Copy a file to a remote computer

[bbozic]

So to sum up my current situation;After a lot of work everything works fine.Problem 1: this method of running administrative scripts seems unreliable due to some computers not working "out of the box"Problem 2: I do not know what exactly failed on one of the notebooks, but I do know which 3 steps I had made to fix it (I listed those in one of the previous posts)Problem 3: If this happens again (or if some OTHER error happens) in the production environment I will be left in the dark, with no other option but to go personally to each problematic computer, run WMIDIAG and manually repeat the 3 steps that fixed things.What I would want to do now:Find a reliable way of deploying remote scripting on a workgroup (and later on a Domain), in order to achieve this I would at least like to know what exactly caused the problem in this case (to prevent it from hapenning again) and to find out why both types of identification (impersonate and identify) work, even though one should fail.

[bbozic]

Youre right, my fix probably opened up the system to intrusion by fcking up security permissions so this should not be done on production environment.The MMC snap in is crap, it does not allow for changing impersonate to identify and will therefore always say access denied on non domain (workgroup) connections.WBEMTEST is indeed an invaluable asset for testing purposes.WMIdiag also works fine now.

[bbozic]

Sorry for the delay, got so many things to do...I am a software developer, not a system administrator, but I have been asked by our sysads to make some scripts to help them. so I learn as I go IMHO - learning rather quickly.Got any book recommendation on how modern windows handle various types of authorization/identification over the network?Most of my scripts now work, the only things I need to do now are:1) find a way to enumerate all PCs in a workgroup or a domain (I am looking for an example of how this is done as we speak). I need IP addresses, thinking of pinging them, got one example that pings a range of IPs via cmd.exe....2) find a vbscript example that explicitly shows how to connect to 2 different computers by identify method, by providing logins/password for each, also searching the net for this...As a side note, seems to me people consider WMI to be crap, most state thate I should be using powershell instead However, from what I have seen WMI can do absolutely everything I could ever want and in a consistent way (once you actually get connected to the machine that is hehe). Perhaps its just a programmers point of view, the complexity of WMI API does not particulary frighten me.Why is there so much hate/distrust for WMI out on the interwebz?

[jvierra]

I am a software developer, not a system administrator, but I have been asked by our sysads to make some scripts to help them. so I learn as I go IMHO - learning rather quickly.Got any book recommendation on how modern windows handle various types of authorization/identification over the network?



I take it you are an applications programmer and not a systems programmer. WHen moving into teh admin scripting world you need to work closely with a trained admin who knows WIndows Management because you will need to understand the network layer and teh management layer as well as the OS structure and implementation. Most programmers never get near this area. ( I am a long time systems programmer and certified in a number of platforms)

To learn the requied layers you could start with the 'Windows Internals" books:http://www.amazon.com/Windows%C2%AE-Int ... 205&sr=1-1

This will get you going with how WIndows is assembled at teh OS and network levels. Actually I believe that all programmers that are serious about Windows programming should be familiar with what is in these books. Of course Windows Certification is also valuable.

In a domain you will need to know the technical side of Active Directory authenticaion within a domain or forest.

FOr the purpose of WMI sripting you just need to know how to authenticate then ask you admins if their inplementation supports or denies the kind of auth that you need to use. In a domain you will use inpersonation and should be able to do this with no specification as all defaults should work.

VBScript:
Set wmi = GetObject("winmgmts://MyServer/root/CimV2")

PowerShell:
$wmi=Get-WMIObject Win32_Process -filter "Name like 'sql%'"

To a standalone you may ned to use credentials as you have already seen.

[jvierra]

1) find a way to enumerate all PCs in a workgroup or a domain (I am looking for an example of how this is done as we speak). I need IP addresses, thinking of pinging them, got one example that pings a range of IPs via cmd.exe....


In order to script in a domain you need to learn Active Directory and how to use ADSI.

Here is an ADSI script that returns all domain computers from the local domain.

uploads/2491/Get-Computers.vbs.txt

The only easy way to return workgroup computers is by reading them from a file.

[jvierra]

Here is an example in PowerShell that does most of what you want.

Code: Select all

# get a searcher that will find all computers in domain.
	$searcher=[adsisearcher]"(objectcategory=computer)"
	$computers=$searcher.FindAll()
	
	# ping all computers
	$computers | ForEach-Object{ Test-Connection $_.Properties['name'] -count 1 -q }
	
	# generate a report of all computers in a table format
	# only computers that are pingable will be queried.
	$computers | ForEach-Object{ $_.Properties['name'] } | 
	     Where-Object{
		 Test-Connection 
	$_ -count 1 -q } | 
	     ForEach-Object{Get-WMIObject win32_computersystem -computer $_} | 
	     Format-Table -auto
	

The above code can actually be made much more compact. I uncompacted it so you could get a better idea of waht was happening.

