Delete User Profiles In Windows 10

First off, there are several methods to accomplish this task and we’ll cover the most common ways of doing this. To give you an overview, we’ll review the manual method, the scripted method using delprof2 and the bulk method using Group Policy. Each method has its own pros and cons and you’ll be able to choose which one works best for you.
 

Method 1 – Delete User Profiles Manually

If you want to delete a user profile in Windows and don’t want to download any additional tools, this will perhaps be the best option for you. We already know that this won’t scale and should only be used for adhoc situations.
 

On your Windows machine:

• Navigate to start -> run -> type sysdm.cpl to access the advanced system properties

• Select the user profile you want to delete
• Click delete

There are occasions when you might have to manually delete the folder under C:\Users as well so that’s something that you should be aware of.

Method 2 – Remove User Profiles using DelProf2

If you’re looking for more of a scripted approach, delfprof2 definitely takes the cake on that one. DelfProf2 is the evolution to Microsoft’s original DelfProf (Delete Profile) but that was sadly no longer being updated after Windows XP. Since DelProf2 doesn’t come standard on Windows machines, it is something you will have to download from the owners website. It’s completely free but just note that it’s not an official Microsoft product.
 
Direct Download Link: https://helgeklein.com/downloads/DelProf2/current/Delprof2 1.6.0.zip
 

This allows you to use the command line interface to touch multiple machines without much effort. This mighty program also supports the removal of user profiles after x amount of days so that’s great if you don’t want to leave those stale profiles on the machines. Let’s cover a common example to help you get started (assuming you’ve already downloaded the app from the link above).
 

List accounts that haven’t logged in for 14 days

PS C:\delprof> .\DelProf2.exe /l /d:14

List accounts that match the name ‘Luke’

PS C:\delprof> .\DelProf2.exe /id:luke /l

For a full list of options you can always run /? to see what switches are currently suppported.
 

Method 3 – Removal using Group Policy

Our last option allows us to remove user profiles using Group Policy. This options is by far the one that scales the best since Group Policy is used in many on-premises infrastructures. Let’s look at the settings to enable this policy via GPO.
 

With Group Policy Editor open:

• Navigate to Computer Configuration → Administrative Templates → System → User Profiles
• Select Delete user profiles older than a specified number of days on system restart

• Click Enabled and set the number of days to trigger the policy

While this option is great and scalable, some users have noticed that the username folder under C:\Users is still there. If that’s the case, you may need clean that manually if it poses an issue.

Conclusion

Hopefully, this article was able to show you how to delete user profiles in Windows 10. I provided 3 options that are pretty scalable as well a quick adhoc method.
 

Again, just to reiterate, you should always test before applying any configs just to ensure that everything is working as expected. If you like this article, be sure to check out our own PowerShell Gallery for awesome scripts.

The post How To Delete User Profiles In Windows 10 appeared first on the Sysadmin Channel.

Some use cases for this would be to use an unattended install for Windows 10, you can also use this for SCCM or even MDT if you like. It can lower the footprint of your setup by removing unnecessary files that you know you won’t use. In my case I know I would use Windows 10 Enterprise 100% of the time because it’s the more appropriate version of my work environment.

Extract Windows 10 Enterprise WIM From ISO

Once you’ve downloaded your WIM file, let’s go ahead and mount it to your system so we can see exactly what we’re working with. In my case, I’m going to mount ‘Windows 10 20H2.iso’ to my D drive and open Powershell as an administrator.

By default, any newer Windows 10 machine will have the DISM module loaded with the machine so make sure you’re using that to extract this. Next we’ll run the command Get-WindowsImage -ImagePath D:\sources\install.wim to spit all the WIM files that are associated with it. Once that happens, let’s take notice of the index that Windows 10 Enterprise is associated with. In our example, it is sitting at Index #3.

Click to view full image

PS C:\> Get-WindowsImage -ImagePath D:\sources\install.wim

ImageIndex : 1
ImageName : Windows 10 Education
ImageDescription : Windows 10 Education
ImageSize : 15,734,867,941 bytes

ImageIndex : 2
ImageName : Windows 10 Education N
ImageDescription : Windows 10 Education N
ImageSize : 14,963,222,046 bytes

ImageIndex : 3
ImageName : Windows 10 Enterprise
ImageDescription : Windows 10 Enterprise
ImageSize : 15,735,021,936 bytes

Next up we’ll run Export-WindowsImage -SourceImagePath D:\sources\install.wim -DestinationImagePath $HOME\Desktop\Windows10Enterprise20H2.wim -SourceIndex 3
This is telling Powershell to extract Index 3 from the info above as well as set the destination to my desktop.

