cornasdf's field

ccmexec crashing on windows 2008 r2

2012-01-27T11:59:00.000Z

Hey all,

I have been tracking an issue for some time. I have no fix but some things are becoming clear and I just found a good way to scope the problem, hence this post…

I am running Systems Center Configuration Manager 2007 SP2 R2 and I have been getting this error on some seemingly random set of my windows 2008 r2 servers:

Log Name: Application

Source: Application Error

Date: 1/27/2012 5:52:09 AM

Event ID: 1000

Task Category: (100)

Level: Error

Keywords: Classic

User: N/A

Computer: xxxxxxxxxxxxxxxxx

Description:

Faulting application name: CcmExec.exe, version: 4.0.6487.2000, time stamp: 0x4ab33e4d

Faulting module name: ntdll.dll, version: 6.1.7601.17514, time stamp: 0x4ce7ba58

Exception code: 0xc0000005

Fault offset: 0x0009ce04

Faulting process id: 0x1d58

Faulting application start time: 0x01ccdcd93adaa8bf

Faulting application path: C:\Windows\SysWOW64\CCM\CcmExec.exe

Faulting module path: C:\Windows\SysWOW64\ntdll.dll

Report Id: f570d39f-48d4-11e1-b96c-6431504ea6e0

Notes from this page and especially the german write up here (translation here) were very helpful. To briefly summarize, when you run resource explorer, you create an ETS performance trace called: WDC.BE95A9B1-DE15-4B78-B923-A12AB70BE951. You can verify this by running ‘logman query –ets’ or in server manager -> Diagnostics -> Performance -> Data Collector Sets -> Event Trace Sessions.

Apparently the sccm client dislikes this trace and will crash, in my case every 65 minutes. Stopping the trace reportedly fixes it, I am still testing before I fully believe that. I have not found it necessary to reboot/reinstall etc as are suggested elsewhere. Stopping the trace will kill your Resource Monitor.

Next step would be looking into the trace to see if it is possible to adjust the trace. Word is MS is refusing to fix it.

The only thing I have to add is that I am seeing a status message of 669 (2 in fact) each time this happens. So in order to determine which machines this is happening on, run the report Status Messages -> All messages for a specific message ID and query for message ID 669. Exported to excel (so I could mask server/site names more easily), it looks like this:

Record ID	Severity	Message ID	Component	Computer Name	Time	Site Code
1012608	Error	669	Advanced Client	SERVER--SCCM	1/27/2012 6:15:46 AM	SC2
1012605	Error	669	Advanced Client	SERVER--WEB3	1/27/2012 6:08:23 AM	SC1
1012607	Error	669	Advanced Client	SERVER--WEB3	1/27/2012 6:08:23 AM	SC1
1012602	Error	669	Advanced Client	SERVER--WEB2	1/27/2012 5:51:38 AM	SC1
1012604	Error	669	Advanced Client	SERVER--WEB2	1/27/2012 5:51:38 AM	SC1
1012601	Error	669	Advanced Client	SERVER--SQLA2	1/27/2012 5:50:07 AM	SC1
1012603	Error	669	Advanced Client	SERVER--SQLA2	1/27/2012 5:50:07 AM	SC1
1012599	Error	669	Advanced Client	SERVER--WEB1	1/27/2012 5:44:05 AM	SC2
1012600	Error	669	Advanced Client	SERVER--WEB1	1/27/2012 5:44:05 AM	SC2
1012596	Error	669	Advanced Client	SERVER--SQLA1	1/27/2012 5:32:24 AM	SC1
1012598	Error	669	Advanced Client	SERVER--SQLA1	1/27/2012 5:32:24 AM	SC1
1012591	Error	669	Advanced Client	SERVER--SQLA2	1/27/2012 5:24:14 AM	SC2
1012593	Error	669	Advanced Client	SERVER--SQLA2	1/27/2012 5:24:14 AM	SC2
1012590	Error	669	Advanced Client	SERVER--SQLB1	1/27/2012 5:21:40 AM	SC1
1012592	Error	669	Advanced Client	SERVER--SQLB1	1/27/2012 5:21:40 AM	SC1
1012584	Error	669	Advanced Client	SERVER--SCCM	1/27/2012 5:10:17 AM	SC2
1012585	Error	669	Advanced Client	SERVER--SCCM	1/27/2012 5:10:17 AM	SC2
1012577	Error	669	Advanced Client	SERVER--WEB3	1/27/2012 5:02:27 AM	SC1
1012583	Error	669	Advanced Client	SERVER--WEB3	1/27/2012 5:02:27 AM	SC1
1012574	Error	669	Advanced Client	SERVER--WEB2	1/27/2012 4:45:50 AM	SC1

According to the ever handy SystemCenterCentral:
Message ID 669: This message is caused when SCCM component raised an exception but failed to handle it. We should further investigate this problem.

So this could easily be from something else but this crash seems to be the primary (only) error I am seeing in my sites that is sending this message.

Please respond if you have any more details to add…

Exporting songs in Windows Media Player by star rating

2011-10-25T15:54:00.000Z

So, I used this some forever ago to move song ratings from iTunes to Windows Media Player with a powershell function. Now I wanted to export the ratings to a file so I have that list outside of wmp. Annoyingly, i didn't see a way to export the song list, saving the playlist just saved the search terms. Meh, powershell to the rescue, yet again...

This function will export the name of all files w/ ‘-starcount’ stars. Could be trivially modified to export other details.

function get-playlistbyStars {

param ($starcount = $(throw "need -starcount")

)

#get WMP

$wmp = New-object -COM WMPlayer.OCX

$WMPLibrary= $wmp.mediaCollection

#set vars

$rated = 0

$processed = 0

$added = 0

$unrated = 0

$1star = 0

$2star = 0

$3star = 0

$4star = 0

$5star = 0

$defstar = 0

$ctr = 0

$allsongs = $WMPLibrary.getall()

$colOut = @()

for ($i = 0; $i -lt $allsongs.count; $i++) {

$processed++

$song = $allsongs.Item($i)

if (@(".jpg",".png") -notcontains ([System.IO.FileInfo]$song.sourceURL).Extension ) {

switch ($song.getiteminfo("UserRating")) {

"0" {

$unrated++

if ($starcount -eq 0) {

$colOut += $song.sourceURL

}

"1" {

$1star++

$rated++

if ($starcount -eq 1) {

$colOut += $song.sourceURL

}

"25" {

$2star++

$rated++

if ($starcount -eq 2) {

$colOut += $song.sourceURL

}

"50" {

$3star++

$rated++

if ($starcount -eq 3) {

$colOut += $song.sourceURL

}

"75" {

$4star++

$rated++

if ($starcount -eq 4) {

$colOut += $song.sourceURL

}

"99" {

$5star++

$rated++

if ($starcount -eq 5) {

$colOut += $song.sourceURL

}

default {

#so I have something to query for random nums

$defstar++

if ($starcount -eq 42) {

$colOut += $song.sourceURL

}

#so I have something to watch

$ctr++

if ($ctr%500 -eq 0) { Write-verbose $ctr}

}

#output results

Write-verbose "Processed: $processed"

Write-verbose "Rated: $rated"

Write-verbose "Added: $added"

Write-verbose "1: $1star "

Write-verbose "2: $2star "

Write-verbose "3: $3star"

Write-verbose "4: $4star "

Write-verbose "5: $5star"

Write-verbose "def: $defstar"

$colOut

}

get-playlistbyStars 3 | out-file –filepath .\3starsongs.txt

SQL and Powershell: Attach all database mdf files in a directory

2011-10-14T13:29:00.002Z

Hey all,

I didn’t find this elsewhere on the web and I needed it. Since I actually had to do work, i figure I should give it out and spare somebody else that pain.

