What Happened To My Custom Delegation?

The concept of delegation on AD objects is known to all AD administrators. The need to create custom delegation on objects is common and even though AD delegation can be quite complex, the amount of experience and knowledge that has been shared, has simplified the process.

Here is the known problem... Imagine you delegate permissions to an OU but for some reason certain objects do not take the new ACL (Access Control List). You perform the delegation again, and confirm that the ACL is on the object correctly. You go about your business and after a while realize that the custom delegation is not working. You go back to check the object and your custom delegation is gone. What happened to my custom delegation?

Active Directory and Protected Groups

Ever since Windows 2000 Active Directory has had a mechanism to ensure members of protected groups have standardized and controlled security descriptors. The process is complex and there are many moving parts that are worth exploring and defining. In the end excluding certain protected groups from this process may be quite helpful.

There is much information on TechNet and MSDN that explores these concepts and a simple Binggle search will uncover additional information.

Let’s explore some of the parts and provide some context.

AdminSDHolder

AdminSDHolder is a container in AD that holds the Security Descriptor applied to members of protected groups. The ACL can be viewed on the AdminSDHolder object itself. Open Active Directory Users and Computers and ensure Advanced Features is selected in the View menu. Navigate to the ‘system’ container under the domain and right click on the sub-container called AdminSDHolder and select properties. The Security tab displays the ACL that will be applied to all members of protected groups.

SD Propagator

The SD Propagator is a process that runs on a schedule on the PDC emulator to find members of protected groups and ensure the appropriate Access Control List (ACL) is present. The SD Propagator runs every hour by default but can run at a different frequency by adding the value AdminSDProtectFrequency to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters. This can be configured anywhere between one minute and two hours. If the value is not present in this registry sub key the default of 60 minutes is applied.

dsHeuristics

The dsHuerisitcs attribute is a Unicode String value on the Directory Service object in the configuration container. It defines multiple forest wide configuration settings on of which being built-in groups to be excluded from the list of Protected Groups. You can view the value of the dsHuristics attribute in the LDP or ADSIEdit tools. Below is the attribute viewed from  ADSIEdit.

If a built-in group, from the table below, needs to be excluded from the protection of the SD Propagator, this value will need to be updated. It must be done carefully as it is a forest wide setting and the value has implications across other pieces of configuration. You can Binggle this to find explicit instructions on how to update this attribute. Below are the groups that can be excluded from the process and the values that they carry. If multiple groups are to be excluded their values are added together.

Bit	Group to Exclude	Binary Value	Hex Value
0	Account Operators	0001	1
1	Server Operators	0010	2
2	Print Operators	0100	4
3	Backup Operators	1000	8

 

adminCount

The adminCount attribute is found on user objects in Active Directory. This is a very simple attribute. If the value is <not set> or 0 then the user is not protected by the SD Propagation. If the value of adminCount is set to 1 that means the user has, or has been a member of a protected group. The value can be seen in ADUC or ADSIEdit or LDP. Below is the attribute viewed via ADUC.

Additional Reading

Make sure to search MSDN, Technet and other web resources to find instructions and guidance on how to manipulate these attributes.. Here are a few articles to get you started:

http://technet.microsoft.com/en-us/magazine/2009.09.sdadminholder.aspx

http://msdn.microsoft.com/en-us/library/windows/desktop/ms675656(v=vs.85).aspx

http://support.nordicedge.com/nsd1313-exclude-protected-groups-from-adminsdholder-in-active-directory/

Moving Azure VM from one Subnet to another

Problem

As I built up my Azure lab I was learning. After a while I have learned quite a bit about how to manage resources on Azure, especially from an IaaS perspective. I love having my lab up on Azure. I get hours through my MSDN subscription and try to keep within those house so size of VMs and what is running at any given time is important to me.

One are that I don't have setup quite as optimally as I would like is my network. I have one Virtual Network and when I created my first subnet I did not allocate enough bits so there are few hosts that can take a spot. So I just created a second subnet (I actually created three). So, not great, but during the process I learned a lot about the Azure Virtual Network stack and it was well worth it.

So, today, I had a need to test something on an un-patched Windows Server 2008 R2 box. I don't tend to keep that server running. I have it in my Azure space but it is marked as 'StoppedDeallocated'. This means it is not taking up any 'billable' resources in Azure. It is there so when you need it you can grab it, but you are not charged for it on an ongoing basis. This is great for labs.

