PowerShell on Remko's Blog

How to use a comma in the Publisher field when using the Desktop App Converter

Tue, 16 Jan 2018 14:55:51 +0000

When using the Desktop App Converter there’s no need to sign the resulting .appx packages with your own code signing certificate when you submit them to the Store.

However if you want to test the package on a different machine or distribute it to test users you may want to sign the .appx with a certificate.

One option is to use the -sign parameter, in this case the Desktop App Converter generates a code signing certificate and signs the package with it. Although easy to use, it’s not very convenient if you want to distribute the .appx as you need to add the certificate to the Trusted People certificates store (for each user). See Run the Packaged App in the documentation.

If you want to sign the .appx package with a trusted certificate (e.g. issued by a trusted certificate authority such as DigiCert) you need to make sure that you pass the subject (the CN) from your code signing certificate to the Desktop App Converter (using the -Publisher parameter).

Sign APPX packages with PowerShell

Wed, 20 Dec 2017 15:00:33 +0000

I have been working with Microsoft’s Desktop App Converter a lot recently. Even though there’s an option to autosign the resulting package with the -Sign switch I prefer to sign APPX packages myself using signtool.

The reason is that I can send UWP packages to testers for sideloading without requiring them to import the auto generated certificate (which is different on each (re)build).

However I always forget the exact path to signtool.exe (this comes with the Windows SDK).

The Windows 10 SDK is installed by default in C:\Program Files (x86)\Windows Kits\10.

Signtool.exe will be in the folder <sdkpath>\bin\<version>\<platform>\signtool.exe.

As there are multiple version of Windows 10 there are multiple version of the SDK and you can install those concurrently.

But then I found the PowerShell cmdlet Resolve-Path which “Resolves the wildcard characters in a path, and displays the path contents”.

This does exactly what I need:

Wow, Resolve-Path is a perfect example of the many hidden gems in PowerShell!

So I decided to wrap signtool.exe in a PowerShell cmdlet as PowerShell also makes it easy to locate the correct code signing certificate from the certificate store.

Get Windows 10 Version Number with PowerShell

Tue, 04 Apr 2017 16:54:02 +0000

As you may heard, the API’s returning the Operating System version have changed, started with Windows 8.1 and Server 2012 R2.

The reason for this change is Application Compatibility but let’s take a little closer look into this why.

As an application developer there may be a need to check the version of the OS you’re running on. A typical example is when you are using an API that only works on a specific Windows version (and up). Or the other round, you’re not supporting an older version of Windows (say Windows XP as an example).

A common error in such version checks is to check for a specific Windows version but forget to take new (not yet released) versions into account.

Split a string by dollar sign ($) in PowerShell

Mon, 13 Mar 2017 15:28:13 +0000

Just a very quick post (more like a note to self) but I wanted to split a string with the $ sign in PowerShell:

powershell Download

'one$two$three$four$five' -split '$'

Took me a little while to realize that this doesn’t work as the split operator in Windows PowerShell uses a regular expression in the delimiter, rather than a simple character.

Upload ovf/ova to vCloud Director with PowerShell

Wed, 14 Oct 2015 10:08:49 +0000

Recently support for NPAPI has been removed from Google Chrome. While understandable from a security point of view it does mean that some plugins no longer work.

A good example is VMware's Client Integration Plugin where we've lost the ability to upload an ovf template. While VMware has published a fix for vCenter (see this kb), it has not been fixed for vCloud Director:

Deploy VCSA 6 to vCloud Director or vCloud Air

Mon, 05 Oct 2015 20:11:47 +0000

In versions prior to 6.0 VMware supplied the VCSA (vCenter Server Appliance) as an OVF template that could be imported directly.

Starting with version 6.0 the installation process has changed and now consist of an .iso file containing a custom, HTML based, installer. Vladan Seget has a nice blog post where he describes the installation.

This installation process is annoying, it needs a separate client (Windows) machine to run the installer on, requires the Client Integration Plugin (which doesn't appear to run well on chrome now that support for npapi/dpapi has been removed):

But even worse is that we cannot import VCSA 6.0 in vCloud Director. Even converting the OVF inside the iso file doesn't help because vCloud directory lacks support for Deployment Options.

Synchronizing Citrix ShareFile with PowerShell

Wed, 28 Jan 2015 11:39:17 +0000

The Citrix ShareFile Sync application is quite limited in functionality, one of those limitations is that you can only synchronize to a single (one) local folder.

As Helge Klein wrote in his excellent article "Configuring Citrix ShareFile Sync from PowerShell" this is simply a GUI restriction and not a restriction in the actual ShareFile sync engine.