As part of a failover plan, I am synchronizing directories of sql files. In a failover, I am going to need to bring up a group of databases in a specific directory. The script below will take in a directory name and a SQL instance. It will get all the .mdf files in the directory and compare them against the database files attached to the SQL instance. Any files that are not attached already are attached, extrapolating the filename from the .mdf file. The MAJOR ASSUMPTION here is that you want to name your Database the same name as the .mdf file (without the .mdf). Several of my dbs have multiple files so I read the .mdf to get all the files it knows about. Another major ASSUMPTION is that you are replicating to/attaching from the same file paths on your new server.

I use my out-log function. if you don’t want to use it, replace out-log with write-host in the below script.

function AttachMDFsInDir {

param (

$dir = $( throw "Must specify -dir" ),

$instance = $( throw "Must specify -instance" ),

$verbosity = 1 # for the out-log function.

)

out-log "Starting AttachMDFsInDir with dir: $dir and inst: $instance"

$srv = new-Object Microsoft.SqlServer.Management.Smo.Server($instance)

out-log "Connected to $($srv.Name)"

#get a list of all attached database file names

$colAttachedMDFs = @()

foreach ($db in $srv.Databases ) {

foreach ($fg in $db.Filegroups) {

foreach ($file in $fg.Files) {

out-log "Adding to `$colattachedMDFs: $($file.Filename)" 2

$colAttachedMDFs += $file.Filename

}

out-log "Found $($colAttachedMDFs.count) mdfs attached in $instance"

#foreach mdf in $groupSQLDir

$colMDFsToAttach = @()

foreach ($mdf in dir "$dir\*.mdf") {

if (-not ($colAttachedMDFs -contains $mdf)) {

out-log "Adding to `$colMDFsToAttach: $($mdf.Fullname)" 2

$colMDFsToAttach += $mdf.FullName

}

Remove-Variable mdf

Remove-Variable file

out-log "Found $($colMDFsToAttach.count) mdf(s) in the directory that are unattached"

foreach ($mdf in $colMDFsToAttach) {

#determine name to restore as from mdf file name.

$DBNameFromFile = ([System.IO.FileInfo]$mdf).Basename

out-log "Named the db $DBNameFromFile based on the mdf: $mdf"

#get list of files

$colDBFiles = $srv.EnumDetachedDatabaseFiles($mdf)

out-log "$mdf specifies $($coldbfiles.count) files to attach."

out-log $colDBFiles 2

#add to collection

$files = new-object system.collections.specialized.stringcollection

foreach ($file in $colDBFiles) {

$files.Add($file)

}

out-log "Ready to attach db: $DBNameFromFile w/ $($files.count) files."

#attach database

$srv.AttachDatabase($DBNameFromFile,$files)

}

As a corollary to the above, i needed to check which of my dbs on the running servers did not have the same name as their .mdf. you can use this loop.

$instances = @("SERV\Inst1","Serv\INST2") )

foreach ($instance in $instances) {

$srv = new-Object Microsoft.SqlServer.Management.Smo.Server($instance)

"------------------------"

$srv.Name

"------------------------"

foreach ($db in $srv.Databases ) {

foreach ($fg in $db.Filegroups) {

foreach ($file in $fg.Files) {

$Fileinf = [System.IO.FileInfo]$file.filename

if ($Fileinf.extension -eq ".mdf" ) {

if ($Fileinf.BaseName -eq $db.name) {

#"File: $($Fileinf.Basename) matches $($db.name)"

} else {

"Filename: $($Fileinf.Basename) DOES NOT MATCH DB Name: $($db.name)"

}

SCCM Child Primary site not replicating Update lists or deployments

2011-06-28T11:23:00.004Z

We ran across an issue this weekend with one of our SCCM child primary sites not replicating deployments or software update lists correctly. 2 of 3 primary sites were replicating fine but one primary was not getting new items. For this article, I will represent my central site as CEN and the non working primary site as PRI (imaginative, I know).

After several hours with the configuration manager logs, I had pretty much tracked it down to bad configuration items (patches) but I was stuck on what to do after trying various sync options, mostly detailed here: http://blogcastrepository.com/blogs/brian_tucker/archive/2009/06/18/how-to-resolve-site-replication-issues-with-sccm-2007-sp1-r2.aspx.

I called MS support and he gave me a set up queries to help figure out what was going on.

At the end of the day, the problem can be seen in objreplmgr.log and you see sets of lines like:

Processing replication file C:\Program Files\Microsoft Configuration Manager\inboxes\objmgr.box\INCOMING\Retry\CEN_48964.CID in retry. SMS_OBJECT_REPLICATION_MANAGER 6/27/2011 9:42:31 AM 5640 (0x1608)

Referenced configuration items are not available yet: http://schemas.microsoft.com/systemsmanagementserver/Site_A4F5CBC7-3D34-4DC1-A024-C496694647C5/SUM_914207c8-1e32-4e4e-acee-7ebdce4568b2/2(2)(6); SMS_OBJECT_REPLICATION_MANAGER 6/27/2011 9:42:31 AM 5640 (0x1608)

Failed to insert Object e5c2a931-5c7c-4c0b-843a-343525f73e3d from replication file C:\Program Files\Microsoft Configuration Manager\inboxes\objmgr.box\INCOMING\Retry\CEN_48964.CID. SMS_OBJECT_REPLICATION_MANAGER 6/27/2011 9:42:31 AM 5640 (0x1608)

Note the unique package name highlighted in red above. This is the key string.

We did do an ‘attempt 1’ that was unsuccessful but may be worth trying. In this, we extract just the GUID of the CI and update the date in the CEN database and hope it replicates down. Get the GUID from the highlighted string above as everything after the SUM_. In our case it would be 914207c8-1e32-4e4e-acee-7ebdce4568b2. In the query below, we have multiple CIs identified, you can put as many as you want in the query (gathered from different log lines).

