Search results for 'app:weblogs' matching tags 'wmi' and 'Scripting Wife'

Use PowerShell to Troubleshoot and Repair WMI Errors

Anonymous — Thu, 29 Mar 2012 05:00:00 GMT

Summary: Learn how to use Windows PowerShell to troubleshoot and repair WMI errors.

Microsoft Scripting Guy, Ed Wilson, is here. Tomorrow is the New York City TechStravaganza. The Scripting Wife and I will be there, and we are looking forward to hanging out with Microsoft PowerShell MVPs such as Tome, Brandon, and Aleksandar. Anyway, it was late when we got to the hotel, and I was looking forward to reading a story collection by Raymond Chandler and calling it a day. I had just started on the third story in the collection, when above the constant hum of Times Square, I heard the Scripting Wife.

“Why do I always get these errors,” she exclaimed with obvious annoyance.

“Probably because you are doing something wrong,” I said not really helping the situation.

“No. In the event log. Here take a look,” she said turning her laptop to me.

The error to which she referred is shown here.

“How do you know you are always getting this error,” I asked.

“Because I always see it every time I open the Application log on my computer,” she replied.

“Well, let’s see how many times you really are getting this error,” I suggested, “Open the Windows PowerShell console, and let’s use the Get-WinEvent cmdlet to retrieve every Event 10 from Windows Management Instrumentation.”

“OK. But you are going to have to help me a bit,” she said.

“But of course. We will use a filter hash table so that we only retrieve the events from Windows Management Instrumentation that are Event 10 in the Application log. The first thing is to type the Get-WinEvent cmdlet, and call the FilterHashTable parameter. But do not press ENTER because we will build the command.”

The Scripting Wife thought for a bit, and then typed the following (she used tab expansion to complete the FilterHashTable parameter name).

Get-WinEvent -FilterHashtable

“Now we need to create the hash table for the filter. Remember that a hash table begins with the ‘at’ sign (@). Then it is the key equals the value. Each pair gets a semicolon separator,” I said.

“OK,” she said as she typed the “at” sign, and opened a pair of curly braces, “Now what?”

“The first pair is LogName equals Application. Put the word ‘application’ in quotation marks,” I said.

The following is what the Scripting wife typed.

@{logname='application'

“Now the next pair is ID equals 10. There is no need for quotation marks around the number ten. Remember, that each key value pair receives the semicolon separator.”

The Scripting Wife was all business. The she typed the following.

;id=10;

“The good thing is that the ProviderName will accept a wild card. So all you need to do is use the asterisk with the letters wmi. Make sure you also put them in quotation marks and close the curly bracket,” I said.
Here is what she typed.

providername='*wmi*'}

“Great. You are almost done. Pipe the whole thing to the Measure-Object cmdlet. You can use the alias measure for that cmdlet,” I instructed.

The following is the Scripting Wife’s completed command.

Get-WinEvent -FilterHashtable @{logname='application';id=10;providername='*wmi*'} | measure

“Cool, it works,” the Scripting Wife exclaimed, “Here take a look.”

As she turned her laptop monitor so I could see the following output in her Windows PowerShell console.

“How would I know how to do this if you were not around?” she asked.

“You could use the Get-EventLog cmdlet to do this, but you would need to pipe the results to the Where-Object cmdlet to help with the filtering. This command is more efficient. Besides, I wrote a great Hey, Scripting Guy! blog last year about using the FilterHashTable parameter. It is titled How to Improve the Performance of a PowerShell Event Log Query,” I said.

“So what does all this mean anyway?” she asked.

“What does what mean?” I asked.

“What is Event 10 from Windows Management Instrumentation, and why is it littering my Application log with meaningless events?” she asked.

“Actually it is not meaningless. It means that some permanent event does not have permission to run. That is what the error code 0x80041003 means. Why it does not have permission is another issue. Let me check with Bing to find out,” I said.

