log rotate and archive with windows

I support a few applications which run on windows and there isn’t really any great way of rotating the logs like there is with linux. While the logs are all configured to go to off host log solutions such as Azure logs or elasticsearch I like to keep the local logs around for a period of time as well. Depending on your rules some fidelity or information may be lost when the logs are ingested into these solutions. I have tried using some of the built-in compression functionality with windows but some of the log files are so large they generate out of memory errors. I have found 7zip to be the best tool for these large files. The compression rate and performance is better.

One such application where I want to compress all logs older than 7 days and then keep for 90 days is bitvise.

You must install 7zip on the computer first, but then you can run the script below on demand or on a schedule. e.g. every night or weekend.

#Get all log files older than 7 days and compress to archive then delete source
cd “C:\Program Files\Bitvise SSH Server\Logs”
foreach ($file in Get-ChildItem -Filter *.log -Path “C:\Program Files\Bitvise SSH Server\Logs” | Where-Object { $_.LastWriteTime -lt (get-date).AddDays(-7)})
{
& “C:\Program Files\7-Zip\7z.exe” -sdel -mx=5 a “$file`.7z” “$file”
}

#Get all old 7zip archives and delete when older than 90 days
Get-ChildItem -Filter *.7z -Path “C:\Program Files\Bitvise SSH Server\Logs” | Where-Object { $_.LastWriteTime -lt (get-date).AddDays(-90)} | Remove-Item -Force -Verbose

WSUSpool keeps stopping and console shows reset node

I recently found myself in a situation where WSUS would only work for a few minutes or even seconds at a time. A restart or IISReset could bring it back for a few minutes but it would soon stop again. The Configuration manager console didn’t show any errors but it also could not see any new updates.

The event log contained this message:

The WSUS administration console was unable to connect to the WSUS Server via the remote API.

Eventually the fix was to increase the amount of memory avaliable to the app pool from the default 1843200 KB – you could set this to 0 so there is no limit or to a higher sensible limit. After doing this and running an IISRESET the app pool remained running and I was able to syncronize new updates as well as service updates to clients.

To do this open up IIS and click the plus by your servername, then on “Application pools”. Next right click on WsusPool and then left click on “Advanced Settings”, then scroll down and locate the “Private Memory limit (KB)” near the bottom and edit this value to 0 or something higher.

ADFS Configuration Wizard Fails with Error “The certificates with the CNG private key are not supported”

When running the ADFS configuration Wizard or renewing a new service communications you will get a “The certificates with the CNG private key are not supported” error unless the certificate was created with a legacy non CNG key. There is a useful blog post here https://blogs.technet.microsoft.com/mspfe/2013/11/29/adfs-configuration-wizard-fails-with-error-the-certificates-with-the-cng-private-key-are-not-supported/ on what to do if you are using a Microsoft certificate authority.

Assuming you are using someone else’s CA the following steps can be used to get a CSR and legacy non CNG private key (Will work post sha1 sunset)

1. Run an MMC and add the local computers certificate store.

2. Expand Personal and Certificates, right click on Certificates > All tasks > Advanced > Create Custom Request.

3. Click on Next then select “Proceed without enrollment policy” and Next again.

4. Change the template to “(no template) Legacy key”

5. Expand the details drop down, click on Properties and make sure to set the correct CN, DNS names, country code etc as required. You must also set the key size to 2048 or higher and you may want to mark the key as exportable if you have other servers that need to share the same private key.

6. Click through and save the CSR and provide this to your CA.

7. When you have the certificate from the CA, import it to the personal store on this computer.

8. Run this command in PowerShell to determine the CertificateHash of the new certificate:

dir cert:\localmachine\my

Review the list of returned certs and note the Thumbprint of the new one.

9. You can now set the service to use this certificate. While the GUI will let you select the service certificate, the http.sys hosted SSL endpoint can only be updated in powershell so you might as well do both like that.