Update ci_configurationitems

set datelastmodified = getdate()

where ci_uniqueid in (‘914207c8-1e32-4e4e-acee-7ebdce4568b2’,' c4fca437-b931-48fc-a6bf-6cc7d0aefc2d’)

This didn’t do anything useful in our case so we continued on to ‘Attempt 2’.

If you take your whole string and do a select in your SCCM database on both the primary and the central sites:

SELECT * FROM ci_sdmpackages where SDMPackageName in (‘Site_A4F5CBC7-3D34-4DC1-A024-C496694647C5/SUM_914207c8-1e32-4e4e-acee-7ebdce4568b2’)

Take note of the isDeleted and the SDMPackageVersion columns. For me, 95% of the items showing up in the logs were showing up as deleted in CEN but not in PRI. This can be fixed by running an update like:

update ci_sdmpackages

set Isdeleted = 1

where SDMPackageName = ' Site_A4F5CBC7-3D34-4DC1-A024-C496694647C5/SUM_914207c8-1e32-4e4e-acee-7ebdce4568b2’ and SDMPackageVersion = '3'

Note that you will change the GUID and the SDMPackage version. You want to update your PRI site to match CEN.

One your DB is updated, you can move your replication file as ID’d above (CEN_48964.CID in this case) from the objmgr.box\incoming\retry to objmgr.box\incoming. Watch your objreplmgr.log for success.

Now, that worked but I had 110 CIDs to work through and I heartily ascribe to larry wall’s 3 virtues. in order to shorten my workload a bit, this is how I did it. I didn’t have any good way to communicate between sites, unfortunately. If I did, I would have done this much more directly. I was on a bit of a deadline to get this up so I went for speed over elegance.

1. Get all the guids. I ran the following against the objreplmgr.log to pull out just my relevant configuration item IDs. I ran this against a copy w/ just one run of ‘failures’ initially but we do sort out unique so you can probably just run it against the real thing.

$a = get-content .\objreplmgr.log | where {$_ -match "Referenced configuration items are not available"}

$ciList = @()

Foreach ($line in $a) {

$line -match ".*(Site_.*/SUM_.*?)/.*"

$ciList += $Matches[1]

}

2. I tried to strip out duplicates. On my first run this only saved 2 items, next run saved me much more. If you run against the whole log, this is more important.

$ciListSorted = $ciList | sort –Unique

3. Create my sql query:

$sqlQuery = "SELECT * FROM ci_sdmpackages where SDMPackageName in ("

for ($i=0; $i -lt $ciListSorted.length - 1; $i++) {

$sqlQuery += "'$($ciListSorted[$i])', "

}

$sqlQuery += "'$($ciListSorted[$ciListSorted.Length-1])')"

4. Run the sql query against both databases. I have this function in my standard library that I stole some time ago:

function query-SQL {

param(

$DBInstance,

$Datatabase,

$Query)

$SqlConnection = New-Object System.Data.SqlClient.SqlConnection

$SqlConnection.ConnectionString = "Server = $DBInstance; Database =$Database; Integrated Security = True"

$SqlCmd = New-Object System.Data.SqlClient.SqlCommand

$SqlCmd.CommandText = $Query

$SqlCmd.Connection = $SqlConnection

$SqlAdapter = New-Object System.Data.SqlClient.SqlDataAdapter

$SqlAdapter.SelectCommand = $SqlCmd

$DataSet = New-Object System.Data.DataSet

$SqlAdapter.Fill($DataSet)

$SqlConnection.Close()

return $DataSet.Tables

}

Run against my Primary database

$colPRI = query-SQL -Datatabase $database -DBInstance $dbinstance -Query $sqlQuery

$PRI = @()

Foreach ($line in $colPRI[1]) {

$PRI += "PRI,$($line.isDeleted),$($line.SDMPackageName),$($line.SDMPackageVersion)"

}

$PRI > PRI.csv

For the CEN site, I manually copied the sql query over w/

$sqlQuery | Out-File sqlquery.txt

Created the text file on the other side and brought it back in and ran it like so:

$sqlquery = Get-Content .\sqlquery.txt

$colCEN = query-SQL -Datatabase $database -DBInstance $dbinstance -Query $sqlQuery

$CEN = @()

Foreach ($line in $colCEN[1]) {

$CEN += "CEN,$($line.isDeleted),$($line.SDMPackageName),$($line.SDMPackageVersion)"

}

$CEN > CEN.csv

Then, I brought my CEN.csv back over to PRI and brought it back to my powershell env.

$CEN = Get-Content .\cen.csv

Now we have $CEN and $PRI that are effectively .csv files in a variable. Check your lengths, do some spot verification that they are the same length and have the same IDs in the same order, etc. We did sort them above and everything should be fine and loop below does some checking but, well, defense in depth. Did you remember to back up your databases? Not my problem if not.

This loop spins through your two arrays and sets the PRI database to match what is in the CEN database. Note the query-sql line, you will need $database and $DBInstance defined already.

for ($i = 0; $i -lt $PRI.length -1; $i++) {

$site,$CenIsDel,$CenID,$CenVersion = $CEN[$i].split(",")

$site,$PriIsDel,$PriID,$PriVersion = $PRI[$i].split(",")

if ($CenIsDel -eq "True") { $CenIsDel =1 } else { $CenIsDel = 0}

if ($PriIsDel -eq "True") { $PriIsDel =1 } else { $PriIsDel = 0}

#Make sure our lines are the same

if (-not $CenID -eq $PriID) {

throw ("iteration $i, $CenID not equal to $PriID")

}

if (($PriIsDel -ne $CenIsDel) -or ($PriVersion -ne $CenVersion)) {

$query = "update ci_sdmpackages set Isdeleted = $CenIsDel where SDMPackageName = '$CenID' and SDMPackageVersion = '$CenVersion'"

"Setting $PriID to $CenisDel and $CenVersion"

query-sql -database $database -dbinstance $dbinstance -query $query

} else {

"$PriId already matches central"

}

After this, I dropped all the files from objmgr.box\incoming\retry back into objmgr.box\incoming. Success! Well, mostly. I still had about 8 bad CIDs. Looking in the log, some of them were due to lines that had two CIs mentioned.

Referenced configuration items are not available yet: http://schemas.microsoft.com/systemsmanagementserver/Site_A4F5CBC7-3D34-4DC1-A024-C496694647C5/SUM_40d3d142-5ea7-463c-a7c1-9d34cdd5a7fc/1(1)(6);http://schemas.microsoft.com/systemsmanagementserver/Site_A4F5CBC7-3D34-4DC1-A024-C496694647C5/SUM_c4fca437-b931-48fc-a6bf-6cc7d0aefc2d/1(1)(6);

My regex only accounts for 1. Rather than figure out a better regex, I ran through the steps above again I gathered the 3 CIs that I had that were specified as the second on a line. Then I ran through the steps above and manually added my 3 CIs to the $ciList, when I was at that step. Moved the \retry items back into the box and all were consumed successfully. Gave it about 15 minutes and site replication is working again. W00t!