Within less than a minute, I had retrieved a support article describing the situation. Interestingly enough, this issue also has a Microsoft Fix It solution attached to it. “Cool.” I thought. Then I thought this would be a great opportunity to talk to the Scripting Wife about permanent event consumers.

“Do you remember when Trevor wrote Use a PowerShell Module to Work with WMI Permanent Events?” I asked.

“Sure. I thought it was great,” she replied.

“Well, before that blog, I talked about working with permanent events and I discussed the technology that was behind them in Use PowerShell to Monitor and Respond to Events on Your Server,” I said.

“Uh. Sure, if you say so. I don’t remember that far back,” I said.

I started to say something like she remembered Trevor’s module, but then I decided to keep my mouth shut for a change. Then I changed my mind.

“Well, this is your lucky day. Because we are going to do a refresher course,” I said.

“Oh, come on. It is late, and tomorrow is the TechStravaganza,” she whined.

The first thing I did was create a simple script that I called Get-BVTFilterandConsumer.ps1. This script is shown here. (Note: The second line uses the back tick character for line continuation. GWMI is an alias for the Get-WmiObject cmdlet. Remember, this is a quick script, and it is late at night.)

Get-BVTFilterandConsumer.ps1

gwmi __EventFilter -Namespace root\subscription -Filter "name = 'bvtfilter'"

gwmi __FilterToConsumerBinding -Namespace root\subscription `

-filter "filter = '__EventFilter.Name=""bvtFilter""'"

“Now I want you to run the script. It will retrieve instances of the __EventFilter Windows Management Instrumentation class that are named bvtFilter. It will also retrieve instances of the __FilterToConsumerBinding Windows Management Instrumentation class—but only instances that are associated with the filter named bvtFilter. It sounds complicated, but really it is not,” I said.

“If you say so. But sometimes I wonder if your idea of complicated and my idea of complicated are the same thing,” she said as she ran the script. The output from the script is shown in the image that follows.

“Now what we need to do is to delete both the bvtFilter and the filter to consumer binding. This part is really easy because all we need to do is to pipe the objects from the previous script to Remove-WmiObject,” I said.

“That is the first thing you have said that makes sense,” she said, “Shouldn’t we back up the computer first?”

“We do not need to back up the entire computer, but it does not hurt to back up system state. To do this, use the CheckPoint-Computer cmdlet,” I said.

The Scripting Wife copied the code from the Get-BVTFilterandConsumer.ps1 script, and at the end of each line she added a pipe character, and sent the objects to the Remove-WMIObject cmdlet. Then she backed up and went to the top of the script and added the Checkpoint-Computer command. The resulting script, which she named BackupComputerAndRemoveBVTFilter.ps1, is shown here.

BackupComputerAndRemoveBVTFilter.ps1

Checkpoint-Computer -Description "prior to fixing event 10 from wmi" `

-RestorePointType MODIFY_SETTINGS

gwmi __EventFilter -Namespace root\subscription -Filter "name = 'bvtfilter'" |

Remove-WmiObject

gwmi __FilterToConsumerBinding -Namespace root\subscription `

-filter "filter = '__EventFilter.Name=""bvtFilter""'" |

Remove-WmiObject

When the Scripting Wife pressed the green triangle to run the script, the dialog box shown here appeared.

Other than the dialog box, there was no output from the script.

“So how do I know that it worked?” she asked.

“For one thing, you can run my Get-BVTFilterandConsumer.ps1 script. But with no instances, it will not display any output either. Another thing you can do is to open WbemTest, change your namespace to root\subscription and open the __FilterToConsumerBinding Windows Management Instrumentation class,” I said.

The Scripting Wife typed wbemtest into the Windows PowerShell console, and when the Windows Management Instrumentation Tester opened, she set the namespace to root\subscription and opened the __FilterToConsumerBinding Windows Management Instrumentation class. She then pressed the Instances button and the following dialog box appeared.

“You might also want to look for instances of the __EventFilter Windows Management Instrumentation class,” I suggested.