So, I went to launch the VM and it threw up all over the place... can't do it... error... blech.

Get-AzureVM scisrv2 |Start-AzureVM

Seems simple but no. I found a really nifty and quick way to address this. If you Bing around you will find lots of super convoluted ways to create new VMs attach to old disks etc. but this is likely newer... meaning a technique that wasn't available a couple of years ago. I believe this came from a MSDN doc but can't find the reference right now.

Get-AzureVM -Name <VMName> -ServiceName <ServiceName> | Set-AzureSubnet -SubnetNames subnet-2 | Update-AzureVM

Super simple and get's it back up and running. If you have many Azure VMs laying around de-allocated from a subnet, you may find this useful to get them reallocated then launched.

Select-Object and other ways to skin a...

One Problem, Many Solutions

In PowerShell and pretty much any aspect of configuration management, there can be many ways to solve a problem. This really will come down to style at the end of the day. There is a camp where being super explicit in your script/language/examples etc. is desirable. There is another camp that takes the twitter approach and it is a bit of a challenge to see how much functionality can be crammed into the least number of characters as possible. And of course, there are the majority of folks who land smack in the middle.

Which one are you? For many people out there PowerShell is still relatively new and in my opinion being as explicit as possible is a huge benefit to the learning process. Typing everything out can be a pain but with the ISE especially there is amazing auto-complete and IntelliSense which makes this process very easy. Also, in the long run what you write today may not be looked at for a while or some colleague in the future may need to look at what you wrote. Being explicit in your scripts will benefit both of these scenarios. 

On the other hand learning the short-cuts can be super valuable and will help you become a true master of the language. If you use a lot of short cuts make sure to comment your scripts to show what it is you are doing. I know how much IT folks, especially scripters love to comment!

So, these three lines deliver the same information...

1. PS C:\ > Get-ADUser -Identity Kevin | Select-Object -ExpandProperty PropertyNames
2. PS C:\ > Get-ADUser Kevin | % PropertyNames 
3. PS C:\ > (Get-ADUser Kevin).PropertyNames

And there are more ways to get the same results... Check out this quick walk through...

Kevin

Hyper-V lab corrupt after Windows 10 upgrade?

OK, So I have no idea, yet, if this has anything to do with my upgrade to Windows 10 but the timing is suspicious.

I have a simple lab setup in Hyper-V running on my Windows 8.1 Lenovo w550s. Well it was running 8.1 until yesterday.

My lab consists of three VMs, one DC, one member Server and one client. I have three Virtual switches created, one internal and two external. The external switches are simply there so that I can quickly shift from traffic going through my wired network to traffic going through my wifi. There are surely lots of ways to do this but at the end of the day this is the most logical to me.

 


So, the member server is dual-homed and has one NIC on the Internal Network and one NIC on the external. The DC and the Client only have a single NIC each on the Internal Network. The member server runs RRAS and handles all traffic going in and out of the environment. It acts as a router for the Internal network.

"OK, blah, blah, blah. What is the point Kevin?"

I'm getting there... seriously. So, I was happily running this lab with all the great SDM solutions installed. Life was grand! Then I upgraded to Windows 10.

Now I'm a huge fan of Windows 10. I've been using it for months and I was seriously clicking the little logo in the tray of my new work laptop since July 29th to get the upgrade... it wasn't coming. Finally yesterday it is there! Yeah. Now, I'm not quite as excited as I am for the new Star Wars movie but my geek flag was flying.

The upgrade was smooth, really smooth, and quick. It was really nice. One minor issue, my dual monitor stopped working. I have a DisplayLink Thinkpad mini-doc thingy, it needed a new driver. That was it. I had heard some horror stories but my experience was great.

Then I launched my VMs and some super simple config was changed. I can't say it was the upgrade but I can't think of what could have done it. It didn't take long to diagnose but it could have. It wasn't super logical what happened, but it has to do with the above configuration. I just had to go into Hyper-V, check the Switch. My External Switch was changed to Internal. It just needed to be changed back.

I was showing how to do this in PowerShell and realized another issue. It appears the hyper-v help content, even after running update-help, isn't updating. Once I figure that out, I'll get a video posted of how to address this issue with hyper-v. But to get you started...