Set-AdfsCertificate -CertificateType Service-Communications -Thumbprint thumbprint

Set-AdfsSslCertificate -Thumbprint thumbprint

If you have any doubt as to what the service is configured to use either before or after the change you can run the equivalent get command. e.g. Get-AdfsCertificate

(If in doubt as to which one is configured, them get-adfssslcertificate can be run as well)

Windows 2012 Dedupe – huge chunk store and 0%

One of the best new features in 2012 was the file de-duplication.  That said it does sometimes behave a bit strangely under some workloads.  I recently faced an issue where a a 40TB volume with de-duplication enabled resulted in a huge chunk store that was using more space than the original data!

chunky

At a glance it looks like the best thing to do is turn off dedupe for this volume, but all this seems to do is disable further dedup work, anything that is already deduped will remain so.  I found the best/fasted way to “re-hydrate” your data and get rid of the chunkstore (You could just format the volume if you don’t need the data) is to leave the dedupe enabled, but set an exclusion on the root.

Then run the commands below in power-shell (Assuming drive letter F:):

Start-DedupJob -Volume “F:” -Type unoptimization -Memory 50

Then run:

Start-DedupJob -Volume “F:” -Type GarbageCollection -Memory 50

You can then monitor the size of the chunkstore and/or run this command to see the progress of any “dedupjobs” with this command:

Get-dedupejob

dedupejob

Do bare in mind the increased IO and server load while this runs, it maybe best to start this out of hours.  Please also note that this command will only actually re-hydrate your files if dedupe is still enabled.

Compacting / shrinking a VHDX

Sometimes you over provision a server and need the space back on your cluster shared volume or use a full fixed size disc and later want a dynamic one and then need to shrink it.   Or it could simply be you are making a template and want to compact the disk as much as possible for faster deployments and less disk space consumed on your VMM server.

Some of the steps here are also useful if you just want to find additional space on a windows server.  Step 1 outlines how to cleanup the component store and remove installation files for unused windows features.  (e.g. why keep the source files for the Remote desktop session host server role on a web server?) You can skip step 4 if you are just looking to shrink the file temporarily,  if the VHDX is for a VMM template or if you are just cleaning up a working server for more free space.

Here is the process:

1.  Clean up the disk first and remove any files or data you don’t need so that you can compact the disk as much as possible.

Here are a few options:

You can remove the source installation files for any roles and features you don’t need to save on disk space.  This can make it difficult or sometimes impossible to enable the features later though so proceed only if you are sure you don’t need other roles to be added later. Make sure to run this in an Admin powershell window.

Get-WindowsFeature | Where-Object {$_.Installed -match “False”} | Uninstall-WindowsFeature –Remove

For 2012 R2 and other later windows versions you can also clean up the component store with DISM. This does mean you won’t be able to remove existing service packs and updates however future updates will be removable.

Dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase

dism online cleanup-image

Clean up any temporary files, old profiles and all the other places you would usually look to free up more space. 2.  Grab a copy of the sysinternal Sdelete tool and use it to zero the deleted files on the disk. This step is not essential but you will get better results if you do it.  I would recommend skipping this step if you are using an SSD on a physical machine.

https://technet.microsoft.com/en-us/sysinternals/bb897443.aspx

This command assumes you are on the machine you want to shrink:

C:\pathtofile\sdelete.exe -s -z c:

sdelete in progress

3.  Defragment the disk. You can run this from within the guest OS but you may get better results shutting down the VM and mounting the VHDX file on another system. This way all the files can be defragmented.

defrag C: -w –v

defrag command screenshot

4.  Consider shrinking the partition. It maybe if you are making a template you want to keep a large partition as you expect and want the VHDX to grow after it is deployed. (If that is the case skip this step) If you are looking for a more permanent shrink then you should now shrink the partition to the desired size. This is best accomplished in the disk management GUI or with PowerShell.

This assumes you only have one local disk and know the size you want to resize to, if this isn’t the case use get-partition to work out the correct numbers for your situation and use Get-PartitionSupportedSize to view the possible sizes you could shrink to.