The Scripting Wife closed the previous dialog box, and opened the __EventFilter class. Next she looked for instances. The results are shown here.

“OK. That’s enough. You are making my head hurt, and I need to catch up with people on Facebook,” the Scripting Wife said.

And with that, I was effectively dismissed. 2012 Scripting Games Prep Week will continue tomorrow when we will have a guest blog post from Boe Prox.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy

The Scripting Wife Uses PowerShell to Find Service Accounts

Anonymous — Wed, 15 Feb 2012 06:00:00 GMT

Summary: The Scripting Wife interrupts Brahms to learn how to use Windows PowerShell to find service accounts and service start modes.

Microsoft Scripting Guy, Ed Wilson, is here. One of life’s real pleasures is sitting around a fireplace, listening to a Brahms concerto, and sipping a cup of chamomile tea. I like to add a bit of local honey, and drop in a cinnamon stick. So here I am…mellow and as relaxed as a cat lying in a bay window on a warm summer afternoon. The Charlotte SQL User Group meeting tonight was awesome. We had not seen Chris Skorlinski (the speaker) since the Raleigh SQL Saturday, so we were excited to go. The Scripting Wife and I had a great time, and it was a nice chance to see some friends we had not seen for a while.

Anyway, work finished, now it is time for a warm fire, a little Brahms, and a cup of warm (but not boiling) tea. About to nod off, I was suddenly startled back into reality as the overhead light suddenly switched on.

“How can you see in here in the dark,” the Scripting Wife exclaimed.

“There was nothing to see—I was listening to Brahms,” I began.

“You need to turn that racket down. The neighbor’s dog is beginning to howl. I think he prefers Trace Adkins to that classical stuff anyway,” she continued, “As long as you are awake, I have a problem with a Windows PowerShell command.”

“I see. I think it is you who likes Trace Adkins.”

“Yep, but don’t sidetrack me with talk about Trace Adkins, I need to be prepared for the 2012 Scripting Games so I do not embarrass you or me. Now back to what I came to ask you. I am trying to figure out what account a service uses to start, and I don’t see it. “

“And…”

“And nothing. I type Get-Service, and I do not see anything about service user accounts.”

“Show me your command,” I wearily asked.

“It is right here. Nothing hard…see?”

She plopped down beside me on the sofa and showed me her laptop. She had typed the single command shown here.

Get-Service

The command and the output from the command are shown in the image that follows.

“You know that there is more information don’t you?” I asked.

“Well, duh,” she said. “OK, I will clear the screen and send the output to the Format-List cmdlet.”

Here is what the Scripting Wife did to clear the screen and to obtain all the information available from the Get-Service cmdlet.

She cleared the screen by using the Clear-Host command. But instead of typing Clear-Host, she used the cls shortcut command instead.
Next, she pressed the Up arrow one time to retrieve the previous Get-Service command.
She then typed a space <space> by tapping the Space bar one time, and then she typed a pipe character (the pipe character | is located above the Enter key on my keyboard).
She then typed a space and Format-List * after the pipe character.

The complete command is shown here.

Get-Service | Format-List *

The command and the associated output from the command are shown in the image that follows.

“OK. I am looking at this output, and I still do not see anything about the service account that a service uses to start up,” she complained.

“Well, I did not say it was there, did I? I just asked you if you had looked at all of the information that the Get-Service cmdlet provides,” I stated. “To find the service account start-up information, you need to use WMI. Remember yesterday when we talked about Using PowerShell to Get Hardware Information? You can use the same technique today as you used yesterday.”

The Scripting Wife thought for a few seconds, and then she typed the following command.

Get-WmiObject –list *service*

“Wow, that is a lot of information,” she exclaimed. She turned the laptop monitor so I could look at the display. Indeed, as is shown here, it is a lot of information.

“Use the same technique that you used yesterday to find the WMI class you need to work with services,” I prompted.

Within a few minutes, the Scripting Wife was pointing at Win32_Service.

“Now use the Get-WmiObject cmdlet to query that WMI class,” I said.