As a programmer you would be interested to know that PowerShell is a programmers scripting language. The syntax is based on C#. ( Thank you for not using VB - a language designed to drive any programmer crazy-sorry Dartmouth). It uses dotNET 2.0 framework an can instantialte almost every NET class. PoSH has intimate knowledge of Windows Management and acive directory through type accellerators and custom formatters. PowerShell can execute any 'CMD' commands at it's prompt through many mechanisms. Programs can be launched the same as in CMD.

Example - compacted code
(this is all only one line of code.

Code: Select all

([adsisearcher]"(objectcategory=computer)").FindAll() |
     ?{Test-Connection $_.Properties['name'] -count 1 -q } | 
     %{gwmi win32_computersystem -computer $_.Properties['name']} | 
     ft -auto

This same functionality for a normal admin scripter would usually take about 100 lines of code. An efficient scripter might do it in about 50. PowerShell does it in one line or, if you are not a 'one-liner' kink of scripter then you can do it as I did at first. You can even do it with old linear coding (no pipeline) and you will still end up with only about 10 lines in PowerShell thanks to teh advanced CmdLets and the front ends to AD and WMI ( [adsisearcher] and Get-WMIObject)

The above may look a little funcky but, as a programmer, you should recognize the AD serach result properties breakout. I am using the property bundle that teh seqarch retrieves by default because it contains the name of teh system that I need to test and wuey in NetBios format. (I could have also used the DNS name which is also available). This is quick and conbeneioent and uses only defaults.

I try to always use the 'Best Practice' of only asking as much of an API as I actually need. There are other methods that you will see but thay are normally unnecessary. Most have been generated by admins without and programming knowledge converting the MSSN example linearly. The examples are ther to demonstrate nearly all options and usually show setting options to the default values which is unnecessary.

We can also use 'thisrf party' CmdLets and extensions to PowerShell such as the Quest AD CmdLets which are free and are extremely useful.

To get all computers in AD just type Get-QADComputer and BANG all computers will be returned.

Get-QADUser
Get-QASGroup
Get-QAD-Object
etc....

All take filters and single onject names in nearly all formats
Get-QADUser user1
Get-QADUser user1@domain.com
Get-QADUser 'user display name'
Get-QADUser "cn=John Doe,ou=traffic,dc=domain,dc=edu"

We can also use Microsoft AD management on Win7 and later with WS2008 AD.

Get-ADComputer
Get-ADUser
etc...

These work very much like Quest CmdLets but are more Microsoft like and tuned to AD more directly in many cases.


There is absolutely nothing in VBScripot (WSH) that comes close to what can be done in PowerSHell. This forum has been dying on teh VBScript front since PowerShell 2.0 came out howeverm it is still useful for getting help in fixing old scripts that may not be worth converting.

Fromwhat I have seen in recent months VBScript/WSH is dying a very rapid death. It willpersist for many years but no self-respecting admin wuold fail to move rapidly to PowerShell. Leave VBScript to the old farts like me and my cronies. We can do it blindfolded. (just kidding) VBScript will remain very useful for quite some time so it, too, is worth learning.


jvierra2010-10-11 11:22:03

[bbozic]

Excellent, got my hands on some "for dummies" books on Powershell, will have to do some serious reading, coz PoSH looks really good judging by the examples you provided. I do dislike plumbing, reminds me of the old painful days when programmers had a (terrible) dress code in line with their work, and minimal weight limit of 130kg (thats without the greasy manuals), BUT if it gets the job done, then I shall use it Unfortunately sysads are busy people (at least thats what they are claiming) so I cant rely on their help 24/7 (and I am programming 24/7) - so the process of getting info out of them can get kinda slow-ish, so I usually proceed on my own, its the hard way, but the knowledge I get makes my CV look all that better

[jvierra]

Without teh admins knowledge of th edomain setup you are fisshing in an empty hole. You will jabe no idea why something fails if you can't understand teh stuctures and settings. If you were a wiz at WIndowws systems programming you could discover it with code but then you wouldn't be her.

Right- you will learn a lot. PowerSHell can help but you stillneed to learn how WIndows works from other than the desktop program view. YOu will need either admin training or internal training.

Here is a link to a free PoSH book that will be better than the Dumbo books in my opinion.
http://www.primaltools.com/downloads/co ... ool=poshv1
It's an eBook for download writtenby teh originator of this sitem Don Jones, and Jeff Hicks. The book is a very good intro with many good examples. It is PoSH V1 but nearly all things remain true in V2. After that you can buy PoSH V2 from the same web site as it is very good too.

