{"id":4157,"date":"2013-02-16T00:01:00","date_gmt":"2013-02-16T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2013\/02\/16\/weekend-scripter-backup-and-remove-old-adms\/"},"modified":"2013-02-16T00:01:00","modified_gmt":"2013-02-16T00:01:00","slug":"weekend-scripter-backup-and-remove-old-adms","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/weekend-scripter-backup-and-remove-old-adms\/","title":{"rendered":"Weekend Scripter: Backup and Remove Old ADMs"},"content":{"rendered":"

Summary:<\/strong> Two Microsoft PFEs talk about a couple of functions to back up and remove old ADMs by using a Windows PowerShell function.<\/span><\/p>\n

Microsoft Scripting Guy, Ed Wilson, is here. Welcome back to two PFEs Mark Morowczynski and Tom Moser for part two of a three-part series.<\/p>\n

Please read yesterday’s<\/a> blog to catch up if you missed reading it.<\/p>\n

Mark Morowczynski (@markmorow) and Tom Moser (@milt0r) are Premier Field Engineers (PFEs) out of Chicago and Metro Detroit, respectively. They, with a group of contributing platform PFEs, write on the AskPFEPlat<\/a> blog, covering a wide range of operating system, Active Directory, and other platform-related topics. Tom is a Red Wings fan. Mark is a Hawks fan. To date, no physical altercations have occurred due to this work conflict.<\/p>\n

Onward!<\/p>\n

Building the paths<\/h2>\n

Next up, we need to take all of the information we put together about the domain and use it to build our paths. The very first thing we do, starting at line 111 in the script, is to create a string that contains the path to sysvol. This UNC path specifically points to the PDCe and not<\/em> to the domain DFS namespace.<\/p>\n

$sysvol = “\\\\$($PDCEmulator)\\sysvol”<\/p>\n

if($NoCentralStore.IsPresent -eq $true)<\/p>\n

{<\/p>\n

    $PolicyDefinitionPath = “C:\\Windows\\PolicyDefinitions”<\/p>\n

}<\/p>\n

else<\/p>\n

{           <\/p>\n

    $PolicyDefinitionPath = “$($sysvol)\\$($DomainFQDN)\\Policies\\PolicyDefinitions”<\/p>\n

}<\/p>\n

 <\/p>\n

$GPTPath = “$($sysvol)\\$($domainFQDN)\\Policies”<\/p>\n

$backupTarget = $null<\/p>\n

Next, we check to see if –NoCentralStore<\/strong> is set by looking for $NoCentralStore.IsPresent<\/strong>. If this property is true, we point to C:\\Windows\\PolicyDefinitions for the $PolicyDefinitions<\/strong> variable. The reason we check for this is that some customers expressed that they don’t want to use the GP Central Store. Instead, they use a terminal server for Group Policy management, and that server has local copies of all of the necessary ADMX templates. If $NoCentralStore.IsPresent<\/strong> returns anything but true, including null, we use the $sysvol<\/strong> <\/em>variable to build out the path to the domain’s GP Central Store. Following that, we build the path to the domain Policies<\/strong> folder, and store it in $GPTPath<\/strong>. This path contains all of the Group Policy templates. Finally, we set $backupPath<\/strong> to $null<\/strong> as a placeholder.<\/p>\n

Finally, before getting to function declaration, we create an object called $ADMDateStamps<\/strong> by using the ConvertFrom-CSV<\/strong> <\/em>cmdlet. We pass in headers, for naming the properties, as well as the names and dates associated with all out-of-box ADMs for operating systems prior to Windows Server 2008.<\/p>\n

(This is just a small part.)<\/p>\n

$ADMDateStamps = ConvertFrom-Csv `<\/p>\n

                “ADM,DateStamp<\/p>\n

                conf.adm,2\/22\/2003<\/p>\n

                inetres.adm,2\/18\/2005<\/p>\n

                system.adm,2\/18\/2005<\/p>\n

                wmplayer.adm,2\/18\/2005<\/p>\n

                             …<\/p>\n

 The object this cmdlet creates looks like this.<\/p>\n

\"Image<\/a><\/p>\n

We’ll come back to that later on in our functions.<\/p>\n

Function declarations<\/h2>\n

Now, we’ll discuss where all of the work takes place. The script contains six functions. For the sake of brevity, they’re briefly described in the following table.<\/p>\n\n\n\n\n\n\n\n\n\n
\n

Function<\/strong><\/p>\n<\/td>\n

\n

Purpose<\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

GetADMTemplates<\/strong><\/p>\n<\/td>\n

\n

Performs a recursive Get-Childitem<\/strong> for *.adm in the $GPTPath<\/strong>.<\/p>\n<\/td>\n<\/tr>\n

\n

GetADMXTemplateHashTable<\/strong><\/p>\n<\/td>\n

\n

Gets a list of *.admx from $PolicyDefinitions<\/strong> and stores information about them in a hash table.<\/p>\n<\/td>\n<\/tr>\n

\n

BackupAndRemoveADM<\/strong><\/p>\n<\/td>\n

\n

This function does the real work. It backs up, removes, and logs all actions.<\/p>\n<\/td>\n<\/tr>\n