Using SQL and Powershell to set Extended Properties

2011-05-13T09:16:00.003Z

I searched around for a bit and didn’t find this anywhere easy so I banged it out myself. Hope this helps somebody to set an extended property on one of your SQL Objects using Powershell.

Assume you want to set a property on a database. If you don’t have your SQL psdrive loaded you can add it (assuming you have the prereqs) with:

add-pssnapin SqlServerProviderSnapin100

The name of your property will be “TestName” and you want a value of “TestValue”.

You will need your DB as an object. If you have your SQL PSDrive you can use:

$DBObject = Get-Item SQLSERVER:\SQL\SERVERNAME\INSTANCE\Databases\$DBName

First, you create your new ExtendedProperty Object:

$ExtProp = new-object Microsoft.SqlServer.Management.Smo.ExtendedProperty

Then you need to designate what object you are attaching your new property to:

$ExtProp.Parent = $DBObject

Set your Name and Value:

$ExtProp.Name = "TestName"

$ExtProp.Value = "TestValue"

Finally, create the object. This seems to be more like applying it to me:

$ExtProp.Create()

Full list:

$DBObject = Get-Item SQLSERVER:\SQL\SERVERNAME\INSTANCE\Databases\$DBName
$ExtProp = new-object Microsoft.SqlServer.Management.Smo.ExtendedProperty

$ExtProp.Parent = $DBObject

$ExtProp.Name = "TestName"

$ExtProp.Value = "TestValue"

$ExtProp.Create()

Using powershell to run SQL Jobs serially

2011-03-24T15:04:00.002Z

We had some backups fail due to disk space issues. Once we cleared the space, we needed to run the backups as I didn’t want to wait an entire day. I didn’t want to run them at once due to contention issues and I am way too lazy to manually start each one and wait for it to finish.

Powershell to the rescue.

The SQL provider is slick, gives you a sql server psdrive that you can explore. Finding the jobs was easy enough. Finding failed jobs was easy enough. Running the jobs… wtf? Not hard, but seems like I should be able to just start a job rather than send it as a sql command. I hardly need the sql snapin for that.

Anyway, update SERVERNAME (and potentially instance) in the code below and it will find all your failed jobs and run them serially.

Sweet

cd SQLSERVER:\SQL\SERVERNAME\DEFAULT\JobServer\Jobs

$jobs = dir | where {$_.lastrunoutcome -eq "failed" }

foreach ($job in $jobs) {

"starting $($job.name)"

invoke-sqlcmd -database msdb "sp_start_job '$($job.name)'"

while ((invoke-sqlcmd -database msdb "sp_help_jobactivity @job_id = NULL, @job_name = '$($job.name)'").run_status -ne 1) {

"still running..."

sleep 120

}

"Completed at $(date)"

}

Timeouts Removing VMWare snapshots w/ PowerCLI

2011-03-08T15:45:00.000Z

On commit of several of our vmsnapshots we are getting the annoy “Operation Timed Out” after the vcenter timeout limit is reached. Luckily, the remove snapshot operation is still performed in the background and eventually completes. Below is a quick and dirty way to delete a vm snapshot and wait for the process to complete. I check the existence of the snapshot every 60 seconds and return when it is gone. If it is still going after 2 hours, I throw an error. It is pretty noisy as I wanted to see what was happening but didn't feel like getting into logging, you will probably want to add to it if you need to actually use it.

This is to be run in a PowerCLI window. Add the function and then you can use
delete-vmsnapshot "VMName"

Note: if you add -confirm:$false to the remove-snapshot line, you won't be prompted to confirm the delete. I took it out of the below to add some protection against copying and pasting code. B)

Note 2: if you don't care about how monitoring how long it takes you can just do something like the following. I wanted to loop through several serially and didn't want them starting over each other.
get-vm -name "VMNAME" | get-snapshot | remove-snapshot

function delete-vmsnapshot {

param ($vmname)

$d1 = date

"Starting at $d1"

$vm = get-vm -name $vmname

$sn = $vm | get-snapshot

"Deleting:"

$sn | fl *

$sn | remove-snapshot

$timesleeping = ((date) - d1).TotalSeconds

while (-not (($vm | Get-Snapshot) -eq $null)) {

$timesleeping = ((date) - d1).TotalSeconds

if ($timesleeping -gt 7200) {

throw ("waiting over 2 hours for snapshot to delete")

} else {

"Merging for $timesleeping seconds."

}

sleep 60

}

$d2 = ((date) - d1).TotalSeconds

"Complete taking a total of $d2 seconds"

}

SCCM Distribution point tar file error

2010-11-28T11:47:00.003Z

I spent all weekend fighting various sccm parent-> Child site replication issues. One I had around some of my software update packages had basically no information on the web despite what I would expect to be a very ‘searchable’ signature. the misspelling in signature in this line:

failed to register the source with the signautre repository

The full error message I was getting is below but the most obvious lines were (from distmgr.log on the child)

invalid tar file signature
UnpackFolderW failed; 0x80040299
UnpackFolder() failed
failed to register the source with the signautre repository
UpdateStagedFolderRdcW failed; 0x80070299
Cannot copy package CEN00004 from e
Failed to copy package CEN00004 from e
STATMSG
Forward package status for pkg CEN00004 to site CEN
Error occurred.

I was stuck in a loop w/ two of my packages where they would expand to an e:\_S XXXXXXX temp directory but would fail during or just after that step w/ the above errors.

Resolution:
Short answer:
Delete from dp, turn off binary replication, repush.

Step by step:
What finally worked was to remove the packages from the child distribution point at the parent server, turn off binary replication, and re-add them to the DP. So, from the parent server Computer Management –> Software Updates –> Deployment Packages –> My Package –> right click on distribution points –> manage distribution points –> delete from selected. Once I saw this go through in the distmgr log of the child site, which looks something like:

Updated replicated package info for package CEN00004
Updated replicated package server ["Display=\\childsite\"]MSWNET
Updated replicated package program info for package CEN00004, program *, dependent program
Successfully processed C
Removing package CEN00004 from the active package array.

