Summary: The Scripting Wife plays WhatIf and creates her ideal Microsoft TechEd 2012 schedule.
Microsoft Scripting Guy, Ed Wilson, is here. The Scripting Wife likes to use WhatIf in her daily musings. She has also been hearing from a lot of people who are going to Microsoft TechEd for the first time. Last year was her first TechEd experience, and she hopes to improve her takeaways this year. When asked what her schedule would look like if she was not working at the Scripting Guys booth, she sat down with the catalog and came up with the following schedule. I will warn you that Teresa is very flexible, so although this would be her proposed schedule on paper, it by no means indicates what will or would actually occur.
For example, she may have chosen a session to attend based on the content, but then she may meet a really interesting person after we arrive who is presenting at the same time as a session she had already written down as attending. The next thing I know, I may be getting an email from her on my Windows 7 smartphone that says, “My plans have changed and I am going to attend a different session than is on my schedule. I met this really cool person and I want to go to his session.” In truth, the chances are good that if you want to talk to the Scripting Wife, come by the Scripting Guys booth during nearly any hour that the Connect Zone is open, and she will probably be there. She loves talking to people who want to learn Windows PowerShell, but do not know where or how to begin.
Now without further ado, here is the Scripting Wife’s schedule for Microsoft TechEd 2012.
Hello everyone! Scripting Wife is here. I need to say a couple of things so you can follow what I have written and chosen. By the way do you know how hard it is to choose between Don Jones and Mark Minasi? Both are dear friends and both are excellent speakers.
First, I am going to list the three items that I will work on while I am not attending a session. There is one demo in The Learning Center (TLC) and there are two hands-on labs.
Demo in S. Hall A:
Windows Server 2012 Server Manager and PowerShell | WSV07-TLC
Whatever the size of your organization, you want to maximize IT operational cost efficiency. Windows Server 2012 offers excellent total cost of ownership as an integrated platform with comprehensive, multiserver manageability. It delivers capabilities to manage many servers and the devices connecting them—whether they are physical or virtual, and whether they are on-premises or off. Specifically, Windows Server 2012 provides new multi-machine management capabilities, automation, improved compliance with industry management technology standards, and experiences which are unified across physical and virtual platforms. Visit the Windows Server 2012 Management booth to hear from experts about all the great new features.
Lab in S. Hall B:
What's New in Windows PowerShell 3.0 | WSV11-HOL
This lab gets you up and running with the all-new Server Manager in Windows Server 2012. Topics covered include: deploying roles and features to a remote server, configuring a role on a remote server, monitoring remote servers, and troubleshooting a remote server. You will leave this lab with a solid grasp of how to use the new Server Manager to quickly and easily perform common server management tasks, local and remote.
Lab in S. Hall B:
Introduction to Windows PowerShell Fundamentals | 3.0 WSV12-HOL
This lab gets you up and running with Windows PowerShell, Microsoft's latest shell environment and scripting language. Topics covered include: file system navigation, help and discovery features, PowerShell scripts, working with WMI, working with the system registry, and working with Active Directory. You will leave this lab with a solid grasp of how to use PowerShell to quickly and easily perform common IT management tasks, and have a solid foundation to learn advanced PowerShell topics.
And now for my session schedule...
Monday, June 11
9:00 AM - 10:30 AM
Keynote Session
11:30 AM - 1:15 PM
Lunch
1:15 PM - 2:30 PM
The 12 Reasons to Love Microsoft SQL Server 2012 | DBI202
Speakers: Dandy Weyn, Thomas LaRock
In this demo-only session, discover 12 good reasons to love SQL Server 2012. Learn about AlwaysOn, ColumnStore Indexing, Data Quality Services, Transact-SQL Enhancements, Power View, SQL Server Data Tools, and so much more in a very demo-driven session. By the end of the session you will understand the key features and improvements in SQL Server 2012, and how they work together.
3:00 PM - 4:15 PM
PowerShell Remoting in Depth | WCL403
Speaker: Don Jones
Remoting is a foundation feature in Windows PowerShell, and is poised to become one of the most important protocols on your network, especially for remote client management and support. Do you know how it works? Can your troubleshoot it? Can you configure it in a variety of scenarios to meet your organization's needs for security and operations? Don Jones, PowerShell author and MVP, walks you through the nitty-gritty details of Remoting, showing examples for a variety of scenarios and covering its troubleshooting features in great detail.