\n

IsValidPolicyDefinitonPath<\/strong><\/p>\n<\/td>\n

\n

A simple function to verify that the Policy Definition Path is valid.<\/p>\n<\/td>\n<\/tr>\n

\n

CheckADMDate<\/strong><\/p>\n<\/td>\n

\n

A simple function to check the out-of-box ADM dates against the dates found on sysvol. Returns $false<\/strong> if the date isn’t found.<\/p>\n<\/td>\n<\/tr>\n

\n

RestoreADMFiles<\/strong><\/p>\n<\/td>\n

\n

When used with the $logpath<\/strong> parameter, restores all ADMs to the original location.<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 Some of these functions are just a few lines long. For portability and reusability, it made more sense to functionalize them (is that a word?). Since some of these are pretty brief and self-explanatory, we won’t cover them all.<\/p>\n

Function: GetADMTemplates<\/h2>\n

As mentioned above, this is a simple function.<\/p>\n

function GetADMTemplates<\/p>\n

{<\/p>\n

    param([string]$GPTPath)<\/p>\n

    $ADMTemplates = get-childitem $GPTPath *.adm -recurse | where { $_.extension.length -eq 4 }   <\/p>\n

    return $ADMTemplates<\/p>\n

}<\/p>\n

The function takes in a string parameter called $GPTPath<\/strong>. Based on the paths we constructed earlier in the script, this should be the UNC path to the sysvol folder on the PDCe for the domain. Line 4 does a simple Get-Childitem<\/strong> <\/em>with the –Recurse<\/strong> <\/em>switch. We also filter for *.adm. <\/em>This will return all files in sysvol that end in .adm* (including ADMX and ADML). Since we want only<\/em> *.ADM, we pipe the results of the Get-Childitem<\/strong> <\/em>to a where-object<\/strong> <\/em>and specifically filter for any files with an extension of 4 characters or fewer, including the period. The result is returned to the script body by using a return statement.<\/p>\n

Download the function<\/a> from the Script Repository.<\/p>\n

Function: GetADMXTemplateHashTable<\/h2>\n

Hash tables in Windows PowerShell are a great way to use a dictionary-type search when checking for the existence of an object. The hash table allows us to create a key\/value pair that we can later use to quickly check to see if a specific ADMX name was found anywhere in sysvol.<\/p>\n

Function GetADMXTemplateHashTable<\/p>\n

{<\/p>\n

    param([string]$PolicyDefinitionPath)<\/p>\n

       <\/p>\n

    $ADMXTemplates = @{}<\/p>\n

    $ADMXFiles = get-childitem $PolicyDefinitionPath *.admx<\/p>\n

   <\/p>\n

    if($ADMXFiles -eq $null)<\/p>\n

    {<\/p>\n

        write-host -fore ‘yellow’ “No ADMX templates found in the central store.”<\/p>\n

        return<\/p>\n

    }<\/p>\n

    if($ADMXFiles.count -eq $null)<\/p>\n

    {<\/p>\n

        $ADMXTemplates.Add($ADMXFiles.Name, $ADMXFiles.Fullname)<\/p>\n

    }<\/p>\n

    elseif ($ADMXFiles.count -gt 1)<\/p>\n

    {<\/p>\n

        $ADMXFiles | foreach { $ADMXTemplates.Add($_.Name, $_.Fullname) }  <\/p>\n

    }<\/p>\n

   <\/p>\n

    return $ADMXTemplates<\/p>\n

}<\/p>\n

Above, you can see that we only require a single parameter for this script— $PolicyDefinitionPath<\/strong>. Next, we create an empty hash table using $ADMXTemplates= @{}<\/strong>. <\/em>Next, we use Get-Childitem<\/strong>, recursively searching for *.admx, storing the result in a variable called $ADMXFiles<\/strong>.<\/em><\/p>\n

We need to evaluate the result of that search to find out if it found one object or many. We do this by looking for the count<\/strong> property on the returned object. A single object doesn’t have this property, but an array of objects will have the count<\/strong> property. The second if<\/strong> statement checks for the count<\/strong> property.<\/p>\n

Since a property that doesn’t exist on an object is equal to null, we just check to see if count is equal to $null<\/strong>. If it is, we got only one file back from our Get-Childitem<\/strong>. <\/em>If it isn’t null, we know that count must be greater than one, so we check for that. In either scenario, we then iterate through every file (or just the one) and build a set of key\/value pairs in our hash table. The file name <\/em><\/strong>is stored as key<\/strong> and the full file path<\/strong> is stored as the value.<\/strong> More on that later. At the end, we return the hash table back to the caller.<\/p>\n

Download the above function<\/a> from the Script Repository.<\/p>\n

Function: BackupAndRemoveADM<\/h2>\n

As noted in the script comments, #This<\/strong> function does all of the work.<\/p>\n

First, the function takes in three parameters: $ADMTemplatePath<\/strong>, $BackupPath<\/strong>, and $BackupTarget<\/strong>. We’ve already defined the purpose of those first two parameters. (Hint: They’re script parameters.) The last one is dynamically constructed in the script body and we’ll talk about it later.<\/p>\n

