Tagged: powershell
Cross Domain PowerShell Remoting [Fail]
I tried to run our PowerShell environment configuration scripts today and got hit with a nasty error. I double checked my credentials so I know that wasn’t the issue. The scripts worked just a month ago, but we did have some stupid security software installed on our workstations that may be adjusting how remoting works. Let’s see if I can get around it before I open a ticket and start complaining.
Here is the error. This results from a simple call to New-PSSession. The other server is in another domain, but like I said this has been working just fine.
New-PSSession : [agpjaxd1pciapp1] Connecting to remote server agpjaxd1pciapp1 failed with the following error message : WinRM cannot process the request. The following error with errorcode 0x80090311 occurred while using Kerberos authentication: There are currently no logon servers available to service the logon request. Possible causes are: -The user name or password specified are invalid. -Kerberos is used when no authentication method and no user name are specified. -Kerberos accepts domain user names, but not local user names. -The Service Principal Name (SPN) for the remote computer name and port does not exist. -The client and remote computers are in different domains and there is no trust between the two domains. After checking for the above issues, try the following: -Check the Event Viewer for events related to authentication. -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTTPS transport. Note that computers in the TrustedHosts list might not be authenticated. -For more information about WinRM configuration, run the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.
After I read this, I just stared at this for about 5 minutes; deer in the head lights.
I found some hope on the PowerShell Scripter’s friend, “Hey Scripting Guy” blog – http://blogs.technet.com/b/heyscriptingguy/archive/2013/11/29/remoting-week-non-domain-remoting.aspx.
Anyway, the solution from Honorary Scripting Guy, Richard Siddaway was to add the computer I am connecting to the the trusted host list. The trusted host list basically tells your computer, “Hey, you can trust this computer, go ahead and share my sensitive and private credentials with the.” So, be careful with this.
You can view the trusted host list with this PowerShell command.
Get-Item -Path WSMan:\localhost\Client\TrustedHosts
You can add a computer to the trusted list with this command.
Set-Item -Path WSMan:\localhost\Client\TrustedHosts -Value 'computerNameOfRemoteComputer' [Y] Yes [N] No [S] Suspend [?] Help (default is "Y"): Y
Now, I run the configuration script and I am deer in the head lights again.
New-PSSession : Opening the remote session failed with an unexpected state. State Broken.
Such a helpful error message. Stackoverflow – http://stackoverflow.com/questions/30617304/exchange-remote-powershell-gets-sporadic-broken-state. Looks like it may be a timeout, and I’m feeling that because the script sat on “Creating Session” forever (why so long is probably the next question). I update my script to increase timeout.
$so = New-PSSessionOption -IdleTimeout 600000 $Session = New-PSSession -ComputerName $node.ComputerName -Credential $credential -SessionOption $so;
10 minute timeout is good right? So, I try again and State is still Broken. Not mission critical at the moment so I will investigate further later.
You can read more about possible solutions at the links above.
GoCD: Install Multiple Agents with Powershell, Take 2
I wrote about how to Automate Agent Install with PowerShell and thought I would provide the script I am using now since I recently had to deploy some new agents. The script is below and it is pretty self explanatory and generally follows my previous blog post and the Go.cd documentation.
We basically, copy an existing agent to a new location, remove some files that are agent specific, and create a Windows service to run the agent. Until I feel the pain of having to do it, I set the service account/password and start the service manually. Also, I configure the agent on the server manually through the Go.cd UI. When I have to install more agents I will probably automate it then.
$currentAgentPath = "D:\Go Agents\Internal\1"; $newAgentName = "Go Agent Internal 3"; $newAgentPath = "D:\Go Agents\Internal\3\"; Write-Host "Copying Files" Copy-Item "$currentAgentPath\" -Destination $newAgentPath -Recurse; Write-Host "Deleting Agent Specific Files" $guidText = "$newAgentPath\config\guid.txt"; if (Test-Path $guidText) { Remove-Item $guidText; } Remove-Item "$newAgentPath\.agent-bootstrapper.running"; Write-Host "Create Agent Service" New-Service -Name $newAgentName -Description $newAgentName -BinaryPathName "`"$newAgentPath\cruisewrapper.exe`" -s `"$newAgentPath\config\wrapper-agent.conf`""; #$credential = Get-Credential; #Eventually, we will write a function to set the service account and password and start the service would be nice to have a way to automatically configure the agent on the server too.