Resize-Partition -DiskNumber 1 -PartitionNumber 1 –size 30GB 5.  Now use the Hyper-V, VMM or failover cluster manager GUI to compact the VHD.

5.  Compact the VHDX.  The quickest method is to use the Hyper-V, VMM or failover cluster manager GUI to compact the VHD.  e.g. right click on the VM>Select settings>Left click on the disk>click “Edit”>Click “Next”>Select “Compact”>Click “Next”>Review the change summary screen and click on “Finish.”  This might take some time if there is a lot to shrink.  The VM also needs to be powered off for this final step.

Compact VHDX settings screen

Happy shrinking!

PowerShell script to setup SNMP

It is a bit old school and most people will be using something more modern and feature reach like SCOM or PRTG for monitoring but SNMP still enjoys just about the widest support and can be great for agentless monitoring from free/cheap tools such as observium or nagios.

Here is a script I use to automatically install and configure SNMP on windows servers where we want to use SNMP monitoring.

$pollers = @(“Observium”,”10.10.5.4″,”prtg01″) # Edit this to contain your SNMP Pollers (IP or DNS name) so it looks like this @(“monitorserv1″,”10.10.5.2”)
$CommunityStr = @(“Priv176c0m”) # Edit this to contain your community strings so it looks like this @(“Secretcommunity”,”private2″)

Import-Module ServerManager

#test if SNMP-Service Feature is enabled
$test = Get-WindowsFeature -Name SNMP-Service

#Install/Enable SNMP-Service if it is not enabled
If ($test.Installed -ne “True”) {
Write-Host “Enabling SNMP-Service Feature”
Get-WindowsFeature -name SNMP* | Add-WindowsFeature -IncludeManagementTools | Out-Null
}

#re-test if SNMP-Service Feature is enabled and update variable
$test = Get-WindowsFeature -Name SNMP-Service

#Setup reg keys to configure SNMP-Service if Feature is Enabled
If ($test.Installed -eq “True”){
Write-Host “Configuring SNMP-Services with your Community strings and Permitted pollers”
reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters\PermittedManagers” /v 1 /t REG_SZ /d localhost /f | Out-Null

Foreach ($String in $CommunityStr){
reg add (“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters\TrapConfiguration\” + $String) /f | Out-Null
reg delete (“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters\TrapConfiguration\” + $String) /ve /f | Out-Null
reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters\ValidCommunities” /v $String /t REG_DWORD /d 4 /f | Out-Null
$i = 2

Foreach ($Manager in $pollers){
reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters\PermittedManagers” /v $i /t REG_SZ /d $manager /f | Out-Null
reg add (“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNMP\Parameters\TrapConfiguration\” + $String) /v $i /t REG_SZ /d $manager /f | Out-Null
$i++
}
}
}
Else {
Write-Host “Error: SNMP Setup did not complete”
}

Click Enable-SNMP.ps1 to download this as a text file.

List of feature names in DISM

The feature names in DISM are a bit different to those in PowerShell.  You can see what they are from a booted computer with the following command:

dism /online /get-features

However I find it useful to keep a searchable list around as it is faster to use to try and remember/work out what that feature is actually called when you are trying to add it to a wim file or computers and the install-windowsfeature is not working for you.

Here is a list of all features from an up to date 2012 R2 Standard computer:

