A Great Write-Up on WMI Events and PowerShell 2.0

I haven't been inspired to do a full post in a while, but I stumbled across this article by Trevor Sullivan today, and I thought I'd point it out for those of you that are interested.

PowerShell: Getting Started with WMI Events

Working with CSV Files

It's been a while since I had an update to the blog, and I've been waiting for something to jump out at me. Today I read on the news that the White House has released some visitor logs to the public, and they are making them available for download as a CSV file, and it piqued my interest, so I downloaded the file.

PowerShell v1 and v2 both have a module called Import-CSV that makes it ridiculously easy to work with CSV files. They will slurp up the file and output an array of objects, one per row, with properties that correspond to the columns in the file.

Let's import the file and look at a record:

PS> $visitors = Import-Csv .\10-30-waves-posting.csv

PS> $visitors[-1]

NAMELAST : ZIMPHER

NAMEFIRST : NANCY

NAMEMID : L

UIN : U81194

BDGNBR : 72400

ACCESS_TYPE : VA

TOA : 4/1/20091:45:42PM

POA : D0102

TOD : 4/1/20095:50:21PM

POD : D1

APPT_MADE_DATE : 3/25/20095:07:33PM

APPT_START_DATE : 4/1/20092:00:00PM

APPT_END_DATE : 4/1/200911:59:00PM

APPT_CANCEL_DATE :

Total_People : 3

LAST_UPDATEDBY : J7

POST : WIN

LastEntryDate : 3/25/20095:08:57PM

TERMINAL_SUFFIX : J7

visitee_namelast : DOUGLAS

visitee_namefirst : DEREK

MEETING_LOC : OEOB

MEETING_ROOM : 459

CALLER_NAME_LAST : WILKINS

CALLER_NAME_FIRST : ELIZABETH

CALLER_ROOM :

Description :

Interesting. I wonder, who had the most visitors (I snipped out the middle of the results)?

PS> $visitors |

Group-Object visitee_namelast |

Sort-Object Count |

Select-Object Count, Name

Count Name

----- ----

1 ANDREW

1 LONG

1 BINNIX

1 BREWER

...

7 'SUMMERS'

7 JARRETT

8 'POTUS/FLOTUS'

8 'EMANUEL'

9 POTUS/FLOTUS

9 'DOEBLER'

10 DOEBLER

10 'TCHEN'

12 TCHEN

42 'POTUS'

56 POTUS

69 OFFICE

211

Uh oh. There's something funky about this file. There are empty lines, and it's inconsistent about when it puts quotes around text fields. I'm pretty sure we don't have any fields with commas in them, so let's try stripping out any lines that only have whitespace and/or commas in them and then strip out single quotes from the rest of the lines:

PS> Get-Content .\10-30-waves-posting.csv |

?{$_ -notmatch '^(\s|,)*$'} |

%{$_.replace("'", '')} > wh.csv

** Note: that regex after -notmatch above can be read as:

^ start at the beginning of the string

(\s|,)* zero or more whitespace or comma characters

$ the end of the string

There. Now we can try that again, using our new file (snipped for length again).

PS> $visitors = Import-CSV .\wh.csv

PS> $visitors |

Group-Object visitee_namelast |

Sort-Object Count |

Select-Object Count, Name

Count Name

----- ----

1 SHAH

1 LONG

1 PETER

1 ANDREW

...

19 DOEBLER

22 TCHEN

69 OFFICE

98 POTUS

So now we know that the person with the largest number of visitors was the President of the United States of America. Hardly surprising, but you can easily explore this data with PowerShell. Here are a few more queries you might try:

Look at the records of the visits to the President

PS> $visitors |

?{$_.visitee_namelast -eq 'POTUS'}

How many visits occurred in July?

PS> $visitors |

?{$_.APPT_START_DATE -match '^7/'} |

sort APPT_START_DATE |

select NAMELAST, NAMEFIRST, APPT_START_DATE

What was the description given of the appointments for meeting the President?

PS> $visitors |

?{$_.visitee_namelast -eq 'POTUS'} |

select APPT_START_DATE, NAMEFIRST, NAMELAST, Description |

sort APPT_START_DATE

Hopefully this gives you a good idea of how you can manipulate CSV data using PowerShell using Import-CSV and a little filtering.