Finally, you’ll need to replace install.wim that’s currently in the sources folder with the new wim you just created. You must rename it to install.wim because that’s what unattended installs are looking for by default so it must be set to that filename in order for it to work correctly.

Next thing to do is to confirm that we’ve extracted the Windows 10 Enterprise WIM properly from the general ISO that was available to us. To do that we’ll run the same command that we did earlier, however, this time the difference would be that we only see Windows 10 Enterprise as our only option.

Now when you run the unattended install, you won’t be prompted for a Windows 10 version 🙂

Conclusion

Hopefully this article was able to help figure out how to extract Windows 10 Enterprise WIM from your ISO file. If you liked this article be sure to check out the others in our Server Administration.

The post How to Extract Windows 10 Enterprise WIM From ISO appeared first on the Sysadmin Channel.

Today we’re going to focus on what is Windows Task Scheduler, but more importantly how to run Powershell scripts from Task Scheduler to automate your tasks. There are a couple of caveats I’ve learned over the years but we’ll get into that later in the article.

What is Task Scheduler?

I suppose before we get into the details of how to run Powershell scripts as a scheduled task, it would be a good idea to explain exactly what Task Scheduler is.
 

So what is Task Scheduler? Wikipedia explains Task Scheduler as a component of Microsoft Windows that provides the ability to schedule the launch of programs or scripts at pre-defined times or after specified time intervals.

In other words, it’s a way to schedule jobs or certain tasks at specific time intervals throughout the day, week, month or as a one time basis.

Task Scheduler is available on Windows Server and Windows Client machines. i.e Windows Server 2016/2019 and Windows 10

How To Automate Powershell Scripts with Task Scheduler

Now that you know what is it, let’s move on to how you can use it to your advantage. The first step is knowing what we’ll want to automate (or schedule). In my example I’m going to automatically email my users once their password is within 10 days of expiration. Luckily, we already have a Get Password Expiration Date Powershell script so now it’s just a matter setting up a task.

 
Let’s get to that now.

• First, we’ll need to open Task Scheduler from the start menu
• Choose the path you want to setup the task. I normally choose the root
• Right click Task Scheduler Library and select Create Task (not basic task)
• Under the General tab, insert the Name and Description
• Set the user account (preferably a service account with a password that doesn’t expire)
• Check the option to run whether the user is logged in or not
• Configure the dropdown to use the latest version

• Under the trigger tab, select on a schedule for time based tasks
• Select the time frequency. One time, daily, weekly or monthly
• Since we want the task to run daily, I’ll set it recur every 1 days
• Under the advance settings, if you want to run the task every x hours, enter that in there (i.e. 12 hours for the duration of 1 day will run every 12 hours until you disable it)
• Ensure the check for Enabled is checked

• Under the Actions tab, select start a program in the drop down menu
• Under program/script select the powershell.exe. (i.e. c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)
• Under Add arguments, select the location of the Powershell script (i.e. c:\_Scripts\Get-PasswordExpirationDate.ps1)

• Under Conditions tab, leave default unless you want to change anything specifically
• Under Settings tab, check Allow task to be run on demand
• Click OK and enter password for the account running the task

Granting Logon as batch job rights

If the account you’re using to run the scheduled task is not an administrator, you might be prompted with the following message. “This task requires that the user account specified has Log on as batch job rights…

 
To fix that we’ll do the following:

• Go to start -> Type gpedit.msc
• Navigate to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment
• Open Log on as a batch job and add the user account

When should you use Task Scheduler?

Honestly there are a ton of use cases for using Task Scheduler and the possibilities are pretty much unlimited. I would define it as anything that you can script and you want to run more than once in a specific time interval. Off the top of my head, a perfect example would be get password expiration dates using Powershell and automatically notify the user. Another good use case is automatically reboot a server after deploying windows updates using SCCM.

It really just depends on what you want to do. There was a point in time where I had about 50+ jobs scheduled through out the week. Anything from Exchange Online to Active Directory tasks, if I was able to script it (and I usually can) I would setup a job to automate it.

Automate Powershell Scripts – Conclusion

At this point I really hope I was able to explain, in detail, how to automate your Powershell scripts with task scheduler so you can hopefully set it and forget it. If you’re not using task scheduler, let me know in the comments what you are using to run your jobs. Again, I strive to automate myself out of a job so it’s very helpful that I’m to run jobs essentially while I am sleeping. This frees up time for me to try and automate more items or look for ways to enhance the environment on other technologies.

If you liked this article, be sure to check out our other Server Administration posts. I recently uploaded a Get Reboot History Powershell Script that could be useful. While you’re at it, don’t forget to stop by our YouTube Channel for awesome video content.

