{"id":49893,"date":"2010-05-09T00:01:00","date_gmt":"2010-05-09T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/05\/09\/hey-scripting-guy-weekend-scripter-configuring-w32time-service-logging\/"},"modified":"2010-05-09T00:01:00","modified_gmt":"2010-05-09T00:01:00","slug":"hey-scripting-guy-weekend-scripter-configuring-w32time-service-logging","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/hey-scripting-guy-weekend-scripter-configuring-w32time-service-logging\/","title":{"rendered":"Hey, Scripting Guy! Weekend Scripter: Configuring W32Time Service Logging"},"content":{"rendered":"

\"Bookmark<\/a><\/p>\n

 <\/p>\n

Microsoft Scripting Guy Ed Wilson here, yesterday<\/a> I wrote a script that configured my domain controller with an external time source. After doing that, I thought it would be a good idea to have the ability to enable and disable diagnostic logging for the W32Time<\/b> service. I ran across a pretty good knowledge base article, KB 816043<\/font><\/a>, that explained the different registry keys that needed to be modified, and I decided to get to work on the script. (I later found the Time Service team blog on MSDN<\/font><\/a> that talks about a different way to do this). The result is the ConfigureW32TimeLogging.ps1 script seen here. <\/p>\n

ConfigureW32TimeLogging.ps1<\/strong><\/p>\n

Param(
  <\/span>$computer = “Hyperv”,
  <\/span>$user = “nwtraders\\administrator”,
  <\/span>[switch]$enable,
  <\/span>[switch]$disable
)<\/p>\n

Function Start-W32TimeLogging($PSSession)
{
 <\/span>Invoke-Command -Session $PSSession -ScriptBlock {
 <\/span>$timeRoot = “HKLM:\\SYSTEM\\CurrentControlSet\\services\\W32Time\\Config”
 <\/span>$invalidChars = [io.path]::GetInvalidFileNamechars()
 <\/span>$date = Get-Date -format s
 <\/span>$file = “w32time-” + ($date.ToString() -replace “[$invalidChars]”,”-“) + “.log”
 <\/span>$logPath = Join-Path -Path c:\\fso -ChildPath $file
 <\/span>Set-ItemProperty -path “$timeroot” -name FileLogSize -Value 10000000
 <\/span>Set-ItemProperty -path “$timeroot” -name FileLogName -Value $logPath
 <\/span>Set-ItemProperty -path “$timeroot” -name FileLogEntries -Value 0-116
  <\/span>
 <\/span>Register-WmiEvent -Query `
  <\/span>“select * from __InstanceModificationEvent within 5 where targetinstance isa ‘win32_service'” `
  <\/span>-SourceIdentifier stopped<\/p>\n

 <\/span>Stop-Service -Name w32Time
 <\/span>Wait-Event -SourceIdentifier stopped
 <\/span>Start-Service -Name w32Time
 <\/span>
 <\/span>Unregister-Event -SourceIdentifier stopped
 <\/span>Remove-Event -SourceIdentifier stopped
 <\/span>} # end invoke-command
 <\/span>Remove-PSSession -Session $psSession
} #end Start-W32TimeLogging<\/p>\n

Function Stop-W32TimeLogging($pssession)
{
 <\/span>Invoke-Command -Session $PSSession -ScriptBlock {
 <\/span>$timeRoot = “HKLM:\\SYSTEM\\CurrentControlSet\\services\\W32Time\\Config”
 <\/span>Remove-ItemProperty -path “$timeroot” -name FileLogSize
 <\/span>Remove-ItemProperty -path “$timeroot” -name FileLogName
 <\/span>Remove-ItemProperty -path “$timeroot” -name FileLogEntries
  <\/span>
 <\/span>Register-WmiEvent -Query `
  <\/span>“select * from __InstanceModificationEvent within 5 where targetinstance isa ‘win32_service'” `
  <\/span>-SourceIdentifier stopped<\/p>\n

 <\/span>Stop-Service -Name w32Time
 <\/span>Wait-Event -SourceIdentifier stopped
 <\/span>Start-Service -Name w32Time
 <\/span>
 <\/span>Unregister-Event -SourceIdentifier stopped
 <\/span>Remove-Event -SourceIdentifier stopped
 <\/span>} # end invoke-command
 <\/span>Remove-PSSession -Session $psSession
} #end Stop-W32TimeLogging<\/p>\n