[bbozic]

Thanks, thats pretty much everything I need. Update: the script worksIt takes a list of computers from a text file (new line delimitation), pings every one the list, if a reply is found the moniker connects, then checks OS version, IE version, IE margin registry settings, IE header and footer settings, IE print background images, calculates the size of "temporary internet files" and deletes it.Then it reports (per computer) what it found (and what it changed) puts it into an excel document, colors Windows XP OS version as yellow, IE v6 as red, IE v7 as yellow, lists IE page setup settings, and colors all the faulty settings in red.The other scripts allows to "push" the correct registy settings across the domain or to the list of "red" computers that have faulty settings.As a side note, our sysads had to take a pen a paper and manually to this in the past, for more than 1000 workstations.Ok, so thats that, now I am working on installing a custom made installrite .exe package to remote computers, by first checking the OS version, then checking whether an older version of this software is installed (if so, uninstall) and then silently install the new software.Anyhow, additional side note on vbscript and VB.net, you see, in my environment the other programmers know, basically, only vbscript and VB.net, so they always nag on me to program in those "languages" so that they could edit the code (and/or sell it on freelancer.com more likely, right?). Thats one problem, the other one is, our managers are computer agnostic (they always are), and they are in charge of what we do (the irony), and they insist on EXTREMELY rapid developmentFor an example, they gave me a day (a single day) to learn to make the above mentioned "simple" script. And they gave this much time cause they like me, otherwise, a REAL programmer would have done it in 30mins or so.So, due to this kind of extremely ludicrous deadline constraints I started doing things in VB.net (I havent done much work in it beforehand, but its extremely easy to learn after having done a lot of programming in C# with net framework), I was very sceptic about it coz everyone says that VB is a childrens toy and C# is real mens language (approved by C.Norris) BUT it worked well for me!I actually started liking it! I do have SOME problems when I need to work with memory referenced callbacks (and pointers, but the difference is academic, methinks) due to managed memory and managed GC-ing but even this was solvable by VB.I dont see why people hate VB so much, they have quite a similar reaction to vbscript/wmi. Probably a matter of personal preference and irrational imagined prestige.From my perspective, I cant really list things that serve me better in C# to justify using it exclusively. All I want from a programming language and API objects it can use is to make my life simple - #1 concern in my firm is making code EXTREMELY QUICKLY, and, IMHO, VB servers that particular purpose perfectly.We arent doing 3D game engines, where supposedly C# is faster (and supposedly C++ is even faster) to justify switching to a allegedly faster C#.From what I have seen in 2D graphics, C# (GDI+) and VB (GDI+) are less than 1% apart. Winapi 2D gfx calls are actually the fastest What do you think about this?

[bbozic]

-- Nothing
I have posted has anything to do with updating registries or
--distributing software so I am at a complete loss as to what you might be
--talking about.Well its like this, the first part of the script that I wanted to complete and test was to simply connect to a remote computer and see what I can execute "over there", after this was done I started trying what else I can do without further changes to the system securtiy settings. Then I naturally wanted to see if I can choose particular computers from either the workgroup or the AD and see what rights of execution I get "out of the box".With your help I learned that there in fact existeda difference between DCOM carried logon for a workgroup and a domain, concerning the calling moniker. Therefore I learned all that I could about the moniker. After I was successfull at listing files on a remote computer I tried copying and deleting files to check if that works. It did. At this point I knew I could proceed to the real task at hand - which was copying over a *.reg file and then running it. I decided not to overwhelm the forums with what I really needed to do, I made up smaller code samples that illustrated what I wanted to do and made progress step by step until completion.Thanks to your advice I discovered that WMI has in itself dedicated methods for writing to the registry so I decided to implement that instead.Thats how I learn to program in a new "language", I work on a real project (only way to really get into it) and first design the logic (algorithm so to speak), then implement the beginning and the end with pseudocode in the middle, then I repeatedly go from the beginning to the end ironing out everything, constantly working with a minimal number of unknowns (less than 2 pieces of unproven code, if at all possible). Works extremely well for me. -- Speed has nothing to do with any of thisExactly my point, as I said, the #1 reason why people tend to say that C# is real mans language is beacuse they THINK its code execution is for some reason much faster. Its "speed" is the same as that of VB because they both depend on what is in the net framework and then on the CIL and JIT. Once the (CIL) code is made into byte code>jit>native its almost identical if not completely identical.Hopefully the days of assembler type languages are gone, unfortunately my next project will be coding smart cards, and from what I have read, assembler type code is eagerly waiting for my undivided attention IMHO the real grief you old timers should be having with the "new kids" is that todays situation enables us to make pretty good code (code that does its work) without ever needing to know the nitty gritty inner details. I recognize in myself that I almost never get to explore WHY exactly stuff works the way it does, because my boss wants me to spawn code that works and after I do it, he reassigns me immidiately. When you sum it all up, its becomes an academic question; is todays software (in general) better of worse than what it was before, because of the fact that a horde of newly made programmers dont know the inner details of what is going on and yet their code works and BRINGS MONEY TO THEIR EMPLOYERS.We derailed from the original discussion...