The post Automate Powershell Scripts With Task Scheduler appeared first on the Sysadmin Channel.

The uptime script showed you when was the last time a machine was booted, aka how long the system has been running, but what if you wanted to pull a little more information? What if you wanted to see the shutdown or reboot history, and probably more importantly, who was the actor that imposed that event.

A minor incident happened the other day where person A was running a job while logged into a server, and it just so happens that person B needed to complete a series of patches on that same server. Obviously the communication could have been handled much better but long story short, person B applied the patches and manually reboot the server, cutting off person A’s job mid tracks.

If you’re looking to use to a Powershell script to get reboot history for multiple servers, I’m sure your scenario may be different from the one above. Whatever the reason is, I got you covered in this post.

Event Viewer Logs and Event ID 1074

Shortly after, I used my Google-fu and eventually came across some articles that would point me in the right direction. I was sure there would be some logs in the event viewer and sure enough, I found Event ID 1074 under the System Logs.

I have worked with scripting Event Viewer logs in the past, such as this Get Account Lock Out Source Using Powershell, so I was already familiar with how the process goes. And if you’re ok with checking the event viewer manually from the time to time it may not be worth looking up how to do it in Powershell. However for me, I love automating things and using Powershell everywhere I can, not to mention this would be great for the community to use as well.

Now let’s get on to the script!

Get Reboot History Using Powershell Script

Function Get-RebootHistory {
<#
.SYNOPSIS
    This will output who initiated a reboot or shutdown event.

.NOTES
    Name: Get-RebootHistory
    Author: theSysadminChannel
    Version: 1.0
    DateCreated: 2020-Aug-5

.LINK
    https://thesysadminchannel.com/get-reboot-history-using-powershell -

.EXAMPLE
    Get-RebootHistory -ComputerName Server01, Server02

.EXAMPLE
    Get-RebootHistory -DaysFromToday 30 -MaxEvents 1

.PARAMETER ComputerName
    Specify a computer name you would like to check.  The default is the local computer

.PARAMETER DaysFromToday
    Specify the amount of days in the past you would like to search for

.PARAMETER MaxEvents
    Specify the number of events you would like to search for (from newest to oldest)
#>


    [CmdletBinding()]
    param(
        [Parameter(
            Mandatory = $false,
            ValueFromPipeline = $true,
            ValueFromPipelineByPropertyName = $true
        )]
        [string[]]  $ComputerName = $env:COMPUTERNAME,

        [int]       $DaysFromToday = 7,

        [int]       $MaxEvents = 9999
    )

    BEGIN {}

    PROCESS {
        foreach ($Computer in $ComputerName) {
            try {
                $Computer = $Computer.ToUpper()
                $EventList = Get-WinEvent -ComputerName $Computer -FilterHashtable @{
                    Logname = 'system'
                    Id = '1074', '6008'
                    StartTime = (Get-Date).AddDays(-$DaysFromToday)
                } -MaxEvents $MaxEvents -ErrorAction Stop


                foreach ($Event in $EventList) {
                    if ($Event.Id -eq 1074) {
                        [PSCustomObject]@{
                            TimeStamp    = $Event.TimeCreated
                            ComputerName = $Computer
                            UserName     = $Event.Properties.value[6]
                            ShutdownType = $Event.Properties.value[4]
                        }
                    }

                    if ($Event.Id -eq 6008) {
                        [PSCustomObject]@{
                            TimeStamp    = $Event.TimeCreated
                            ComputerName = $Computer
                            UserName     = $null
                            ShutdownType = 'unexpected shutdown'
                        }
                    }

                }

            } catch {
                Write-Error $_.Exception.Message

            }
        }
    }

    END {}
}

So now that you have the script in hand, just copy and paste to a local file so you can start sending nice notes to people for rebooting machines.

Anyway I hope you enjoyed this script and can put it to use. If you liked it and want to see more, be sure to check out our own Powershell repository full of useful, real world scripts that I’m certain you can use in your environment. While you’re at it, don’t forget to check out our Youtube Page for awesome sysadmin video content.

The post Get Reboot History Using Powershell appeared first on the Sysadmin Channel.

I wanted to setup a quick and dirty site on my localhost and found that xampp was the perfect solution for my Windows 10 machine. However, when it came to test the security I realized that it had not been secured with a proper certificate so I was unable to use HTTPS. The code that I was testing required https so I was off to my Google-venture.

Setup SSL Certificates on XAMPP

As we can see here I’ve setup my local xampp server and after piecing together a couple of articles, I finally got it working.

