As Active Directory management from PowerShell is very important to me in my daily work as I do all AD, SMS and MOM management from PowerShell as well as some of the others in my department allready ;-) ,
I do not know how to do it yet using the wrapper, (see last NG thread [ADSI] getting COM properties . )
PS C:\PowerShell> ([adsi]'LDAP://CN=FooMoved,DC=mow,DC=local').'AccountDisabled' PS C:\PowerShell> ([adsi]'LDAP://CN=FooMoved,DC=mow,DC=local').get('AccountDisabled') Exception calling "get" with "1" argument(s): "The directory property cannot be found in the cache. " At line:1 char:49 + ([adsi]'LDAP://CN=FooMoved,DC=mow,DC=local').get( <<<< 'AccountDisabled') PS C:\PowerShell> PS C:\PowerShell> # Old way (works): PS C:\PowerShell> PS C:\PowerShell> ([adsi]'LDAP://CN=FooMoved,DC=mow,DC=local').psbase.invokeget('AccountDisabled') True
I still think that for this little value that.emulating VbScript this wrapper does add for someone starting with PowerShell (when he is coming from VbScript, and knowing all the Methods by Head ;-) ) ,
This wrapper does to much concessions to the usability of PowerShell for more advanced administrator tasks, for using /converting all examples in other .NET languages (C#,IronPyhon,VB.NET,PowerShell), Developers to use PowerShell as a Tool , or to glide to a making a CmdLet , and it is very confusing, making exploring and Learning harder.
I think the way forward, using the Framework, is the best way , see also all changes in .NET2.0 for managing AD infrastructure : /\/\o\/\/ PowerShelled: AD Infrastructure exploring with MSH (AD is managed by admin's, not by end-users ) , as you could see in the Part 3of the series, and the example in this post, it is already easy enough to get to those Hidden Methods added by the wrapper, and we have best of both worlds.
Also Get-Member is one of the most used and important commands in PowerShell , and in exploring Objects , and we have to be able to trust it to be consistent and complete, as it is one of our eyes into the PowerShell World.
So I think that hiding important information from it, for some also hidden added methods is the wrong way to go on the glidepath, and I see almost nothing for it in return, as for typing PSBase.
As you have RC2 Installed all my AD post will not work anymore, As I did switch back on all my work PC's (I did call all my colleagues not to upgrade as all our AD tools are messed up, I will not update them, as I would not recommend to upgrade to RC2 of you work with AD a lot , as it is verry confusing, but fixable if you read explaination below,
you can get all working again be the result might be messy.
he examples in my AD series will most of the time not work, most of the things discussed will not seem to be there , so if you did not do AD in PowerShell all seem very strange, and it will be hard to follow.
I will explain what has happened and give the ways to solve this.
As PowerShell RC2 was released, I hopefully started to explore the new AD support :
Name MemberType Definition ---- ---------- ----------
...
...
But after that even worse, if you follow the series you could add Properties directly and did not need to commit them (part 3) Hence you could do this :
PS C:\PowerShell> $user.psbase.displayName = 'user' Property 'displayName' cannot be found on this object; make sure it exists and is settable. At line:1 char:14 + $user.psbase.d <<<< isplayName = 'user'
Hmm, let go the hard way then (and again the Psbase !!!!)
So you see this makes working with AD interactive very errorprone, and lots of extra troubles and gotyas to take care of, and I hope that this will be solved for RTM as I think this makes PowerShell AD support much worse opposed to better,and lots of boilercode making scripts harder to read.
I realy wonder how they came to this and if they did eat there own dogfood on this one, as I can not get what they see as improvements for this wrapper.
for WMI the ++ are mutch greater (direct method access) as the -- (losing getInstances() e.g.)
but for AD please give me only the [ADSI] shortcut, and remove that wrapper again, as said and shown I think this makes it even harder for starters in PowerShell to explore AD.
So as you could see in last post I got started with IronPython for AD management also, it is a lot more clear as current solution in RC2, as dir() does show all directly , but as PTY is limited (no tabcompletion) but we have dir() next to the PTY examples (as we have no tabcompletion and PowerShell commands(direct see PowerShell Memo links) in next post I also will work out loading the IronPython DLL to work with it from PowerShell and embed it inside a script using a here string in and add some more AD stuff, also I look into the Event Form and Thread support in IronPython and how to borrow this functionality from IronPython to extend PowerShell.