Right click on your package under Deployment Packages and uncheck ‘Enable Binary Replication’.
Right click on Deployment Packages –> your package –> distribution points and add a new DP.
You should see it uncompress to the _S temp folder and then continue to creating the directory structure and moving the files into your SMSPGKE$ (or whichever drive is appropriate).
Full log of the repeating (erroring) attempt below.
Hopefully this will save somebody an afternoon.
Good luck

Starting package processing thread,thread ID = 1670
Sleep 3600 seconds...
STATMSG
Retrying package CEN00004
No action specified for the package CEN00004.
Start adding package to server ["Display=\\childsite\"]MSWNET
["Display=\\childsite\"]MSWNET
Will wait for 1 threads to end.
Thread Handle = 7056
Attempting to add or update a package on a distribution point.
for ["Display=\\childsite\"]MSWNET
STATMSG
Established connection to ["Display=\\childsite\"]MSWNET
Signature share exists on distribution point path MSWNET
Found the existing package path on MSWNET
Validating the compressed file E
Used 1 out of 7 allowed processing threads.
Sleep 3600 seconds...
The package file requires a NTFS drive to decompress to.
Decompressing package E
Processing incoming file C
Package CEN00004 is currently being processed
Processing incoming file C
Package CEN00004 is currently being processed
Used 1 out of 7 allowed processing threads.
Sleep 3600 seconds...
Used 1 out of 7 allowed processing threads.
Sleep 3600 seconds...
Used 1 out of 7 allowed processing threads.
Sleep 3600 seconds...
STATMSG
GetPackageSignature() called for package CEN00004 with version 3. UnpackedSignature = 0
RDC
for ["Display=\\childsite\"]MSWNET
IISPortsList in the SCF is "80".
IISSSLPortsList in the SCF is "443".
IISWebSiteName in the SCF is "".
IISSSLState in the SCF is 0.
Virtual Directory SMS_DP_SMSPKGE$ for the physical path E
for ["Display=\\childsite\"]MSWNET
IISPortsList in the SCF is "80".
IISSSLPortsList in the SCF is "443".
IISWebSiteName in the SCF is "".
IISSSLState in the SCF is 0.
Virtual Directory SMS_DP_SMSSIG$ for the physical path E
Get access to the package directory and the number of free bytes at that location.
Attempting to make an accessible connection to MSWNET
Established connection to MSWNET
Getting the NAL path's NOS equivalent.
The NOS path is \\childsite\SMSPKGE$\CEN00004\
Getting the number of free bytes.
The number of free K bytes 221886568
Successfully made an accessible connection, got a NOS path, and, if requested, got the number of free bytes at this location.
Attempting to make an accessible connection to MSWNET
Established connection to MSWNET
Getting the NAL path's NOS equivalent.
The NOS path is \\childsite\SMSSIG$\
The number of free bytes at the specified location has not been requested.
Successfully made an accessible connection, got a NOS path, and, if requested, got the number of free bytes at this location.
Successfully set access security on MSWNET
GetPackageSignature() called for package CEN00004 with version 3. UnpackedSignature = 0
RDC
RegisterSignatureUsage() called with for Package CEN00004, Version 3 with Targetpath as E
invalid tar file signature
UnpackFolderW failed; 0x80040299
UnpackFolder() failed
failed to register the source with the signautre repository
UpdateStagedFolderRdcW failed; 0x80070299
Cannot copy package CEN00004 from e
Failed to copy package CEN00004 from e
STATMSG
Forward package status for pkg CEN00004 to site CEN
Error occurred.
Performing error cleanup prior to returning.
DP thread with array index 0 ended.
DP thread with thread handle 7056 and thread ID 5628 ended.
Updating package info for package CEN00004
Only retrying local DP update for package CEN00004, no need to replicate package definition to child sites or DP info to parent site.
StoredPkgVersion (3) of package CEN00004. StoredPkgVersion in database is 3.
SourceVersion (3) of package CEN00004. SourceVersion in database is 3.
STATMSG
Failed to process package CEN00004 after 3 retries, will retry 97 more times

Automatically closing SCOM alerts w/ powershell

2010-08-03T18:50:00.003Z

You may have seen my post earlier about Syslog Monitoring Walkthrough with Systems Center Operations Manager 2007. Well, I went on vacation and my colleagues got a little overzealous in what we directed at scom. I came back to over 200k warnings from one device that was sending alerts at waaaay too low a threshhold. These were going into a view that wasn’t normally checked (it seems) and now we have a problem. The console crashes when trying to select all of them (surprise) and I do not want to do this by hand. Powershell to the rescue?
After opening the OpsMgr PS console, we can get started. Setting the alert to closed (ResolutionState =255) should be trivial. We mustn’t forget to update the alert after we set the state. The interesting part is that we need to get our collection of alerts with as little impact as possible.
I could just do:
$colAgents = get-alert
but that would crush my database and take forever. To narrow this down a bit, I am going to select by source (as basically all of these came from the same source.)
We could run a get-alert | where {SOMETHING} but that would have to return all the alerts and then parse them which would be very heavy. The SCOM cmdlets have a –criteria to do the filtering in the db, lets use that.
Source seems to translate, at an object level, to MonitoringObjectDisplayName so I set my criteria, do the query and loop through the results like so:

$criteria = “ResolutionState = 0 AND MonitoringObjectDisplayName = ‘SERVERNAME’”

$colSysLogAlerts = get-alert -criteria $criteria

foreach($Alert in $colSysLogAlerts) {

$Alert.ResolutionState = 255

write-host “Closing $($Alert.id)”

$Alert.Update("Closed by Powershell")

}

Powershell to the rescue indeed.

Syslog Monitoring Walkthrough with Systems Center Operations Manager 2007

2010-06-08T11:17:00.002Z

Building on excellent posts here, here and here and feedback on the forums here, I am going to describe our Operations manager 2007 syslog setup.

First step was to build a group of servers that will be our Syslog collectors in Opsmgr. Populate your Syslog Collectors group w/ the servers you will be pointing your syslog messages towards. I created a new management pack called _Default_Syslog that will hold all the work in this section.

Once I have my group, I want to create a new rule. Under the rule wizard, I select Alert Generating Rules –> Event Based-> Syslog (Alert).

I am going to have 3 Syslog rule. One for each state, warning, error and informational. The first rule I am making is the error rule. So we are going to name it, Syslog Error. (I know, imaginative)

Since I am collecting Alerts, it seems “Alert” would be a good rule target but I will admit to being a bit hazy on this area of SCOM and what it implies. If you know better, please let me know.

For rule target, I am just going to pick Windows Computers. Note that at some point I tried to target this at the Agent and this caused problems when I wanted to use a Management server as a collector. To quote Graham Davies from the System Center Operations Manager General forums:

If you want the rule to run on the RMS \ Gateway then you'll need to target the appropriate class - management server. Although the Management Servers include "agent capability", they are not agents and hence won't get the rule if you target agent.

MAKE SURE you unselect Rule is Enabled or you will turn on syslog collection for all of your servers. We will override to turn on these rules for our specific group later.