I guess I decided to do the work for you 🙂
Enjoy
PowerShell in Visual Studio, Finally, At Last… Almost
Even if you don’t like Microsoft or .Net, you have to admit that Visual Studio is a boss IDE. After being thrust into the world of scripting and PowerShell, it was disappointing to find the PowerShell support in Visual Studio to be lacking. Well, today I received a notice that Microsoft joined Adam Driscoll’s open source project, PowerShell Visual Studio Tools (PVST). They announced a release of a new version and I am ready to give it another go.
Adam makes note that Microsoft submitted a large pull request full of bug fixes and features. This project provides pretty nice PowerShell support inside my favorite IDE including:
- Edit, run and debug PowerShell scripts locally and remotely using the Visual Studio debugger
- Create projects for PowerShell scripts and modules
- Leverage Visual Studio’s locals, watch, call stack for your scripts and modules
- Use the PowerShell interactive REPL window to execute PowerShell scripts and command right from Visual Studio
- Automated Testing support using Pester
From https://visualstudiogallery.msdn.microsoft.com/c9eb3ba8-0c59-4944-9a62-6eee37294597
You can download it for free from the Visual Studio Gallery. A quick double click install of the visx file you download and your ready.
My first test was to create a PowerShell project. In the Visual Studio New Project window there’s a new project template type, PowerShell. Inside of it are two templates: PowerShell Module Project and PowerShell Script Project.
Scripting and Debugging
I start with a script project and bang out a quick Hello World script to see debugging in action.
$myName = "Charles Bryant" $myMessage = "How you doin?" function HelloWorld($name, $message) { return "Hello World, my name is $name. $message" } HelloWorld $myName $myMessage
It feels very comfortable… like Visual Studio. I see IntelliSense, my theme works and I can see highlighting. I can set breakpoints, step in/over, see locals, watches, call stack, console output… feeling good because its doing what it said it can do and scripting PowerShell now feels a little like coding C#.
REPL Window
What about the REPL window. After a little searching, I found it tucked away on the menu: View > Other Windows > PowerShell Interactive Window. You can also get to it by Ctrl + Shift + \. I threw some quick scripts at it… ✓, it works too.
Unit Testing
Last thing I have time for is testing unit testing. First, I install Pester on the solution. Luckily there’s a NuGet package for that.
>Install-Package Pester
Then I create a simple test script file to test my Hello World script.
$here = Split-Path -Parent $MyInvocation.MyCommand.Path $sut = (Split-Path -Leaf $MyInvocation.MyCommand.Path).Replace(".tests.", ".") . "$here\$sut" Describe "HelloWorld" { It "returns correct message" { HelloWorld "Charles Bryant" "How you doin?" | Should Be "Hello World, my name is Charles Bryant. How you doin?" } }
Houston there’s a problem. When I open the Test Explorer I can see a bunch of tests that come with Pester, but I don’t see my little test. I try to reorganize the tests in the explorer and it freezes. Not sure if this is a problem with PVST, Pester, NuGet, Visual Studio, or user error… oh well. I can’t say it is a problem with PVST because I didn’t try to find out what was wrong (I still have work to do for my day job).
Conclusion
OK, unit testing isn’t as intuitive as the other operations, hence the Almost in the title. It will feel complete when I get unit testing working for me, but none the less, I like this tool a lot so far. I will definitely be watching it. If I see something up to my skills that I can contribute, I will definitely pitch in as this is something I can definitely use.
Orphaned Powershell PSDrive
I received this strange error while executing a script that creates a new PSDrive.
New-PSDrive : The local device name has a remembered connection to another network resource
I tried to use Remove-PSDrive, but
Remove-PSDrive : Cannot find drive. A drive with the name 'S:' does not exist.
I was able to fix this issue with the “net use” command.
First, I ran it to see if the drive was still mapped. I am still unsure how it is there between Powershell sessions, I must have missed something.
PS C:\> net use New connections will be remembered. Status Local Remote Network ------------------------------------------------------------------------------ Unavailable S: \\node1\d$ Microsoft Windows Network Unavailable I: \\node2\it Microsoft Windows Network OK P: \\public Microsoft Windows Network The command completed successfully.
Then I ran “net use” with the delete parameter to remove the orphaned drive.
