jbits.se

Run this script on a dfsr-member to check status of all dfs replications. 

$RGroups = Get-WmiObject -Namespace "root\MicrosoftDFS" -Query "SELECT * FROM DfsrReplicationGroupConfig"
$ComputerName=$env:ComputerName
$Succ=0
$Warn=0
$Err=0

foreach ($Group in $RGroups)
{
$RGFoldersWMIQ = "SELECT * FROM DfsrReplicatedFolderConfig WHERE ReplicationGroupGUID='" + $Group.ReplicationGroupGUID + "'"
$RGFolders = Get-WmiObject -Namespace "root\MicrosoftDFS" -Query  $RGFoldersWMIQ
$RGConnectionsWMIQ = "SELECT * FROM DfsrConnectionConfig WHERE ReplicationGroupGUID='"+ $Group.ReplicationGroupGUID + "'"
$RGConnections = Get-WmiObject -Namespace "root\MicrosoftDFS" -Query  $RGConnectionsWMIQ
foreach ($Connection in $RGConnections)
{
$ConnectionName = $Connection.PartnerName.Trim()
if ($Connection.Enabled -eq $True)
{
if (((New-Object System.Net.NetworkInformation.ping).send("$ConnectionName")).Status -eq "Success")
{
foreach ($Folder in $RGFolders)
{
$RGName = $Group.ReplicationGroupName
$RFName = $Folder.ReplicatedFolderName

if ($Connection.Inbound -eq $True)
{
$SendingMember = $ConnectionName
$ReceivingMember = $ComputerName
$Direction="inbound"
}
else
{
$SendingMember = $ComputerName
$ReceivingMember = $ConnectionName
$Direction="outbound"
}

$BLCommand = "dfsrdiag Backlog /RGName:'" + $RGName + "' /RFName:'" + $RFName + "' /SendingMember:" + $SendingMember + " /ReceivingMember:" + $ReceivingMember
$Backlog = Invoke-Expression -Command $BLCommand

$BackLogFilecount = 0
foreach ($item in $Backlog)
{
if ($item -ilike "*Backlog File count*")
{
$BacklogFileCount = [int]$Item.Split(":")[1].Trim()
}
}

     if ($BacklogFileCount -eq 0)
{
$Color="white"
$Succ=$Succ+1
}
elseif ($BacklogFilecount -lt 10)
{
$Color="yellow"
$Warn=$Warn+1
}
else
{
$Color="red"
$Err=$Err+1
}
Write-Host "$BacklogFileCount files in backlog $SendingMember->$ReceivingMember for $RGName" -fore $Color

} # Closing iterate through all folders
} # Closing  If replies to ping
} # Closing  If Connection enabled
} # Closing iteration through all connections
} # Closing iteration through all groups
Write-Host "$Succ successful, $Warn warnings and $Err errors from $($Succ+$Warn+$Err) replications."

Download from the following link, note that it's only supported on W2k8R2
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=45105d7f-8c6c-4666-a305-c8189062a0d0

Use this script to remind users logging on to Mgmt or TS machines to keep their profile and recycle bin size down. 

# Disk Space Dictator (tm)
# (c) 2011 / jbjorkman

$PSWarning=199
$RSWarning=99

[reflection.assembly]::loadwithpartialname("System.Windows.Forms")
[reflection.assembly]::loadwithpartialname("System.Drawing")
$ProfileSize=[math]::truncate((New-Object -com Scripting.FileSystemObject).GetFolder($Env:Userprofile).Size/1024/1024)
$RecyclerSize=[math]::truncate((New-Object -com Scripting.FileSystemObject).GetFolder("C:\RECYCLER\"+(new-object system.security.principal.NtAccount($Env:userName)).translate([system.security.principal.securityidentifier]).Value).Size/1024/1024)
$msg="Please help keep disk space usage down.`r`n`r`n"
$msg=$msg+"This popup will warn you if your profile exceeds 200Mb,`r`n"
$msg=$msg+"or if your system drive recycle bin exceeds 100Mb.`r`n"