Our Japanese MVP newpops is also doing a series on doing it the other way around hosting PowerShell in IronPython PowerShell Memo:
be sure to take a look, only the code samples impressive enough and will get you going or you can use Google to translate.
so here is an Hint example how to start the IronPython CLI (ipy.exe) from powershell and to connect to the Active Directory RootDSE and to list its children.
PS C:\PowerShell> C:\IronPython-1.0\ipy.exe IronPython 1.0.60816 on .NET 2.0.50727.42 Copyright (c) Microsoft Corporation. All rights reserved. >>> import sys >>> import clr >>> import System >>> >>> clr.AddReferenceByPartialName("System.DirectoryServices") >>> root = System.DirectoryServices.DirectoryEntry() >>> for c in root.Children: print c.Name ... CN=Builtin CN=Computers OU=Domain Controllers CN=foo CN=ForeignSecurityPrincipals CN=Infrastructure CN=Ken Myer CN=LostAndFound OU=MowOtherOU OU=MowOu CN=NewUs:::er0003 CN=NewUser0010 CN=NewUser0011 CN=NewUser0012 CN=NTDS Quotas CN=Program Data CN=System CN=Users >>> exit 'Use Ctrl-Z plus Return to exit' >>> ^Z
*Edit* Importing NameSpaces, Cool !, but do not throw $$ around ;-)
import System.DirectoryServices from System.DirectoryServices import *
root = DirectoryEntry()
>>> u = root.Children.Add("CN=fooBar","User") >>> $u.name Traceback (most recent call last): SyntaxError: unexpected token bad character '$' (<stdin>, line 1)
still not about Searching AD as I did say before using the DirectorySearcher Object,
but as a lot of my older posts and examples about already use it, If you did read the read the other parts of this AD series, you should be able understand those example scripts to get much information from that older scripts about searching AD going on from the examples, and pasting in lines of code from the examples into the interactive Shell .
See for a complete list, of all the parts in this series, and the other examples and scripts using the DirectorySearcher.
The excellent PowerShell Links directory Dance2Die maintains on Del.icio.us : PowerShell (Note the RSS feed !! )in the Active Directory Subdirectory: del.icio.us PowerShell AD links
(if can you make a get-Aduser ($SamAccountName){} from that using a DirectorySearcher as an example, please leave it in the comments ;-)
so in this post renaming and moving objects as that was not discussed yet :
Yesterday night, I got a question on how to rename a user in PoSH on IRC (IRC.freeNode.net #PowerShell).
I could not come up with a direct answer at the time, but did remember from VbScript that you could use a method on the OU,
You can see from this that it is handy that you can use the methods you are used to (or vaguely remember) from VbScript.
And you can use the methods from the .NET Wrapper Object ( you can learn about using Get-Member ).
Ok, Ok the CmdLets are for V2, (but I did hear some rumors about some extra functionality for AD as well as for WMI in RC2 .),
but working in the Interactive Shell console like this trying things interactively , combining Old and discovered knowledge, having much less looking up of Information and templates for admin task, using SDK DLL's (MOM 2005,SMS2003)gives you that kind of a productivity boost compared to working in VbScript ( a guess for me it's 10x and sometimes (for on the fly work ) much more (could be days ), as against doing the same in VbScript, and 2 or 3 times for CMD.EXE and commandline tool usage where applicable )
That sometimes I really feel like flying in PowerShell ;-)
and we can make our own functions with ease from the commands also :
and with the easy of making GUI Forms in PowerShell see PowerShell : Active Directory Part 10 (AD Browser) , for exporing the AD tree and visual selecting an AD object for use in PowerShell, that also makes it easy to get to AD objects for interactive tasks.
Not everything is perfect yet (Exception Handling, for in scripts,Remoting etc.), but I would not be able to live without it for my dayly work allready.
If you followed this series, and / or used PowerShell for AD management, compared to how you used to do you think it gives you a productivity boost, or will be able to ? I would be glad to hear what you think about this , please leave a comment about that also (Ok, enough begging, but my read / comment rate is low ;-) )
In the TechNet ScriptCenter there is a series : Sesame ScriptIf you’re new to scripting, these articles will teach you the basics and help get you started.
