Infrastructure Saturday

Just a quick post to let everyone know that I will be presenting at this years Infrastructure Saturday (infrastructuresaturday.com). 

You can see my session at: http://www.infrastructuresaturday.com/session-details/

Understanding PKI and Certificate Services

Speaker: Kieran Jacobsen http://aperturescience.su 

Level: 200

In every organization there is a growing need for a strong well designed public key infrastructure solution and in many of these, Active Directory Certificate Services will be used. This session will guide you through a solution based on best practice, shed some light on common issues encountered and some shortcuts to assist in management through the use of PowerShell.

Regular Expressions in Powershell

As part of a script I am working on, I needed to parse some web content which was stored on a remote server; in this case, I needed to scrap a particular set of web links of the page and report back.

The best way to get content of the internet from within a script is wget, which from within Windows you can make use of the GNUWin32 project. I will post about how useful this project is to Windows Scripting and administration later!

Back to the topic at hand.

After getting the content from the web and saving it as a file, I then put the content into a variable using Get-Content, from there, searching the content was pretty easy. First you need to make a RegularExpression.Regex object, and from there, you can feed any string into that object, and it will return the matches.

For Example:

Server Timezone Script

Time for another one of my quick powershell scripts.

This script was created because we discovered we had servers at the Brisbane site, who were running with Daylight Saving time, and also found some servers in Sydney who were not.

For a list of computer names, this script will check that the timezone is "Brisbane" and output the ones who are not to a file.

Creating 1.5 million users in AD

Ever needed to create A LOT of user accounts?

Try this script: (uses Quest CmdLets)

Service Monitoring and Recovery with PowerShell

Recently, Symantec Backup Exec was crashing quite regularly on me.Every Saturday at 4am, the main Backup Exec service would coem crashing down, taking the weekly backups with it and then causing my Monday morning to be painful (unless whoever was on call managed to see that the backups had stopped).

I know that this sort of monitoring should be done with something like SCOM, but that wasn't something I could do in this situation.

The solution was a PowerShell script running hourly (or more or less depending on the needs) that would look at the running state of all the Backup Exec services and start any that were not running, as well as send the person on call an email to tell them something bad was happening.

Using my standard template (see previous postings), I added one parameter to the script, $query, which is simply the query string that I would pass to get the services I want to monitor. For example, a query string of "backup*" will return all the Backup Exec processes, a string of "spooler" would return the print spooler.

The body of the script is pretty simple:

Windows DNS and BIND Server together

Another one of my bulk DNS scripts.

This was a weird request however there were a number of requirements:

• Allow BIND servers running on Linux/Unix to take zone transfers of all production zones (forward and reverse), this should be limited to specific servers.
• BIND servers should only be allowed to request one transfers from specific servers
• Only authorised BIND servers should be permitted
• BIND servers SHOULD be listed in a name server query for a particular zone (that is, BIND servers should have an NS record)

The script is pretty simple:

Bulk import of DNS PTR Records

Due to a number of issues, I was once required to delete some reverse lookup zones in DNS and then recreate them. There were two reasons I had to do this, firstly there were some conflicting replications configurations, secondly I was merging some DNS servers and finally I was making the reverse look zones class B instead of 2 dozen class C zones.

Before I start, there is one limitation with this script. All of entries you are importing must belong to the same reverse lookup zone. For example, this script would handle importing entries of 10.0.0.23, 10.0.0.55 into a reverse lookup zone of 10.0.0.0/24 or even 10.0.0.0/16; however it will fail if you try to import those entries into a zone of 172.16.0.0/24.

This script I wrote for these sort of situations, and many others. Whenever doing this work, I have always had a resulting CSV file with my entries that I need to end up back in DNS. This file has had the following format:

host, ip

hostname1.domain.local, 10.0.0.1

hostname2.domain.local, 10.0.0.2

Once you have a CSV file of the above format, point the following code at it:

$filename = read-host "CSV filename"
$dnsserver = Read-Host "dnsserver"
$namespace = read-host "namespace - format 201.168.192.in-addr.arpa"
$entries = import-csv $filename
foreach ($entry in $entries) {
    dnscmd $dnsserver /recordadd $namespace $entry.ip "ptr" $entry.host
}

Bulk DNS PTR record creation

Many years ago, a poorly informed technician on a vendor support line claimed that because we had "GAPS" (his words not mine) in our reverse look up zones that their application was running poorly. Missing entries in your reverse lookup zone can be caused by computers not registering their PTR records, the DHCP server not doing so, or in some cases the DNS server not creating the records correctly; for the record, our "gaps" were because on that subnet, only a dozen or so clients were residing and hence, only a few entries existed (and they were all correct too).

To prove the vendor wrong, i went a created "filler" entries in that subnet using PowerShell. See below:

$dnsserver = <your dns server >
$namespace = <namespace - format 201.168.192.in-addr.arpa>
$startip = <if you want to create a whole standard class C subnet, this is 1>
$endip = <if you want to create a whole standard class C subnet, this is 255>

for ($ii=$startip; $ii -lt $endip; $ii++) {
    dnscmd $dnsserver /recordadd $namespace $ii "ptr" "FakeDummyAddress"
}