$Warn=$False
If ($ProfileSize -gt $PSWarning) { $msg=$msg+"`r`nYour profile is $ProfileSize Mb." ; $Warn=$true}
If ($RecyclerSize -gt $RSWarning) { $msg=$msg+"`r`nYou have $RecyclerSize Mb in the recycle bin" ; $Warn=$true}
If($Warn) {
 $icon=[system.drawing.icon]::ExtractAssociatedIcon((join-path $pshome powershell.exe))
 $notify = new-object system.windows.forms.notifyicon
 $notify.icon = $icon
 $notify.visible = $true
 $notify.showballoontip(20,"Disk Space Dictator (tm)",$msg, [system.windows.forms.tooltipicon]::Info)
 Start-sleep 15
 $notify.visible=$false
}

Powershell packet capture script written by Robbie Foust.

http://blog.robbiefoust.com/?p=68

Start capture of everything on interface outside:
#capture CAPFILE interface outside packet-length 1500 buffer 8192

Start capture on interface outside using access-list (define access-list first):
#capture CAPFILE interface outside packet-length 1500 access-list 345 buffer 8192

Stop capture
# no capture CAPFILE interface outside
Fire up a browser and go to the following URL to fetch your capture (Other protocols can be used too):
https://ASA-IP/capture/CAPFILE/pcap

Clean up
# no capture MYCAP

Typeperf is a command to echo performance counter data out to console (can also output to file or sql)

typeperf "\Processor(_Total)\% Processor Time" -si 0:0:5 -sc 5

Normal behaviour for Windows 2008 onwards is to register all IPs for a certain adapter in DNS if dynamic dns registration is enabled.
To prevent this behaviour you need to install below mentioned hotfix and add the addresses using the following netsh syntax:

Netsh int ipv4 add address skipassource=true
http://support.microsoft.com/kb/975808/EN-US

By default, IIS will bind a certain port to all IPs sharing NIC.
To disable this behaviour you need to disable socket pooling.
You do this providing a list of ip:port pairs to listen to, with socket pooling enabled the list is usually empty

For IIS6 you can use httpcfg.exe from support tools.
httpcfg.exe set iplisten -i 0.0.0.0:80
httpcfg.exe set iplisten -i 10.0.0.1:443

For IIS7 you use netsh
netsh http add iplisten ipaddress=0.0.0.0:80
netsh http add iplisten ipaddress=10.0.0.1:443

http://support.microsoft.com/kb/238131

To clear all currently registered eventhandlers:
Get-EventSubscriber | % {Unregister-Event $_.SubscriptionID}

Capture Service Status changes (Example uses Wireless Zero Configuration):
Register-WmiEvent -Query "select * from __InstanceModificationEvent within 2 where targetinstance isa 'win32_service' and targetinstance.name= 'WZCSVC'" -sourceIdentifier "WZCSVC Status" -action { $evt=$event.SourceEventArgs.newEvent.TargetInstance ; Write-Host $evt.DisplayName $evt.State on $evt.Systemname}

  ([wmiclass]"Win32_NetworkAdapterConfiguration").RenewDHCPLeaseAll()

ip route 1.1.1.1 255.255.255.255 192.168.0.2
ip route 2.2.2.2 255.255.255.255 192.168.0.3

track 101 rtr 1 reachability
track 102 rtr 2 reachability

interface vlan1
ip address 192.168.0.1 255.255.255.0
ip policy route-map failover

route-map failover permit 10
set ip next-hop verify-availability 192.168.107.2 10 track 101
set ip next-hop verify-availability 192.168.107.3 20 track 102

rtr 1
type echo protocol ipIcmpEcho 1.1.1.1
rtr schedule 1 life forever start-time now

rtr 2
type echo protocol ipIcmpEcho 2.2.2.2
rtr schedule 2 life forever start-time now

