{"id":4505,"date":"2012-12-06T00:01:00","date_gmt":"2012-12-06T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2012\/12\/06\/use-the-powershell-best-practices-module-to-configure-servers\/"},"modified":"2012-12-06T00:01:00","modified_gmt":"2012-12-06T00:01:00","slug":"use-the-powershell-best-practices-module-to-configure-servers","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/use-the-powershell-best-practices-module-to-configure-servers\/","title":{"rendered":"Use the PowerShell Best Practices Module to Configure Servers"},"content":{"rendered":"

Summary:<\/strong> Microsoft Scripting Guy, Ed Wilson, talks about using the Windows PowerShell Best Practices module to audit configuration of servers.<\/p>\n

Microsoft Scripting Guy, Ed Wilson, is here. Well, tonight is the Charlotte Windows PowerShell user group. We are doing a mini version of the Scripting Games, and so if you are in the area, you should check it out. It is a great learning experience to see how four or five different people approach the same problem.<\/p>\n

Exploring the Best Practices module<\/h2>\n

Today, I decided to play around with the Best Practices module on my domain controller running Windows Server 2012. To find the available cmdlets, I used the Get-Command<\/strong> cmdlet to look at the Best Practices module, as shown here.<\/p>\n

PS C:\\> Get-Command -Module bestpractices<\/p>\n

 <\/p>\n

CommandType     Name                                               ModuleName<\/p>\n

———–     —-                                               ———-<\/p>\n

Cmdlet          Get-BpaModel                                       BestPractices<\/p>\n

Cmdlet          Get-BpaResult                                      BestPractices<\/p>\n

Cmdlet          Invoke-BpaModel                                  BestPractices<\/p>\n

Cmdlet          Set-BpaResult                                      BestPractices<\/p>\n

First find the available best practice models<\/h2>\n

The first thing to do is to check for available best practice models. I do this by using the Get-BPAModel<\/strong> cmdlet and by not supplying anything else. This returns everything from everything as shown here.<\/p>\n

PS C:\\> Get-BpaModel<\/p>\n

Id                     : Microsoft\/Windows\/ADRMS<\/p>\n

Company                : Microsoft Corporation<\/p>\n

Name                   : RightsManagementServices<\/p>\n

Version                : 1.0<\/p>\n

LastScanTime           : Never<\/p>\n

LastScanTimeUtcOffset  :<\/p>\n

SubModels              :<\/p>\n

Parameters             :<\/p>\n

ModelType              : SingleMachine<\/p>\n

SupportedConfiguration :<\/p>\n

 <\/p>\n

Id                     : Microsoft\/Windows\/CertificateServices<\/p>\n

Company                : Microsoft Corporation<\/p>\n

Name                   : CertificateServices<\/p>\n

Version                : 1.0<\/p>\n

LastScanTime           : Never<\/p>\n

LastScanTimeUtcOffset  :<\/p>\n

SubModels              :<\/p>\n

Parameters             :<\/p>\n

ModelType              : SingleMachine<\/p>\n

SupportedConfiguration : Win8<\/p>\n

<OUTPUT TRUNCATED><\/p>\n

For me, a better output is to look at the ID<\/strong> <\/em>and the LastScanTime<\/strong>. <\/em>This is because invoking the BPAModel<\/strong> requires the ID and because I want to know when the last time (if ever) the Best Practices Analyzer (BPA) model ran. Here is the command and the associated results.<\/p>\n

PS C:\\> Get-BpaModel | select id, lastscantime<\/p>\n

Id                                         LastScanTime<\/p>\n

—                                         ————<\/p>\n

Microsoft\/Windows\/ADRMS                    Never<\/p>\n

Microsoft\/Windows\/CertificateServices      Never<\/p>\n

Microsoft\/Windows\/DHCPServer               Never<\/p>\n

Microsoft\/Windows\/DirectoryServices        11\/18\/2012 11:57:12 AM<\/p>\n

Microsoft\/Windows\/DNSServer                Never<\/p>\n

Microsoft\/Windows\/FileServices             Never<\/p>\n

Microsoft\/Windows\/Hyper-V                  Never<\/p>\n

Microsoft\/Windows\/LightweightDirectoryS… Never<\/p>\n

Microsoft\/Windows\/NPAS                     Never<\/p>\n

Microsoft\/Windows\/RemoteAccessServer       Never<\/p>\n

Microsoft\/Windows\/TerminalServices         Never<\/p>\n

Microsoft\/Windows\/UpdateServices           Never<\/p>\n

Microsoft\/Windows\/VolumeActivation         Never<\/p>\n

Microsoft\/Windows\/WebServer                Never<\/p>\n

To focus in on one specific best practices model, use the ID from the above output. I use the Clipboard to avoid a lot of typing. As shown here, the Invoke-BPAModel<\/strong> cmdlet does not appear to like wild cards.<\/p>\n

PS C:\\> Invoke-BpaModel -Id *dir*<\/p>\n

Invoke-BpaModel: There has been a Best Practice Analyzer error for Model Id ‘*dir*’. The Model is not installed.<\/p>\n