PS C:> Get-VMSwitch
PS C:> Set-VMSwitch

A bit more than that but you get the picture. 

Best,
Kevin

Windows 10 Administrative Templates

Have you been upgraded to Windows 10 yet? Are you a fan? I am. I've been working with and running Windows 10 on most of my home clients for months now. My work computer just upgraded today with little fan fare. One minor issue where Lenovo had a new Win10 Driver for a mini-port/DisplayLink device. Once I updated that driver all seems lovely!

As you may have seen from Group Policy MVPs and other enthusiasts and writers out there, the Windows 10 Settings spread sheet has arrived. I can't tell you how many times I have anxiously awaited the new spreadsheet. I've read through and studied far too many of these that I like to admit. 

If you haven't used the spreadsheet before don't be over whelmed. It is actually quite whelming, it is not over-whelming, nor is it under-whelming... it is just whelming. I literally yawned as I typed that sentence.

It is however cool and interesting. Knowledge of what settings you can manage for these new clients is super important and this spreadsheet is key to that knowledge.

Some Highlights

If you take a look at and filter on the column called 'New in Windows 10' you will find that there are 201 Administrative Template settings that are labeled as New in Windows 10. 

That is 139 Machine settings and 62 user settings. They are in a lot of ADMX files... 46 files to be close. There is one new setting in the grouppolicy.admx file. One setting to prevent programs from loading untrusted fonts. This setting actually has an interesting 'Audit' mode which allows you to see if blocking untrusted fonts makes bad things happen. Seems interesting, we'll see if it is useful. There are a few AppX related settings, there are many additions to inetres.admx and there are 20 settings in microsoftedge.admx.

Managing Edge will be new and it will interesting to see how people are using the new browser. I'll have to add some Edge customization's to my <gratuitous plug>"Managing Group Policy and Active Directory with PowerShell" session at Spiceworld on September 25th! </gratuitous plug>.

There is a new setting related to Credential Providers. I'm sure my friends at Specops Software will be interested in that one! 

Summary

Just a brief overview, check out the spreadsheet and the actual ADMX files at these links..

• ADMX Files
• Settings Spreadsheet

I'll continue to dive in to see what other interesting stuff is in there. I'll take a look at the security tab and put up an overview soon.

Enjoy!

Kevin

Group Policy Comments

Group Policy comments have great potential. I don't seem them used too frequently. This is unfortunate as they can be a simple way to document your GPOs so that you can quickly determine what the intent of a given bag of configuration settings may be.

The life-cycle of a Group Policy Object is not something that has received a lot of attention over the years. Microsoft's Advanced Group Policy Management is great, but not widely used and doesn't cover some key life-cycle needs. There are some tools out there to help in that area and at SDM Software you can find a couple of very nice solutions to common configuration issues. Take a look at Group Policy Compliance Manager and Group Policy Auditing and Attestation when you get a chance.

But, out of the box, comments are great and it may be helpful to take a few minutes to check them out. I recorded a bit of a stream of conscious discussion, with myself, on Group Policy comments. Take a look. If you have ideas of other topics around configuration, Group Policy, PowerShell and more, let me know. I'm happy to drill into different areas that may be helpful to folks.

Enjoy! 

Kevin

Clean up my Azure space

Starting a new job can be filled with rebuilding labs, cleaning up old configurations, essentially building up tech so that you can start from scratch.

There are so many benefits to being a Microsoft Alumni that I was simply not paying attention to. One of those it 50% off MSDN subscription (new subscription). That is amazing. I began my MSDN Pro subscription last week. With that level there are $150 a month worth of Azure services! This is great for testing.

I had used Azure quite a bit for different things while at Specops and my liveID was associated with the company. I had done a lot of configuration up there before and I wanted to clean up... get rid of VMs, Networks, essentially wipe and re-load... but no... not really.

The Directory Services I created for labs while at Specops (SullyCo and Speocps Product Services) are apparently there to stay. They most likely won't interfere with anything (but they could) but it is annoying to see artifacts in there that you won't ever use...

It also took me a while to actually figure out this was not possible, after trying many things... finally found the threads and discussions online about this.

Simply for regulatory reasons there should be a way to remove the Directory Services when they are deprecated. If anyone is aware of a way to do this, please let me know.