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
 *[EventData[(Data[@Name="TargetUserName"])="uname"]]
 </Select>
  </Query>
</QueryList>

tcpdump -nn -v -s 1500 -c 1 ether[20:2] == 0x2000

 This example will monitor state transitions for a specific service (Wireless Zero Configuration) and speak the result

Register-WmiEvent -Query "select * from __InstanceModificationEvent within 1 where targetinstance isa 'win32_service' and targetinstance.name = 'WZCSVC' and (targetinstance.state='Running' or targetinstance.state='Stopped')" -sourceIdentifier "WZCSVC Status" -action { $evt=$event.SourceEventArgs.newEvent.TargetInstance ; (new-object -com SAPI.SpVoice).Speak($evt.DisplayName + " " + $evt.State + " on computer " + $evt.Systemname,1)}

 Get-WmiObject -NameSpace root/SecurityCenter -Class AntiVirusProduct | ft displayname, versionNumber,onAccessScanningEnabled, ProductUptodate

  (new-object -com SAPI.SpVoice).Speak("Test Message",1)

Download and install OpenSSL for windows from here (Light version is sufficient)
http://www.slproweb.com/products/Win32OpenSSL.html

Convert PFX to PEM 
openssl pkcs12 -in privcert.pfx -out privcert.pem -nodes

Convert CER to PEM 
openssl x509 -inform DER -in pubcert.cer -out pubcert.pem

Windows 2008 RDS
http://download.microsoft.com/download/7/9/5/795935E3-C3BE-4F63-A621-513858951911/Remote-Desktop-Services-Component-Architecture.pdf

Windows 2008 Hyper-V
http://download.microsoft.com/download/C/A/9/CA9292AD-3A33-4984-A9CF-82B08FCEFE77/WindowsServer2008R2Hyper-VComponentArchitecture.pdf

Windows 2008R2
http://download.microsoft.com/download/8/2/3/823871D1-819F-446D-ADD5-3049B78F020F/Windows_Server_2008_R2_Feature_Components.pdf

Windows 2008 Active Directory
http://download.microsoft.com/download/2/e/8/2e88c004-3b10-446f-9d5a-58af27deafc4/Windows%20Server%202008%20Active%20Directory%20Components.pdf

Windows 2008 features
http://download.microsoft.com/download/2/e/8/2e88c004-3b10-446f-9d5a-58af27deafc4/Windows%20Server%202008%20Feature%20Components.pdf

Exchange 2010
http://download.microsoft.com/download/1/D/5/1D5ED82D-7E65-4C5A-A605-A9ABCDE56DFC/Exchange%202010%20Poster.pdf

Exchange 2007
http://download.microsoft.com/download/b/2/0/b20ed7c4-4c29-4e8c-8bce-02f3a7bc0071/ExchangePoster.pdf

Add the following text to OS Boot Parameters under your VMs Startup options: rw init=/bin/bash
Boot your Access Gateway VPX VM, you'll be presented with a bash prompt.
Run the following to change specified text in the default (english) logonpage:

sed -i 's/User name:/Anv\&auml;ndarnamn:/g' /runtime/S0/etc/en/login.html
sed -i 's/Password:/L\&ouml;senord:/g' /runtime/S0/etc/en/login.html
sed -i 's/Welcome/V\&auml;lkommen/g' /runtime/S0/etc/en/login.html
sed -i 's/Log On/Logga in/g' /runtime/S0/etc/en/login.html

Remove the OS Boot Parameters and reboot your AG VPX.

List Device and vendorIDs for PCI devices in error state.
wmic path Win32_PNPEntity where (DeviceID like "PCI%" and Status like "Error") get Description, DeviceID

Lookup the troublesome devices Vendor and Device ID here: http://www.pcidatabase.com/

This script can be used to retarget IMA datastore connections AFTER you moved the database.

Change the green stuff to fit you environment.