For Event Expressions, I want to catch all events w/ a Severity of less than or equal to 3. So I build my Filter like so:

For my alerts, I like to get more data so I am going to put the following in the description:

Facility:
$Data/EventData/DataItem/Facility$
Severity:
$Data/EventData/DataItem/Severity$
Priority:
$Data/EventData/DataItem/Priority$
Priority Name
$Data/EventData/DataItem/PriorityName$
Time Generated:
$Data/EventData/DataItem/TimeStamp$
Hostname:
$Data/EventData/DataItem/HostName$
Message:
$Data/EventData/DataItem/Message$

Click create to finish the wizard.

Repeat the above for the Warning Alerts. You will only need to change the Name, the severity on the alert and make your Filter equal to 4 like so:

And again for your Informational alerts. Your filter will be greater than or equal to 5 and don’t forget to change your severity.

I chose to capture these as infomational alerts for now, I am going to see how spammy this gets. another option is to create these as Event collection rules without alerts. That will allow you to hold on to the data but not alert on it. It will depend on your alerting requirements. You can also manage what you send from your sending device’s syslog configuration.

To enable these rules on specific servers, right click on your rule and choose ‘Overrides’ –> Override the Rule –> For a group…

Select your Syslog Servers group and override the rule to enable it on these servers.

You can verify that the syslog listener is enabled by getting on the machine you expect to be listening and checking for UDP 514 in netstat. Open a command windows and type ‘netstat –an | findstr 514’ (findstr = grep). You want to see a line like the below. If you don't get anything, you are not listening for syslog packets.

In order to make this easy to see, I also created a view. Under the SCOM Console Monitoring view, find your _default_syslog folder –> right click –> New –> Alert View. Include alerts ‘created by specific sources’. Pick your rules that you just created.

You should end up w/ a view like (your source will probably be a computer name):

More info I found two ways to display more info in the line. The first way is the most straightforward and I typed it up first so I am going to show it anyway. You probably want the second way. B)
The first way:

You can add more information to your alert and then set your view to show it. Under your alert configuration, you can add custom alert fields. I added fields for both my hostname and my priority name.

Send a few more test syslogs. BTW, the kiwi syslog generator works perfectly for this. Update your view so that you show Custom Field 1 and Custom Field 2 from the Display tab under your view properties.

Note that for some reason my extra columns were not displaying initially. I had to delete and recreate the view. Since my source was always the same, I also stopped showing the source. You can see the syslog entry created after the change has populated the custom fields:

The second way:

This initially involved some (simple) XML munging so I was going to have an advanced and a simple method, the simple being the one above. Once I figured out how in the XML, it turns out you can do it in the GUI as well.

I first exported the MP and saw the below XML

<Name>Syslog Error</Name>
<Description>Facility:
{0}
Severity:
{1}
Priority:
{2}
Priority Name
{3}
Time Generated:
{4}
Hostname:
{5}
Message:
{6}</Description>

Note that the curly bracked enclosed items are expanded to our variables. So {5} is analogous to $Data/EventData/DataItem/HostName$ in our GUI based alert description. Putting $Data/EventData/DataItem/HostName$ in the alert name doesn’t work but putting {5} does. So I changed the XML to

<Name>Syslog Error: {5} - {3}</Name>
<Description>Facility:
{0}
Severity:
{1}
Priority:
{2}
Priority Name
{3}
Time Generated:
{4}
Hostname:
{5}
Message:
{6}</Description>

When I checked my alert view, voila!, My alert name has changed as in the screen shot below. My next thought was why can’t I do that from the gui? So, i edited my alert name to be: Syslog Warning: {5} - {3}

Back to my alert view and, check it out, useful alert names!! Maybe I am too excited about this but it makes it much more supportable in my opinion. B)

One note, I am putting the syslog collector on other running servers. We have only a few devices that are sending data here and only critical events are expected. YMMV, you may want to dedicate a server to this.

Using Powershell to create groups, populate groups and retrieve LDAP distinguished names

2010-05-06T13:59:00.002Z

Update: 20100507 - updated the sam search string to do fuzzy matching.

A couple more functions I needed during a recent project. Using powershell of course, we needed to create a group in ad in a specific OU. We also wanted to populate that group. To do the second, I needed a helper function to get the distinguished name of a group or user. I leverage two main sites for most of these with some light modifications.

For create group we pass it the name of our new group and the OU we want to create our group in, such as:

Create-group “Newgroup” “OU=ServerGroups,DC=example,DC=com”

function create-group ($groupname, $strOU) {

$OU = [adsi]"LDAP://$strOU"

$group = $ou.Create("Group", "CN=$groupname")

$group.setinfo()

$g2 = [adsi]"LDAP://CN=$groupname,$strOU"

$g2.sAMAccountName = $groupname

$g2.setinfo()

Write-Host "Created $groupname in $strOU"

}

For add-usertogroup we pass it a user DN. DNs are the full LDAP distinguished name like:

LDAP://CN=myuser,OU=Admins,DC=example,DC=com

So we would pass something like

Add-usertogroup “LDAP://CN=myuser,OU=Admins,DC=example,DC=com” “LDAP://CN=Newgroup,OU=ServerGroups,DC=example,DC=com”

That is kind of annoying so you could also use the get-dn function below.

The safe way:

$userDN = get-dn "myuser"

$groupDN = get-dn "newgroup"

add-usertogroup $userDN $groupDN

or the one liner

add-usertogroup (get-dn "myuser") (get-dn "newgroup")

function add-usertogroup ($userDN, $groupDN) {

$user = [adsi]$userDN

$group = [adsi]$groupDN

Write-Host "Adding $($user.cn) to $($group.cn)"

$members = $group.member

$group.member = $members+$user.distinguishedName

$group.setinfo()

}

I would further note this excellent site describing how to write an LDAP filter. It cleared a few things up for me at long last. I can’t believe I never realized that & was a logical AND... Pretty straightforward afterwards but the writeup above helped me bridge the gap. Note that it is for some software or other so ignore the part about escaping the special characters at the top. B)

function get-dn ($SAMName)

{

$root = [ADSI]''

$searcher = new-object System.DirectoryServices.DirectorySearcher($root)

   #note: if you don't want fuzzy searches, remove the *s from the line below.
   #this will force a match of the search string only - thanks jc for the tip
   $searcher.filter = "(&(|(objectClass=user)(objectClass=group))(sAMAccountName=*$SAMName*))"

$user = $searcher.findall()

if ($user.count -gt 1)

{

$count = 0

foreach($i in $user)

{

write-host $count ": " $i.path

$count = $count + 1

}

$selection = Read-Host "Please select item: "

return $user[$selection].path

} else {

return $user[0].path

}

Note that it matches the SAM Account Name (aka the ‘Pre-Windows 2000’ name in the AD snapin)

Enjoy

Use powershell to quickly backup all TFS Work Item Types

2010-05-05T09:59:00.005Z

Hey all,
Just a quickie to easily backup all your current work items from all projects in Team Foundation Server 2008 SP1. I wanted to do this ahead of a big migration and I am adverse to manual labor.