PS C:\> net use /delete S: S: was deleted successfully.
I love it when a plan comes together.
Update PSModulePath for Custom PowerShell Module Development
I am in the process of a deep dive into DSC and I want to store my custom modules and DSC Resources in source control. To make it easy to run PowerShell modules you have to import them or have them on the PSModulePath environment variable. Since I don’t want to point a source repository to the default PowerShell module path, I want to add my custom module path to PSModulePath. This will save me some time when it comes to having to import modules and module changes. This means I will always be running the most recent version of my modules even the buggy ones, so if you do this, understand the implications.
It’s actually pretty easy to automate this with PowerShell. Since I already have some experience updating environment variables with PowerShell I just created a new script to add my custom module path to PSModulePath.
$currentModulePath = [Environment]::GetEnvironmentVariable("PSModulePath", "Machine") $customModulePath = "C:\_DSC\DSCResources" $newModulePath = $currentModulePath + ";" + $customModulePath
[Environment]::SetEnvironmentVariable("PSModulePath", $newModulePath, "Machine")
I complicated this script a bit so it is more self evident on what is happening (code as documentation – no comments necessary).
I can envision someone needing to also remove a path from PSModulePath, but this is enough to get started so I will leave it up to you, until I have a need for that :).
UPDATES
When running this script in an Invoke-Command on a remote session the modules aren’t immediately available if I tried to use modules in the new path. This is because the path is not updated on the remote session. A quick workaround for me was to remove the session and recreate it.
Get-PSSession | Remove-PSSession;
This removes all sessions so you may not want to do this. Since I don’t care about sessions I like it. This was just a one line change in my workflow script and it didn’t cause too much latency in the script execution. I know there are some other solutions that involve messing with the registry, but this is a one time deal so resetting the remote session works for me.
GoCD: Automate Agent Install with PowerShell
I have been setting up build servers and I have been exploring automating the process. So, I have been scripting every step I take to stand the servers up. In this post I will sharing some of the commands I use to create GoCD Agents. If you decide to go down this road, you should think about creating reusable scripts and parameterize the things that change (I didn’t want to do all the work for your :). Also, it would make sense to use a configuration manager like DSC, Puppet or Chef to actually run the scripts.
I am using PowerShell remotely on the build servers, which is indicated by [winbuildserver1]: PS> in the command prompt. Check out my previous post to learn more about configuring remote servers with PowerShell.
Copy Install Files
The first thing I do is copy the install files from the artifact repository to the server.
[winbuildserver1]: Copy-Item -Path \\artifactserver\d$\repository\Go-Agent\go-agent-14.1.0-18882\go-agent-14.1.0-18882-setup.exe -Destination "D:\install-temp\" -Recurse -Force
Install Agent
[winbuildserver1]: PS>([WMICLASS]"Win32_Process").Create("D:\install-temp\go-agent-14.1.0-18882-setup.exe /S /SERVERIP=<ip of go server> /GO_AGENT_JAVA_HOME=<path to JRE> /D=D:\Go Agents\Internal\1\")
Here we are getting a reference to the static WMI class “Win32_Process”, call the create method passing the command line to install an agent (http://www.thoughtworks.com/products/docs/go/current/help/installing_go_agent.html). In the command line we have
- the path to the install file
- /S switch for silent install (no user prompts)
- /SERVERIP switch for the IP of the Go Server (this is optional)
- /GO_AGENT_JAVA_HOME switch for the path to the JRE (this is optional)
- /D switch is the path to location you want to install the agent.
Run Multiple Agents on Same Server
If I want to run multiple agents on the same server I do a little extra work to get the other agents installed.
[winbuildserver1]: PS> Copy-Item "D:\Go Agents\Internal\1\*" -Destination "D:\Go Agents\PCI\1"
[winbuildserver1]: PS> Remove-Item "D:\Go Agents\PCI\1\config\guid.txt"
[winbuildserver1]: PS> Remove-Item "D:\Go Agents\PCI\1\.agent-bootstrapper.running"
Here we are just copying an installed agent to a new location and removing a couple files to force the agent to recreate and register itself with the server.
Create Agent Service
Lastly, I create a service for the agent.