A Regular Expression Cheat Sheet for PowerShell

Okay, so there's really not much that is PowerShell-specific about this cheat sheet, but I wrote it up in response to a post on microsoft.public.windows.powershell, and I thought I'd share it here, since I know a lot of new PowerShell users haven't been exposed to Regular Expressions very much.

This is not meant as an exhaustive reference on regular expressions, but just something that may be helpful if you get a little stuck. I hope you find it helpful.

1. What kind of character is it?

[] - any of the characters inside the brackets will match

(use the dash to indicate a range)

Examples: [a-z] will match any letter.

[aeiou] will match any vowel

\w - "word" characters. Basically matches [a-z0-9_]

\s - "whitespace" characters. matches spaces, tabs, etc.

\d - any digit. Basically matches [0-9]

\t - a tab character

. - any character

2. How many characters?

(the below appear after the character class)

{x} - matches x number of characters

{x, y} - matches minimum x number of characters, maximum y characters

Examples: \d{4} matches 4 digits

* - matches ZERO or more of the character (as many as possible)

+ - matches ONE or more of the character (as many as possible)

*? - matches ZERO or more characters (as few as possible)

+? - matches ONE or more characters (as few as possible)

3. Where is the character?

\b - matches a word boundary, without actually absorbing any characters

^ - matches the beginning of a string

$ - matches the end of a string

4. Grouping

() - any characters between the parentheses will be their own group

(try checking the value of $matches after using -match)

| - a pipe character is the OR character

Example: (one|two) will match the word "one" or the word "two"

Add a List of Users to the Local Admins Group

Just a quick update here, and another real-world example of where the Split() method of a string can come in handy for day-to-day tasks.

Today I had to add a list of about 20 individual usernames as administrators to a particular machine. Someone sent me the comma-separated list in an IM, and it took me about ten seconds:

PS> 'user1,user2,user3,user4,user5,user6,user7,user8,user9,user10'.split(',') |

>> %{net localgroup administrators $_ /add}

The command completed successfully.

The command completed successfully.

The command completed successfully.

The command completed successfully.

The command completed successfully.

The command completed successfully.

The command completed successfully.

The command completed successfully.

The command completed successfully.

The command completed successfully.

Use PowerShell to Get Local Group Members from a Remote Computer

I had a friend ask me recently how to get a list of administrators from a server.

"That's easy" I thought. "You just have to... um... actually..."

It turns out that this can be frustratingly difficult in PowerShell, so I wrote this module to make it easier when I'll need to do this in the future. It's comprised of three functions:

• Add-NoteProperty: About 90% of the time when I want to create a custom PSObject and add some properties, they're all NoteProperties. This function makes adding a property easy, like so: Add-NoteProperty $my_object 'PropertyName' $property
• Get-COMProperty: This is a kludgy hack to get around the fact that members of groups gotten through ADSI get returned as __ComObject objects, and you have to call the InvokeMember() static method of the class in order to get at their properties. Now I can just do this: Get-COMProperty $com_object 'PropertyName'
• Get-LocalGroups: This is the function that we needed. It returns a list of custom PSObjects representing the local groups on a server, and each one has a property called Members that is a list of custom PSObjects for each member, including the Name, Domain, and ADSPath. From there, you can use whatever method you want to the object you want, whether it's using Get-QADUser for domain users, or whatever, for example: Get-LocalGroups computername.

If you're using Powershell v2 CTP3 or higher, you can use help on each of the functions to see examples if you forget. You can download the module from Poshcode.org here.

String Manipulation: Splitting and Joining Strings

I think it's time to get back to some more basic things, so let's get to it.

The split()method of a string object lets you define a delimiter and "split" the string up into multiple pieces, which are returned as an array.

Let's say I do this:

PS C:\Users\tojo2000> $string = "one two three four"

PS C:\Users\tojo2000> $string.split(" ")

one

two

three

four

As it turns out, though, split() splits on a single whitespace character by default.