It starts w/ a function i found a couple years ago. I don’t recall where or I would give credit here. It is very useful for any tfs powershell manipulation.

Edit below to enter your $TFSHost and update your path if necessary. I recommend running from a blank directory. It will create a directory for each project and export each WIT for that project to the respective directories.

Update: I added another function from my library test-win32 and had that manage the default paths for x64 and x86 archs.

Good luck

$tfshost = "thshost"

function Test-Win32() {

return [IntPtr]::size -eq 4

}

if (test-win32) {

$tfstoolspath = "C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE"

} else {

$tfstoolspath = "C:\Program Files (x86)\Microsoft Visual Studio 9.0\Common7\IDE"

}

function get-tfs {

#10-08 - cornasdf - i stole this from the web but this is a great way to connect to TFS

# in your code you use: $tfs = get-tfs $TFSHost

#some quick examples from resolvedticketsmail.ps1:

#get select from Stored query

#$query = $tfs.WIT.Projects[$ProjectHoldingQuery].StoredQueries | where{$_.Name -eq $QueryViewName}

#get results of specified query

#$oldTickets = $tfs.WIT.Query($query.QueryText)

param(

[string] $serverName = $(throw 'serverName is required')

)

begin

{

# load the required dll

[void][System.Reflection.Assembly]::LoadWithPartialName("Microsoft.TeamFoundation.Client")

$propertiesToAdd = (

('VCS', 'Microsoft.TeamFoundation.VersionControl.Client', 'Microsoft.TeamFoundation.VersionControl.Client.VersionControlServer'),

('WIT', 'Microsoft.TeamFoundation.WorkItemTracking.Client', 'Microsoft.TeamFoundation.WorkItemTracking.Client.WorkItemStore'),

('CSS', 'Microsoft.TeamFoundation', 'Microsoft.TeamFoundation.Server.ICommonStructureService'),

('GSS', 'Microsoft.TeamFoundation', 'Microsoft.TeamFoundation.Server.IGroupSecurityService')

)

}

process

{

# fetch the TFS instance, but add some useful properties to make life easier

# Make sure to "promote" it to a psobject now to make later modification easier

[psobject] $tfs = [Microsoft.TeamFoundation.Client.TeamFoundationServerFactory]::GetServer($serverName)

foreach ($entry in $propertiesToAdd) {

$scriptBlock = '

[System.Reflection.Assembly]::LoadWithPartialName("{0}") > $null

$this.GetService([{1}])

' -f $entry[1],$entry[2]

$tfs | add-member scriptproperty $entry[0] $ExecutionContext.InvokeCommand.NewScriptBlock($scriptBlock)

}

return $tfs

}

$tfs = get-tfs $tfshost

$projects = $tfs.wit.Projects

foreach ($proj in $projects) {

if ( -not (Test-Path -path .\$($proj.Name))) {

New-Item .\$($proj.Name) -type directory

}

foreach ($wit in $proj.WorkItemTypes) {

"Exporting $($proj.Name) : $($wit.Name) -> .\$($proj.Name)\$($wit.Name).xml"

& "$tfstoolspath\witexport.exe" /p "$($proj.Name)" /n "$($wit.Name)" /f ".\$($proj.Name)\$($wit.Name).xml" /t $tfshost

}

Systems Center Operations Manager R2 CU1 Issues and command line update

2010-04-20T13:42:00.001Z

Just a quick one on our recent opsmgr R2 CU1 update.

Kevin Holman has a good post about his experiences. Start here. I would add the below

1. The gateway update does not copy the update msp to the agentmanagement folder. Due to this, when I approved updates for agents on the other side of a gateway, they did not get the update. You could fix this by copying the files from your gateway server before you approve your pending agent updates. Copy the files at c:\Program Files\System Center 2007 R2 Hotfix Utility\KB974144\agent to the appropriate directory under c:\Program Files\System Center Operations Manager 2007\AgentManagement. Make sure you copy the x86 update to the x86 folder. x64 goes in AMD64 and ia64 goes in ia64.

2. Only remotely managed agents will offer an update. In my case, my only agents that were manually installed were due to troubleshooting or other issues. Another solution from Kevin Holman shows how to reset your agents to be remotely managed. Pay attention to the whole post to make sure it is right for you.

3. If you didn’t realize your gateways were not updated (like me) or put in the wrong password for one of your domains, you may need to update manually. You can go on each server and run the installer and then choose install agent but that seemed annoying. You can do it from the server over the network w/:

"\\GATEWAYSERVER\c$\Program Files\System Center 2007 R2 Hotfix Utility\KB974144\SetupUpdateOM.exe" /silent /x86msp:KB974144-x86.msp /amd64msp:KB974144-x64.msp /UpdateAgent

4. or you can do what I did and psexec it w/:

psexec -u DOMAIN\user "\\comp1,comp2,compN" cmd /c "\\GATEWAYSERVER\c$\Program Files\System Center 2007 R2 Hotfix Utility\KB974144\SetupUpdateOM.exe" /silent /x86msp:KB974144-x86.msp /amd64msp:KB974144-x64.msp /UpdateAgent

Note that you need to pass the user to psexec (which will query for a password) so you can access network resources. Also note that I needed to enclose my computer list in “ to get it to pass correctly. YMMV.

Also note that this will not work w/ 2k8+ clients as UAC gets in the way. You could add –s to the the psexec line but then you would need a file share that the machine accounts could get at. You could also probably do a small script that did a net use and then accessed the files. I cheesed out and logged on directly as I only had a few that needed to be done manually.

Good luck.

How does windows determine a cipher strength for an encrypted connection OR SQL Server data in transit cipher strength

2010-04-15T12:24:00.005Z

This question is really just “how does windows determine a cipher strength for an encrypted connection” as SQL server just hands off to the windows schannel.dll to deal w/ this. But I was looking to determine the answer for SQL Data in transit encryption.

This was pretty muddy to track down. There are some reference details here, here and here.

At the end of the day, it comes down to an OS version question (potentially influenced by some OS/registry settings or patches). I couldn’t find any matrix anywhere so I am going to start one here. I am going to start out w/ the few I tested and hopefully fill this in w/ reader submissions (hint, hint). The guidance I can find seems to say that Win 2k8R2 and Win 7 have the same schannel capabilities so I am going to list them together.