[winbuildserver1]: PS> New-Service -Name "Go Agent PCI 1" -Description "Go Agent PCI 1" -BinaryPathName "`"D:\Go Agents\PCI\1\cruisewrapper.exe`" -s `"D:\Go Agents\PCI\1\config\wrapper-agent.conf`""
Get more on using PowerShell to configure services in my previous post.
Conclusion
I use similar commands to install the server, plug-ins, and other tools and services (e.g. Git, SVN, NuGet…) that I need on the build server. I have to admit that this isn’t totally automated yet. I still have to manually update the service account, credentials and manually accept a certificate to get SVN working with the agent, but this got me 90% done. I don’t have to worry about my silly mistakes because the scripts will do most of the work for me.
Using Powershell to Export an SVN XML List to CSV
I needed to get a list of files in a specific folder of an SVN repository and export it as an csv file. The main reason was to get the size of the contents of the folder, but I also wanted to work with the results (sort, group, filter) and Excel was the tool I wanted to do it in. I will use the svn command line to get the list of files and directories and Powershell to parse, transform and output the CSV file.
PS C:\program files\tortoisesvn\bin> ([xml](svn list --xml --recursive https://myrepohost/svn/repo/branches/branch/folder)).lists.list.entry | select -property @(@{N='revision';E={$_.commit.GetAttribute('revision')}},@{N='author';E={$_.commit.author}},'size',@{N='date';E={$_.commit.date}},'name') | sort -property date | Export-Csv c:\svnlist.csv
OK, that is a mouthful, so here is a break down of what’s going on here.
[xml] – this is the Powershell XML type accelerator. It converts plain text XML into an XML document object that Powershell can work with. This can be used on any source that returns plain text XML, not just SVN list. More info, http://blogs.technet.com/b/heyscriptingguy/archive/2014/06/10/exploring-xml-document-by-using-the-xml-type-accelerator.aspx.
svn list –xml –recursive https://myrepohost/svn/repo/branches/branch/folder – this returns an xml list of files and folders from the svn path and recurse into subdirectories (http://svnbook.red-bean.com/en/1.7/svn.ref.svn.html#svn.ref.svn.sw.verbose).
.lists.list.entry – this is some XML parsing magic where we get a reference to the root “lists” node, then each “list” and each “entry” in the list. More info, http://blogs.technet.com/b/heyscriptingguy/archive/2012/03/26/use-powershell-to-parse-an-xml-file-and-sort-the-data.aspx.
The next part of the script we are sending each entry node object to our processing pipeline to produce the output. First we set the properties we want. If you want to see the XML, you could output to a file like this:
PS C:\program files\tortoisesvn\bin> ([xml](svn list --xml --recursivehttps://myrepohost/svn/repo/branches/branch/folder).Save("c:\svnlist.xml")
This simply takes the XML document created by [xml] and saves it to a file. If you view this file you would see that there is a root lists node that has a child node list, that has child node entry, which in turn has child nodes: name, size, and commit (with revision attribute and child node for author and date).
<?xml version="1.0" encoding="UTF-8"?> <lists> <list path="https://myrepohost/svn/repo/branches/branch/folder"><entry kind="file"> <name>somefile.cs</name> <size>409</size> <commit revision="18534"> <author>Charles.Bryant</author> <date>2010-02-09T18:08:05.647589Z</date> </commit> </entry> ...
| select -property…. – this takes each of our entry nodes and parses it to select the output we want. Example: I want the author included in my output so I will tell Powershell to include author, N=’author’ and set the value to the value of the author node from the commit node object, E={$_.commit.author}. You will notice that to get the revision I am asking Powershell to GetAttribute on the commit node. As you can see, its pretty powerful and I could reformat my output as I see fit. More info, http://technet.microsoft.com/en-us/library/dd347697.aspx.
| sort -property date – this does what it says and sorts by date, http://technet.microsoft.com/en-us/library/dd347718.aspx.
| Export-Csv c:\svnlist.csv – formats the results as csv and saves it to a file, http://technet.microsoft.com/en-us/library/ee176825.aspx.
Conclusion
Powershell strikes again and provides a simple and easy way to work with XML output. I actually did another script that prints the size of the repository folder by getting a sum of the “size” nodes, but I will leave that as an exercise for the reader (hint: Measure-Object Cmdlet and the -Sum Parameter would be useful).
Install IIS with PowerShell
Here is another PowerShell command. This one is for installing IIS.