4:45 PM - 6:00 PM
Windows PowerShell Crash Course | WSV321
Speakers: Don Jones, Jeffrey Snover
Windows PowerShell 3.0 is here, and it is delivering on Microsoft's promise to make nearly everything in Windows manageable from the command-line. Are you finally going to learn the shell, or learn to say, "Would you like fries with that?" instead? Join PowerShell author, columnist, trainer, and MVP Don Jones (one of the world's most well-known PowerShell experts) in a crash course that shows you how to use the shell's key features. No scripting experience needed—you'll use the shell as it is meant to be used to accomplish real administrative tasks with just a few commands. Also, learn how the shell can teach you how to use itself, setting you up for success with the new wave of Microsoft and third-party enterprise products.
6:00 PM - 9:00 PM
TechExpo Welcome Reception
Tuesday June 12
10:15 AM - 11:30 AM
Inside Windows Server 2012 Multi-Server Management Capabilities | WSV306
Speakers: Erin Chapple, Jeffrey Snover
Windows Server 2012 will offer excellent total cost of ownership as an integrated platform with comprehensive, multicomputer manageability. Two areas in which Windows Server 2012 improves multicomputer management are Server Manager and Windows PowerShell 3.0. Server Manager in Windows Server 2012 helps you efficiently deploy and manage roles and features on the local server, on remote servers, and on both online and offline virtual hard disks. It also provides a multiserver experience where you can centralize your Windows Server management in a single view, and streamlined your server configuration and deployment from the same window. Windows PowerShell 3.0 provides an extensive platform to help you manage server roles and automate management tasks. With access to over 2300 cmdlets (a tenfold increase from the previous version), Windows PowerShell 3.0 offers comprehensive management across your datacenter. This session overviews these subjects in detail and prepares you for enhancing your management capability.
11:30 AM - 1:30 PM
Lunch
1:30 PM - 2:45 PM
Legal Structures of User Groups | BOF05-ITP
Room S329
Should your group incorporate or apply for non-profit status? What are the benefits and pitfalls of creating legal structures for IT Professional groups? Do you charge membership fees to the members to pay the legal obligations?
3:15 PM - 4:30 PM
Standards Support and Interoperability in Windows Server 2012: Storage, Networking, and Management | WSV308
Speakers: Gene Chellis, Jeffrey Snover, See-Mong Tan, Wojtek Kozaczynski
Windows has always implemented formal and industry standards but the Windows Server 2012 mission to be a Cloud OS required us to take this to a new level with investments in storage, networking and management standards. For example, in Windows Server 2012 the WSMAN standard is now the primary management protocol, with DCOM provided for backwards compatibility. Clearly this is not your father’s Windows Server. This 200-level session covers formal “de jure” standards including management (such as SMI-S, WSMAN and CIM), networking (such as IPv6, IPSec, DCB, DCTCP, NVGRE, ECMA Power standards and RDMA), and storage (such as NFS and iSCSI). We describe the technology, how Windows supports it, what benefits it brings, and what you need to change/do in order to get those benefits. We also discuss “de facto” standards such as VSS and SMB and describe how Microsoft enables and promotes interoperability using conferences, protocol documentation, plugfests and more to make Windows Server 2012 the most interoperable operating system on the planet. IT pros should come learn how Windows Server 2012 simplifies the tasks of architecting and running systems and how you should update your equipment purchasing guidelines. Developers and Partners should come to learn about new opportunities and preferred mechanisms to interoperate with Windows Server 2012.
5:00 PM - 6:15 PM
Extending Applications to Everywhere! Your Guide to Securing RDS RemoteApps for the Internet | WSV311
Speaker: Greg Shields
Your job as IT administrator is all about applications and data. You need to protect your users' data, and you need to ensure access to it via applications. But today's workforce requires us to make our applications available from everywhere. Creating your own Internet-based cloud infrastructure for corporate applications is quickly becoming a need for every environment, both large and small. You can create this today for very little cost using Microsoft Remote Desktop Services. RDS Guru and Microsoft MVP Greg Shields has been working with Terminal Services since its introduction in Windows NT 4.0 Terminal Services Edition, and in this deep dive session he presents the step-by-step approach to building a cloud-based remote applications infrastructure with enough industrial-grade security that even the most secure of networks will allow it. RDS has for too long been relegated to the sidelines. Attend this session and make secure, scalable, and inexpensive cloud applications a reality for your company.