(Check out also the Sesame Script Archives , although the Series is aimed at beginners also some more advanced topics get explained, an all articles are a good read.), also the concepts are often also usable in PowerShell so even they are in VbScript they still can be a good resource for learning PowerShell)
In PowerShell we have a similar object called a HashTable that works almost the same and other .NET Collection Classes we can use that work like this, so this concepts are also good to know mastering PowerShell, the WMI example might not be the best example as it is an collection of objects already, but as an ArrayList is used also in for example a Select statement for more info also PowerShell and Active Directory Part 5 so is good to understand, and if you did not get the use in the Select completely its also good to get this background.
the HashTable unlike many other things do not enumerate on the pipeline. this can be a catch Wmi-Help Part 1
In this post I will follow the Sesame Script Article with similar command in PowerShell and point out the PowerShell Specifics, be sure to read the part in the "Sesame Script" article completely first.
An Example that Doesn’t Use the HashTable Object
PoSH>gwmi win32_service | fl name,state
name : Alerter state : Stopped
name : Eventlog state : Running
The next example about Filtering
PoSH>gwmi win32_service -filter "state = 'Stopped'" | ft name,state
You can also see more advanced examples of working with the HashTable Object in an MSH post (nothing changed here) here :
: Get AD info into a nested HashTable from MSH , (also a good read if you follow the AD series, as this also contains info about how to construct the Query for a Search of Active DIrectory using a directory Searcher)
But not all is lost if you still Have Exchange 2003 as much of the tasks listed here, you can also do in Active Directory directly.
I will show here also how you can do this directly in AD using PowerShell, for as you have an Exchange 2003 environment and you need to do this, and so you can see the difference with and without the Exchange 2007 Cmdlet,
I select the mailbox from AD with the PowerShell Active Directory Browser from Last post in the AD series PowerShell : Active Directory Part 10 (AD Browser) , ofcourse there are other ways to get at the mailbox as you could see in that series:
For some more info about setting Active Directory ACL's and ExtendedRights see also PowerShell and Active Directory Part 8 (ACL's) , or do a Search for the GUID : 'ab721a54-1e2f-11d0-9819-00aa0040529b' in Google for more info about SendAs and Exchange 2003 (SP1 + ).
For this part 10 of this series, I'v made a GUI Active Directory Browser script in PowerShell.
*Warning* As you have RC2 Installed all my AD posts will not work anymore, it is verry confusing, but fixable if you read explaination here PowerShell RC2 and Active Directory :
As I did switch back on all my work PC's (I did call all my colleagues not to upgrade as all our AD tools are messed up, I will not update them, as I would not recommend to upgrade to RC2 of you work with AD a lot.
*Edit 2* an RC2 version of this script you can find in the Comments, updated by Jakke, Thanks Jakke !
In the first post in this Active Directory series, PowerShell and Active Directory Part 1 , I showed how you could connect to the root of an Active Directory Domain,
Listed and created AD Objects, as OU's Users and Groups, Changed properties, Used methods, Exported and Imported/Created the Objects (Users) to and from a CSV file and did set ACL's to AD Objects.
But if you need to connect to a SubOU deep in the AD tree, it is hard to get at it this way, we or need a lot of Get_Children() and Find() Methods, or a long LDAP path.
In next post we will so how to search for Objects in Active Directory using a DirectorySearcher, and how you can connect to the Active Directory Object from the results,that also will solve part of this problem.
But most of the times would also be handy to be be able to just browse through the AD Tree to the Object you need and then use it in PowerShell to perform some actions.
I Made a Script for this in PowerShell : BrowseActiveDirectory.ps1
This Script will connect to the Root of the Domain or to custom root (a Subcontainer supplied as a DirectoryEntry Object, if you did follow the rest of the series, I hope this makes perfect sense ;-) ) and if this succeeds builds a Form that contains a TreeView Object, that you can use to browse to the AD object you need, and then Returns it so you can use it in PowerShell.
This Form, (as you might have seen in my Teaser), Looks like this (click picture to enlarge)
In this case I walked to the OU : MowOU, I also used in former examples, when the Active Directory Browser will Startup you will only see the Root Object with the DN of the AD Object it represents.
for performance reasons, not the Whole AD-tree will be read when starting up, but only when you select a Node in the TreeView, the Children of the AD object it presents get enumerated and there DN's are added to the TreeView, we will use events from the TreeView to do this.
When you use the Select Button or hit Enter, the DirectoryEntry will be retrieved and Passed back to the pipeline so you can Catch it in the PowerShell console and put it into a variable for further use.
I like this GUI form as a quick way to get to the Object I want in AD, it is much quicker then getting there from the commandline, or it also much easier to explore and look at the structure of the ActiveDirectory domain this way.