Helge describes that you can easily do this in PowerShell with the following example:

Add-SyncJob example powershell Download

Add-SyncJob -ApplicationId 1 -ApplicationName "PowerShell" -Account helgeklein.sharefile.com
-RemoteFolderName "foc86c19-d904-434a-9d67-xxxxxxxxxxxx" -LocalFolderPath "D:\Daten\Sync to ShareFile"
-AuthType 4 -UserName xxxxxx@helgeklein.com -SyncDirection 2 -Password "MY SHAREFILE PASSWORD"

While the command was accepted, nothing was synchronized.

Handling ini files in PowerShell

Tue, 29 Jul 2014 15:03:08 +0000

This morning Aaron Parker was wondering if Hash Tables could be used to work with ini files:

I thought it was a great idea because in Hash Tables you can use the . operator to get or set a Hash Table entry. But I wondered what to do with sections in ini files. Then I got the idea to use nested Hash Tables for that.

The result is two functions, one to read an ini file into a nested Hash Table and one function to write it back to an ini file.

Sorting a hashtable by byte value in PowerShell

Tue, 22 Jul 2014 12:03:28 +0000

In a PowerShell script I needed to sort a hash table by byte value (not alphabetically, lowercase parameters will be listed after uppercase ones). An example for this requirement is the Amazon Product Advertising API.

Consider the following hashtable as an example:

Example Hash Table powershell Download

$params = @{}
$params.Add("AssociateTag", "dummy")
$params.Add("AWSAccessKeyId", "AKIAIOSFODNN7EXAMPLE")
$params.Add("IdType", "0679722769")
$params.Add("Operation", "ItemLookup")

If we use the Sort-Object to order the list (note that we need to use the GetEnumerator method):

Sort Hash Table powershell Download

$params.GetEnumerator() | Sort-Object Name

We will get the following result:

Sort Results powershell Download

Name Value
---- -----
AssociateTag dummy
AWSAccessKeyId AKIAIOSFODNN7EXAMPLE
IdType 0679722769
Operation ItemLookup

If you use the -CaseSensitive switch the resulting order will remain the same.

Get Actual CPU Clock Speed with PowerShell

Fri, 18 Jul 2014 16:29:24 +0000

To get the best performance out of Virtual Desktops it is essential that the power configuration in the system BIOS and the HyperVisor are configured for maximum performance.

Many people have blogged about the importance of these settings like, Andrew Wood, Helge Klein and Didier Van Hoye. So I will not go into details again.

But how do you check from a Virtual Machine if you are actually running at full clock speed or not?

I have written a PowerShell script to do just that (requires at least PowerShell v3).

Here are some screenshots:

Running with "High Performance profile":

Running with "Balanced" power profile:

Scriptable Citrix Password Encoder

Tue, 19 Mar 2013 16:27:49 +0000

A while ago I published a tool to Encode and Decode Citrix passwords. Today I am publishing a small update to this tool that makes it scriptable by adding a COM interface.

If you start the tool without parameters you will get the GUI, just like before:

To use the COM interface you first need to register the executable with the /regserver switch:

After the registration you can call it using any language that supports COM. To get you started I wrote a few examples

Parse RES Building Blocks with PowerShell

Fri, 07 Dec 2012 13:29:20 +0000

Background
Customer uses Citrix XenApp 5 with ThinApp, RES Workspace Manager and RES Workspace Extender.

An application integration strategy is defined, the picture below displays the strategy and preferred order:

Question
Customer wanted to know the type (1..7) for all applications currently defined in RES Workspace Manager.

I decided to export all the Applications from RES WM as Building Blocks. This results in a folder with XML files. I decided to parse the XML files with a PowerShell script.

Query Administrator Account Name with PowerShell

Thu, 25 Oct 2012 15:22:47 +0000

A customer had partially implemented a (written) policy in the past where the the Local Administrator account was renamed according to a special convention.

This policy stated that the Administrator account needed to be renamed to admin with the computername as a prefix.

However they didn’t know exactly on which machines this policy had been applied to in the past. I was asked to write a script that would check a list of machine names, query the Administrator account name and write this in a new list.

The Administrator account has a Well Known SID of S-1-5-21-xxxxxxx-500 where xxxxxxx is the SID of the computer.

Bit Shifting in PowerShell

Thu, 10 May 2012 12:14:36 +0000

I needed to dome some Bit Shifting in PowerShell but unfortunately PowerShell lacks operator for Bit Shifting. I searched the .NET Framework for anything that allows for bit shifting but was unable to find anything suitable.