Kevin

Copy-VMFile and more

I'm setting up some labs and wanted to capture a few things. Here is a walk through of how to copy files from you Hyper-V host to Guest VMs. I touch on a few items that are a bit tricky and try to highlight some good techniques in using the amazing PowerShell.

Enjoy the video and let me know if more topics like this would be interesting or helpful.

Kevin

Old Friends, New Beginnings

I am so excited to have the opportunity to join my old friend, cohort in all things Group Policy and general good guy, Darren Mar-Elia. Darren has asked me to join his team to continue to deliver great solutions to the world. We are both passionate about the past, present and future of configuration management and configuration technologies in general.

It is an exciting time. Check us out at http://www.sdmsoftware.com and follow Darren (@grouppolicyguy) and me (@kevsully67) on twitter.

I'll begin to use this space as a general purpose, scratch-pad of sorts. I will also start blogging on the GPOGuy blog and be delivering some webinar content in the areas of configuration, powershell, Group Policy, DSC and more and more.

Find SDM Software on youtube, Facebook and wherever you wander. We'll try to be there.

Kevin

Setting up a lab

There are so many good reasons to have a lab available. There are very few reasons to not. IT organizations are constantly testing new releases, new configuration, and some widget that needs to be rolled out. We need to evaluate software and solutions that we want to implement in our production environments. With Windows 8+ and the latest versions of Hyper-V there are really no good reasons to not have a lab to use.

With that said, managing the lab in Hyper-V is very easy and to be honest, it is quite fun. If you are a VMWare shop, that is great. Either way there are some simple techniques and best practices that can be super helpful.

This video walks through some thoughts and ideas on how to manage your lab, how to setup the core environment and prepare for testing. We’ll try to follow up with additional content related to evaluating Specops solutions, but first things first…

Enjoy!

Why are my cmdlets not working? Duh!

PS C:> Get-VM

PS C:> 

What? I have multiple VMs running on my system. I use this cmdlet often. What? Why did it suddenly stop working?

So, what to do? Of course my first move is to look at the help system.

PS C:> Get-Help Get-VM -ShowWindow

I really like the 'ShowWindow' parameter. It dumps the complete help file into a separate window where you can filter, zoom, search and more. 

Unfortunately I didn't find anything. I don't get an error in the console. I started using bing. Or Google, whatever you choose. I use bing. Of course there are lots of forum threads and random links. Nothing to do but start reading. 

The 'ah-ha' moment suddenly becomes the 'duh' moment. I saw a thread on the Get-VM cmdlet not working. And a few people were adding very complicated troubleshooting including SC-VMM stuff etc. At the end of the long thread... someone posted "run the console as admin"... DUH! 

I always run my console as admin, but for some reason this time I forgot. And didn't check.

If you have a problem in PS, and it is bizarre/strange... make sure to check how it is running. It is simple, the title bar of the console will tell you if you are running as admin. Make sure to check.

If you are new to PowerShell, simply right-click on the PowerShell Icon in the task bar and choose your option. Simple...

Windows Management Framework 5.0 - September Preview

Like a kid in a candy shop - well a sort of geeky kid

The Windows Management Framework 5.0 came out yesterday twitter-verse was abuzz. Blogging, tweeting, re-tweeting, re-re-tweeting. Lots of interest it appears. It is fun to look at what is new, what improvements have been implemented and begin to see hints of more to come.

Some of the features are fully accessible now, some will take some additional thought. And for each of us those may be different things.

You can find the team announcement on their blog - PowerShell Team Blog.

I'm having a scattered multitasking Friday so I don't know how much time I can spend on this today but I'm excited to dig in. Thanks PowerShell team for delivering a good evaluation guide with these previews, really helpful!

Today I'm;

1. Setting up Azure Virtual Machine to begin testing some upcoming products!
2. Digging into some PowerShell/Azure synergy I haven't played with yet
3. Reviewing the WMF 5.0 September Release
4. Working on multiple sessions/webinars/conference proposals
1. DSC and Group Policy - compliance for the desktop
2. Longer is Stronger - why passphrases are powerful
3. PowerShell basics - training sessions for our customers

Some of my favorites from the team announcement are;

• Manage Zip files! - the little things are sometimes great!
• Compress-Archive
• Expand-Archive
• Lots of DSC stuff
• Register a PSRepository with PowerShell Get sounds interesting - hosted modules - work from anywhere? we will soon see
• Switch management - more evolution
• ISE updates to make working with DSC easier

Great job PowerShell team. 