Client\Server	Windows 2008 R2	Windows 2003 SP2	Windows 2000 SP4
Windows 2008R2/7	TLS_RSA_WITH_AES_128_CBC_SHA	SSL_RSA_WITH_RC4_128_MD5	SSL_RSA_WITH_RC4_128_MD5
Windows 2003 SP2	SSL_RSA_WITH_RC4_128_SHA	SSL_RSA_WITH_RC4_128_MD5	SSL_RSA_WITH_RC4_128_MD5
Windows XP SP3	SSL_RSA_WITH_RC4_128_SHA	SSL_RSA_WITH_RC4_128_MD5	SSL_RSA_WITH_RC4_128_SHA

How to use this table: Find the client OS listed vertically down the left side and then find the server OS listed horizontally across the top. Where the row and column meet is your the cipher which, under the default settings, they should negotiate to use. More on the ciphers here.

How did we determine this? The only way I was able to find was to sniff the beginning of the SSL conversation. Netmon 3.3 is an excellent tool for this. Note that you may need to set your Windows parsers from stub to full in order to decrypt the TDS packets. You can do this in Tools -> options -> Parser. Set Windows to ‘Full’

Start your trace before you start your encrypted connection. I like netmon b/c it will separate the network traffic into conversations. Find the conversation you are looking for by IP and port. For my purposes I was looking for my web server IP and my DB IP going to port 1433 on my DB.

Once you have found your conversation, you are going to want to find the SSL conversation. In netmon, it will look like this:

What happens here, generally, is that the client offers a list of supported ciphers in the SSL: Client Hello. In netmon, you can see this by selecting that packet as I have done above. In the ‘Frame details’ pane, you can expand ssl: Client Hello.–> TlsRecordLayer: –> SSLHandshake –> Client Hello:. You should see a list of CipherSuites listed in order of preference. See the bottom of the picture below.

The server will respond with cipher it wants. You can see this in the (likely) next packet under ssl –> TlsRecofdLayer-> SSLHandshake –> ServerHello –> CipherSuite. In this case, both client and server are running Win 2k8 r2.

As you can see, between Win 2k8r2 and Win 2k8r2 we attain TLS_RSA_WITH_AES_128_CBC_SHA.
There are several methods to influence the SSL Handshake. The links above will be useful in starting that journey.

One note on AES-128 cipher strength. For a measure of scale, a computer with a billion processing elements, each capable of trying a billion keys every second, would be able to try (2^60 keys/second). That means it would take (2^128 keys) / (2^60 keys/second) = 2^68 seconds to brute-force check all 128-bit keys. That is about 10^13 years to crack the key, or about 1000 times the age of the universe. Realistically, you would only need to try half the keys on average so that would be 500 times the age of the universe.

Or you could find a flaw in the algorithm...
or steal the certificate/password...

Using powershell to get ntfs info (such as cluster size)

2010-03-31T16:43:00.006Z

20100331 - slight update. Converting the hex items to dec and allowing passing of multiple drives.

A new function for my library. Base idea copped from Jacques Barathon [MS] at the bottom of this thread and hashed out to get all the properties.

function get-ntfsinfo {

param ([char[]]$drive = "c")

$drive | foreach {

if (test-path "$($_):") {

$cs = new-object PSObject

$cs | add-member NoteProperty Drive $_

$output = (fsutil fsinfo ntfsinfo "$($_):")

foreach ($line in $output) {

$info = $line.split(':')

#if the value is hex, convert to dec and put hex in ()

if ($info[1].trim().startswith('0x0')) {

$info[1] = [Convert]::ToInt32(($info[1].Trim()),16).toString() + " (" + $info[1].Trim().toString() + ")"

}

$cs | add-member NoteProperty $info[0].trim().Replace(' ','_') $info[1].trim()

$info = $null

}

$cs

} else {

throw "Drive '$_' not found"

}

A basic run gives you:
PS C:\Windows\system32> get-ntfsinfo e

Drive                           : e
NTFS_Volume_Serial_Number       : 0xeabe7aefbe7ab423
Version                         : 3.1
Number_Sectors                  : 558614527 (0x00000000214bc7ff)
Total_Clusters                  : 69826815 (0x00000000042978ff)
Free_Clusters                   : 36249097 (0x0000000002291e09)
Total_Reserved                  : 0 (0x0000000000000000)
Bytes_Per_Sector                : 512
Bytes_Per_Cluster               : 4096
Bytes_Per_FileRecord_Segment    : 1024
Clusters_Per_FileRecord_Segment : 0
Mft_Valid_Data_Length           : 262144 (0x0000000000040000)
Mft_Start_Lcn                   : 786432 (0x00000000000c0000)
Mft2_Start_Lcn                  : 2 (0x0000000000000002)
Mft_Zone_Start                  : 786496 (0x00000000000c0040)
Mft_Zone_End                    : 837664 (0x00000000000cc820)
RM_Identifier                   : 04E578BF-2D2F-11DF-9782-18A9055883A2

But the nice thing here is being able to say
PS C:\Windows\system32> (get-ntfsinfo e).Bytes_Per_Cluster
4096

I then looped it to check cluster size (what I really wanted) on each drive on the server.

foreach ($drive in Get-PSDrive | where {$_.Provider.name -eq "FileSystem"}) {

if ($drive.free -ne $null) {

"$drive - $((get-ntfsinfo $drive.name).bytes_per_cluster)"

}

gives output like:

C - 4096

E - 4096

G - 65536

J - 4096

K - 4096

L - 4096

M - 65536

N - 65536

O - 65536

Q - 4096

S - 65536

T - 65536

Z – 4096

Let me know if you use it…

powershell: delete files older than X

2010-03-29T17:09:00.005Z

It really is that easy.

Get-ChildItem $env:temp/myfiles | where {$_.Lastwritetime -lt (date).addminutes(-15)} | remove-item

Everybody has needed the 'delete files older than X' script. One more thing that is easier in powershell. In this case I have $env:temp/myfiles as my directory containing the files. I could also add -recurse to get-childitem if I wanted to get subdirectories as well. Anonymous noted below that you can add a test to exclude directories if you just want to clean the files out of the directory structure. I am using addminutes to delete files older than now - 15 minutes but you have other options. More on that here.

Note that if we want to delete all files older than X we would use -lt. ie, the timestamp of the file is older than 15 minutes ago. If we want to delete files newer than X we would use -gt. ie, the timestamp of the file is newer than 15 minutes ago. X, in our case, is the time now minus 15 minutes.

We are going to 'at' it. Although the Vista and later scheduling engine is vastly improved and renamed to schtasks.

We are going to run this every 15 minutes.
schtasks /create /ru "NT Authority\NETWORK SERVICE" /F /sc daily /mo 1 /ri 15 /st 00:00 /du 0023:50 /tr "powershell -command {

Get-ChildItem $env:temp/myfiles | where {`$_.Lastwritetime -lt (date).addminutes(-15)} | remove-item -recurse" /TN "File Delete"}

Updated: 20110310 - fixed some issues w/ the schtask line (notice the `) and added a note about the pscontainers test noted by anonymous below.