6:15 PM - 9:00 PM
Community Night. There will be a Scripting Guys area!
9:00 PM - 1:00 AM
Jam Sessions
Wednesday June 13
8:30 AM - 9:45 AM
Group Policy Reporting and Analysis with Windows PowerShell | WSV415
Speakers: Jeffery Hicks, Jeremy Moskowitz
In this session led by PowerShell MVP Jeffery Hicks and Group Policy MVP Jeremy Moskowitz, we discuss techniques for analyzing Group Policy objects to identify potential problems. We look at ways to identify Group Policy settings using PowerShell scripts and third-party tools.
11:30 AM - 1:30 PM
Lunch
1:30 PM - 2:45 PM
Turn PowerShell Commands into Reusable CLI and GUI Tools | WCL404
Speakers: Don Jones
Say you have written an incredible PowerShell command or script. How do you leverage that as a tool across your entire organization? Learn to turn those commands and scripts into tools that can be safely used by your less-technical colleagues, or even end users! PowerShell MVP and author Don Jones demonstrates a variety of approaches, including cmdlet-like command-line tools all the way up to fully-distributable GUI tools that you can build yourself!
3:15 PM - 4:30 PM
Windows PowerShell Best Practices | BOF11-ITP
Led by Windows PowerShell MVP, Don Jones, and Microsoft Scripting, Guy Ed Wilson
All of Microsoft's current operating systems and most of their server-based products have deep PowerShell integration, and that trend will continue. Same goes for the hardware and software vendors out there, large and small. You need to be on this train! You need to script! How do you know if you are doing it right? What does that even mean? Can you save time by using tried and tested techniques?
5:00 PM - 6:15 PM
Advanced Automation Using Windows PowerShell 3.0 | WSV414
Speakers: Hemant Mahawar, Travis Jones
This session showcases the improvements to Windows PowerShell introduced in Windows Server 2012. Demos for this talk include how IT administrators can create cmdlet functionality without the need for programming skills, PowerShell Remoting, Jobs, Modules, Debugging, and Constrained Endpoints, among others.
Thursday, June 14
8:30 AM - 9:45 AM
How to Tell Your Manager You Need Quotas on Your Mailboxes | EXL203
Speaker: Bhargav Shukla
As systems offer bigger and bigger mailboxes and Microsoft has published whitepapers on large mailbox vision, it is important to understand the infrastructure to support such designs, what your company desires, and what the cost and operational impacts are. This session provides intelligent discussion about factors involved and cost benefits, to help you drive your infrastructure towards better manageability and stability.
10:15 AM - 11:30 AM
Application Monitoring with Microsoft System Center Operations Manager 2012 | MGT302
Speakers: Aakash Mandhar, Daniele Muscetta
In this session we provide a summary of the application monitoring capabilities enabled through System Center 2012 Operations Manager against Microsoft .NET and Java applications, covering the platforms and supported configurations. See how System Center 2012 Operations Manager can provide critical availability, performance, and reliability information without requiring any custom instrumentation to the code or custom management packs.
11:30 AM - 1:00 PM
Lunch
7:30 PM - 12:00 AM
Closing Party
That is my WhatIf schedule, and I think it has a nice balance to it. Hopefully, you will find it useful. Keep in mind, Microsoft TechEd 2012 is a huge event, and the Orlando Expo Center (according to the Scripting Guy) is like three miles long. So you should definitely bring comfortable walking shoes and also wear clothes that are comfortable. I look forward to seeing you if you get to come to TechEd 2012 in Orlando. There are still some slots available, so there is still time to register.
~Scripting Wife
I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.
Ed Wilson, Microsoft Scripting Guy
Summary: Microsoft premier field engineer, Jason Walker, shows how to use Windows PowerShell to get a history of USB drive usage.
Microsoft Scripting Guy, Ed Wilson, is here. I was talking to Jason Walker at the Charlotte Windows PowerShell User Group the other day. I asked him what cool things he was doing with Windows PowerShell, and he discussed a script he had recently written. I encouraged him to write a guest blog about the script. Today’s blog is a result of that conversation.
Jason Walker is a premier field engineer (PFE) at Microsoft, and he supports customers in the public arena. His primary job is supporting Exchange Server, but he jumps at the opportunity to flex his Windows PowerShell muscles to resolve any issue that may come up. It does not matter if it is related to Exchange Server. Jason also actively participates in the Charlotte PowerShell Users Group.