Group Policy 002: The Cmdlets - New-GPO

Simple!

It really is. I want to create a new GPO from PowerShell. Of course there will be work to do later but just get the GPO created. 

I created a brief video walking through the process.

Enjoy!

C'Mon Man! - wasted time - PowerShell Help

PowerShell Help

I love the PowerShell Help System! I honestly do. I have surely drank the kool-aid and stopped trying to memorize everything in there. When I have a need I turn to...

1. Get-Command
2. Get-Module

When I have found a command that I believe will work I use

• Get-Help
• Get-Help -Full
• Get-Help -ShowWindow
• Get-Help -Examples

And...

• Get-Help -Online

If for some reason I'm still having issues I will go to the Internet and find resources to help. People who have had my problem before, and figure out what they have done.

The Problem

Why is it that people think it is helpful to copy the content of Get-Help -Full and post that as a blog post on their personal blog. No additional value, not scenarios where they used the cmdlet, nothing but the same exact content I can get from Get-Help -Full or Get-Help -Online. 

This is not helpful! It is distracting and hurts troubleshooting efforts.

OK, let me give folks the benefit of the doubt, let's assume they are trying to be helpful. Point to source of the info and post how you used the cmdlet. Learn the help system and know that all of that information is online. The system is absolutely awesome and we as a community need to support it and help it continue to grow. Let people know how great it is and how it helped you. Don't simply copy it and re-post. It is not adding any additional value.

PowerShell 009 - Get-Help -ShowWindow

Help... huh... what is it good for?

The help system in PowerShell is one of the features that makes the new shell so accessible. Once you get used to the system you ask PowerShell questions and it gives you answers. You ask it to clarify, and it does. You ask for more details, it gives you more details. You ask for examples, it gives you examples. It is really, really great.

I was working through some best practices by some of the PowerShell MVPs and I was finding some sample scripts and advanced functions on TechNet and realized that often times writing good help is skipped.

I'm optimistic that the amount of help content I consume will burn into my brain the value of taking the time to write good help content.

-ShowWindow

You can write the help content to the screen and read it from the console. You could even send it right out to a printer, but don't! ("I speak for the trees, for the trees have no tongues" - The Lorax) Sending the help content to the console window is great. When working quickly I often will simply look at examples to get me started;

PS> Get-Help Get-CimInstance -Examples

If I want to see all of the content in the console window;

PS> Get-Help Get-CimInstance -Full

Great. Quick, moves the ball forward nicely. But when learning the subtleties of cmdlets there is often an extensive amount of content to go through. PowerShell's ISE provides a way to throw the content into a single window. It also provides some very interesting features to assist. To get the full content in a separate window type;

PS> Get-Help Get-CimInstance -ShowWindow

Your help content is now in a separate windows. Makes research and troubleshooting much easier in my opinion.

My poor eyes! The text is small, my reading glasses are in the other room, my backup reading glasses are in the couch cushions and my backup, backup reading glasses are who knows! But look... in the bottom right hand of the screen there is a slider bar that allows you to magnify the text... nice! Thanks Microsoft! (you can also <CTRL> & + to increase the font size)

Narrow It Down

OK, now there is a lot of content. How do I find what I am looking for. Get-CimInstance (the cmdlet I chose for the example) seems pretty confusing. The first thing I see is syntax. Lots of syntax. There are almost 10 parameter sets to deal with. Seems to be lots of parameters. I'm betting there are lots of examples.

Right at the top left side of the screen you will see a 'Find:' feature. Simply type in the word or phrase you are looking for and let PowerShell (well the ISE) help you.

In the upper right you will find a button called 'Settings'. Click this button and select only the 'type' of content you want displayed in the window.

It is all pretty self-explanatory. Make sure you spend time here. I have surely heard this message from the PowerShell gurus out there and taken it to heart. Another lesson I'm learning the more I develop scripts and tools with PowerShell is the importance of formatting... but that is a discussion for a different day.

PowerShell 008 - $Profile

$Profile - what is it good for?

There are many things you can use the profile for in PowerShell. The variable $profile stores the path to the profile loaded when you launch the console or the ISE.

