the bill?”

Senior Systems Administrator Sue walks over. “Just this envelope with an ID/password and the words ‘Office 365’. Everything is running, but none of our existing systems seems to work for management. We need to create some new users as well as manipulate our existing distribution lists.”

BATCHman calmly strokes his chin. “Office 365, you say? Well, then, as long as you have credentials, we’re okay. For basic access, all we need to do is log on to office365.com with the provided credentials, and we can do everything from there. But never fear. We can use Windows PowerShell as well to manage the email.”

BATCHman quickly logs on with the provided user ID and password to the Web-based interface for Office365.com, showing them a basic management interface.

“Now, normally to create a user in Exchange, we might use the New-Mailbox or Enable-Mailbox cmdlets. But the process for Office 365 isn’t too difficult. The workflow is almost identical to Exchange because it’s just Exchange in a hosted environment. First, we add the needed modules. The first is the MSONLINE module, which we download from the Office 365 website.”

IMPORT-MODULE MSONLINE

“Next we provide the credentials to Windows PowerShell using Get-Credential and connect to the Office 365 web services. The UserPrincipalName or email address and password The Consultant left you are your credentials.”

$Cred=GET-CREDENTIAL
CONNECT-MSOLService -credential $Cred

“After this is done, we bring down the Exchange cmdlets using implicit remoting from the Office 365 server.”

$s = NEW-PSSESSION -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $Cred -Authentication Basic -AllowRedirection
$importresults=import-pssession $s

The IT team begins to breathe more clearly. They are not locked out and this is scriptable. Windows PowerShell and BATCHman have once again saved the day.

“After the cmdlets are installed, you’ll find that many of the abilities to add and remove distribution groups and memberships are identical to what you’re used to because it is just Exchange on the back end. To create a user, however, is slightly different. We must use the following cmdlet.”

NEW-MSOLUSER

“So all you’ll need to do to create users is use the previously cached credentials you stored in the $CRED variable and run the cmdlet like so. This is presuming an email address of evilconsultant@contoso.com, the first name of ‘Evil,’ and the last name of ‘Consultant.’”

NEW-MSOLUSER –userprincipalname ‘evilconsultant@contoso.com -DisplayName 'Evil Consultant' –Firstname ‘Evil’ –Lastname ‘Consultant’

“But BATCHman! Creating users is fine, but what do we do to delete them?! Usually that is coming down the line quicker than creating a user! We need to ensure that when our payroll application disables the staff member, it can still run our existing Windows PowerShell module!”

BATCHman smiled. “I concur that’s just as important, but never fear, Windows PowerShell is here!”

They pause as BATCHman quickly types.

REMOVE-MSOLUSER –userprincipalname ‘evilconsultant@contoso.com’

“There is also a web-based interface at office365.com to allow a richer interface to manage the accounts in the system. You’ll also find a plethora of online resources to aid in managing the system.”

The IT team breathes a sigh of relief. Although The Consultant changed their back end on them, automation is still here to aid them. Being in the cloud did not mean being left alone on the ground, thanks to Windows PowerShell.

“By the way, if you have the card of that particular villain, I’d like to pass it along to the Better Business Bureau.”

Thanks Sean for this episode of BATCHman. Join us tomorrow for another exciting episode of BATCHman—Episode 9!

Ed Wilson, Microsoft Scripting Guy

Convert Hexadecimal to ASCII Using PowerShell

Anonymous — Fri, 09 Sep 2011 05:00:00 GMT

Summary: Superhero BATCHman defeats evil Hextor and converts hexadecimal to ASCII to retrieve passwords.

Microsoft Scripting Guy Ed Wilson here. Sean Kearney is back again, and this time he delivers Episode 7 of the BATCHman series.

Whenever trouble happens in systems and people will call,

And darkness rolls out causing your fall,

Creatures of bits roam in the night,

Shine to the sky, the bright bluish Light,

And call to…BATCHman !

…and, oh yes, his sidekick Boy Blunder Cmdlet, too.

In Today’s Episode, BATCHman Encounters HEXTOR the Encyptor!

Panic grips the city! A beacon cuts through the night! It’s the BATCHsignal!

“Beep! Beep! beep! Beep!” Cmdlet rolls over and executes the Get-Snooze script. It is naptime in the BATCHcave.

But not for BATCHman. He deftly grabs Cmdlet’s blanket and flips him into the air like a flapjack. “No time to waste! Evil is afoot! Quick! To the Winmobile!”

Cmdlet looks inside the BATCHbay and sees an empty parking spot.

“Uhhhh, BATCHman, where’s the Winmobile?” gesturing to a large empty rectangle of pavement.

BATCHman smacks his head . “D’oh! I forgot I shipped it out for a Mango upgrade! Whatever shall we do?”

“Holy, Big Ben! What horrible timing! Then to the BATCHsubway! Quick, grab the tokens!”

They disappear into the local mass transit system.

***Meanwhile in another part of the city***

“BAA FAA FAA FAA!” the evil villain cackles “BAA FAA FAA!”

Dressed in nothing but dark purple with a large hexagon for a symbol, the evil genius Hextor looks down upon the chaos that has become the local Redmond post office, smiling.

“BAA FAA FAA! All your passwords are belong to me! The systems are locked away. None of you will ever retrieve them! For I have encrypted everything in….HEXADECIMAL! BAA FAA FAAAA!”

The administrator looks shaken. Decoding hexadecimal! What a foul turn of events! “Oh if only BATCHman were here!”

As if by sheer luck, our fearless heroes stumble onto the scene, smelling vaguely of the subway.

Hextor looks at our heroes with disdain. “Nothing can save them. Not you or your silly bad acting sidekick! Everything is written in pure hexadecimal! BAA FAAA FAAA FAAAA!” he giggled madly

Cmdlet stares at Hextor’s copy of the user password list. Now written in hexadecimal, it seems impossible to decrypt. “Holy magic hexes, BATCHman! He wasn’t kidding!”

50 6f 73 74 61 6c 41 63 63 65 73 73 31 09 55 62 65 72 4c 33 33 74 50 40 73 73 77 30 72 64 0d 0a 53 75 70 65 72 76 69 73 6f 72 09 42 40 74 63 68 4d 40 6e 77 31 6c 6e 76 72 47 33 74 74 68 31 73 21 0d 0a 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 09 21 4b 72 40 35 68 4e 62 75 52 4e 3f 0d 0a 50 6f 73 74 61 6c 41 63 63 65 73 73 32 09 42 75 61 68 21 48 41 3f 68 61 21 48 41 41 41 41 21 3f 21 0d 0a

“Why, foul villian, I believe you’re right. Nothing can solve this easily. Nothing that is,” BATCHman pauses dramatically with a finger in the air, “except Windows PowerShell!”