Feature Name : NetFx4ServerFeatures
Feature Name : NetFx4
Feature Name : NetFx4Extended-ASPNET45
Feature Name : MicrosoftWindowsPowerShellRoot
Feature Name : MicrosoftWindowsPowerShell
Feature Name : ServerCore-FullServer
Feature Name : IIS-WebServerRole
Feature Name : IIS-WebServer
Feature Name : IIS-CommonHttpFeatures
Feature Name : IIS-Security
Feature Name : IIS-RequestFiltering
Feature Name : IIS-StaticContent
Feature Name : IIS-DefaultDocument
Feature Name : IIS-DirectoryBrowsing
Feature Name : IIS-HttpErrors
Feature Name : IIS-HttpRedirect
Feature Name : IIS-WebDAV
Feature Name : IIS-ApplicationDevelopment
Feature Name : IIS-WebSockets
Feature Name : IIS-ApplicationInit
Feature Name : IIS-NetFxExtensibility
Feature Name : IIS-NetFxExtensibility45
Feature Name : IIS-ISAPIExtensions
Feature Name : IIS-ISAPIFilter
Feature Name : IIS-ASPNET
Feature Name : IIS-ASPNET45
Feature Name : IIS-ASP
Feature Name : IIS-CGI
Feature Name : IIS-ServerSideIncludes
Feature Name : IIS-HealthAndDiagnostics
Feature Name : IIS-HttpLogging
Feature Name : IIS-LoggingLibraries
Feature Name : IIS-RequestMonitor
Feature Name : IIS-HttpTracing
Feature Name : IIS-CustomLogging
Feature Name : IIS-ODBCLogging
Feature Name : IIS-CertProvider
Feature Name : IIS-BasicAuthentication
Feature Name : IIS-WindowsAuthentication
Feature Name : IIS-DigestAuthentication
Feature Name : IIS-ClientCertificateMappingAuthentication
Feature Name : IIS-IISCertificateMappingAuthentication
Feature Name : IIS-URLAuthorization
Feature Name : IIS-IPSecurity
Feature Name : IIS-Performance
Feature Name : IIS-HttpCompressionStatic
Feature Name : IIS-HttpCompressionDynamic
Feature Name : IIS-WebServerManagementTools
Feature Name : IIS-ManagementConsole
Feature Name : IIS-LegacySnapIn
Feature Name : IIS-ManagementScriptingTools
Feature Name : IIS-ManagementService
Feature Name : IIS-IIS6ManagementCompatibility
Feature Name : IIS-Metabase
Feature Name : IIS-WMICompatibility
Feature Name : IIS-LegacyScripts
Feature Name : IIS-FTPServer
Feature Name : IIS-FTPSvc
Feature Name : IIS-FTPExtensibility
Feature Name : WAS-WindowsActivationService
Feature Name : WAS-ProcessModel
Feature Name : WAS-NetFxEnvironment
Feature Name : WAS-ConfigurationAPI
Feature Name : IIS-HostableWebCore
Feature Name : BITSExtensions-AdminPack
Feature Name : Gateway-UI
Feature Name : MSMQ
Feature Name : MSMQ-Services
Feature Name : MSMQ-Server
Feature Name : MSMQ-Triggers
Feature Name : MSMQ-ADIntegration
Feature Name : MSMQ-HTTP
Feature Name : MSMQ-Multicast
Feature Name : MSMQ-DCOMProxy
Feature Name : MSMQ-RoutingServer
Feature Name : WCF-Services45
Feature Name : WCF-HTTP-Activation45
Feature Name : WCF-TCP-Activation45
Feature Name : WCF-Pipe-Activation45
Feature Name : WCF-MSMQ-Activation45
Feature Name : WCF-TCP-PortSharing45
Feature Name : ManagementOdata
Feature Name : DSC-Service
Feature Name : IdentityServer-SecurityTokenService
Feature Name : Application-Server
Feature Name : AS-NET-Framework
Feature Name : Application-Server-WebServer-Support
Feature Name : AS-Ent-Services
Feature Name : Application-Server-TCP-Port-Sharing
Feature Name : Application-Server-WAS-Support
Feature Name : Application-Server-HTTP-Activation
Feature Name : Application-Server-MSMQ-Activation
Feature Name : Application-Server-TCP-Activation
Feature Name : Application-Server-Pipe-Activation
Feature Name : AS-Dist-Transaction
Feature Name : AS-Incoming-Trans
Feature Name : AS-Outgoing-Trans
Feature Name : AS-WS-Atomic
Feature Name : ADCertificateServicesRole
Feature Name : CertificateServices
Feature Name : OnlineRevocationServices
Feature Name : WebEnrollmentServices
Feature Name : NetworkDeviceEnrollmentServices
Feature Name : CertificateEnrollmentPolicyServer
Feature Name : CertificateEnrollmentServer