 

 

If you notice the path above you will see the script is called 'Microsoft.PowerShellISE_Profile.ps1'. It is a profile script that will load when you launch the ISE. I almost exclusively use the ISE these days, I have found very few reasons to use the console. That is a different discussion.

 

What is put in the profile script?

Well, that is really the question I've been asking myself. I find that just about every time I launch the ISE I think of something that I need to have available to me. For example I use the Specops PowerShell cmdlets every day. The cmdlets and functions that come through our Deploy products are PowerShell modules. Our Specops Password products expose their commands through PSSnapIns. PSSnapIns and some modules need to be loaded explicitly.

• Add-PSSnapIn -Module specopssoft.specopspasswordpolicy
• Import-Module -Module specopsdeploy

Another thing I do on a regular basis is update the help content. Now this is a bit much for a profile in my experience but it can catch updated content when available. If there are specific modules that you utilize all the time you can update those individually. This command updates the help content.

• Update-Help
• Update-Help -Module Hyper-V

Many of my friends and colleagues use PowerShell and some are true power users. Their profile scripts include quite a bit of automation. These are just simple examples share yours.

 

Starting the console with the focus on a directory that is used for most tasks is also very helpful.

• Set-Location c:\psstuff

How to Update the profile script

The path to the profile script is stored in the $Profile variable. Above you can see the data stored in this variable for the ISE. When you want to edit your profile script simply type

 

 

 

 

This will launch notepad with the profile script.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

And that is that

Save the script, close the ISE and re-launch it. the configuration your have in the script will run. If you haven't updated help content in a while this one can take a while. So use that with the understanding of what it is doing.

PowerShell 007 - Building the pipe

A Step Back

OK, so I’m a big fan of get-help. I use it just about every time I sit at the PowerShell_ISE. It is partly because I’m old and can’t remember everything, partly because there is simply too much to know, and, as Jeffrey Snover says “I am a flawed human being”. You should check out the Virtual Academy PowerShell Jumpstart session with Jeffrey Snover and Jason Helmick. These two are great Edutainers. So, even if I forget to mention the help system use it and the community to learn.

As you may know, or possibly not yet, PowerShell is a system that returns objects back on request. Even though you may only see a small bit of data returned to the screen the object returned may include much more data. For a quick example, if I want to look at the most recent log entry in my application log I can type;

PS\> Get-EventLog –LogName Application –Newest 1

This returns something like this.

Index, Time, EntryType, Source, InstanceID and Message. It provides some very important data and often this is all I may need to look at. But if I want to see the whole object I can try;

PS\> Get-EventLog –LogName Application –Newest 1 |format-list *

The above means get the same data but display the object in a list, as opposed to a table, and show me the entire (*) object. It looks like this.

Lots more data. For different cmdlets there is going to be different data returned to the screen, which is a sub-set of the entire object.

I actually did something else here. I ‘piped’ the object returned from one cmdlet to another.

Pipeline

Above the simple example takes the single object output from my Get-EventLog cmdlet into the Format-List cmdlet. Great for organizing your output. What happens if you have a cmdlet that returns a lot of data?

PS\> Get-EventLog –LogName Application |Measure

This counts how many objects to output. Right now I would return a measly 2685 events as individual objects. Small application log but way too much to handle. I want to pipe the output to another cmdlet, Select-Object, to trim down the output a bit.

When I pipe the output to Select-Object I can narrow down based on the properties of the object.

PS\> Get-EventLog –LogName Application | Select-Object –Property EventID, MachineName, –First 20

The above uses Select-Object to only show two properties, EventID and MachineName for the first 20 entries in the log.

You can narrow by any data that you are looking for. What if you want to see Source, or EntryType. Just use those properties in your list and you are good.

I find the pipeline to create an incredibly intuitive, readable system that at first glance can look very complex. It reads like a bit of a work flow.

1. Get all events in the application log
2. Select from that list the first 20 events
3. only prepare the EventID, MachineName, Source and EntryType.
4. Export the data to a webpage

PS\> Get-EventLog –LogName Application | Select-Object –Property EventID, MachineName, source, EntryType  –First 20 |Convertto-HTML |Out-File .\eventlog.html

Other than some typos…

SMH - Windows 8, Windows 8.1, Windows 8.1 Update 1

Not what you are expecting?