It did not take her long to modify her command line to query the Win32_Service WMI class. Here is the command she composed.

Get-WmiObject Win32_Service

The command and the associated results are shown in the image that follows.

“OK, so where are the service accounts?” she asked.

“Remember, you need to use the same technique that you used with the Get-Service cmdlet to retrieve all the information,” I said.

She thought for a bit, then pressed the Up arrow to retrieve the previous command. Then she added a pipeline character and the Format-List cmdlet. The revised command is shown here.

Get-WmiObject win32_service | format-list *

The command and its associated output are shown in the image that follows.

“So where is the service account name?” she asked.

“Look closely at the output. See where it says StartName? That is the service account. See where it says StartMode? That is the way the service starts,” I said, “Why don’t you create a table with just the Name, StartName, and StartMode.”

This time the Scripting Wife did not hesitate. She first cleared the screen, then used the Up arrow to retrieve the previous command. She then edited it by changing it to a Format-Table command. The command that she arrived at is shown here with its associated output.

“That’s cool,” she said.

And with that, she was gone. Just in time for the Andante movement in D-major. Brahms may not have had Windows PowerShell in mind when he wrote, but somehow it seems to fit.

Ed Wilson, Microsoft Scripting Guy

The Scripting Wife Uses PowerShell to Get Hardware Information

Anonymous — Tue, 14 Feb 2012 06:00:00 GMT

Summary: The Scripting Wife needs to get ready for the 2012 Scripting Games, and she uses Windows PowerShell to get hardware info from her laptop.

Microsoft Scripting Guy, Ed Wilson, is here. The Scripting Wife and I were in Myrtle Beach, where I was working on the Scripting Games over the weekend. The trip to the Carolina Beaches is rapidly becoming an annual migration of the rare but not endangered Script Monkey. Anyway, I was on the lanai reading my email this morning, when I heard her—or more accurately—I felt her enter the room.

“So where are you taking me for Valentine’s Day?” she queried.

“I am taking you to the Charlotte IT Pro User Group meeting,” I said.

“You’re kidding. Right?”

“Nope, that is why I took you to Ruth’s Chris Steak House on Friday night. You knew that.”

“You took me to Ruth’s Chris because you had a gift card,” she countered.

“You knew it was your Valentine’s Day dinner. We had a lovely time. Now what’s the problem?” I asked.

“No problem. I was just trying to see if you were awake. Good morning, my little Script Monkey.”

“By the way, what are you doing up so early? It is not yet noon,” I queried.

“Ha ha. So funny,” she intoned. “Just so you will know, I have been up for hours. I am working on the 2012 Scripting Games Study Guide.”

“Uh huh. I see. Well, that is great. Good luck. Let me know how it is working for you,” I replied pleasantly enough.

“Well, my little Script Monkey, I do have a question.” She was dripping with sincerity.

“Yes,” I replied with more than a modicum of hesitancy. (I was never going to get through the 2,000 emails in my inbox at this rate.)

“I am a little rusty with Windows PowerShell. In fact, I have pretty much not touched it since last year,” she confessed.

“Huh? But all that time you spend at your computer. I thought you were at least writing a script.”

“Facebook. Twitter. PowerScripting PodCast. My blog. I get busy. Besides, if I really need a script, I figure you will write it.”

“You might just figure wrong too,” I said smiling. “So what is your problem?”

“Well, I forget how to find stuff out about hardware. I figure that will be the first event, because your Study Guide lists it first.”

I smiled, but did not commit myself. Paused for a second. Then replied, “OK, sit down.” She took a seat on the lanai swing.

“Now, to find out stuff about the hardware in Windows PowerShell 2.0, it is normally going to require using WMI,” I continued.

“I would use the Get-WMIObject cmdlet to find that out?” she asked.

“Absolutely. Now, write a command that will get information from the BIOS,” I said.

“Well, how do I know that? That is why I am here, silly,” she chastised.