As already mentioned in PowerShell and Active Directory Part 8 (ACL's) , I like to just use "loose lines of Code" or functions, that you just can just past into the Commandline, so most of my examples are given that way
You can also use the Browse-ActiveDirectory Function that does all the work in the Script, by Loading it into your current session by dotSourcing the ActiveDirectoryBrowser.Ps1 script and providing the -loadOnly Switch
then you can use the Browse-ActiveDirectory function interactively from then on, so you can also use this script in your profile
If you use the -LoadOnly Switch but do not DotSource it the script will warn you like this :
PoSH>.\ActiveDirectoryBrowser.Ps1 -l WARNING: LoadOnly Switch is given but you also need to 'dotsource' the script to load the function in the global scope To Start a script in the global scope (DotSource) put a dot and a space in front of path to the script If the script is in the current directory this would look like this : . .\ActiveDirectoryBrowser.Ps1 then : The Browse-ActiveDirectory Function is loaded and can be used like this : $de = Browse-ActiveDirectory
PoSH>. .\ActiveDirectoryBrowser.Ps1 -l The Browse-ActiveDirectory Function is loaded and can be used like this : $de = Browse-ActiveDirectory
If you use the script this way for loading the function, it also will Define the alias Bad for ease of use
I hope this LoadOnly option example also shows a bit how you can use the different forms of starting things in PowerShell.
The Script looks like this :
# ActiveDirectoryBrowser.Ps1 # # This script does show a GUI to browse ActiveDirectory in a Treeview # and Returns the DirectoryEntry Selected for use in PowerShell # or if LoadOnly Parameter is given it just loads the Browse-ActiveDirectory function, # and does set the alias bad, for loading the function for interactive use by dotsourcing the script # # /\/\o\/\/ 2006 # # http://mow001.blogspot.com
# Return selected DirectoryEntry or $false as Cancel Button is Used Return $script:Return }
# If used as a script start the function
Set-PSDebug -Strict:$false# Otherwise Checking the Switch parmeter does fail (Bug ?)
if ($LoadOnly.IsPresent) {
# Only load the Function for interactive use
if (-not $MyInvocation.line.StartsWith('. ')) { Write-Warning "LoadOnly Switch is given but you also need to 'dotsource' the script to load the function in the global scope" Write-Host "To Start a script in the global scope (dotsource) put a dot and a space in front of path to the script" Write-Host "If the script is in the current directory this would look like this :" Write-Host ". .\ActiveDirectoryBrowser.Ps1" Write-Host "then :" } Write-Host "The Browse-ActiveDirectory Function is loaded and can be used like this :" Write-Host '$de = Browse-ActiveDirectory' Set-alias bad Browse-ActiveDirectory } Else {
# start Function
. Browse-ActiveDirectory $root
}
Most of this Code is straight forward I think with the # comments( if you followed the AD series, and have seen some of my other PowerShell GUI Examples) , just remember that the add_* methods are used to add scripts to events from the objects on the Form.
here some remark by the main points of interest in the script (sorry Numbers Gone) :
Line 24 : &{trap {throw "$($_)"};[void]$Root.get_Name()}
This line does test the ActiveDirectory Connection by getting the name Property and use a Trap block to catch it and throwing the Error again so the script will stop if this fails.
Line 49,64 :$btnCancel.add_Click({$script:Return = $false ; $form.close()})
The add_Click methods handle the event when I button gets clicked you can give this funtion a Delegate ScriptBlock that gets executed every time the button get clicked.
Line 75-95 : $TV.add_AfterSelect({
This whole Scriptblock is also an eventhandler delegate, this one from the Treeview object and it is called every time a TreeNode is selected,
you can see there is a variable with the name $This, this will contain the TreeView object so we can get the treenode that is selected at that moment from that
Line 76 : if ($this.SelectedNode.tag -eq "NotEnumerated")
we check if we already did get the children of this node, otherwise we will collect them and add SubNodes to the TreeView for them.
Line 109 : $form.AcceptButton = $btnSelect
Make The Select Button the Default so it will get a click event when [Enter] is pressed
Line 111 : $Form.Add_Shown({$form.Activate()})
Used to give the form focus
Line 120 : The logic to make the script "Hybrid"
For more info about the AD parts see the rest of the series,
For more info about building GUI's and placing and using Form elements on them in PowerShell See my Other GUI examples in former posts.
I came to another nice challenge, creating a test file for it, that is random and with some missing numbers,
I made a remark about speed, (edit 3) in the second post, as on IRC we where comparing other methods and speed differences between the Methods used, you can find the examples at the end of the second post.