I should mention that the certificate I am using is not a self signed cert, but rather an actual Public SSL certificate from Let’s Encrypt. If you want to know how I did that, please check out my article on how to Create Free Lets Encrypt SSL Certificates Using Powershell. This article goes in depth and even has a video walkthrough if you prefer that method.

 
Now that we got that covered, let’s take this step by step on how to setup SSL certificates on Xampp. Assuming you installed Xampp in the default directory of C:\xampp here’s how to do it.

• Navigate to c:\xampp\apache and create a ‘cert’ folder
• Copy the cert.cer and the cert.key that we got from Let’s Encrypt
• Paste those 2 files in to this directory

Next, since I want to eventually access the web application from other browsers I am going to setup a DNS HOST A record. This will allow any computer in the domain to access the URL and have it point to our instance. Since I am running this at the domain level, I am using Domain Admin privileges.

• While logged into a domain controller, open DNS Management
• Expand the root of the domain namespace you want to use
• In my case I’m using tool.thesysadminchannel.com so I’m using thesysadminchannel.com namespace
• Right click and create New Host (A or AAAA) record
• Enter the URL you would like to have
• Enter the IPaddress of the server you want to point it back to (In this case our local xampp server)

Now that we have the certificate placed in the correct directory and we’ve setup our Host A record to be able to access the URL from any location in our network. It’s time to modify the apache config file to use this cert.

• Navigate to C:\xampp\apache\conf\extra\httpd-vhosts.conf and open with your editor of choice
• Enter in the following config to create a new https virtual host

<VirtualHost *:443>
    ServerAdmin webmaster@thesysadminchannel.com
    DocumentRoot "C:/xampp/htdocs"
    ServerName tool.thesysadminchannel.com
    ErrorLog "logs/tool.log"
    CustomLog "logs/tool-access.log" common
    SSLEngine on
    SSLCertificateFile "C:/xampp/apache/cert/cert.cer"
    SSLCertificateKeyFile "C:/xampp/apache/cert/cert.key"
</VirtualHost>

On the above be sure to take note of the following things.

• VirtualHost *:443 – This creates the port over 443 which is what SSL uses
• The servername is the URL you plan on using. In my case i’m using tool.thesysadminchannel.com so this is what I have configured here and my DNS records
• SSL Engine is turned on
• The SSL Certificate File and the SSL Certificate Key File are set to the path we created
• The paths have forward slashes and not backslashes

Once you have that, we should be all done as far as the process on how to setup SSL Certificates on XAMPP server. Check it out and let me know if you run into any snags with your setup.

Thanks again and if you’re interested in more sysadmin content, be sure to check out our Server Administration category as well as our Youtube Channel.

The post How To Setup SSL Certificates on XAMPP appeared first on the Sysadmin Channel.

A break glass account is an account that is used for emergency purposes to gain access to a system or service that is not accessible under normal controls. You, as a systems administrator should not only document all of your break glass accounts but regularly audit those accounts to ensure that the correct people have access.

More importantly, the reason you need a break glass account is to bypass the controls put in place that are there to increase security.
 

What Roles Should Break Glass Accounts Have?

Typically any account that is used for emergency purposes needs to have the rights to be able to gain access to the system and revert any controls or lockouts that are in place. Nine times out of ten, I would recommend that the account have administrator rights to ensure you’re up and running as soon as possible. Furthermore, a break glass account is usually highly privileged and has the least amount of controls in place so it needs to be secured in a vault that very few people have access to.
 

How Many Emergency Accounts Should I Have?

Ideally you would want 1-2 emergency account per platform. Let’s take Microsoft’s Azure Active Directory for example. Although you can have many administrators or Global Admins, Microsoft recommends 2 break glass accounts for the M365 platform. The reason being is that you’ll want a backup to the backup just for good measure.

 
Lets say you deploy Multifactor Authentication and your policy is scoped to all users, you’ll want to have this break glass account excluded from that policy to ensure that you can still login if admins aren’t able to get in.

In this scenario, the Azure AD account would have Global Admin rights, it would be excluded from the MFA policy and finally, it would NOT be an on-premises account. Specifically, this Global Admin account should be an onmicrosoft.com account in the event your on-prem AD has issues.
 

How To Monitor Break Glass Accounts Sign-in And Audit Logs

Every platform is different so it will be nearly impossible to give an answer to anything really specific. However, if we use our example of Azure Active Directory (Azure AD), I can give you a general idea of what this would look like in a real world example. If you’re already using Azure AD that’s great! If you’re not, but you plan to migrate sooner than later we got you covered in our Exchange Migration YouTube Playlist.

As I mentioned, it is recommended that you monitor sign-in and audit log activity from emergency accounts. I would also highly recommend you trigger a notification to your administrators when there has been activity. How do I do this you ask? Here is a quick break down of what that looks like.