While this BackupAndRemoveADM<\/strong> function does all of the work, it’s a relatively simple function.<\/p>\n

First, we use Test-Path<\/strong> <\/em>to see if the path specified in $backupPath<\/strong> actually exists. If not, we use the New-Item <\/strong>cmdlet and make sure to use the –ItemType<\/strong> parameter to specify that this should be a directory and not a file, function, alias, Active Directory object, or anything else we can create with the wonderfully generic New-Item<\/strong> cmdlet.<\/p>\n

    if((Test-path $backupPath) -eq $false)<\/p>\n

    {<\/p>\n

        New-Item -ItemType directory $backupPath<\/p>\n

    }<\/p>\n

Next, we need to create the GUID-based backup path. This is where $backupTarget<\/strong> comes in to play. Down in the main body of the script, we have this:<\/p>\n

$backupTarget = $BackupPath + “\\” + $ADMTemplate.FullName.split(‘\\’)[6]<\/p>\n

That line is located in a Foreach<\/strong> loop that iterates through all of the ADMs found on sysvol. The line performs a String.Split()<\/strong> on the full name of the ADMTemplate using \\ <\/strong>as a delimiter. We pull out the 6th<\/sup> element and append to the user-specified backup path. An example of that process would look like this.<\/p>\n\n\n\n\n
\n

\\<\/p>\n<\/td>\n

\n

\\<\/p>\n<\/td>\n

\n

PDC.Corp.Contoso.Com\\<\/p>\n<\/td>\n

\n

Sysvol\\<\/p>\n<\/td>\n

\n

Corp.contoso.com\\<\/p>\n<\/td>\n

\n

Policies\\<\/p>\n<\/td>\n

\n

{GUID}\\<\/p>\n<\/td>\n

\n

ADM\\<\/p>\n<\/td>\n

\n

System.ADM<\/p>\n<\/td>\n<\/tr>\n

\n

0<\/p>\n<\/td>\n

\n

1<\/p>\n<\/td>\n

\n

2<\/p>\n<\/td>\n

\n

3<\/p>\n<\/td>\n

\n

4<\/p>\n<\/td>\n

\n

5<\/p>\n<\/td>\n

\n

6<\/p>\n<\/td>\n

\n

7<\/p>\n<\/td>\n

\n

8<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 In the path above, the characters preceding each slash becomes an element in the array. We wanted the 6th<\/sup> element, as this is the GUID for the GPO. We append that to the specified backup path and come up with the following.<\/p>\n

C:\\MyADMBackup\\{2F1B9A33-F347-4010-9492-157C08B71F54}<\/em><\/p>\n

Back in the function, we check to see if that path exists. If not, the file is created. What this ends up doing is populating the backup folder with a subfolder for every GUID found in sysvol.<\/p>\n

Next, we actually copy the ADM located at $ADMTemplatePath<\/strong> to the path set in $backupTarget<\/strong>. Since we want to be extra sure that the ADM was successfully backed up, we make use of the Windows PowerShell $? <\/strong>variable. Consulting Get-Help<\/strong> about_automatic_variables tells us exactly what the variable does.<\/p>\n

\"Image<\/a><\/p>\n

We can use $?<\/strong> to ensure that our backup, or other commands, was actually successful before we go and remove the file.<\/p>\n

copy-item $ADMTemplatePath $backupTarget <\/p>\n

if($? -eq $true)<\/p>\n

            {<\/p>\n

       remove-item $ADMTemplatePath<\/p>\n

            write-host -fore ‘yellow’ “Removed $($ADMTemplatePath)”       <\/p>\n

       }  <\/p>\n

If the if<\/strong> statement evaluates to true, we remove the file, and in yellow font, we write to the console that it was removed.<\/p>\n

You can download the above function<\/a> at the Script Repository.<\/p>\n

Like we said, simple!<\/p>\n

~Tom and Mark<\/p>\n

Thanks again, Tom and Mark, for sharing this knowledge and your time. Be sure to join us tomorrow for the conclusion.<\/p>\n

 I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy <\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Two Microsoft PFEs talk about a couple of functions to back up and remove old ADMs by using a Windows PowerShell function. Microsoft Scripting Guy, Ed Wilson, is here. Welcome back to two PFEs Mark Morowczynski and Tom Moser for part two of a three-part series. Please read yesterday’s blog to catch up if […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,152,56,410,3,411,61,45],"class_list":["post-4157","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-group-policy","tag-guest-blogger","tag-mark-morowczynski","tag-scripting-guy","tag-tom-moser","tag-weekend-scripter","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Two Microsoft PFEs talk about a couple of functions to back up and remove old ADMs by using a Windows PowerShell function. Microsoft Scripting Guy, Ed Wilson, is here. Welcome back to two PFEs Mark Morowczynski and Tom Moser for part two of a three-part series. Please read yesterday’s blog to catch up if […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/4157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=4157"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/4157\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=4157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=4157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=4157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}