My rant du jour is not against Windows and its direction since Windows 7, it is a rant for it. More specifically it is a rant against those so called pundits that have built careers spouting opinion filled nonsense because it collects readers. 

I have been reading about Update 1 for a while as most of us have. I had taken a look at the update on one of my tablets, I waited for my main computer and my laptop until today. I was expecting to not like the update. The reason I didn't think I would like the update is because I felt like Microsoft and the Windows team was bailing. It seemed like they were pandering to whiney, I don't like change people and I personally think that is weak! I love Windows 8 + and I love it on my Surface Pro, my RT, my laptop, my desktop. Touch, no-touch, I don't care. I find the OS elegant, fun and interesting. 

I like the management of it, I like PowerShell, I like the dual experience of modern and classic. I like the cloud integration, I like the device management, I just like it. There were some time where I was frustrated with how I used to do something, but learning how a scenario works on this new OS family is interesting.

When I first installed a Windows 8 machine at home, a long time ago (I was working on the Windows Engineering team at the time so very early previews). I had to keep it to myself. But when it was announced I could install an update that exposed the new UI and start talking about it. It took me some time to get efficient but it was still a very cool experience.

I sat my oldest daughter down, she was probably 10 at the time, and I told her to check out my new computer. I walked away and without any instruction she was finding things, she was painting, creating docs, playing games and enjoying herself. No touch screen, just mouse and keyboard and she loved it and found it very intuitive. 

How can some self-proclaimed experts spew nonsense about the OS without any technical backing? How can someone correlate the drop in PC sales with the OS alone and not take into account that computing is changing fundamentally? I read a piece today on Information Week that was not a bad piece. It was 'Windows 8.1 Update 1: 10 key changes'. OK, great, let's see what was important to them. The article began quoting Paul Thurrott and a couple of others on how they hated Windows 8+. 

Now I have been following Windows since the beginning. I was an MCSE in Windows NT 3.5, I was one of the early MCSEs in Windows 2000 and I have been reading Paul and and others for years. Paul built a reputation on being incredibly helpful to those of us who were learning how these systems works. An incredible resource along with his colleagues. At some point it seems like he realized people cared about his opinion and it has been a decline in value since. The quote in the previously mentioned article was "Windows 8 is a disaster in every sense of the word." OK, taken out of context I'm sure but come on, really. Slackware was a disaster. There were so many great things about Windows 8 even for the haters out there from day 1. The willingness for Microsoft to take a pretty aggressive jump forward in the experience by itself is impressive and very, well, non-Microsoft. 'Disaster'? Really? Vista was a disaster. There was some user research regarding Vista that was interesting. Out of the population surveyed for a given study a very high percentage said that Vista was horrible. Out of those who said Vista was horrible a very low percentage had ever personally seen or used a Vista machine. I'm not going to even bother trying to dig that up because even if I did... haters are going to be haters. It is not even worth the argument. 

I was happy to see that the Update, even though it was pandering a bit IMO, has some pretty great changes. Even though the Information Week article started out negative and had a bit of a negative tone, it walks through these 10 changes that are really interesting and make the usability of the system better. Check out that article here. There are a ton of articles going around. Come up with your own opinions. See what you like and what you don't. Don't listen to the haters, and don't be one. Make up your own mind. If you don't like it fine, but justify it with something a bit deeper than it is a disaster.

SMH

PowerShell 006 – WMF v5 and OneGet

Windows Management Framework v5 Preview

WMF V5

Jeffrey Snover posted an announcement of the WMF V5 preview on the Windows Server Blog. The post and a download link to get the new bits is here.

There are a few very interesting pieces here and it is another step in the growth of the framework and PowerShell. I’m personally a little unsure of the reach and extension of the framework into realms ‘unmanaged’ or out of the control of Microsoft. When software vendors provide their modules they take responsibility, with the WFM V5 and especially the OneGet functionality the line is a bit blurred. Who is responsible if OneGet isn’t working? MSFT? Chocolatey? other source providers? At the end of the day, OneGet is pretty cool.

OneGet

From the Windows Server Blog “OneGet is a new way to discover and install software packages from around the Internet. It will simplify the acquisition of all kinds of software and make installation and discovery ‘easy peasy’ as they say.