# *** Entry Point to script ***<\/p>\n

$psSession = New-PSSession -ComputerName $computer -Credential $user <\/p>\n

if($enable) { start-w32TimeLogging -pssession $pssession ; exit }
if($disable) { stop-w32TimeLogging -pssession $pssession ; exit }<\/font><\/font><\/p>\n

To enable diagnostic logging for the W32Time<\/b> service, the three registry keys that are shown in the following image are added to the w32Time<\/b> configuration hive. To disable diagnostic logging, the same three registry keys are removed. Of course, both of these operations require the w32Time<\/b> service to reload the configuration information from the registry. To do this, I stop and start the w32Time<\/b> service.  <\/span><\/p>\n

\"Image<\/font><\/a><\/p>\n

The script is extremely similar to the one I wrote yesterday. They both use Windows PowerShell remoting, they both use the Set-Itemproperty<\/b> cmdlet to create registry keys, and they both use WMI eventing to indicate when the w32Time<\/b> service has stopped. <\/p>\n

Despite the similarities, there are some differences between the two scripts. One of the things I do is create a custom name for the w32Time.log file. I do this because I might want to run it at different times of the day on the same day, and I did not want to fool with renaming or deleting pre-existing log files. This will also automatically allow me to keep as many logs as I wish. Here is the code:<\/p>\n

$invalidChars = [io.path]::GetInvalidFileNamechars()
$date = Get-Date -format s
$file = “w32time-” + ($date.ToString() -replace “[$invalidChars]”,”-“) + “.log”
$logPath = Join-Path -Path c:\\fso -ChildPath $file<\/font><\/font><\/p>\n

Because I am using the timestamp that gets converted to a string as part of the file name, I need to do a little bit of work. This is because all of the characters that are used in a timestamp are not allowed to be used in a filename. Using the GetInvalidFileNameChars<\/b> static method from the system.io.path<\/b> .NET Framework class, I can easily find out which characters are disallowed. I use this character set, and feed it to the replace<\/b> operator to change all invalid characters to a dash. Finally the Join-Path<\/b> cmdlet is used to build the path to the new log file. <\/p>\n

The log itself is Unicode, so when you attempt to read it, you will need to specify the encoding parameter. Using the Select-String<\/b> cmdlet, I can read the file and look for a particular string at the same time. The command I used is seen here (I shortened the path to fit it on a single line for clarity):<\/p>\n

Select-String -Path c:\\time.log -Pattern “ntpclient” -Encoding unicode \u2013AllMatches<\/font><\/font><\/p>\n

When I run the command, I am greeted with the output seen in the following image.<\/p>\n

<\/font><\/a>\"Image<\/p>\n

 <\/p>\n

If you want to know exactly what we will be looking at tomorrow, follow us on Twitter<\/a> or Facebook<\/a>. If you have any questions, send e-mail to us at scripter@microsoft.com<\/font><\/a> or post your questions on the Official Scripting Guys Forum<\/font><\/a>. See you tomorrow. Until then, peace.<\/p>\n

 <\/span><\/p>\n

Ed Wilson and Craig Liebendorfer, Scripting Guys<\/span><\/b><\/p>\n

<\/span><\/b><\/p>\n","protected":false},"excerpt":{"rendered":"

  Microsoft Scripting Guy Ed Wilson here, yesterday I wrote a script that configured my domain controller with an external time source. After doing that, I thought it would be a good idea to have the ability to enable and disable diagnostic logging for the W32Time service. I ran across a pretty good knowledge base […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[86,51,31,26,57,3,130,61,45],"class_list":["post-49893","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-basic-information","tag-getting-started","tag-operating-system","tag-registry","tag-remoting","tag-scripting-guy","tag-servers","tag-weekend-scripter","tag-windows-powershell"],"acf":[],"blog_post_summary":"

  Microsoft Scripting Guy Ed Wilson here, yesterday I wrote a script that configured my domain controller with an external time source. After doing that, I thought it would be a good idea to have the ability to enable and disable diagnostic logging for the W32Time service. I ran across a pretty good knowledge base […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/49893","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=49893"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/49893\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=49893"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=49893"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=49893"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}