At line:1 char:1<\/p>\n

+ Invoke-BpaModel -Id *dir*<\/p>\n

+ ~~~~~~~~~~~~~~~~~~~~~~~~~<\/p>\n

    + CategoryInfo          : ResourceUnavailable: (:) [Invoke-BpaModel], CommandLetException<\/p>\n

    + FullyQualifiedErrorId : ModelNotFound,Microsoft.BestPractices.Cmdlets.RunScan Command<\/p>\n

 <\/p>\n

So, I use the Clipboard to paste the real ID name of the Directory Services BPA model to the Invoke-BPAModel<\/strong> cmdlet. This command is shown here along with the associated output from the command.<\/p>\n

PS C:\\> Invoke-BpaModel -Id Microsoft\/Windows\/DirectoryServices<\/p>\n

ModelId           : Microsoft\/Windows\/DirectoryServices<\/p>\n

SubModelId        :<\/p>\n

Success           : True<\/p>\n

ScanTime          : 11\/18\/2012 12:28:33 PM<\/p>\n

ScanTimeUtcOffset : -05:00:00<\/p>\n

Detail            : {DC1, DC1}<\/p>\n

Retrieving results from the best practices analyzer<\/h2>\n

To retrieve results after running the Invoke-BPAModel<\/strong> cmdlet, use the Get-BPAResults<\/strong> cmdlet. The command is shown here.<\/p>\n

Get-BpaResult -Id Microsoft\/Windows\/DirectoryServices<\/p>\n

The output is extensive and, when unfiltered, goes on for page after page. This is because the cmdlet presents lots of information about each check. The results of the command and the first two checks are shown here.<\/p>\n

\"Image<\/a><\/p>\n

Well, I might not be an expert on the Best Practices Analyzer, but dude, I certainly know Windows PowerShell. So, I can fix this output easily. To do this, I first pipe the results to the Group-object<\/strong> and sort by the count. This way, I can get the “executive overview” and see the number of runs, hits, and errors.<\/p>\n

PS C:\\> Get-BpaResult -Id Microsoft\/Windows\/DirectoryServices | group severity -NoEle<\/p>\n

ment | sort count<\/p>\n

 <\/p>\n

Count Name<\/p>\n

—– —-<\/p>\n

    1 Error<\/p>\n

    8 Warning<\/p>\n

   34 Information<\/p>\n

Hey, that is not too bad at all. I guess I will look at the Error first. I filter it out by using the Where<\/strong>–Object<\/strong> cmdlet. Because I am using Windows Server 2012, I have access to Windows PowerShell 3.0 and, therefore, to the new Where-Object<\/strong> syntax. Here is the command I use.<\/p>\n

Get-BpaResult -Id Microsoft\/Windows\/DirectoryServices | where severity -eq error<\/p>\n

Even the output from this one error is extensive. It appears (just a bit cut off) in the following figure.<\/p>\n

\"Image<\/a><\/p>\n

After looking over the output, I decide I am only interested in the Title, Impact, and Resolution properties. The cleaned up output is shown here.<\/p>\n

\"Image<\/a><\/p>\n

From my previous command, where I grouped the results by severity, I saw there were eight warnings. I now want to examine them. I use the up arrow, and change error<\/strong> <\/em>to warning<\/strong>, as shown here.<\/p>\n

Get-BpaResult -Id Microsoft\/Windows\/DirectoryServices | where severity -eq warning | fl title, impact, Resolution<\/p>\n

It might also be interesting to see the results by category. The following command shows that most of my results are configuration-related.<\/p>\n

PS C:\\> Get-BpaResult -Id Microsoft\/Windows\/DirectoryServices | group category -NoElement<\/p>\n

Count Name<\/p>\n

—– —-<\/p>\n

   42 Configuration<\/p>\n

    1 Operation<\/p>\n

If I am curious as to which report is related to operations, I use the following command.<\/p>\n

Get-BpaResult -Id Microsoft\/Windows\/DirectoryServices | where category -eq ‘operation’<\/p>\n

To get a general overview of the warnings I have, I use the following command.<\/p>\n

Get-BpaResult -Id Microsoft\/Windows\/DirectoryServices | where severity -eq warning | fl title<\/p>\n

The command and resulting list of warnings are shown in the following image.<\/p>\n

\"Image<\/a><\/p>\n

OK, it seems that a lot of the warnings are because I do not have a backup. How about if I filter out the “backup noise” and see what is left. Here is the command I use.<\/p>\n

PS C:\\> Get-BpaResult -Id Microsoft\/Windows\/DirectoryServices | ? { $_.title -notmatch ‘backed up’ -AND $_.severity -eq ‘warning’} | select title<\/p>\n

Title<\/p>\n

—–<\/p>\n

All domains should have at least two domain controllers for redundancy<\/p>\n

All OUs in this domain should be protected from accidental deletion<\/p>\n

The domain controller dc1.nwtraders.msft should comply with the recommended best …<\/p>\n

 There is more stuff related to the BPA module, and you can even download updated and additional BPA models. That is about it for now. Join me tomorrow when I will talk about more cool Windows PowerShell stuff.<\/p>\n

I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/strong> <\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about using the Windows PowerShell Best Practices module to audit configuration of servers. Microsoft Scripting Guy, Ed Wilson, is here. Well, tonight is the Charlotte Windows PowerShell user group. We are doing a mini version of the Scripting Games, and so if you are in the area, you […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,331,41,362,3,45,368],"class_list":["post-4505","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-best-practices","tag-monitoring","tag-powershell-3","tag-scripting-guy","tag-windows-powershell","tag-windows-server-2012"],"acf":[],"blog_post_summary":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about using the Windows PowerShell Best Practices module to audit configuration of servers. Microsoft Scripting Guy, Ed Wilson, is here. Well, tonight is the Charlotte Windows PowerShell user group. We are doing a mini version of the Scripting Games, and so if you are in the area, you […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/4505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=4505"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/4505\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=4505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=4505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=4505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}