Twitter: AutomationJason
USB ports are an awesome resource to any computer. They allow you quickly connect and use accessories such as mice, keyboards, and storage devices, just to name a few. However, USB storage devices are a popular vector bad guys use to get nefarious code onto a machine. With my customers being in the public sector, security is a top priority, and USB storage devices are not allowed. We could disable USB ports all together, but that would eliminate the ability to use other USB devices. Therefore, users are told to simply not use USB storage devices. The need came up to see if the users are playing by the rules and Windows PowerShell was the answer to that need.
“How do we find out if a USB storage device has been connect to a computer?” you ask. We look in the registry, of course. When a USB storage device is inserted into a machine, the USBSTOR key is created in the registry, and everything the operating system needs to know about that storage device is contained in that key. This is the complete path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
When we expand the USBSTOR key, we see all the USB storage devices that have been used on the computer.
We see here that 15 different USB storage devices have been used on this machine. I know what you are thinking: “Whoever owns this machine is not very security conscience!”
By looking at the subkey names, we can get an idea about what kind of storage device was used, but the data isn’t easily readable. When we dig deeper, we find a FriendlyName property that is easily readable.
Now we can see that a “SanDisk U3 Cruzer Micro USB Device” was used on this machine.
To get this information, all we need Windows PowerShell to do is start from the USBSTOR key, recurse down two subkeys, and grab the FriendlyName property. There are a couple ways we can get this data. We could do it in one line like this:
But if we want to get this data from a remote machine, this will not work unless Windows PowerShell remoting is enabled—and it most cases it is not. I believe the method that will work in the most number of scenarios is the Microsoft.Win32.RegistryKey class.
Note If you have Windows PowerShell remoting enabled, see last week’s Hey, Scripting Guy! blogs for a different approach to working with the registry. Saturday’s blog, Use PowerShell to Easily Modify Registry Property Values, contains links to the entire series.
I will explain the code that does all the heavy lifting.
First, starting at USBSTOR, we get all the subkeys:
$Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($Hive,$Computer)
$USBSTORKey = $Reg.OpenSubKey($Key)
$USBSTORSubKeys1 = $USBSTORKey.GetSubKeyNames()
Then we go through each subkey ($USBSTORSubkeys1) and collect the child subkeys. We store them in $SubKeys2 as shown here:
ForEach($SubKey1 in $USBSTORSubKeys1)
{
$Key2 = "SYSTEM\CurrentControlSet\Enum\USBSTOR\$SubKey1"
$RegSubKey2 = $Reg.OpenSubKey($Key2)
$SubkeyName2 = $RegSubKey2.GetSubKeyNames()
$Subkeys2 += "$Key2\$SubKeyName2"
$RegSubKey2.Close()
}#end foreach SubKey1
Now we go through each Key in $Subkey2 and grab the FriendlyName property of the key. The value of the property and the name of the computer are stored in a custom object so we can easily send our data to Export-CSV or filter with Where-Object.
ForEach($Subkey2 in $Subkeys2)
{
$USBKey = $Reg.OpenSubKey($Subkey2)
$USBDevice = $USBKey.GetValue('FriendlyName')
$USBDevices += New-Object –TypeName PSObject -Property @{
USBDevice = $USBDevice
Computer = $Computer
}
$USBKey.Close()
}#end foreach SubKey2
A few things to note are that the Remote Registry service must be running on the remote machine. I added a Write-Progress cmdlet because when I first wrote this script it ran against hundreds of machines. The Test-Connection cmdlet is not needed because the connection to the remote machine is inside the Try\Catch. However, during testing, it took 30+ seconds for the script to move to the next computer when trying to connect to a machine that was not online, so I added that as an option.
The script is written as a function, and it has comment-based Help with examples. Because it is written as a function, it will need to be dot-sourced. This is done by placing a dot and a space in front of the path to the script. When this is done, you can use the function just as you would a native Windows PowerShell cmdlet. Here is an example of how this is done:
Thanks, and I hope you can find this script useful when it’s time for you to flex your Windows PowerShell muscles.
~Jason
The complete script can be downloaded from the Script Repository. Thank you for a great guest blog. I have often seen this registry key, but never thought about using it in the way you have here. Awesome job.
I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.
Ed Wilson, Microsoft Scripting Guy