Feature Name : Web-Application-Proxy
Feature Name : IPAMServerFeature
Feature Name : RightsManagementServices-Role
Feature Name : RightsManagementServices
Feature Name : RMS-Federation
Feature Name : RightsManagementServices-AdminTools
Feature Name : WSS-Product-Package
Feature Name : BITSExtensions-Upload
Feature Name : Printing-Server-Foundation-Features
Feature Name : Printing-Server-Role
Feature Name : Printing-LPDPrintService
Feature Name : BusScan-ScanServer
Feature Name : Printing-InternetPrinting-Server
Feature Name : HCAP-Server
Feature Name : HCSRuntime
Feature Name : RemoteAccess
Feature Name : RemoteAccessServer
Feature Name : RasRoutingProtocols
Feature Name : WCF-HTTP-Activation
Feature Name : WCF-NonHTTP-Activation
Feature Name : WindowsPowerShellWebAccess
Feature Name : RPC-HTTP_Proxy
Feature Name : Smtpsvc-Admin-Update-Name
Feature Name : Smtpsvc-Service-Update-Name
Feature Name : Gateway
Feature Name : WebAccess
Feature Name : Microsoft-Windows-Web-Services-for-Management-IIS-Extension
Feature Name : WorkFolders-Server
Feature Name : UpdateServices
Feature Name : UpdateServices-Services
Feature Name : UpdateServices-Database
Feature Name : UpdateServices-WidDatabase
Feature Name : Microsoft-Windows-Deployment-Services
Feature Name : Microsoft-Windows-Deployment-Services-Deployment-Server
Feature Name : Microsoft-Windows-Deployment-Services-Transport-Server
Feature Name : Microsoft-Windows-Deployment-Services-Legacy-SIS
Feature Name : BitLocker
Feature Name : Bitlocker-Utilities
Feature Name : BitLocker-NetworkUnlock
Feature Name : User-Interfaces-Infra
Feature Name : Server-Gui-Mgmt
Feature Name : RSAT
Feature Name : CoreFileServer-RSAT
Feature Name : Server-Manager-RSAT-File-Services
Feature Name : Server-RSAT-SNMP
Feature Name : DNS-Server-Tools
Feature Name : IPAMClientFeature
Feature Name : WINS-Server-Tools
Feature Name : DfsMgmt
Feature Name : ADCertificateServicesManagementTools
Feature Name : CertificateServicesManagementTools
Feature Name : OnlineRevocationServicesManagementTools
Feature Name : RSAT-AD-Tools-Feature
Feature Name : RSAT-ADDS-Tools-Feature
Feature Name : DirectoryServices-DomainController-Tools
Feature Name : DirectoryServices-ADAM-Tools
Feature Name : BitLocker-RemoteAdminTool
Feature Name : BdeAducExtTool
Feature Name : ActiveDirectory-PowerShell
Feature Name : DirectoryServices-DomainController
Feature Name : DirectoryServices-ISM-Smtp
Feature Name : DirectoryServices-AdministrativeCenter
Feature Name : RasServerAdminTools
Feature Name : DamgmtTools
Feature Name : HCSUI
Feature Name : Licensing-UI
Feature Name : Licensing-Diagnosis-UI
Feature Name : Microsoft-Windows-Deployment-Services-Admin-Pack
Feature Name : DHCPServer-Tools
Feature Name : FailoverCluster-Mgmt
Feature Name : NetworkLoadBalancingManagementClient
Feature Name : NFS-Administration
Feature Name : UpdateServices-UI
Feature Name : WindowsServerBackupSnapin
Feature Name : FaxServiceConfigRole
Feature Name : NPSManagementTools
Feature Name : RightsManagementServicesManagementTools
Feature Name : Security-SPP-Vmw
Feature Name : FSRM-Infrastructure
Feature Name : FSRM-Management
Feature Name : Microsoft-Windows-FCI-Client-Package
Feature Name : Printing-Client
Feature Name : Printing-Client-Gui
Feature Name : RSAT-NIS
Feature Name : MicrosoftWindowsPowerShellISE
Feature Name : Microsoft-Hyper-V
Feature Name : Microsoft-Hyper-V-Offline
Feature Name : Microsoft-Hyper-V-Online
Feature Name : RSAT-Hyper-V-Tools-Feature
Feature Name : Microsoft-Hyper-V-Management-Clients
Feature Name : Microsoft-Hyper-V-Management-PowerShell
Feature Name : VmHostAgent
Feature Name : Server-Gui-Shell
Feature Name : Internet-Explorer-Optional-amd64
Feature Name : FaxServiceRole
Feature Name : ServicesForNFS-ServerAndClient
Feature Name : ServerForNFS-Infrastructure