I didn't want to revert to C# so I implemented shift left and shift right functions in PowerShell.

The code isn't really pretty and could probably be improved (comments/improvements are welcome!) but here goes (please note that I implemented for bit shifting a byte):

Edit Document requires a Windows SharePoint Services-compatible application

Fri, 09 Mar 2012 14:23:11 +0000

Today I was troubleshooting a message that appeared when a user tries to edit a document from SharePoint on a Citrix XenApp server.

The user browsed to a word document on Sharepoint and selected “Edit in Microsoft Office Word” from the Combobox:

This would present the following error message to the user:

PowerShell script to read Agent Guid from Automation Manager

Tue, 06 Mar 2012 16:00:06 +0000

From a script I needed to schedule a project in RES Automation Manager 2011 for a particular server.

This can be done with the WMC.exe commandline tool as documented in the Admin Guide. However we must specify the agent's GUID instead of it's name. We can of course use the AM console to get the agent's GUID but it's more flexible to script this.

Unfortunately there's no API we can call so I am directly quering the AM database using a PowerShell script.

The script read the database server and database name from the registry so it assumes you have the AM console installed.

PowerShell RegEx Fun

Tue, 06 Mar 2012 11:19:53 +0000

I am writing a script that is going to automate a number of manual steps involved in creating a new image with Citrix PVS.

First step is to copy the most recent base image which is kept in a folder structure. The folder name is always YYYY-MM-DD (description):

I needed to determine the most recent folder and didn't want to rely on creation date. Instead I walk the directory tree and filter the date out of the filename with a regular expression:

Convert MCli output into PowerShell Objects

Wed, 29 Feb 2012 21:35:49 +0000

I was experimenting today with the PowerShell cmdlets for Citrix Provisioning Server. I was surprised to learn that the output of these cmdlets are not PowerShell types such as collections and objects with methods and properties but just plain text output.

A google search for a method to quickly convert the garbage output to objects led me to this blog post by Frank Peter. He describes a clever use of the switch statement with regular expressions with the Get-DiskInfo cmdlet.

Using Frank's code as a basis I wrote a generic function that converts Mcli output to an array of objects.

Read Maximum Password Age with PowerShell

Fri, 02 Dec 2011 13:47:44 +0000

I needed to read out the Maximum Password age with a PowerShell script in a Windows 2003 domain.

Reading out the maxPwdAge attribute is a trivial task in PowerShell (I am re-using the function AdsLargeIntegerToInt64):

text Download

$domain = New-Object System.DirectoryServices.DirectoryEntry

# Read maxPwdAge attribute and convert to Int64
$maxPwdAge = AdsLargeIntegerToIn64 $Domain.maxPwdAge.Value

In my case this returns the value -78624000000000 but how do we interpret this?

Embedding images in HTML

Fri, 02 Dec 2011 13:09:43 +0000

I was creating a small dialog in an .hta file and to make a little prettier for the user I included a company logo:

But I wanted to deploy the .hta as a single file.

Convert IADsLargeInteger to Int64 in PowerShell

Thu, 01 Dec 2011 16:03:46 +0000

Some Active Directory attributes return an 8 byte integer in the form of an IADsLargeInteger interface. An example is the pwdLastSet attribute from a user object.

Because the IADsLargeInteger object doesn’t provide type information PowerShell cannot read the HighPart and LowPart properties.

So I wrote the function below to get the Int64 value of an IADsLargeInteger:

Set homefolder permissions with PowerShell

Tue, 08 Nov 2011 21:05:19 +0000

Today one of my collegues asked me to write a script that performs two actions for all users of a certain Organizational Unit:

Ensure that each user has modify permissions on their homefolder
Make each user visible in the Exchange Address List.

Sounds like a PowerShell job right?

I reused my function to set NTFS Permissions by SID:

Construct AQS date range with PowerShell

Fri, 04 Nov 2011 16:05:25 +0000

For a script I needed to create an AQS (Advanced Query Syntax) Query that contained a date range.

An example of such is a range is: date:11/05/04..11/10/04

However we need to account for regional settings where for example the data seperator and the order of day and month may be different.

In my example I wanted to match any data that is 30 days or older so let's do this in PowerShell:

Exchange Move Mailbox Experiences Part 3

Wed, 28 Sep 2011 11:08:21 +0000

In Part 2 I showed some details about Mailbox Rule corruptions that can disturb Mailbox Moves.

For this part the topic is Mailbox size, which can be an important factor in deciding which mailboxes you want to move first.

In my case the mailbox size was important because we agreed to move smaller mailboxes during the day but larger mailboxes only outside working hours.