But with so little numbers (10) in the original file, it is hard to test,
So I made up some PowerShell commands to make a bigger testfile for this, for example to test the speed of the filereading and the sort, so if you past this code into the PowerShell console It will create a testfile of 1900 numbers from 1 to 2000 in Random order and with 100 missing numbers :
Below the Code you will find the results when I did paste this code into my Console with some remarks to explain what is going on here :
PoSH># Write the test Numbers to the file PoSH> PoSH>1..2000 | sc c:\powershell\test.txt PoSH> PoSH># Read them back in an Array PoSH> PoSH>[collections.arraylist]$a=[io.file]::ReadAllLines('c:\powershell\test.txt') PoSH> PoSH># put them in random order and remove 100 to create the gaps PoSH> PoSH>$r = ($a.count - 100)..1 |% {$R = new-object random}{$R.next(0,$a.count) |%{$a[$_];$a.removeat($_)}} PoSH>
This last line is the most interesting line where the magic happens, but the start of this "magic" is in the line before already, not the method of reading the file but the : [collections.arraylist]$a that will cast the result into an arraylist, In an arraylist you can add and remove Items, we make use of that in the next line.
$r will take the results, as the $a array will be empty at the end of the command, next part is :
($a.count - 100)..1 this will make a range from 1900 to 1, as the first line created a file with 2000 lines, but we want 100 less, if you just want to randomize the list just remove the -100 and all the numbers will stay and the list will only be randomized.
As this scriptblock is followed by another one the Foreach will treat this as a Begin Block and only execute this once, then will execute the next scriptblock as a process block, $R.next(0,$a.count) |%
This will create a random number from 0 to 1999 , and that is pipelined to the next scriptblock, note that the value on the pipeline is not used here, it just is used to determine the times to loop.
The random number is now passed on to the next scriptblock, $a[$_];$a.removeat($_) it takes the random number from the pipeline ($_), and outputs the item that is at that place in the Arraylist $a{$_}, next it will remove the Item that it did output from the Arraylist $a.removeat($_) that is where the base of the magic is hidden,
what, that's all remove an Item ?, Yep ;-),
As next, the loop will go on to the second pass, and will come here again $R.next(0,$a.count) but as we did remove the item that we did output, this will be a number from 0 to 1998,
So we will never output a double item, as we use the random number just as an Index, the trick with the 100 numbers to leave out is also based on that we just miss the last 100 numbers that remain AFTER we picked the numbers at random and that we did put in the $R array already:
Lets list the first 10 to show that this did work :
Now we can do out first test with the randomized list,
PoSH># Test the Times for sorting PoSH> PoSH>(measure-command {$r | sort {[int]$_}}).TotalMilliseconds 1553.9698 PoSH>(measure-command {[array]::sort($r)}).TotalMilliseconds 5.7518
Hmm, we already see some difference, but for testing our solutions for the question, we also want to test the reading of the file so we write the new list back to the file :
PoSH># Write the Randomized numbers back to the file PoSH> PoSH>$r | sc c:\powershell\test.txt PoSH>
Now that we are here, we have created our testfile, and we can go on test the complete solution against a 1900 records random file with 100 numbers missing (I removed some of the output, but you can see the numbers are random missing :
At the end of the post the 2 examples using Diff (compare-Object), and 1 using for to solve it, you can also compare them for speed
Enjoy your testing and timing ,
If you have other any interesting results (in speed or other ways) or other methods to handle the missing numbers problem, or randomize a list solution, please leave them in the comments,
was maybe a bit to tiny to post without any explanation.
you can do very powerfull things on the commandline like this, but for in a script or example this might not very handy.
I still not going to explain it,
but I will make it a lot more Clear what Happens, by showing that you do not have too be so tiny in PowerShell , you can write this in a more verbose and readable way , as the former one-liner Can also be written as Follows :
# Read numbers from file
$numbers = get-content test.txt
# Sort the Numbers
$Sortednumbers = $Numbers | Sort {[int]$_}
# start comparing numbers in file to counter
$counter = 1
foreach ($number in $Sortednumbers ) {
# as long as Number in file is higher than counter, output as missing and raise counter
while ($counter -lt $Number){ "$Counter is missing" $Counter++ }
# counter is the same as Number, hence is in file output and raise counter
"$Counter is In file" $Counter++
}
This code does exactly the same as the on-liner, is a bit more work, but much more clear for code you or somebody else might have to read or change.
*Edit* some other suggestions given on IRC for handling this question are :