• Import or Install AzureAD Module
• The cmdlet Get-AzureADAuditSignInLogs can quickly gather those logs using Powershell
• The cmdlet Send-MailMessage can send an email to send you a notification, also using Powershell
• Setup a scheduled task to check on a regular basis

Get-AzureADAuditSignInLogs Example

Here is a quick example of what Get-AzureADAuditSignInLogs would look like.
 

#Connect to Azure Active Directory
Import-Module AzureAD
Connect-AzureAD -AccountId username@thesysadminchannel.com

#Get Date and then check for sign-ins after said date
$Date = (Get-Date).AddDays(-1).ToString("yyyy-MM-dd")
Get-AzureADAuditSignInLogs -Filter "UserPrincipalName  eq 'breakglass@thesysadminchannel.onmicrosoft.com' AND CreatedDateTime gt $Date" 

 
This short script block above will show the same information you’re used to seeing in the GUI.

Conclusion

At the end of the day you’ll need to ensure you have a backdoor to get into your platform and a break glass account is a perfect use case for it. I hope this article was informative for you and if there’s one take away from this article, that is… Subscribe to my Youtube Channel. Because why not. 🙂

The post Break Glass Account: What Is It And Why Do You Need It appeared first on the Sysadmin Channel.

 
The underlying structure is still going to be using query session so that hasn’t changed. What has changed is now we can specify a specific user or find where a user is logged on in a domain. Another note is the ability to log them off using a simple switch so that can definitely come in handy if you’re checking a log of systems.

Get Logged In Users Using Powershell

Looking back I don’t know why I added the ActiveDirectory Module and made it run as an administrator. That is simply not needed and not required to run this function. However, I would highly recommend you run this on a Windows 10 machine or Server 2016 and later with Powershell 5 because well let’s face it, we’re in 2020.

Parameters

    -ComputerName

Description: This will specify the ComputerName that you would like to check.  If no ComputerName is specified, it will check the local computer.

    -UserName

Description: If the specified username is found logged into a machine, it will display it in the output.

Function Get-LoggedInUser {
<#
.SYNOPSIS
    This will check the specified machine to see all users who are logged on.
    For updated help and examples refer to -Online version.

.NOTES
    Name: Get-LoggedInUser
    Author: Paul Contreras
    Version: 3.0
    DateUpdated: 2021-Sep-21

.LINK
    https://thesysadminchannel.com/get-logged-in-users-using-powershell/ -
    For updated help and examples refer to -Online version.

.PARAMETER ComputerName
    Specify a computername to see which users are logged into it.  If no computers are specified, it will default to the local computer.

.PARAMETER UserName
    If the specified username is found logged into a machine, it will display it in the output.

.EXAMPLE
    Get-LoggedInUser -ComputerName Server01
    Display all the users that are logged in server01

.EXAMPLE
    Get-LoggedInUser -ComputerName Server01, Server02 -UserName jsmith
    Display if the user, jsmith, is logged into server01 and/or server02


#>

    [CmdletBinding()]
        param(
            [Parameter(
                Mandatory = $false,
                ValueFromPipeline = $true,
                ValueFromPipelineByPropertyName = $true,
                Position=0
            )]
            [string[]] $ComputerName = $env:COMPUTERNAME,


            [Parameter(
                Mandatory = $false
            )]
            [Alias("SamAccountName")]
            [string]   $UserName
        )

    BEGIN {}

    PROCESS {
        foreach ($Computer in $ComputerName) {
            try {
                $Computer = $Computer.ToUpper()
                $SessionList = quser /Server:$Computer 2>$null
                if ($SessionList) {
                    $UserInfo = foreach ($Session in ($SessionList | select -Skip 1)) {
                        $Session = $Session.ToString().trim() -replace '\s+', ' ' -replace '>', ''
                        if ($Session.Split(' ')[3] -eq 'Active') {
                            [PSCustomObject]@{
                                ComputerName = $Computer
                                UserName     = $session.Split(' ')[0]
                                SessionName  = $session.Split(' ')[1]
                                SessionID    = $Session.Split(' ')[2]
                                SessionState = $Session.Split(' ')[3]
                                IdleTime     = $Session.Split(' ')[4]
                                LogonTime    = $session.Split(' ')[5, 6, 7] -as [string] -as [datetime]
                            }
                        } else {
                            [PSCustomObject]@{
                                ComputerName = $Computer
                                UserName     = $session.Split(' ')[0]
                                SessionName  = $null
                                SessionID    = $Session.Split(' ')[1]
                                SessionState = 'Disconnected'
                                IdleTime     = $Session.Split(' ')[3]
                                LogonTime    = $session.Split(' ')[4, 5, 6] -as [string] -as [datetime]
                            }
                        }
                    }

                    if ($PSBoundParameters.ContainsKey('Username')) {
                        $UserInfo | Where-Object {$_.UserName -eq $UserName}
                      } else {
                        $UserInfo | Sort-Object LogonTime
                    }
                }
            } catch {
                Write-Error $_.Exception.Message

            }
        }
    }

    END {}
}

How To Run Get Logged In User Powershell Script

In order to the run the script there are a couple of things you need to do.  First and foremost, you need to set your execution policy to RemoteSigned or bypass.  This is a standard with running any Powershell script.