First I establish a session with the server I want to install to:
PS> enter-pssession -computername winbuildserver1
Next we just need to run a simple command:
winbuildserver1: PS> Install-WindowsFeature Web-Server -IncludeManagementTools -IncludeAllSubFeature -Source E:\sources\sxs
In the example I am installing the IIS web server, including the management tools and all sub-features, and I am installing from a specific source path, easy-peasy.
Of course you can achieve more fine grained control of the install and you can get more information on that at:
Manage Windows Services with PowerShell
This is just a quick post to document some PowerShell commands so I don’t forget where they are. One of them wasn’t as easy to find it as I thought it should be (Mr. Delete Service). If you want to delete a Windows Service, how do you do it with PowerShell? You can use WMI, but PowerShell also includes some more friendly methods for working with services that aren’t that hard to find.
Delete Service
PS> (Get-WmiObject win32_service -filter "name='Go Agent 2'").Delete()
Here I am deleting one of my Go.cd Agent Services. The only item I change from service to service in this command is the “name=”, everything else has been boilerplate so far, but there are other parameters you can set. One thing I noticed is that if the service is started you have to first stop it for the delete to complete, otherwise it is just marked for deletion.
You can get more info on PowerShell WMI here:
http://msdn.microsoft.com/en-us/library/dd315295.aspx
http://msdn.microsoft.com/en-us/library/aa384832(v=vs.85).aspx
New Service
PS> New-Service -Name "Go Agent 2" -Description "Go Agent 2" -BinaryPathName "`"D:\Go Agents\2\cruisewrapper.exe`" -s `"D:\Go Agents\2\config\wrapper-agent.conf`""
Here I am creating the Go Agent. Notice that I am able to set additional command parameters in the binaryPathName, like the -s to set my config file above. I use the back tick (`) to escape quotes.
Start Service
PS> start-service -name "Go Agent 2"
This is a simple command that just needs the service name. You only need the double quotes if your name has spaces.
Stop Service
PS> stop-service -name "Go Agent 2"
This is another simple one just like start.
Conclusion
Don’t remote into your server anymore to manage your services. Run remote PowerShell commands.
Update
They say “Reading is Fundamental” and the delete service answer I was looking for was at the bottom of the page I learned about creating services, http://technet.microsoft.com/en-us/library/hh849830.aspx. It even lists another command to delete services:
PS> sc.exe delete "Go Agent 2"
Configure Remote Windows 2012 Server
Have you ever needed to inspect or configure a server and didn’t want to go through the hassle of remoting into the server? Me too. Well as I take a deeper dive into the bowels of PowerShell 4 I found a cmdlet that allows me to issue PowerShell commands on my local machine and have them run on the remote server. I know your excited, I couldn’t contain myself either. You will need PowerShell 4 and a Windows 2012 server that you have login rights to control. I am going to give you the commands to get you started and then you can Bing the rest, but its pretty simple. Once you established the connection, you just issue PowerShell commands just as if you were running them locally. Basically, you can configure your remote server from your local machine. You don’t even need to activate the GUI on the server. You can just drive it all from PowerShell and save the resources needed with the GUI.
Security
Is it secure? About as secure as you remoting into the server through a GUI. Yet, there is a difference in the vulnerabilities that you have to deal with. Security will always be an issue. This is something I will have to research more, but I do know that you can encrypt the traffic and keep the messages deep inside your DMZ.
Code
Note: Anything before the > is part of the command prompt.
PS C:\> Enter-PSSession -ComputerName server01
[server01]: PS C:\Users\CharlesBryant\Documents>
This starts the session. Notice that the command prompt now has the server name in braces and I am in my documents folder on the server.
[server01]: PS C:\Users\CharlesBryant\Documents> hostname
server01
Here I issue the host name command to make sure I’m not dreaming and I am actually on the server. Yup, this is really happening.
[server01]: PS C:\Users\CharlesBryant\Documents> Get-EventLog -list | Where-Object {$_.logdisplay name -eq "Application"}
Max(K) Retain OverflowAction Entries Log
------ ------ -------------- ------- ---
4,096 0 OverwriteAsNeeded 3,092 Application
Yes…I just queried the event log on a remote server without having to go through the remote desktop dance. BooYah! To end your session is even easier.
[server01]: PS C:\Users\CharlesBryant\Documents> Exit