Observe:

PS C:\Users\tojo2000> $string = "one two three four six"

PS C:\Users\tojo2000> $string.split()

one

two

three

four

six

What's the practical use for this? Let's say you have a tab-separated values file called people.txt that looks like this:

Doe John California

Doe Jane Texas

Neuman Alfred Nebraska

And you want the output to be First Last, Location. You could do it like so:

PS C:\Users\tojo2000> Get-Content people.txt |

>> %{$data = $_.split("`t"); Write-Output "$($data[1]) $($data[0]), $($data[2])"}

>>

John Doe, California

Jane Doe, Texas

Alfred Neuman, Nebraska

But what if you have a file like this called people2.txt (let's say the first part is some kind of ID)?

2323:Doe John California

827:Doe Jane Texas

982982:Neuman Alfred Nebraska

Now you have two delimiters, but the split() method of a string object takes a string as an argument, so you would have to split twice in order to get each part of the string split into an array. If only there was some way to split on a regular expression... Oh, wait, there is.

PS C:\Users\tojo2000> Get-Content people2.txt |

>> %{$data = [regex]::split($_, '\t|:'); Write-Output "$($data[2]) $($data[1]), $($data[3])"}

>>

John Doe, California

Jane Doe, Texas

Alfred Neuman, Nebraska

('\t|:' is a regular expression for a tab character or a colon)

What if you have an array, and you want to make a string out of it? Then you can join the strings together using join(). Now there are two ways to join a list of strings, depending on whether you're using PowerShell v1 or v2.

The first way works in both v1 and v2:

PS C:\Users\tojo2000> $buncha_strings = 'one', 'two', 'three', 'four', 'five', 'six'

PS C:\Users\tojo2000> [string]::join(' and a ', $buncha_strings)

one and a two and a three and a four and a five and a six

So what practical use would there be? For a completely contrived example, maybe you want to create a new version of people2.txt called people3.txt that uses pipe characters to separate the fields. We'll split the strings up into an array just like before, but then we'll join them back together the way we want them.

PS C:\Users\tojo2000> Get-Content people2.txt |

>> %{$data = [regex]::split($_, '\t|:'); [string]::join('|', $data)} > people3.txt

PS C:\Users\tjo2000> Get-Content .\people3.txt

2323|Doe|John|California

827|Doe|Jane|Texas

982982|Neuman|Alfred|Nebraska

There is one more way that you can join a list of strings, but this method only works in v2: the -join operator. It works the same way as the other join(), but the syntax is slightly different.

For example, here is how you would join a list of strings by tab characters:

PS C:\Users\tojo2000> $list_of_strings -join "`t"

So to wrap this all up, let me give a real-world example. I had a SQL query that I wanted to run that would retrieve the SCCM information for a specific list of computers. I needed to update the list, and I had the computers in a file called machines.txt, with one name per line.

Here's how I slurped up the file to create the new query string:

$query = @"

SELECT * FROM v_R_System

WHERE Netbios_Name0

IN ('{0}')

"@ -f ((Get-Content machines.txt) -join "', '")

Super Duper Over-Engineered Egg Timer

This was my submission for Event 10 Beginner of the 2009 Scripting Games this year. I usedPrimalForms to design the form and generate the boilerplate code. It's a really great tool.

I added the timer functionality myself. The Windows.Forms.Timer object is very simple. You tell it how frequent to set the ticks, set it to enabled or disabled, and call Start() to kick it off. The Timer itself doesn't keep track of how long it has been going, you do that by adding an event handler for the Tick event. You do that as seen on line 5 below, by calling add_tick() on the Timer object and passing it a script block that will be called every time the event fires. As far as I can tell this should work for any Windows.Forms object, calling add_event(), where "event" is the name of the event you are adding a handler for. The interval is in miliseconds, so in this case

the scriptblock $timer1_OnTick will be called once every second.

I went ahead and gathered the relevant lines in one place below so it's easier to see what I did. They're kind of spread around in the actual script.

1. $timer1 = New-Object System.Windows.Forms.Timer
2. $timer1.Enabled = $true
3. $timer1.Start()
4. $timer1.Interval = 1000
5. $timer1.add_tick($timer1_OnTick)