Next you need to dot source the script since it is a function.  To dot source the script do the following:

• Copy the script above and save it any location. In this example I’ll save it to my C:\_Scripts folder.
• Within the Powershell Window type: . .\_Scripts\Get-LoggedInUser.ps1 – Note the two dots before the backslash.

Get Logged On Users On Remote Computers

The best thing I love about this script is your ability to get who is logged into a remote computer. This mitigates the need to physically log into computer and checking that way. Since this Powershell script allows you to query remote servers and computers, it makes it highly automatable and very scalable. Using this script, you can check 1 server or 1,000 servers and it would be the same amount of effort for the person who is running it. It’s awesome and I love how you can do it all from your own Windows 10 computer.

You can also find where a user is logged on in a domain very easily. Depending on how many machines you’re going to be iterating through, it can obviously take some time but it can be done. Here is a simple code snippet of how to get where a user is logged in to.

PS C:\> . .\_Scripts\Get-LoggedInUser.ps1
PS C:\>
PS C:\> Get-LoggedInUser -ComputerName PAC-WIN1001, PAC-ADC01, PAC-DC01
 
ComputerName UserName   SessionState LogonTime
------------ --------   ------------ ---------
PAC-WIN1001  pcontreras Active       8/5/2021 10:00:00 PM
PAC-ADC01    pcontreras Disconnected 6/22/2021 7:27:00 AM
PAC-DC01     pcontreras Disconnected 6/22/2021 4:29:00 PM

Conclusion

So there you have it, a quick and easy solution to a problem that many IT Administrators have come across in their sysadmin journey. I am well aware that you can also do this via group policy if you wanted to go that route, or you can do this via some GUI tool but I always like to get my hands dirty with Powershell.

Thanks again for taking the time to visit and go ahead and drop a comment if you have any questions about the script or its intended fuctions. Also, don’t forget to check out our Youtube Channel for visual video content and our own personal Powershell gallery full of real world scripts.

The post Get Logged In Users Using Powershell appeared first on the Sysadmin Channel.

 
The goal of the script was to have Powershell get all files in a directory and subdirectories with size. As mentioned above I also wanted it to be portable so I wanted to make sure it was able get folder sizes for remote computers. I was in luck because Get-ChildItem -Recurse does exactly that, and it does it very quickly. The best thing of all is that it supports remote UNC paths, mapped drives and local drives. This would be the base of the function.

Things to Note

There are a couple of things I wanted to highlight and/or clarify just in case it might be misleading.

• Get-DirectoryTreeSize supports remote UNC (Network), Local and Mapped Drives
• It uses Get-Childitem and Measure-Object as the base cmdlets to quickly calculate data
• Only specifying the path parameter will show files, folders and size for the specified directory
• Recurse shows files, folders and sizes for each directory respectively
• To avoid long subfolder strings, subfolders will display “.\” instead of $Path
• AllItemsAndAllFolders will get all files, all folders and the total size for the specified directory and all subdirectories
• Get-DirectoryTreeSize -Path C:\Temp -Recurse | Sort-Object FolderSizeInMB -Descending will quickly get the largest folder in your query
• There are 3 decimal places so smaller files won’t show 0 size

 
If you have any questions feel free to drop me a comment and I’ll do my best to get back to you.

Get Directory Tree Size Using Powershell

Function Get-DirectoryTreeSize {
<#
.SYNOPSIS
    This is used to get the file count, subdirectory count and folder size for the path specified. The output will show the current folder stats unless you specify the "AllItemsAndAllFolders" property.
    Since this uses Get-ChildItem as the underlying structure, this supports local paths, network UNC paths and mapped drives.

.NOTES
    Name: Get-DirectoryTreeSize
    Author: theSysadminChannel
    Version: 1.0
    DateCreated: 2020-Feb-11


.LINK
    https://thesysadminchannel.com/get-directory-tree-size-using-powershell -


.PARAMETER Recurse
    Using this parameter will drill down to the end of the folder structure and output the filecount, foldercount and size of each folder respectively.