Hextor’s eyes open like flying saucers! “EEEEEEEEEEEEEEEEEEEEE! AAAAAAAAAA! BAAAAA! ” is all that escapes his mouth as he runs off hands in the air, immediately sensing defeat.

BATCHman looks over at Cmdlet. “In Windows PowerShell, we can easily convert binary, octal, decimal, and even hexadecimal. It is a native feature. We just need to leverage [CONVERT]. To quickly convert a number to hexadecimal, I would type this.

[convert]::tostring(12345,16)

“This will produce the following hexadecimal output.

3039

“To convert back to decimal, we specify that we’re converting to an integer and specify the base we’re converting from.”

[convert]::toint16(“3039”,16)

Which produces

12345

Cmdlet looked on. “Wow, BATCHman! But that doesn't help us. We need to convert those hexadecimal numbers to decimal and then convert them back to a real ASCII character! I don’t think we can convert a number to an ASCII character. That’s just lu…”

“Hold there, chum. We can do that as well in Windows PowerShell. We just need to type it as a [char]. When [char] is followed by any decimal number less than 256, it converts it to an ASCII character. We can even find the ASCII value of characters using the [BYTE] type like this.

[BYTE][CHAR]’a’

“To convert back, all we do is reverse the process.”

[CHAR][BYTE]97

Cmdlet looked at the string of hexadecimal numbers. “So if we convert these to decimal, we can just preface the result of each one with [CHAR][BYTE] and see its ASCII character? That sounds too easy.”

“You’ve got it on the nose, oh sidekick of mine! Now, the challenge is we need as easy way to split up those hexadecimal pairs to convert them. Any thoughts?”

The eager one claps his hands together “Split! Holy chopping board, BATCHman! We can take this data, drop it into a string, and run a split method based upon the spaces separating them!”

Cmdlet quickly sets up a simple variable in Windows PowerShell:

$HEXDATA=”50 6f 73 74 61 6c 41 63 63 65 73 73 31 09 55 62 65 72 4c 33 33 74 50 40 73 73 77 30 72 64 0d 0a 53 75 70 65 72 76 69 73 6f 72 09 42 40 74 63 68 4d 40 6e 77 31 6c 6e 76 72 47 33 74 74 68 31 73 21 0d 0a 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 09 21 4b 72 40 35 68 4e 62 75 52 4e 3f 0d 0a 50 6f 73 74 61 6c 41 63 63 65 73 73 32 09 42 75 61 68 21 48 41 3f 68 61 21 48 41 41 41 41 21 3f 21 0d 0a”

$HEXDATA.Split(“ “)

“What next? I think you have the idea right!”

“Well, we could pipe this into ForEach and apply the [convert]::toint16() against each like this.”

$HEXDATA.Split(“ “) | FOREACH{ [CONVERT]::toint16($_,16)}

BATCHman rubs his hands together with glee as the decimal numbers pour down the screen. “Excellent, Cmdlet! Now with all the decimal numbers, you can just convert them to ASCII, right?”

The other half of the terrible twosome added the [CHAR][BYTE] to the output.

$HEXDATA.Split(“ “) | FOREACH {[BYTE][CHAR]([CONVERT]::toint16($_,16))}

His jaw dropped. “Oh, no, it’s just a long unreadable column of letters. I need to write it in a row.”

“Soooooo, what if we could write to the host with no new line? We can pass your data to the Write-Host cmdlet without dumping a line feed between each out like so.”

$HEXDATA.Split(“ “) | FOREACH {WRITE-HOST –object ( [BYTE][CHAR]([CONVERT]::toint16($_,16))) –nonewline }

Cmdlet stared in awe as the message on the screen converted back to ASCII.

PostalAccess1 UberL33tP@ssw0rd
Supervisor B@tchM@nw1lnvrG3tth1s!
Administrator !Kr@5hNbuRN?
PostalAccess2 Buah!HA?ha!HAAAA!?!

“Now, quickly get the credentials reset before Hextor strikes again!”

Quickly the credentials were reset and the Redmond post office was back online. The postmaster stepped out to shake their hands.

“Oh, BATCHman, thank you! How can we ever repay you now that you’ve returned our passwords to us?”

“No thanks necessary, but any chance you have a stamp? I have to mail this to my mother for her birthday.”

Thanks, Sean, for another awesome episode of BATCHman. Everyone, join us tomorrow for Episode 8.

Ed Wilson, Microsoft Scripting Guy

BATCHman Uses PowerShell to Import a CSV File into His SQL Server

Anonymous — Sun, 04 Sep 2011 05:00:00 GMT

Summary: Windows PowerShell superhero BATCHman quickly imports CSV data into his SQL Server.

Microsoft Scripting Guy Ed Wilson here. Sean Kearney is back today with Episode 6 of the BATCHman series.

Note You can read all gripping, engaging, informative, and downright funny BATCHman episodes.

Whenever trouble happens in systems and people will call,
and darkness rolls out causing your fall,
Creatures of bits roam in the night,
Shine to the sky, the bright bluish light,

and call to…BATCHman !

…and, oh yes, his sidekick Boy Blunder Cmdlet, too.

In Today’s Episode, BATCHman Encounters Cmdlet’s Bad Field Notes!

So after a long week of crusading, standing on Telephones, being blinded by overcharged BATCHsignals, and generally keeping those ne’er-do-well evildoers at bay, BATCHman and Cmdlet are now about to upload all of Cmdlet’s notes to the BATCHcomputer. (No, forget that thought. It does not BATCH process with COBOL!)

“So, Cmdlet, let’s get those notes off your local SQL Express database and merge them from the Batch applet I created for taking field notes. Time to compile some data!”

“Uhhhh,” is Cmdlet’s only response. “What’s a Batch applet?”

BATCHman stands there scratching thoughtfully on his chin. “Why that would be the application I provided to you to keep field notes about all those evil villains we planned to encounter. I wrote it specifically to just simply sync up with the SQL 2008 R2 batch database on the batch computer.”

Cmdlet shuffled his feet. “Sooooo, not the batch Excel sheet?”

A pause of realization. “No.”

More shuffling by our Boy Blunder. “So, not Notepad? Not the XML editor?”

BATCHman just stood there. His beautiful applet, enabled with Windows PowerShell cmdlets, the GUI written with PrimalScript with some tweaking from PowerBoots. And it has gone unused.

"Cmdlet, can I see your notes?”

Boy Blunder hands over his Slate PC to BATCHman. Quickly, BATCHman keys into Windows PowerShell.

GET-CHILDITEM $HOME\Documents\CmdletNotes

The output produces some dismay to the BATCHman.

BADGUYS.CSV

“A CSV file?”

“Well, we were in the heat of battle, and I just quickly grabbed what was available to me. I thought it would be easy to search and sort and I…I…OH PLEASE! PLEASE BE MERCIFUL! PLEASE DON’T DECOMPILE ME!!!” Cmdlet wailed

BATCHman shook his head with a smile and tapped his young friend gently on the shoulder. “It was a mistake and an honest one. But remember, we have Windows PowerShell. We just need to convert this data into something the batch database will recognize. So let’s take a quick look at your CSV file.”

IMPORT-CSV BADGUYS.CSV

“Well this isn’t so bad. All we need to do is match these fields with ones from the BATCHman database. Because Windows PowerShell will work with SQL, we could literally import your CSV file into the database. First, we’ll add the SQL snap-ins to allow us to work with SQL Server from Windows PowerShell.”

ADD-PSSNAPIN SqlServerProviderSnapin100
ADD-PSSNAPIN SqlServerCmdletSnapin100

“With these added we can use Invoke-SQLCmd, which will allow us to pass SQL queries directly from Windows PowerShell, returning the results as an object. As an example, here is our current query. Because this is a small database, we’ll just use this. This presumes that the user, me in this case, has access.”

Invoke-Sqlcmd -Query 'SELECT * FROM BATCHmanDB.dbo.BATCHmanCrimeTable' -ServerInstance localhost

Cmdlet looked as the output appeared on the screen. You could tell by the single row of data they were very early into the crime fighting game, and BATCHman started at an early age.

“But BATCHman? How does this help us? All this did was show us information in a SQL database! We need to take my data and place that in SQL! Oh please! Just let me retype it!”

BATCHman smiled. “Because little buddy, this is a Windows PowerShell object. I can do this, too.”

$DATA=(Invoke-Sqlcmd -Query 'SELECT * FROM BATCHman.dbo.BATCHmanCrimeTable' -ServerInstance localhost)

$DATA.CriminalName

Cmdlet looked and realized he was now looking at an object in Windows PowerShell as normal. A light lit in his eyes.

“Wait! Do you mean I could put Windows PowerShell objects in an SQL query and populate the BATCHman database?”

“Exactly!” decried BATCHman, nearly poking Cmdlet in the eye. So first, let’s look at your file. It appears Villain will be the same as Criminal Name, Appearance matches Description, but the other two are dead on the nose. There are some fields you don’t have, such as Solved, but these are not required in the database. We can edit these later if we choose. Our only challenge now is to build the query.”

BATCHman pulled open his slate and launched SQL Server Management Studio.

“A very simple SQL INSERT query to add a row to the BATCHman database would look like this.”

INSERT INTO [BATCHmanDB].[dbo].[BATCHmanCrimeTable]
([CriminalName],[Description],[Problem],[Solution])
VALUES
(‘SomeEvilGuy’,’Looks Awful Funny’,’Something bad’,’Something Good’)
GO

“We can easily make this a value in Windows PowerShell like this,” BATCHman noted.

$SQLQUERY=”INSERT INTO [BATCHmanDB].[dbo].[BATCHmanCrimeTable] ([CriminalName],[Description],[Problem],[Solution]) VALUES (‘SomeEvilGuy’,’Looks Awful Funny’,’Something bad’,’Something Good’)”

The eyes of Cmdlet opened wide. “BATCHman! That’s almost unreadable! Couldn’t I just do this?”

$SQLHEADER=”INSERT INTO [BATCHmanDB].[dbo].[BATCHmanCrimeTable] ([CriminalName],[Description],[Problem],[Solution])“

$SQLVALUES=”VALUES (‘SomeEvilGuy’,’Looks Awful Funny’,’Something bad’,’Something Good’)”

$SQLQUERY=$SQLHEADER+$SQLVALUES

BATCHman beamed. “Excellent! You’ve been learning well. Now let’s take your notes and begin importing them into the database. We could just write it in a single line, but let’s take it one piece at a time. Let’s store your CSV file in a variable.”

$DATA=IMPORT-CSV BADGUYS.CSV

“Now we’ll step through each line with a Foreach-Object.”

FOREACH ($LINE in $DATA)

{
$Criminal=$Line.Villain
$Description=$Line.Appearance
$Problem=$Line.Problem
$Solution=$Line.Solution

}

Cmdlet watched the CSV flow on the screen. “So, BATCHman, can we just substitute the Windows Powershell variables for the same samples in the query?”

BATCHman nodded. “With one exception: we need to make sure the single quotes are still surrounding the data because the SQL query is expecting them. So we will populate the values like this, remembering the quotation mark is a special character and will need an escape before each reference.”

$Criminal="`'"+$Line.Villain+"`'"
$Description="`'"+$Line.Appearance"`'"
$Problem="`'"+$Line.Problem"`'"
$Solution="`'"+$Line.Solution"`'"

“So we can now just replace them in the query? Do you mean like this?” Cmdlet quickly edits the query lines.

$SQLHEADER=”INSERT INTO [BATCHmanDB].[dbo].[BATCHmanCrimeTable] ([CriminalName],[Description],[Problem],[Solution])“

$SQLVALUES=”VALUES ($Criminal,$Description,$Problem,$Solution)”

$SQLQUERY=$SQLHEADER+$SQLVALUES

“Correct, now we drop that into our script so that we end up with this.”

$DATA=IMPORT-CSV BADGUYS.CSV

FOREACH ($LINE in $DATA)

{
$Criminal="`'"+$Line.Villain+"`'"
$Description="`'"+$Line.Appearance+"`'"
$Problem="`'"+$Line.Problem+"`'"
$Solution="`'"+$Line.Solution+"`'"

$SQLHEADER=”INSERT INTO [BATCHmanDB].[dbo].[BATCHmanCrimeTable] ([CriminalName],[Description],[Problem],[Solution])“

$SQLVALUES=”VALUES ($Criminal,$Description,$Problem,$Solution)”

$SQLQUERY=$SQLHEADER+$SQLVALUES

Invoke-Sqlcmd –Query $SQLQuery -ServerInstance localhost

}

They executed the script, quickly populating the BATCHman database with the needed data. Cmdlet wiped the sweat off his face with a pair of Vibram shoes he found by the door.

“No sweat, little buddy. With Windows PowerShell, almost any problem can be eliminated. Now, let me show you the cool features for taking your notes.”

Sean, many thanks for sharing these episodes of BATCHman. Everyone, join us tomorrow as guest blogger Thiyagu talks about Exchange Best Practice Analyzer XML Parser.

Ed Wilson, Microsoft Scripting Guy

BATCHman Foils the Fowl Ping Win and Repairs the Registry

Anonymous — Sat, 03 Sep 2011 05:00:00 GMT

Summary: In this episode, superhero BATCHman foils the fowl villain Ping Win and repairs the registry.

Microsoft Scripting Guy Ed Wilson here. Today is Episode 5 of the BATCHman series by Sean Kearney.

Note You can read all gripping, engaging, informative, and downright funny BATCHman episodes.

Whenever trouble happens in systems and people will call,
and darkness rolls out causing your fall,
Creatures of bits roam in the night,
Shine to the sky, the bright bluish light,

and call to…BATCHman !

…and, oh yes, his sidekick Boy Blunder Cmdlet, too.

In Today’s Episode, BATCHman Encounters Ping Win

Flying through the night in the new BATCHcopter, BATCHman begins veering off course dramatically.

“Aiaighahighiahgihi!!! My eyes! Such BRIGHT BLUE LIGHT!”

“Holy bluebird of sharpness!” screams Cmdlet. “It’s the BATCHsignal!”

“Yes, Boy Blunder, trouble calls us.” BATCHman calls up the new crime fighting one-liner:

GET-TROUBLE | INVOKE-LAND –location $_.Source

In moments, they are at the scene, the trouble, the issue at hand. It appears that all the firewalls at the Redmond Community Center have been shut down somehow! Home pages have been set to “pingwinrulez.com”! All search queries have been routed to pingwinrulez.com. What dastardly villain would do such a thing?

“Holy earthworm, BATCHman! All of these computers accessed by kids! Surfing whatever they want unprotected! What villain, what creature of the night, who would do.…”

BATCHman taps Cmdlet on the shoulder and points to a rather obvious character off to his left.

Cmdlet looks. “Holy mackerel, BATCHman! It’s the Pin…”

“Ahh, Boy Blunder.” BATCHman taps the side of his nose shaking his head.

“Oh…er…uh…right…it’s…it’s…” Cmdlet stammers staring at the oddly dressed black-and-white flightless fowl-looking person.

The strange character sees the Static Duo. “Meh. Allow me to introduce myself. I am…,” he pauses dramatically before he rips open his jacket, “…PING WIN! Meh heh hehe!”

The words “PING WIN” flash in a mad pulsing fashion, surrounded in blinking lights from a large, very expensive-looking neon sign hanging over his shirt.

BATCHman pauses for a moment, looking. “Ah” is all he can say. He looks at Cmdlet. “Was this really necessary?”

Cmdlet nods. “The blog post went way under budget. We had to burn up some funds. Cool shirt, eh?”

Getting a hold of himself, BATCHman gets back into character. “So Ping Win, you’ve downed all the firewalls, eh? To what end? Why?”

“Antivirus Software! To rid themselves of this problem and all the annoying popups, it will advertise nothing but PingWin-Nev-R-Fayl Antivirus! I will become a trillionaire! Muah har herh hah!”

As Ping Win dances his previctory dance, he trips over one of fifty wires running the neon lights on his shirt and collapses, knocked senseless by his own silliness.

“I thought he’d never shut up!” muttered Cmdlet. “So BATCHman, how do we solve this?”

“How else? With a BATCH file and some Windows PowerShell!” he proudly declares with his hands on the BATCH module belt, standing heroically. First, we must ensure the firewall service is started on all of these systems. We will get the status of it using the Get-Service cmdlet.”

GET-SERVICE “Windows Firewall”

“We can see on this machine that it’s stopped.”

“To restart it, we can pipe it into the Start-Service cmdlet.”

GET-SERVICE “Windows Firewall” | START-SERVICE

Cmdlet is rapidly opening up his copy of PowerGUI to begin building the script for rapid deployment.

“Now,” he mumbled as he gnawed on his cape, “to reset those home pages. Need to get this done fast.”

For a moment, he eyed a large cache of energy drinks and pictured Cmdlet running about like a gerbil clicking away on GUI options. He smiled.

“Nah! Let’s use the registry!” he thought aloud. “So to change these home pages and how he’s redirected the search, we’ll need to directly access the registry for each user. The settings we need are all under this key.”

“HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\”

Using Regedit, BATCHman shows Cmdlet an example of what Ping Win had done.

“And there are three values we need to fix: Start Page, Search Page, and possibly even Default_Page_Url. As you can see, Cmdlet, he’s modified Default_Page_Url to point to his own private dastardly site. But we can easily access the registry using Windows PowerShell. We can access the registry using a built-in provider. To get the list of available providers, we simply type this.”

GET-PSPROVIDER

“Holy convenience store, BATCHman! HKCU is marked as a drive! Do you mean if I were to type SET-LOCATION HKCU:, I would be navigating the registry?”

“Not only that but if you ran a GET-CHILDITEM against it, you would see that part of the registry: GET-CHILDITEM HKCU: Or we can even recurse: GET-CHILDITEM HKCU: –recurse.”

Cmdlet pauses in thought. “So to access the available registry keys for HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\ all I have to do is enter:

GET-CHILDITEM HKCU:\Software\Microsoft\Internet Explorer\Main\

BATCHman smiled. “Close, my little digital partner, but not quite. You would need to execute a GET-ITEM because that is how the registry tree branches are recognized by Windows PowerShell. The CHILDITEMs in this case are actually just other available branches under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\. To see what is attached to the main branch, we type this.”

GET-ITEM HKCU:\Software\Microsoft\Internet Explorer\Main\

“And that shows us it has Properties attached to it.”

“To access and see what values are available under the main branch, we need only attach the property name, which oddly in this case is called Property, to the original line in Windows PowerShell.”

(GET-ITEM HKCU:\Software\Microsoft\Internet Explorer\Main\).Property

“Now if we need to pull down the values of a PROPERTY from an ITEM in the registry, we do this.”

GET-ITEMPROPERTY –path “Registry::HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main“

Cmdlet blinked as he saw all the registry values from the Main key appear on the screen. “Holy Bee Hive!” he muttered.

“Now of course if we need to see a particular value, such as say Default_Page_Url, we type this.”

GET-ITEMPROPERTY –path “Registry::HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main“ –name “Default_Page_Url”

“But BATCHman, you’ve forgotten the most important part! We need to fix them and fix them now! Kids are due to arrive in minutes!”

BATCHman realized he got a little too carried away in chatting about Windows PowerShell and had almost forgotten the task at hand. “Yes! Of course! So all we need to do to set the value in a key.”

SET-ITEMPROPERTY –path “Registry::HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main“ –name “Default_Page_Url” –Value “http://www.msn.com”

Cmdlet looked and took the initiative. “So for the remaining keys to put in some proper values, I need only do this?”

SET-ITEMPROPERTY –path “Registry::HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main“ –name “Start Page” –Value “http://www.msn.com”

SET-ITEMPROPERTY –path “Registry::HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main“ –name “Search Page” –Value “http://www.bing.com”

“Exactly! Now let’s save this script and try it on a machine!”

“But BATCHman! We need to alter their personal settings as well! How will we do that easily? And quickly?! We only have moments before the center opens!”

BATCHman thought about it. How to alter those settings automatically with this script? “Of course!” his fingers snapped, sending shockwaves. “We’ll use Group Policy and set it as a startup script! As they log in, it will overwrite all the mess Ping Win turned loose!”

BATCHman quickly navigated to the computer configuration and dropped in a reference to his script in the SYSVOL share. Soon, people began to arrive. They logged in. Nobody noticed anything odd.

Ping Win began to recover from his trip over the chords. He looked. No disgusted reactions. Happy people. “Meeeeeea! FOILED!” he screamed and fell over another power cord.

“Cmdlet,” the BATCHman said watching Ping Win “Next time, let’s avoid buying the arch villain a big neon sign he can trip over. We could have spent that money on tires for the WinMobile”

Sean, thanks for another awesome episode of BATCHman. Everyone, join us tomorrow for Episode 6.

Ed Wilson, Microsoft Scripting Guy

BATCHman Uses PowerShell to Thwart Dr. Regex and Save the Zoo

Anonymous — Fri, 02 Sep 2011 05:00:00 GMT

Summary: In this exciting episode, BATCHman uses Windows PowerShell and regular expressions to thwart the evil Dr. Regex and save the monkeys.

Microsoft Scripting Guy, Ed Wilson, is here. Sean Kearney is back with us for three more episodes of the thrilling BATCHman series. Today is Episode 4.

Whenever trouble happens in systems and people will call,
and darkness rolls out causing your fall,
Creatures of bits roam in the night,
Shine to the sky, the bright bluish Light,

and call to…BATCHman !

…and, oh yes, his sidekick Boy Blunder Cmdlet, too.

In Today’s Episode, BATCHman Encounters Doctor Regex!

Cutting through the midnight blue sky, a beacon for justice, a light for freedom calls out!

“Holy shell, BATCHman! It’s the BATCHsignal! We have…”

“Ahem, Cmdlet, I would suggest you watch your language there. This is after all a ‘G’ rated blog post.”

“But but, I…I…ugh…yes, BATCHman,” he sullenly bowed in defeat. “Shall I fire up the WinMobile?”

“No, but you can start it,” snickered our hero. “To the WinMobile!”

Buckling under the weight of our heroes, the WinMobile moved off. “Thank goodness it’s made of Gorilla Glass,” muttered Cmdlet.

Meanwhile, somewhere else in the city of Redmond, evil has placed a call. The arch criminal simply known as the dreaded Dr. Regex has visited. Cursed after too many nights of writing parse queries, our arch villain only speaks in riddles of Regex. He has taken the team at the local Redmond Zoo by surprise. All the cages are being unlocked, potentially unleashing the vicious GUI eating SAPIEN monkeys! Our arch villain dances off on top of the cages laughing maniacally in an oddly cheeseburger colored jumpsuit with his big “!” symbol. “Muah ha haaaaa!”

The only passcode to the electronic Chubb lock system has been left somewhere in this cryptic riddle left on Notepad on the desktop of the main server:

Evil may Come And Evil May Go
The BATCHman Will Seek, be Fast Or Be Slow
But Soon On the Day The pass It Must Be
The word Should He Say, To Not Set Them Free
is The BATCHman Too Smart, Or Is He Not Bright?
under The Stars And Under the Light!
The key We Shall See, Unlocking This Clue
Will chain Them All Down, Or Let Them Run Through

Signed ^[Dr!Regex]^

BATCHman and Cmdlet arrive on the scene, the sound of Monkeys about to tear scripts apart. Cmdlet stared at the riddle. “Holy twisted blisters, BATCHman! That must have worn out somebody’s fingers typing! What a bizarre rid…”

“….bizarre clue!” corrected BATCHman “Yes. Yes, indeed. What a strange person. There must be some type of pattern in this clue. Something usual to the naked human eye, something I can’t quite see, some…”

“BATCHman! It appears only certain words start with a lowercase letter!”

“Cmdlet! Excellent ! How did you spot it so quickly?”

“It’s written here in the plot, page 5, line 7…”

BATCHman looks down scratching his cowl. “Ah, so it is.”

“So we could just write down every word,” suggested Cmdlet.

“Pah! And waste a good chance to use Windows PowerShell? Never! This is a perfect opportunity to use regular expressions to find those matches! First, we need to identify the pattern. We need all words starting with a lowercase letter only. Within regular expressions, that would be a matter of specifying that the first letter is from a to z only like this.”

[a-z]

“And then we’ll need to specify it’s at the beginning of the word.”

\b[a-z]

“Then we’ll specify that the word must be at least two letters long if we find it, but can be as long as we want. This should trap our series of words.”

\b[a-z]{2,}

“With this in place, Cmdlet, we need to pipe the information from the text file into a Select-String statement like this.”

GET-CONTENT C:\EVILCLUE.TXT | SELECT-STRING ‘\b[a-z]{2,}’

Cmdlet sat there cross-legged watching the magic unfold. “But how do we tell it to look for more than one instance, BATCHman? How does it know it is lowercase?”

“Presently it doesn’t, but it will if we add more parameters to our Select-String. One is -allmatches in case there is more than one instance per line. The other is -casesensitive because Select-String by default just does a –match which doesn’t care about uppercase or lowercase.”

GET-CONTENT C:\EVILCLUE.TXT | SELECT-STRING ‘\b[a-z]{2,}’ –casesensitive –allmatches

Cmdlet looked and laughed. “Holy foot in mouth! The output is the same!”

The BATCHman smiled. “Not quite. If we run Get-Member against this output, you’ll see something different.”

GET-CONTENT C:\EVILCLUE.TXT | SELECT-STRING ‘\b[a-z]{2,}’ –casesensitive –allmatches | GET-MEMBER

“This, Cmdlet, is not just a string. We can see there are properties such as Matches. If we were to look at the properties of Matches, we mind find something interesting.”

GET-CONTENT C:\EVILCLUE.TXT | SELECT-STRING ‘\b[a-z]{2,}’ –casesensitive –allmatches | SELECT-OBJECT Matches

“Holy obvious! Do you mean…” looking to his left Cmdlet lifts the keychain to the old cages. A Big envelope with the words “^[Dr!Regex]^” is written on it. He bites it open and his mouth drops sullenly.

“What is it, Cmdlet?”

“Another clue. Awww, come on!!!” Cmdlet stomps about like a little child having a hissy fit showing the new clue to BATCHman.

Remove ME now and unlock the clue

‘meHeymeheymewemearemethemescriptmemonkeesmeandmepeoplemesaymewemearemescriptingmeawayme’

BATCHman looks. “I’m seeing an awful lot of ME in this particular line. I will bet we could just use a –replace on it!

“What’s that?”

Seating himself down in front of the Windows PowerShell console, he explains. “Replace is another part of regular expressions where we can replace one thing with another.”

‘meHeymeheymewemearemethemescriptmemonkeesmeandmepeoplemesaymewemearemescriptingmeawayme’ –replace ‘me’,’’

“That will replace every reference of me with nothing, which gives us this result.”

Heyheywearethescriptmonkeesandpeoplesaywearescriptingaway

“Cmdlet, please try this password on the Chubb security system. I’m sure you’ll find it works; just press the Lock All Cages button.”

Soon echoing through the Redmond Zoo, massive sounds of *KLANG* echo throughout with the odd *yelp* as the occasional finger gets pinched on closing doors.

With one loud *THUD*, Dr. Regex falls into bushes below. “Waaaaihihghghhgih!!”

The keeper of the Redmond Zoo looks up. “Oh, BATCHman! How can ever thank you?”

“Easy, good citizen. One, do not put your master security password under a set of keys to the Monkey House and…do you have something I could scrape my shoes on? I think I stepped on something near the cages.”

Thanks, Sean, for another exciting episode of BATCHman! Join us tomorrow for Episode 5.

Ed Wilson, Microsoft Scripting Guy

BATCHman Faces the Distractful Poker and Recovers Deleted Active Directory Items

Anonymous — Sun, 28 Aug 2011 05:00:00 GMT

Summary: In today’s gripping episode, BATCHman squares off with the Distractful Poker and recovers items deleted from Active Directory Domain Services using Windows PowerShell.

Microsoft Scripting Guy Ed Wilson here. Windows PowerShell MVP Sean Kearney is with us again today with part 3 of the BATCHman series.

Whenever trouble happens in systems and people will call,
And darkness rolls out causing your fall,
Creatures of bits roam in the night,
Shine to the sky, the bright bluish light,

and call to…BATCHMAN!

…and, oh yes, his sidekick Cmdlet too.

In Today’s Episode: BATCHman encounters the Distractful Poker

A travesty has hit Redmond City! The mayor and his staff are unable to log in to Active Directory Domain Services!

“Quick! Get the chief to fire up the BATCHSignal and call BATCHman! We need his help now!”

Shining up to the sky, a gleaming Windows PowerShell signal cutting through the sky and the flight patterns of a few seagulls—the BATCHSignal! Within moments the WinMobile pulls up precariously holding up BATCHman and Cmdlet. The Mayor looks over. “Just how do the pair of you fit on that?” “Very carefully,” quips BATCHman. “So what has happened here today?”

“Oh BATCHman!” the mayor sobbed. “It was the Poker! He came behind the systems administrator, poked him in the side, distracted him, and deleted our user accounts! We can’t get into the system to issue paychecks to any of our staff! If we don’t solve this soon, we’ll have a major disaster on our hands!”

“Holy irritants, BATCHman! Not the Poker! Why the last time he was around…”

“Yes, Cmdlet, I know the story. Clippy was born. The Poker is truly a cruel one. But never mind that. Mayor! Quick take make to your datacenter! We don’t have one second to spare.”

In moments, BATCHman and Cmdlet stood before a console. BATCHman thought, “I could go dig up tapes and do an authoritative restore, but time is of the essence.” Quickly, he spun on his feet.

“Mayor, did you upgrade to Windows Server 2008 R2 as we suggested last time I chatted with you?”

“Why, yes. Yes, I think we did, BATCHman, but why do you ask?”

BATCHman smiled. “if we’re lucky, your administrator enabled the Active Directory Recycle Bin. I can check in moments.” On one of the Windows Server 2000 R2 domain controllers, BATCHman typed:

GET-ADOPTIONALFEATURE ‘Recycle Bin Feature’

“The results of this on the screen, Cmdlet, not only tell us about the feature, but also about what scope it applies to. By default, in a system where it’s not enabled, the EnabledScopes property will have no value.”

“As we can see, it has been enabled here. So now, what we need to do is determine just how much damage has been done by this evil villain. With the ActiveDirectory module, we can key this in to show all objects in Active Directory, including anything that is in the Active Directory Recycle Bin.”

Get-ADObject -filter * –IncludeDeletedObjects

“But BATCHman!” Cmdlet spoke up. “Wouldn’t that be too much? What if we’re dealing with 50,000 objects? There must be a way to only show what was deleted!”

BATCHman nodded. “Correct. So now if we run the GET-MEMBER cmdlet against the output like this…”

Get-ADObject -filter * –IncludeDeletedObjects | GET-MEMBER

“…we’ll see there is a property called DELETED which contains a Boolean TRUE if that value is deleted. For this, we will add a filter to the statement.”

Get-ADObject –filter ‘Deleted –eq $TRUE’ –IncludeDeletedObjects

“Now we can see only deleted items in Active Directory so…”

“Holy undo, BATCHman! Is there a restore we can just pipe the output to?”

BATCHman nodded. “Yes. But what we need to do is restore the tree first. At this point, let’s pipe the output into the Out-GridView cmdlet to have an easier way of viewing the data.”

Get-ADObject –filter ‘Deleted –eq $TRUE’ –IncludeDeletedObjects | OUT-GRIDVIEW

BATCHman cautiously examined the list. “It appears we should be able to pull out all members of the tree by filtering on ObjectClass and pulling down those with the property OrganizationalUnit. So we just need to add an extra filter to our statement.”

Get-ADObject –filter ‘Deleted –eq $TRUE –and Objectclass –eq “OrganizationalUnit”’ –IncludeDeletedObjects | OUT-GRIDVIEW

“Now all we need to do is pipe this output into the Restore ADObject to get the tree back.”

Get-ADObject –filter ‘Deleted –eq $TRUE –and Objectclass –eq “OrganizationalUnit”’ –IncludeDeletedObjects | RESTORE-ADOBJECT

“Now with the tree restored, we can just restore the rest of the objects remaining using a simpler statement because we’ve already restored the tree. The rest of the objects we have are probably users, so we can drop the second filter and just restore.

Get-ADObject –filter ‘Deleted –eq $TRUE –and Objectclass’ –IncludeDeletedObjects | RESTORE-ADOBJECT

In moments, the task was complete. “Cmdlet, have somebody try to log in to the system!” The mayor quickly logged in to verify all worked well. Quickly he called up the accounting department to let them know they could log in to the systems. Paychecks would be out today!

“BATCHman! How can we ever thank you?”

“Just keep doing things the way you are with Windows PowerShell: it was the true superhero today!”

Thank you, Sean, for today’s spell-binding article. Sean will be back next weekend with the concluding episodes of BATCHman. Same BATCHtime, same BATCHchannel.

Ed Wilson, Microsoft Scripting Guy

BATCHman Uses PowerShell to Battle the Dread Madame CAT File

Anonymous — Sat, 27 Aug 2011 05:00:00 GMT

Summary: In today’s episode, intrepid BATCHman uses Windows PowerShell to battle the dreaded Madame CAT file—and the fur really flies.

Microsoft Scripting Guy Ed Wilson here. Windows PowerShell MVP Sean Kearney returns today for part 2 in his BATCHman series.

Deep in the most unforgiving lines of code, a new superhero emerges to bind the illogical, bring peace to the unfathomable binary things in the night, and seek justice where none can be found.

It’s your friend and mine, BATCHman!

….and his sidekick, Boy Blunder Cmdlet.

In Today’s Episode: BATCHman encounters the Dreaded Madame CAT file

Oh, no! The JobsBlog Team has been victimized by Madame CAT file! Madame CAT file loves to do nothing but rename files and place CAT all over the place. Today, she has attacked the folder structure of Microsoft Office leaving the JobsBlog Team helpless!

“Oh, how will we ever be able to review the resumes now? No Outlook! No Word! All of these resumes trapped! Resources untouched! Oh, where is BATCHman? Help us!”

Flying out of nowhere in a flurry of SMS packets and Gorilla Glass, and arriving with a classic “TADA” wav file from Windows 3.1, it’s..it’s…

The truly dynamic (as opposed to static) BATCHman and Cmdlet!

“BATCHman! Thank goodness you’re here! We have millions of resumes to go through and Madame CAT file has rendered us helpless! Our copies of Microsoft Office are covered with nothing but the word “CAT.”

“Holy kitty litter, BATCHman!” bursts out Cmdlet. “What can we do?”

BATCHman quickly assesses the situation. There are two options he foresees.

“Well, Cmdlet, we could just do a System Restore to before Madame CAT file released her claws, but that will take time on all these computers. We need to restore the entire Jobs Blog to action quickly! If we aren’t careful, some fool might post over 8,000 resumes to the system and overload the team! It’s happened once before, and we just can’t take a chance!”

BATCHman thinks for a moment. “You know, I think we can take a shot at undoing this. Let’s see just how much damage that villain really did. I know Windows stores additional properties about certain key files, such as DLLs and EXEs, in the file itself.”

Cmdlet looks up. “Really? Zowie! How do we pull something like that up?”

BATCHman looks at an afffected file:

GET-CHILDITEM C:\Program Files\Microsoft Office\Office14\CATWORDMEOW.EXE

“As we can see, Cmdlet, the file name has been completely tampered with, but if we run this against the Get-Member cmdlet, we can see there are additional properties available to us:

GET-CHILDITEM C:\Program Files\Microsoft Office\Office14\CATWORDMEOW.EXE | GET-MEMBER

“I can see we have a property called VersionInfo. My scripting sense is tingling here. If we were to access this with a Select-Object cmdlet and see what it looks like…”

“Holy Harry Houdini, BATCHman! There’s the file name hidden in the Filename properties!”

“Yes, Boy Blunder, but we’ll have to dig a bit further. So let’s access the property directly to find the name of the property it can be referenced by. We could run the Get-Member cmdlet against it like this.”

(GET-CHILDITEM C:\Program Files\Microsoft Office\Office14\CATWORDMEOW.EXE).VersionInfo | GET-MEMBER

“But let’s see if the information is easily accessible. Windows PowerShell has a tendency to try and make this easier.”

(GET-CHILDITEM C:\Program Files\Microsoft Office\Office14\CATWORDMEOW.EXE).VersionInfo

Cmdlet just about dropped a process when he saw the results. “BATCHman! So if I were to type the Filename property…”

(GET-CHILDITEM C:\Program Files\Microsoft Office\Office14\CATWORDMEOW.EXE).VersionInfo.Filename

His heart sank. “Oh, no! It’s the same! AIHGAIHGIAHGHIHAIGHIH!!!”

“Calm down, little Cmdlet. There are other properties. Sometimes just piping the output to the Format-List cmdlet will reveal them in a more useful manner. Remember, we’re looking at the default output in Windows PowerShell.”

(GET-CHILDITEM C:\Program Files\Microsoft Office\Office14\CATWORDMEOW.EXE).VersionInfo | FORMAT-LIST

“So although you are correct in that the Filename shows the current file name, there is actually a property called OriginalFileName, which has been untouched by our Evildoer, and we can access it like this.”

(GET-CHILDITEM C:\Program Files\Microsoft Office\Office14\CATWORDMEOW.EXE).VersionInfo.OriginalFileName

“BATCHman! Do you mean we could just check the properties of the .dll files and .exe files and possibly just rename them to the original? Even Madame CAT file made the name unrecognizable?”

Patting Cmdlet on the back he smiled. “That’s exactly what I mean!”

Then Cmdlet sighed. “BATCHman, that’s going to be a horribly complicated script! To pull up all those .dll and .exe files, analyze them, rename them, examine them…,” he rambled on.

“You forget, my young friend, that with Windows PowerShell, to pull such a list we simply need to specify the file extensions we want to include and recurse like this.”

GET-CHILDITEM C:\Program Files\Microsoft Office\Office14\ –include *.exe, *.dll –recurse

“Yes I know! But how can we just rename them? To properly do that, we need the file path, the drive letter!” Cmdlet began to sob “WE’RE DOOOOOMED! DOOMED! DOOOOOOOOMED!”

“We could just run a Foreach, pull up the properties, and Rename the bad file name with itself like this, Cmdlet,” he stated calmly.

GET-CHILDITEM C:\Program Files\Microsoft Office\Office14\ –include *.exe, *.dll –recurse | Foreach { Rename-item $_.Fullname –newname $_.OriginalFilename }

“B-b-but, BATCHman! There’s more than 200 files we could be affecting! What if we ruin them? What if we do something horrendously bad? What if your code destroys everything?”

“Funny you should mention the ‘what if.” I was thinking that very same thing. That’s why Windows PowerShell has a parameter called –whatif that is generally provided with any cmdlet that could make a change to the system. We just add it on like this and execute the code.”

GET-CHILDITEM C:\Program Files\Microsoft Office\Office14\ –include *.exe, *.dll –recurse | Foreach { Rename-item $_.Fullname –newname $_.OriginalFilename -whatif}

Cmdlet watched in amazement as each line was executed in the following fashion:

What if: Performing operation "Rename File" on Target "Item: C:\Program Files\Microsoft Office\Office14\MCATPUB.EXE Destination: C:\Program Files\Microsoft Office\Office14\MSPUB.EXE".
What if: Performing operation "Rename File" on Target "Item: C:\Program Files\Microsoft Office\Office14\MSCAT32.EXE Destination: C:\Program Files\Microsoft Office\Office14\MSQRY32.EXE".
What if: Performing operation "Rename File" on Target "Item: C:\Program Files\Microsoft Office\Office14\MSCATEDIT.DLL Destination: C:\Program Files\Microsoft Office\Office14\MSRTEDIT.DLL".
What if: Performing operation "Rename File" on Target "Item: C:\Program Files\Microsoft Office\Office14\CATWORDMEOW.EXE Destination: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE".

“You see? With Windows PowerShell, we have a built-in way to test without breaking anything. As we can see, it appears this script should work. I’ll remove the –whatif parameter and execute as normal.”

Moments later, a system was recovered. All of the CAT litter was gone!