For Exchange 2010 mailboxes it's very easy to obtain the size using PowerShell.

Example:

powershell Download

Get-Mailbox "rweijnen" | Get-MailboxStatistics | select DisplayName, ItemCount, TotalItemSize

 <td valign="top" width="70" align="right">ItemCount</td>

 <td valign="top" width="230" align="right">TotalItemSize</td>
</tr>

<tr>
 <td valign="top" width="130">Remko Weijnen</td>

 <td valign="top" width="70" align="right">313</td>

 <td valign="top" width="230" align="right">34.87 MB (36,564,183 bytes</td>
</tr>

DisplayName

But how can we get the Mailbox Size for Exchange 2003 mailboxes?

Inline arrays in PowerShell

Wed, 28 Sep 2011 10:34:18 +0000

Sometimes I want to process a list of “things” easily in PowerShell where the list is not in an external file but in the script itself.

Ideally this list would not be separated by e.g. a comma so it can be easily copy/pasted from external data sources.

Something like this:

powershell Download

$List = @("
John Doe
Jane Doe
James Bond
And so the list goes on
")

Settings NTFS Permissions by SID in PowerShell

Fri, 02 Sep 2011 17:21:42 +0000

I am currently creating a PowerShell script that creates a user with all needed Active Directory attributes, Exchange mailbox, (TS) Home- and Profile directories and so on.

In such a script you can easily get failures because of Active Directory replication.

Check if a useraccount exists with PowerShell

Fri, 02 Sep 2011 11:51:37 +0000

Function below can be used to check if a given Username exists in Active Directory:

powershell Download

function UserExists([string]$Username)
{
	$strFilter = "(&(objectCategory=person)(sAMAccountName=$Username))"

	$objDomain = New-Object System.DirectoryServices.DirectoryEntry

	$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
	$objSearcher.SearchRoot = $objDomain
	$objSearcher.PageSize = 1000
	$objSearcher.Filter = $strFilter
	$objSearcher.SearchScope = "Subtree"

	$colResults = $objSearcher.FindAll()
	return [bool]($colResults -ne $null)
}

Get smallest Exchange Database in PowerShell

Tue, 16 Aug 2011 14:16:33 +0000

I needed to adapt some scripts that create a user with mailbox for Exchange 2010. The existing scripts had a hardcoded database for new mailboxes.

I wanted the mailbox to be created in the smallest database, but how do we determine this?

Set Exchange Product Key with PowerShell

Mon, 15 Aug 2011 09:17:14 +0000

By default Exchange 2007 and 2010 are installed in Trial mode so before going into production you need to enter the Product Key.

The Exchange Management Console will warn you if one or more servers are still in trial mode:

PowerShell script to set Exchange Static RPC Ports

Wed, 10 Aug 2011 16:49:01 +0000

I am currently working on an Exchange migration from 2003 to 2010. For the implementation of a load balancing solution for the CAS/HUB servers I needed to set Static RPC Ports for the RPC Client Access Service and the Exchange Address Book Service.

The procedure of changing these ports is described on the Technet Wiki: Configure Static RPC Ports on an Exchange 2010 Client Access Server

Since I am lazy I decided to do this with a PowerShell script that would automatically do this for all CAS/HUB servers in my 2010 environment.

AD Internals: Display RID Allocation Pools

Mon, 27 Jun 2011 15:37:04 +0000

In my previous post I wrote about a problem I had with duplicate RID Allocation pools.

But how do we get more insight into these RID Allocation pools?

The DCDIAG tool can display this information per domain controleler using the following syntax

batch Download

dcdiag /s:server /v /test:ridmanager

Example output:

But where in Active Directory is this information stored and can we display it for all Domain Controllers at once for larger environments?

Exchange 2010 well-known object entry install error

Fri, 24 Jun 2011 12:52:30 +0000

Today I was testing the installation of Exchange 2010 in a VMWare sandbox environment. We created the sandbox to test migration from a 2003 AD and Exchange environment to 2008 R2 with Exchange 2010.

We used a P2V to get real copies of the Active Directory and the AD upgrade to 2008 R2 was already tested.

But during the Exchange installation in the sandbox I got the following error:

Reading the otherWellKnownObjects attribute with PowerShell

Fri, 24 Jun 2011 11:19:25 +0000

I wanted to read the otherWellKnownObjects attribute from an Active Directory object.

In my case this was the Microsoft Exchange container in the Configuration partition:

The otherWellKnownObjects attribute is of type ADSTYPE_DN_WITH_BINARY which unfortunately cannot be viewed or edited with ADSI Edit: