Search results for 'app:weblogs' matching tags 'disk drives and volumes', 'Windows PowerShell', and 'storage'

Weekend Scripter: The Scripting Wife Talks About the First Warm-Up Event in the Winter Scripting Games

Anonymous — Sun, 10 Feb 2013 06:00:00 GMT

Summary: The Scripting Wife talks about the first event in the 2013 Winter Scripting Games warm-up events.

Microsoft Scripting Guy, Ed Wilson, is here. Today, we have a special guest. You guessed it: The Scripting Wife is with us today. If you are reading the Hey, Scripting Guy! Blog for the first time, Welcome.

Let me give you a little background. My real-life wife, Teresa, is not an IT person—she is an accounting kind of lady. However, over the years, she has gotten involved in the Windows PowerShell community and is a tremendous asset, if I do say so myself. Teresa thought the Scripting Games sounded like fun and joined in a couple of years ago. This turned out to be a fun way to use Teresa as an example for how you too can learn Windows PowerShell. There are several blogs that we have written where Teresa has been the student, and I have conducted training scenarios with her. Now that you are up to speed I will turn the keyboard over to Teresa.

Hello everyone, thank you for joining us today. I am so happy to see the Winter Scripting Games Camp warm-up events. The Competitor Guide is available from the PowerShell.Org web site. I have completed the first scenario and wanted to share with you how I solved the scenario just in case you did not have time to complete the task.

The first task is now over, but the second task opened on February 8, 2013. Part of the purpose for these events is to test the new Scripting Games platform, as well as to give the PowerShell.Org community some first-hand experience in running the games. The Scripting Games (as you may know) has been turned over to the Windows PowerShell community. (See the announcement on the Scripting Guys blog, as well as on the PowerShell.Org website.)

The task for this first event was to display the percentage of free space (in two digits) for my disk drive.

Whenever I think about doing stuff with the disk drive, I think about using WMI. My first choice is Win32_Volume.

I did a search on the Hey, Scripting Guy! Blog and came up with this hit that talked about using format specifiers to control the way that the information displays to the Windows PowerShell console. I also found a good Hey, Scripting Guy! Blog post called Use PowerShell to Create a Report Displaying Free Disk Space that basically contains the entire solution to the problem. When I saw that, I decided to not look at it yet. I decided to go back and review a Scripting Wife article where I talk about creating custom table headings with Out-GridView.

After I had spent some time reviewing the articles, and making sure that I do not cheat, I decided to take a stab at it (ok, several stabs). The first part is pretty straightforward—I know I need to use Get-WmiObject to query WMI. I know I want to use the Win32_Volume WMI class. I also know that gwmi is an alias for the Get-WmiObject cmdlet, as shown here.

gwmi win32_volume

The hard part is to display the percentage of free disk space in only two decimal places. This is where the format specifiers come into play … and they do not play very nicely. If I want to format a number with two decimal places, I first define the pattern. This pattern goes inside a pair of quotation marks and inside a pair of curly brackets. The other part I really do not understand—I just copied it and it works.

Now, I do know that I use –f, which is the format operator. This is really just one of those things I need to know how to find it, so I have a pattern to do what I need to do. I can’t memorize it very well, because I do not do it all that often—but hey, as long as I can find the Scripting Guy blog and search for it, then I can find what I need.

If I want to display the number 123.00345 as two decimal places, I would use the following code.

17:37 C:\> "{0:N2}" -f 123.00345

123.00

Now, for another thing that is not very straightforward, but at least it is well-documented in Help—creating a custom table label and computed number. We know about the two percentage places, and now we need to divide and multiply to get the percent free space. I divide freespace by capacity, and multiply by 100. To get it into a custom table, I specify Label and Expression. The Label is a string that becomes the Column heading. The expression is the script block that figures out the free space and also formats the output in two decimal places. The event required a one-liner. The following is a single logical line I broke up for readability purposes.

gwmi win32_volume |

ft DriveLetter, FreeSpace, Capacity,

@{Label="PercentFree";Expression= {"{0:N2}" -f (($_.freespace / $_.capacity) * 100)}}

The one line of code and the output associated with the code are shown in the following image.

I could use the same custom table property technique to change the display of free space and capacity to display in gigabytes instead of bytes. That would be a decent amount of work, however, and it was not required by the event.

I hope you find my description useful. When the second event ends, I will publish my solution to it as well. I am not certain that my code is what they were looking for, but it does meet the requirements. Hope you have a great weekend.

Thank you, Scripting Wife—nice write up. Join me tomorrow for more cool Windows PowerShell stuff.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy

Use PowerShell to Find the History of USB Flash Drive Usage

Anonymous — Fri, 18 May 2012 05:00:00 GMT

Summary: Microsoft premier field engineer, Jason Walker, shows how to use Windows PowerShell to get a history of USB drive usage.

Microsoft Scripting Guy, Ed Wilson, is here. I was talking to Jason Walker at the Charlotte Windows PowerShell User Group the other day. I asked him what cool things he was doing with Windows PowerShell, and he discussed a script he had recently written. I encouraged him to write a guest blog about the script. Today’s blog is a result of that conversation.

Jason Walker is a premier field engineer (PFE) at Microsoft, and he supports customers in the public arena. His primary job is supporting Exchange Server, but he jumps at the opportunity to flex his Windows PowerShell muscles to resolve any issue that may come up. It does not matter if it is related to Exchange Server. Jason also actively participates in the Charlotte PowerShell Users Group.

Twitter: AutomationJason

USB ports are an awesome resource to any computer. They allow you quickly connect and use accessories such as mice, keyboards, and storage devices, just to name a few. However, USB storage devices are a popular vector bad guys use to get nefarious code onto a machine. With my customers being in the public sector, security is a top priority, and USB storage devices are not allowed. We could disable USB ports all together, but that would eliminate the ability to use other USB devices. Therefore, users are told to simply not use USB storage devices. The need came up to see if the users are playing by the rules and Windows PowerShell was the answer to that need.

“How do we find out if a USB storage device has been connect to a computer?” you ask. We look in the registry, of course. When a USB storage device is inserted into a machine, the USBSTOR key is created in the registry, and everything the operating system needs to know about that storage device is contained in that key. This is the complete path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

When we expand the USBSTOR key, we see all the USB storage devices that have been used on the computer.

We see here that 15 different USB storage devices have been used on this machine. I know what you are thinking: “Whoever owns this machine is not very security conscience!”

By looking at the subkey names, we can get an idea about what kind of storage device was used, but the data isn’t easily readable. When we dig deeper, we find a FriendlyName property that is easily readable.

Now we can see that a “SanDisk U3 Cruzer Micro USB Device” was used on this machine.

To get this information, all we need Windows PowerShell to do is start from the USBSTOR key, recurse down two subkeys, and grab the FriendlyName property. There are a couple ways we can get this data. We could do it in one line like this:

But if we want to get this data from a remote machine, this will not work unless Windows PowerShell remoting is enabled—and it most cases it is not. I believe the method that will work in the most number of scenarios is the Microsoft.Win32.RegistryKey class.

Note If you have Windows PowerShell remoting enabled, see last week’s Hey, Scripting Guy! blogs for a different approach to working with the registry. Saturday’s blog, Use PowerShell to Easily Modify Registry Property Values, contains links to the entire series.

I will explain the code that does all the heavy lifting.

First, starting at USBSTOR, we get all the subkeys:

$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($Hive,$Computer)

$USBSTORKey = $Reg.OpenSubKey($Key)

$USBSTORSubKeys1 = $USBSTORKey.GetSubKeyNames()

Then we go through each subkey ($USBSTORSubkeys1) and collect the child subkeys. We store them in $SubKeys2 as shown here:

ForEach($SubKey1 in $USBSTORSubKeys1)

{

$Key2 = "SYSTEM\CurrentControlSet\Enum\USBSTOR\$SubKey1"

$RegSubKey2 = $Reg.OpenSubKey($Key2)

$SubkeyName2 = $RegSubKey2.GetSubKeyNames()

$Subkeys2 += "$Key2\$SubKeyName2"

$RegSubKey2.Close()

}#end foreach SubKey1

Now we go through each Key in $Subkey2 and grab the FriendlyName property of the key. The value of the property and the name of the computer are stored in a custom object so we can easily send our data to Export-CSV or filter with Where-Object.

ForEach($Subkey2 in $Subkeys2)

{

$USBKey = $Reg.OpenSubKey($Subkey2)

$USBDevice = $USBKey.GetValue('FriendlyName')

$USBDevices += New-Object –TypeName PSObject -Property @{

USBDevice = $USBDevice

Computer = $Computer

}

$USBKey.Close()

}#end foreach SubKey2

A few things to note are that the Remote Registry service must be running on the remote machine. I added a Write-Progress cmdlet because when I first wrote this script it ran against hundreds of machines. The Test-Connection cmdlet is not needed because the connection to the remote machine is inside the Try\Catch. However, during testing, it took 30+ seconds for the script to move to the next computer when trying to connect to a machine that was not online, so I added that as an option.

The script is written as a function, and it has comment-based Help with examples. Because it is written as a function, it will need to be dot-sourced. This is done by placing a dot and a space in front of the path to the script. When this is done, you can use the function just as you would a native Windows PowerShell cmdlet. Here is an example of how this is done:

Thanks, and I hope you can find this script useful when it’s time for you to flex your Windows PowerShell muscles.

~Jason

The complete script can be downloaded from the Script Repository. Thank you for a great guest blog. I have often seen this registry key, but never thought about using it in the way you have here. Awesome job.

Ed Wilson, Microsoft Scripting Guy

Use PowerShell to Determine Fragmentation of Your Drive

Anonymous — Tue, 15 Mar 2011 05:00:00 GMT

Summary : Learn how to use Windows PowerShell to determine the amount of fragmentation of your hard disk drives. Hey, Scripting Guy! One of the things that annoys me is that the “new” defragmenter program in Windows 7 does not return any information...(read more)