.PARAMETER AllItemsAndAllFolders
    Using this parameter will get the total file count, total directory count and total folder size in MB for everything under that directory recursively.

.EXAMPLE
    Get-DirectoryTreeSize "C:\Some\Folder"

    Path            FileCount DirectoryCount FolderSizeInMB
    ----            --------- -------------- --------------
    C:\Some\folder          3              3          0.002

.EXAMPLE
    Get-DirectoryTreeSize "\\MyServer\Folder" -Recurse

    Path                 FileCount DirectoryCount FolderSizeInMB
    ----                 --------- -------------- --------------
    \\MyServer\Folder            2              1         40.082
    .\Subfolder                  1              0         26.555

.EXAMPLE
    Get-DirectoryTreeSize "Z:\MyMapped\folder" -AllItemsAndAllFolders

    Path                  TotalFileCount TotalDirectoryCount TotalFolderSizeInMB
    ----                  -------------- ------------------- -------------------
    Z:\MyMapped\folder                 3                   1              68.492

#>

[CmdletBinding(DefaultParameterSetName="Default")]

param(
    [Parameter(
        Position = 0,
        Mandatory = $true
    )]
    [string]  $Path,



    [Parameter(
        Mandatory = $false,
        ParameterSetName = "ShowRecursive"
    )]
    [switch]  $Recurse,



    [Parameter(
        Mandatory = $false,
        ParameterSetName = "ShowTopFolderAllItemsAndAllFolders"
    )]
    [switch]  $AllItemsAndAllFolders
)

    BEGIN {
        #Adding a trailing slash at the end of $path to make it consistent.
        if (-not $Path.EndsWith('\')) {
            $Path = "$Path\"
        }
    }

    PROCESS {
        try {
            if (-not $PSBoundParameters.ContainsKey("AllItemsAndAllFolders") -and -not $PSBoundParameters.ContainsKey("Recurse")) {
                $FileStats = Get-ChildItem -Path $Path -File -ErrorAction Stop | Measure-Object -Property Length -Sum
                $FileCount = $FileStats.Count
                $DirectoryCount = Get-ChildItem -Path $Path -Directory | Measure-Object | select -ExpandProperty Count
                $SizeMB =  "{0:F3}" -f ($FileStats.Sum / 1MB) -as [decimal]

                [PSCustomObject]@{
                    Path                 = $Path#.Replace($Path,".\")
                    FileCount            = $FileCount
                    DirectoryCount       = $DirectoryCount
                    FolderSizeInMB       = $SizeMB
                }
            }

            if  ($PSBoundParameters.ContainsKey("AllItemsAndAllFolders")) {
                $FileStats = Get-ChildItem -Path $Path -File -Recurse -ErrorAction Stop | Measure-Object -Property Length -Sum
                $FileCount = $FileStats.Count
                $DirectoryCount = Get-ChildItem -Path $Path -Directory -Recurse | Measure-Object | select -ExpandProperty Count
                $SizeMB =  "{0:F3}" -f ($FileStats.Sum / 1MB) -as [decimal]

                [PSCustomObject]@{
                    Path                 = $Path#.Replace($Path,".\")
                    TotalFileCount       = $FileCount
                    TotalDirectoryCount  = $DirectoryCount
                    TotalFolderSizeInMB  = $SizeMB
                }
            }

            if ($PSBoundParameters.ContainsKey("Recurse")) {
                Get-DirectoryTreeSize -Path $Path
                $FolderList = Get-ChildItem -Path $Path -Directory -Recurse | select -ExpandProperty FullName

                if ($FolderList) {
                    foreach ($Folder in $FolderList) {
                        $FileStats = Get-ChildItem -Path $Folder -File | Measure-Object -Property Length -Sum
                        $FileCount = $FileStats.Count
                        $DirectoryCount = Get-ChildItem -Path $Folder -Directory | Measure-Object | select -ExpandProperty Count
                        $SizeMB =  "{0:F3}" -f ($FileStats.Sum / 1MB) -as [decimal]

                        [PSCustomObject]@{
                            Path                 = $Folder.Replace($Path,".\")
                            FileCount            = $FileCount
                            DirectoryCount       = $DirectoryCount
                            FolderSizeInMB       = $SizeMB
                        }
                        #clearing variables
                        $null = $FileStats
                        $null = $FileCount
                        $null = $DirectoryCount
                        $null = $SizeMB
                    }
                }
            }
        } catch {
            Write-Error $_.Exception.Message
        }

    }

    END {}

}

When you call the function and only specify the path parameter, here is what it looks like.