“OK. One of the nice things about the Get-WmiObject cmdlet is that it can tell you what class you need. To do this, use the List parameter, and then use wild cards around the word BIOS.”

I slid the laptop over to her. She thought for a minute, and hesitantly typed the following:

Get-w<tab><tab><space>-l<tab><space>*bios*

Note (In the commands that follow, <tab> represents one press of the Tab key. One press of the Space bar is <space>. If you see two tab characters, such as <tab><tab>, it means press the Tab key twice. For most computers, this will probably work, but depending on what modules and other items are loaded in your environment, you may need to press the Tab key more than the indicated number of times. Always compare your completed command with the commands that are indicated as complete.

When the Scripting Wife finished typing, she turned the laptop back to me and smiled. “Is this the right command?” she asked.

I looked at it. The command she had composed is shown here.

Get-WmiObject -List *bios*

“That is exactly right. Now, which WMI class do you think actually reports only information about the BIOS on your computer?” I asked.

She looked at the output, which is shown in the image that follows.

“I think the Win32_BIOS is the right WMI class…because it sounds right, and the properties sound like BIOS things,” she postulated.

“And…”

“And it begins with a Win32 which sounds like Windows. You told me to always use WMI classes that start with Win32,” she said.

“Very good. Now, go ahead and query that class,” I said.

She started to ask how, then bent over the laptop and began to type. She did the following:

She hit the Up arrow once and retrieved the previous command.
She hit the backspace 12 times and erased everything but the Get-WmiObject command.
She highlighted the Win32_Bios class name with her mouse from the list in her output window, and then pressed ENTER.
She right-clicked just after the Get-WMIObject command.

The command she created is shown here.

Get-WmiObject Win32_BIOS

Following are the command and its associated output.

“It seems that my screen is getting cluttered up,” she complained.

“Type the command cls…that is a shortcut for the Clear-Host function,” I instructed.

The scripting wife typed the following:

Cls<enter>

“Now, just for fun, use the Get-History cmdlet to see what commands you have typed,” I instructed.

She typed h (a shortcut for the Get-History cmdlet name). Here is her command.

h<enter>

The output is shown in the image that follows.

“Press the Up arrow four times, erase the word bios*, and replace it with *processor*,” I suggested.

The Scripting Wife typed the following commands.

<up arrow><up arrow><up arrow><up arrow><backspace><backspace><backspace><backspace><backspace>*processor*<enter>

The command she created is shown here.

Get-WmiObject -List *processor*

The command and its associated output are shown in the image that follows.

“Now, can you pick out the WMI class that will tell you about the processor on your computer?”

“The Win32_Processor class will do that because it begins with Win32, and it has properties like AddressWidth, Architecture, and Availability,” she said.

“Absolutely right. Now go ahead and clear your screen, and then query the class.”

She did not even hesitate. Not for a second. She immediately did the following.

Highlighted Win32_Processor with her left mouse button, and pressed ENTER.
Typed Cls<enter>.
Used the Up arrow twice to retrieve the previous Get-WmiObject –list *Processor* command.
Used the backspace to erase everything but the Get-WMiObject command, and right-clicked the screen to paste Win32_Process.

The command she that created is shown here.

get-wmiobject Win32_Processor

The output from the command is shown here.

The Scripting Wife handed the laptop back to me. She smiled and jumped off the swing.

“Well, I guess I will see ya,” she said cheerily.

“Huh,” I asked.

“Yep. If we have to go to the Charlotte IT Pro User Group for Valentine’s Day, then it is going to take me all day to get ready,” she explained.

“I see. And why is that?”

“Well, I have to get my hair done. Then I have to go to the spa and get a manicure and a pedicure. I think I will invite my friends out for lunch, and then we will go shopping so I can get a new outfit to wear to the meeting. Really. Don’t you know anything?”

With that, she bounded out the front door of the lanai, and was gone. Really, sometimes I wonder if I do know anything about the Scripting Wife.

Ed Wilson, Microsoft Scripting Guy