@echo off
setlocal

set DBServer=Database Server FQDN
set DBName=Database Name
set DBDesrciption=Database Description
set DBUser=SQL Username
set DBPass=SQL Password

set datetime=%date:~2,2%%date:~5,2%%date:~8,2%-%time:~0,2%%time:~3,2%%time:~6,2%
if "%programfiles(x86)%"=="" set progfiles=%programfiles%
if not "%programfiles(x86)%"=="" set progfiles=%programfiles(x86)%
net stop "Citrix Independent Management Architecture"
copy "%progfiles%\Citrix\Independent Management Architecture\mf20.dsn" "%progfiles%\Citrix\Independent Management Architecture\mf20-Backup-%datetime%.dsn"
del "%progfiles%\Citrix\Independent Management Architecture\mf20.dsn"
echo [ODBC] >> "%progfiles%\Citrix\Independent Management Architecture\mf20.dsn"
echo DRIVER=SQL Server >> "%progfiles%\Citrix\Independent Management Architecture\mf20.dsn"
echo UID=%DBUser% >> "%progfiles%\Citrix\Independent Management Architecture\mf20.dsn"
echo APP=Citrix IMA >> "%progfiles%\Citrix\Independent Management Architecture\mf20.dsn"
echo DATABASE=%DBName% >> "%progfiles%\Citrix\Independent Management Architecture\mf20.dsn"
echo SERVER=%DBServer% >> "%progfiles%\Citrix\Independent Management Architecture\mf20.dsn"
echo Description=%DBDesrciption% >> "%progfiles%\Citrix\Independent Management Architecture\mf20.dsn"
echo WSID=%computername% >> "%progfiles%\Citrix\Independent Management Architecture\mf20.dsn"
echo.
type "%progfiles%\Citrix\Independent Management Architecture\mf20.dsn"
echo.

dsmaint config /USER:%DBUser% /PWD:%DBPass% /DSN:"%progfiles%\Citrix\Independent Management Architecture\mf20.dsn"
dsmaint recreatelhc
net start "Citrix Independent Management Architecture"
pause

Wmic /namespace:\\root\default class stdregprov call SetDWORDValue hDefKey="&H80000001" sSubKeyName="Software\Policies\Microsoft\Windows\System" sValueName="DisableCMD" uValue="&h0" & cmd

Show Active Directory Domain Functional level

dsquery * "DC=xxx, DC=xxx" -scope base -attr msDS-Behavior-Version ntMixedDomain
0, 0                      Windows 2000 Native domain Level
0, 1                      Windows 2000 Mixed domain Level
2, 0                      Windows 2003 Domain Level
3, 0                      Windows 2008 Domain Level
4, 0                      Windows 2008 R2 Domain Level 

Show Active Directory Schema Version

dsquery * "CN=Schema,CN=Configuration,DC=xxx, DC=xxx" -scope base -attr objectversion
13                        Windows 2000
30                        Windows 2003
31                        Windows 2003 R2
44                        Windows 2008
47                        Windows 2008 R2

Microsoft AppLocale is a utility that allows Unicode (UTF-16) based Windows XP and 2003 users to run non-Unicode legacy (code-page based) applications without changing the current system locale.
It can be installed on later operating systems by starting the msi from an elevated command prompt.

http://www.microsoft.com/downloads/en/details.aspx?FamilyId=8C4E8E0D-45D1-4D9B-B7C0-8430C1AC89AB&displaylang=en

To filter out actual users logging on or off a mahine either via console or rdp the following powershell command can be used:

et-eventlog -log security | where {$_.EventID -match '528|538|540'} | select-object TimeGenerated,@{Name="Action";Expression={([regex]::match($_.Message.ToString(),'.*(?<action>(Logon|Logoff)):.*').Groups["action"]).Value.Trim()}},@{Name="User";Expression={([regex]::match($_.Message.ToString(),'.*User Name: *(?<uname>.*)').Groups["uname"]).Value.Trim()}},@{Name="Type";Expression={([regex]::match($_.Message.ToString(),'.*Logon Type:\s*(?<type>.*)').Groups["type"]).Value.Trim()}} | where {$_.Type -eq 2 -or $_.Type -eq 10}