In this example, I have 3 files and 2 subdirectories, totalling 66678.063 MB (65.11 GB) for that current directory

There are a total of 12 files and 5 directories amounting to 181759.929 MB (177.49 GB) – This for this directory and all subdirectories. This is also equivalent to right clicking the folder and selecting properties.

Finally, we can get the folder tree recursively so I’m going to run the same script locally (thanks to its portability), from my other computer that’s hosting the backup folder.

The Recurse parameter allows you to drill down all folders and view stats. You can also sort by FolderSizeInMB and see which folder has the most space.

Another thing to note is that I wanted to shorten the display of the subfolders so it doesn’t push the file, directory and size counts off the screen. For this I replaced the original $Path location with “.\” so it’s relative to $Path.

So hopefully you were able to make use of the Powershell script to get directory tree size including all subfolders. I’m pretty stoked how quickly it was able to process remote servers and I’m sure I’ll be adding this to my list of audit tasks. It’s not that much effort to run and it provides a ton of useful information so it’s pretty much a no brainer.

 
All in all I wanted to say thanks a lot for taking the time to visit and hopefully you can make use of the Powershell script in your environment. If you like these kinds of posts, feel free to check out our gallery full of useful real-world scripts. Don’t forget to check out our Youtube Page for sysadmin video content.

Post Updated: August 2020

The post Get Directory Tree Size Using Powershell (Recursive) appeared first on the Sysadmin Channel.

By default, the WindowsCapability logs are stored in C:\Windows\Logs\DISM\dism.log so we’ll check there to see what’s happening behind the scenes.

DISM   DISM Package Manager: PID=1280 TID=6320  Error in operation: (null) (CBS HRESULT=0x800f0954) - CCbsConUIHandler::Error
DISM   DISM Package Manager: PID=1280 TID=5772 Failed finalizing changes. - CDISMPackageManager::Internal_Finalize(hr:0x800f0954)
DISM   DISM Package Manager: PID=1280 TID=5772 Failed processing package changes with session options - CDISMPackageManager::ProcessChangesWithOptions(hr:0x800f0954)
DISM   API: PID=11232 TID=1244 Failed to install capability. - CAddCapabilityCommandObject::InternalExecute(hr:0x800f0954)
DISM   API: PID=11232 TID=1244 InternalExecute failed - CBaseCommandObject::Execute(hr:0x800f0954)
DISM   API: PID=11232 TID=8352 CAddCapabilityCommandObject internal execution failed - DismAddCapabilityInternal(hr:0x800f0954)

Fix: Add-WindowsCapability failed. RSAT Error code = 0x800f0954

The steps to fix this are pretty simple and should only take a couple of minutes.

• On the problem child machine open gpedit.msc
• Go to Computer Configuration -> Administrative Templates -> System
• Open Specify settings for optional component installation and component repair

• With that settings open, select Enabled
• Check Download repair content and optional features directly from Windows Updates instead of Windows Server Updates Services (WSUS)

• Go back in your Powershell Window
• Run a gpupdate /force
• Rerun the Add-WindowsCapability again to install the feature

Once you’ve installed the RSAT tools for 1809, 1903 and later you might want to consider undoing those settings because this will install unnecessary updates on your machine. You would especially want to reconsider this if you’re deploying software updates using SCCM. Hopefully you’ve been able to fix the Add-WindowsCapability failed. Error code = 0x800f0954 error that so many of us have been running into.

Finally, feel free to check out the rest of our server administration for more of that content.

The post [Solved] Add-WindowsCapability failed. Error code = 0x800f0954 – RSAT Fix appeared first on the Sysadmin Channel.

Install RSAT for Windows 10 Version 1809, 1903 and Later in the GUI

Although I much prefer the Powershell method, we’ll start off with the GUI method.

• Open Settings -> Apps -> Optional Features

• Select the tools you want to install and click install

Install RSAT for Windows 10 Version 1809, 1903 and Later in Powershell

• Open Powershell as Administrator
• Type: Get-WindowsCapability -Name RSAT* -Online

Take note of the name and status

• To install the feature, you can either pipe the command to Add-WindowsCapability -or-
• Add-WindowsCapability -Name Name-of-Feature -Online

In this example, I’m installing the RSAT: Active Directory Domain Services and Lightweight Directory Services Tools

• The items should now be in the Start Menu -> Windows Administrative Tools

I’d love to hear your feedback and I hope you can now add RSAT easily using the Features on Demand. As always be sure to check out our Youbtube Channel https://www.youtube.com/c/theSysadminChannel or if you want more Server Administration content, check out our Server Administration Category. There is a lot of useful information on both links.

The post Install RSAT for Windows 10 Version 1809, 1903 and Later appeared first on the Sysadmin Channel.