“Now quickly, Cmdlet! Take this USB key, run Windows PowerShell with administrative rights, and execute this code on each affected machine!”

In a matter of minutes the entire team was restored to productivity!

“Now keep in mind, Cmdlet, that this was a break/fix—a good one but a brake/fix nonetheless. We should speak to IT about having System Restore run on these machines later. But for the moment, we’re good!”

“Oh, BATCHman! How can we ever thank you?” burst out the JobsBlog Team.

“Easy! Always trust in Windows PowerShell and try not to let any more CATs in the office with local administrative access. BATCHman…AWAY!”

Thank you, Sean. Everyone come back tomorrow for part 3. Same BATCHtime, same BATCHchannel.

Ed Wilson, Microsoft Scripting Guy

BATCHman Uses PowerShell to Battle the Evil Mr. Freeze-Process

Anonymous — Fri, 26 Aug 2011 05:00:00 GMT

Summary: A new superhero uses Windows PowerShell for good. He is BATCHman, and today he battles Mr. Freeze-Process.

Hey, Scripting Guy! I know there are the Scripting Guy and Dr. Scripto, but are there any real scripting superheroes?

—SH

Hello SH,

Microsoft Scripting Guy Ed Wilson here. Today is part 1 of a multipart series written by Windows PowerShell MVP Sean Kearney. Read his other posts.

The one superhero to whom all others pale in comparison is faster than that so-called Flash guy with his efficiency of code and able to leap past unbelievable expectations of clients (more than SomewhatSuper Guy). He has the endurance of an all-night developer trapped in a last-minute bug fix and the strength of an IT pro standing in an overheating datacenter.

It’s your friend and mine: BATCHman!

…and his Boy Blunder Cmdlet.

In Today’s Episode, BATCHman Encounters Mr. Freeze-Process!

We find today the evil villain Mr. Freeze-Process—once a harmless data entry clerk known as VIC Twennie, who’s mind was so twisted he tried translating Hollerith cards to English—hovering over his victim, philanthropist Bill Gates.

”Buah ha ha ha haaa! I have you now! Your entire laptop held prisoner by my constantly spawning processes! A screen flooded in Notepad! A-ha! You will never get that email out to the world now with that newly discovered cure! Now quickly sign! Sign! Sign your autograph on every sheet of paper on this skid! I will make billions selling it on online auction sites!”

Mr. Gates looks to the ground sullenly. “Oh, if only BATCHman were here to save me from this diabolic and bad-acting villain!”

***Meanwhile back in the BATCHcave!***

“Cmdlet, my scripting sense is tingly! I sense, I sense trouble! Quickly! To the WinMobile!”

***Moments later with minimal explanation or plot! ***

“Oh, thank goodness you’re here, BATCHman! The Evil Mr. Freeze-Process has tied up my laptop with an application that constantly launches copies of Notepad. My CPU is pegged and I need to get a truly important email message out!”

BATCHman disposes his faithful sidekick to keep Mr. Freeze-Process busy by interviewing him for the fake Villain of the Year Award. Quickly he assesses the problem. There is a parent process spawning multiple copies of Notepad. “This is a job for Windows PowerShell!” he blurts dramatically.

“First, we must kill off most of these applications. Using Windows PowerShell, I can run the Get-Process cmdlet to find all the copies of it. I will store those results in a variable so that I don’t fill up the screen.”

$BADPROCESSES=GET-PROCESS NOTEPAD

“Now I can use the Stop-Process cmdlet. But rather than trying to stop them one at a time, I can just pipe the entire list in!”

$BADPROCESSES | STOP-PROCESS

By this time the Boy Blunder has returned, having bored Mr. Freeze-Process to sleep.

“Holy echo, BATCHman! They’re still appearing!” True enough, the Boy Blunder was right! Notepad kept appearing! “Zoinks! I almost forgot about the parent process! What a diabolic villain!”

Quickly, our hero thinks to himself. “I must find the newest process that launched just before all these child processes! *SNAP* Of course!”

BATCHman runs Get-Member against Get-Process:

GET-PROCESS | GET-MEMBER

He finds there is a property called Starttime.

“I shall run Get-Process, and not show any Notepad in the list. Then I shall run the output through Sort-Object based on the Starttime to put the most recent ones near the top. Odds are that Mr. Freeze-Process’ application is one of the last ones launched!”

GET-PROCESS | Where { $_.Name –ne ‘NOTEPAD’} | Sort-object Starttime

But a problem appears in the output! “Holy unclear answers, BATCHman! Look!” bursts out Cmdlet.

The BATCHman, never fazed, realizes not all processes such as system processes can have their properties read by the user. We can have this ignored in the output to make it clearer to read by adjusting the ErrorAction value in the line:

GET-PROCESS | Where { $_.Name –ne ‘NOTEPAD’} | Sort-object Starttime –erroraction ‘SilentlyContinue’

“Much better!” exclaims BATCHman, “but I really only need the most recent processes.”

“BATCHman,” Cmdlet pokes in, “could we run all of this through Select-Object and just take the top 3? We should have an easier time spotting parent applications launching all these vile Notepads!”

“Of course, Boy Blunder! Excellent work! We’ll use Select-Object and show the last 3 items in the process list!”

GET-PROCESS | Where { $_.Name –ne ‘NOTEPAD’} | Sort-Object Starttime –erroraction ‘SilentlyContinue’ | Select-Object –Last 3

“Now, Cmdlet, let’s strike that parent process! Taste BATCH Justice, EvilDoerProgram!”

GET-PROCESS EvilDoerProgram | STOP-PROCESS –force

“Let’s crush those remaining Notepad applications once more to get Mr. Gates back to his ability to save the world!”

GET-PROCESS NOTEPAD | STOP-PROCESS –force

In moments, the screen quiets down and the laptop returns to normal. Mr. Gates quickly clicks Send.

“Holy vanishing process, BATCHman! It appears the villain has run off!” screams Cmdlet.

“As evildoers always will, Cmdlet.” smiles BATCHman.

“Thank you BATCHman! How can I ever thank you?”

“Just keep doing what you do best, saving the world.”

BATCHman shakes Mr. Gates’s hand and is about to step onto the WinMobile when Cmdlet starts tugging on his cape.

“Yes, Cmdlet?”

“…pssst…pssst……psssst”

“Ah, I see. Mr. Gates, Cmdlet would like to get your autograph.”

“Why sure! There’s about five hundred in that pile over there.” Mr. Gates points at the former skid of paper provided by the Evil Mr. Freeze-Process

They all laugh as Cmdlet quickly executes his newly written advanced function GET-AUTOGRAPH | OUT-SAFE.

Thanks, Sean! Join us tomorrow for part 2 of the amazing adventures of BATCHman. Same BATCHtime, Same BATCHchannel.

Ed Wilson, Microsoft Scripting Guy