Feature Name : ClientForNFS-Infrastructure
Feature Name : SearchEngine-Server-Package
Feature Name : FSRM-Infrastructure-Services
Feature Name : NPAS-Role
Feature Name : IAS NT Service
Feature Name : iSCSITargetServer-PowerShell
Feature Name : OEM-Appliance-OOBE
Feature Name : PSync
Feature Name : AppServer
Feature Name : Microsoft-Windows-ServerEssentials-ServerSetup
Feature Name : PKIClient-PSH-Cmdlets
Feature Name : KeyDistributionService-PSH-Cmdlets
Feature Name : TlsSessionTicketKey-PSH-Cmdlets
Feature Name : RemoteAccessMgmtTools
Feature Name : RemoteAccessPowerShell
Feature Name : MicrosoftWindowsPowerShellV2
Feature Name : Server-Psh-Cmdlets
Feature Name : UpdateServices-RSAT
Feature Name : UpdateServices-API
Feature Name : DirectoryServices-ADAM
Feature Name : AuthManager
Feature Name : ServerCore-WOW64
Feature Name : ServerCore-EA-IME-WOW64
Feature Name : LegacyComponents
Feature Name : DirectPlay
Feature Name : Windows-Identity-Foundation
Feature Name : SimpleTCP
Feature Name : Printing-LPRPortMonitor
Feature Name : Printing-InternetPrinting-Client
Feature Name : Printing-AdminTools-Collection
Feature Name : ServerManager-Core-RSAT
Feature Name : ServerManager-Core-RSAT-Role-Tools
Feature Name : ServerManager-Core-RSAT-Feature-Tools
Feature Name : NetFx3ServerFeatures
Feature Name : NetFx3
Feature Name : EnhancedStorage
Feature Name : Microsoft-Windows-GroupPolicy-ServerAdminTools-Update
Feature Name : RasCMAK
Feature Name : RSAT-RDS-Tools-Feature
Feature Name : FailoverCluster-AdminPak
Feature Name : FailoverCluster-PowerShell
Feature Name : AdminUI
Feature Name : BiometricFramework
Feature Name : WindowsServerBackup
Feature Name : WindowsFeedbackForwarder
Feature Name : FileAndStorage-Services
Feature Name : Storage-Services
Feature Name : File-Services
Feature Name : CoreFileServer
Feature Name : File-Services-Search-Service
Feature Name : DFSN-Server
Feature Name : DFSR-Infrastructure-ServerEdition
Feature Name : FileServerVSSAgent
Feature Name : iSCSITargetServer
Feature Name : SMBHashGeneration
Feature Name : Dedup-Core
Feature Name : DHCPServer
Feature Name : DNS-Server-Full-Role
Feature Name : FailoverCluster-AutomationServer
Feature Name : FailoverCluster-CmdInterface
Feature Name : FRS-Infrastructure
Feature Name : Windows-Internal-Database
Feature Name : WINSRuntime
Feature Name : iSCSITargetStorageProviders
Feature Name : iSNS_Service
Feature Name : BITS
Feature Name : LightweightServer
Feature Name : MultipathIo
Feature Name : NetworkLoadBalancingFullServer
Feature Name : NIS
Feature Name : PeerDist
Feature Name : P2P-PnrpOnly
Feature Name : Printing-XPSServices-Features
Feature Name : QWAVE
Feature Name : MSRDC-Infrastructure
Feature Name : RemoteAssistance
Feature Name : ServerCore-EA-IME
Feature Name : DataCenterBridging
Feature Name : ServerMediaFoundation
Feature Name : InkAndHandwritingServices
Feature Name : DesktopExperience
Feature Name : MediaPlayback
Feature Name : WindowsMediaPlayer
Feature Name : ServerMigration
Feature Name : ServerCore-Drivers-General
Feature Name : Server-Drivers-General
Feature Name : Server-Drivers-Printers
Feature Name : SIS-Limited
Feature Name : SmbDirect
Feature Name : SNMP
Feature Name : WMISnmpProvider
Feature Name : WindowsStorageManagementService
Feature Name : TelnetClient
Feature Name : TelnetServer
Feature Name : Remote-Desktop-Services
Feature Name : SessionDirectory
Feature Name : SBMgr-UI
Feature Name : Licensing
Feature Name : TFTP
Feature Name : VolumeActivation-Full-Role
Feature Name : TIFFIFilter
Feature Name : WirelessNetworking
Feature Name : Xps-Foundation-Xps-Viewer
Feature Name : SMB1Protocol
Feature Name : SMBBW
Feature Name : FailoverCluster-FullServer
Feature Name : CCFFilter
Feature Name : ResumeKeyFilter
Feature Name : SmbWitness