Much of the OneGet capability is very interesting. I have a few areas that cause me some concern. I’m am willing to be convinced so I’ll spend some time checking it out.  After I setup WMF 5 this morning I used the Get-Command cmdlet to find the OneGet cmdlets. After I found the basics I ran;

PS C:\> Find-Package |Export-csv packages.csv

This first informed me that it needed to retrieve NuGet Package Manager. It then gave me a list of all of the packages available via the provider Chocolatey. There are roughly 1750 packages today (4/4/2014). I wanted to learn more so I decided to check to see if my help files were up to date.

PS C:\> update-help

Uh Oh! update-help throws an error when grabbing help on the ‘OneGet’ and ‘NetworkSwitch’ Modules. Honestly not a great place to start but it is preview! So, learning what parameters are required, mandatory, allow for wildcards etc. may have to wait a bit. Or I can just sit at my computer for hours trying different things!

I did look through my .csv file and found Notepad++ and I decided to set that up.

PS C:\> Install-Package -Name notepadplusplus

After a brief warning about the package not being marked as safe and me ignoring the warning, it downloaded any dependencies and installed the package. Pretty cool if you ask me.

NetworkSwitch

Last year at TechEd I ran into Jeffrey between sessions and had a chance to catch up. Jeffrey is an incredibly accessible guy and so enthusiastic. Just a great person to chat with. I have a few great Jeffrey Snover stories from some projects I had the pleasure of working while at Microsoft, but those are for a different post <G>. During that brief discussion Jeffrey shared with me how one of his visions around Desired State Configuration (DSC) was managing switches, well… here we are! Read through the Windows Server Blog announcement on WMF v5 Preview to learn more about this capability.

PowerShell 005 – Install-ADDSForest

Setting Up a Lab

DCPromo has come a long way in the past 13 + years. Windows Server all up is so incredibly different, more powerful, more intuitive, more manageable. It is simply a great operating system to work with. I have a very specific scenario that I want to talk about here. That is setting up a lab.

There are many ways to do this, and they all have their benefits. I want to start simply. The first machine in the lab, setup as the forest root, your first DC.

The Scenario

This is not simply building a new lab. This is the re-building process that many of us go through every couple of months to get a clear setup to test with. Building the lab manually is a powerful experience especially when you are being introduced to a new OS. In this case I’m running Windows Server 2012 R2. I want to walk through the creation process manually to see if anything noticeable has changed. In this case I have already installed the Active Directory Domain Services Role and now it needs to be configured. This is the DCPromo process we have used for years. The task is initiated from within Server Manager.

After you install the AD DS role you will notice a flag informing you that you now need to ‘promote’ this server to function as a Domain Controller.

Click ‘Promote this server to a domain controller’ and the ‘Deployment Configuration’ Wizard will start.

The purpose of this post is not to walk through the configuration of the domain. In summary you can add a new DC to a domain, add a new domain or create a new forest. I’m going to create a new forest.

After walking through basic configuration, naming your domain, DC options, functional levels, NetBIOS naming, paths to files etc. etc. etc. You will come to a page in the wizard called ‘Review Options’. Along the way there are lots of links to additional information. If you are new to AD or new to Windows Server 2012 R2, take the time to read this information. It will save you time in the future.

Notice the ‘View script’ button in the bottom of the dialog. Hmmm… what could that be?

A simple PowerShell script to configure your first DC. You don’t need to, or want to, run the wizard every time you need to rebuild your lab. Simply save this script as a .ps1 file. Save it in a place that you will keep to use every time you build out a new lab.

I am going to cancel the wizard after I save the script. I want to execute this DC Promotion in PowerShell. I like to use the PowerShell ISE for multiple reasons but when working with scripts you have both the scripting windows right along with the console. Makes things very easy.

You can hit F5 or click the green arrow or get into the ‘Debug’ menu for more options. For the quick and dirty I’m just clicking the green arrow. Provide your SafeModeAdministratorPassword and off it goes.

You may get some messages and warning along the way. PowerShell seems to provide great feedback to help you understand what is going on.

The server will reboot and your DC is setup.

Save the script, store it. You will find many others. I will explore Desired State Configuration (DSC) in the future to really fully leverage PowerShell to manage deployment and configuration of components across your enterprise. I have a long way to go before I’m ready for that! Just getting my feet wet with DSC at this point.

Enjoy!