List windows updates or Hotfixes installed after a certain date

Ever found something broken and wondered what updates have been installed since a certain point in the past?

PS C:\Users\robin> Get-HotFix | ? installedon -gt 06/09/2015

Source        Description      HotFixID      InstalledBy          InstalledOn
——        ———–      ——–      ———–          ———–
Mxxxxx    Update           KB2693643     NT AUTHORITY\SYSTEM  09/07/2015…

Delegate rights to unlock accounts in AD

To delegate the right right to unlock user accounts in ADUC:

Right-click the OU or domain in Active Directory Users and Computers and select Delegate Control from the context menu
Click Next on the Welcome dialog
Click Add to select the user or group and click OK
Click Next
Select Create a custom task to delegate and click Next
Select Only the following objects in the folder. In the list, check User objects and click Next
Clear the General checkbox and check the Property-specific box
Check both the Read lockoutTime and Write lockoutTime boxes and press Next
Click Finish

WinRM Connection limits

Sometimes in various Microsoft products (Exchange/VMM mostly) you might reach some of the WinRM connection limits.  Personally I see it most in Virtual Machine Manager when you have many admins who are making lots of changes and deploying large numbers of services.

The symptom is sometimes an error like this:  Error Connecting to remote server failed with the following error message: The WS-Management service cannot process the request. This user is allowed a maximum number of 5 concurrent shells, which has been exceeded. Close existing shells or raise the quota for this user.

It can also just show as a generic Failed/timeout job which then works when you re-try later.

1. On the offending server open a command prompt or Powershell window with administrative privileges.
2. Type in winrm get winrm/config/winrs to view the current configuration.

winrmmax

These values will need to be increased, don’t just add a load of zeros to the end as having limits configured can stop unwanted or malicious connections from brining a server to its knees.

To adjust the values use the commands below where 20 and 100 are appropriate numbers for your environment.

3. winrm set winrm/config/winrs @{MaxConcurrentUsers=”20″}
4. winrm set winrm/config/winrs @{MaxShellsPerUser=”100}