Admin on the cheap

Chris E. AvisIT Evangelist – Microsofthttp://chrisavis.com

You need to: Implement methods to automate management tasks across your client and server base Manage any part of any computer, at any time, even when users are using the computer Create scripts that make it easy for help desk technicians to repeat the most common fixes

Run commands on a remote computer?Run commands on multiple remotecomputers?Use PowerShell as your primary commandline environment

Improved Command-line Shell and Scripting Language • Improves productivity and control • Accelerates automation of system admin • Easy to use • Works with existing scripts • Community model • Out-GridView New Features Integration• Graphical PowerShell • Active Directory Administration Center• Improved security • Internet Information Services (IIS)• Portability • Power management• New cmdlets • One-to-many remote management• Remote execution capability using WS-MGMT

”Easy” to Learn Commands are comprised of verb-noun pairs which provide consistency (cmdlets) Get-EventLog Help is built-in … and that’s consistent too TAB-completion eases discoverability Get-Event<press TAB> produces “Get-EventLog” Continue to press TAB to cycle through possible commands

 Remoting  Modules  Transactions  Computers Disable-PSSessionConfiguration Export-ModuleMember Complete-Transaction Add-Computer Enable-PSRemoting Get-Module Get-Transaction Checkpoint-Computer Enable-PSSessionConfiguration Import-Module Start-Transaction Disable-ComputerRestore Enter-PSSession New-Module Undo-Transaction Enable-ComputerRestore Exit-PSSession New-ModuleManifest Use-Transaction Get-ComputerRestorePoint Export-PSSession Get-PSSession Remove-Module Test-ModuleManifest  Debugging Remove-Computer Reset-ComputerPassword Disable-PSBreakpoint Get-PSSessionConfiguration Import-PSSession  Eventing Enable-PSBreakpoint Restart-Computer Restore-Computer Invoke-Command Get-Event Get-PSBreakpoint Stop-Computer New-PSSession Get-EventSubscriber Get-PSCallStack Test-Connection New-Event Remove-PSBreakpoint New-PSSessionOption New-WebServiceProxy Register-EngineEvent Set-PSBreakpoint  WMI Register-PSSessionConfiguration Register-ObjectEvent Remove-Event  Type Conversion Invoke-WMIMethod Register-WMIEvent Remove-PSSession Add-Type Set-PSSessionConfiguration Unregister-Event Remove-WMIObject Wait-Event ConvertFrom-Csv Set-WMIInstance Custom Sessions  WS-Man ConvertFrom-StringData  Other Disable-PSSessionConfiguration ConvertTo-Csv Enable-PSSessionConfiguration Connect-WSMan ConvertTo-Xml Clear-History Get-PSSessionConfiguration Disable-WSManCredSSP Disconnect-WSMan  Diagnostics Debug-Process Export-FormatData New-PSSessionOption Clear-EventLog Register-PSSessionConfiguration Enable-WSManCredSSP Get-FormatData Get-WSManCredSSP Export-Counter Get-Random Set-PSSessionConfiguration Get-Counter Unregister-PSSessionConfiguration Get-WSManInstance Import-LocalizedData Invoke-WSManAction Get-Hotfix Out-GridView Background Jobs New-WSManInstance Get-WinEvent Select-Xml Get-Job New-WSManSessionOption Import-Counter Send-MailMessage Receive-Job Remove-WSManInstance Limit-EventLog Set-StrictMode Remove-Job Set-WSManInstance New-EventLog Start-Process Start-Job Set-WSManQuickConfig Remove-EventLog Test-ComputerSecureChannel Stop-Job Test-WSMan Show-EventLog Update-List Wait-Job Write-EventLog Wait-Process This list is a small sample of the cmdlets that are available.

Invoke-Expression<command>C:PS>Invoke-Expression dirAliasingC:PS>dirC:PS>chdirC:PS>get-item

Windows cmd.exe / Windows PowerShell BashPowerShell COMMAND.COM Description (Unix, BSD, (MS-DOS, Windows, (Cmdlet) (Alias) Linux, Mac OS X, OS/2, etc.) etc.) Display the current directory/present workingGet-Location gl, pwd cd pwd directory.Set-Location sl, cd, chdir cd, chdir cd Change the current directory Clear-Host cls, clear cls clear Clear the screen Copy-Item cpi, copy, cp copy cp Copy one or several files / a whole directory tree Get-Help help, man help man Help on commandsRemove-Item ri, del, erase, rmdir, rd, rm del, erase, rmdir, rd rm, rmdir Delete a file / a directoryRename-Item rni, ren ren, rename mv Rename a file / a directory Move-Item mi, move, mv move mv Move a file / a directory to a new locationGet-ChildItem gci, dir, ls dir ls List all files / directories in the (current) directoryWrite-Output echo, write echo echo Print strings, variables etc. to standard output Change the current directory to the directory mostPop-Location popd popd popd recently pushed onto the stackPush-Location pushd pushd pushd Push the current directory onto the stackSet-Variable sv, set set set Set the value of a variable / create a variableGet-Content gc, type, cat type cat Get the content of a fileSelect-String find, findstr grep Print lines matching a pattern Get-Process gps, ps tlist, tasklist ps List all currently running processesStop-Process spps, kill kill, taskkill kill Stop a running process Pipe input to a file or variable, then pass the input Tee-Object tee n/a tee along the pipeline

What are modules? Discrete collections of cmdlets, providers, functions, aliases and other commands Can be used locally or accessed on remote computersWhere do modules come from? System modules are built-in to PS 2.0 Role and feature-specific modules are added automatically as roles and features are installed Modules can be authored and shared with others

Install the module Import the module into your PS session Find the commands that the module added Use the commands

Script AuthoringPowershell_ise.exe Output Input

Check box in Server ManagerEnable settings in Group PolicyRun cmdlet using PowerShell 2.0

InboundRules toEnable

You need to: Determine a way to reconfigure your network so that you can centrally manage the health of your servers Ensure that your workstations all have the right configuration so they can be easily supported Simplify the ways that users access resources Reduce the risk that computers you don’t own or manage pose to your most important data

Centrally manage serversImplement Group PolicyCreate a security and access framework

Downloadable set of Administration Tools forWindows 7Allow administration of both full server andserver coreMust be enabled via Programs andFeatures

• Adds new role services & featuresServer Manager • Provides a GUI interface for managing Server Core • Available on full and Server Core installations Windows • Includes new cmdlets and modulesPowerShell 2.0 • Enables automated remote server management • Built-in for several rolesBest Practices • Available through Server Manager and Analyzers PowerShell cmdlets

Role ManagementService ManagementConfigure Windows Error ReportingUpdate StatusRun Best Practices AnalyzerWindows Firewall configurationIE ESC SettingsServer manager automated via DISM command or ServerManager Module

Provides on-demand analysis & reporting ofactual vs. best practice configurations forseveral server rolesImplemented with Server Manager orPowerShell cmdletsProvides output with suggested tasks andlinkshttp://go.microsoft.com/fwlink/?LinkID=122786

WSUS is integrated as aWindows Server 2008 R2 Microsoft Update Web siteRole Service Automatic Updates Server running Windows Server Update ServicesTest Clients LAN Internet Automatic Updates

Create only the OUs you needTake advantage of Security Filtering

Limit total number of GPOs beingimplementedLimit No Override and Block InheritanceUse GP PreferencesDisable unused Group Policy elements

300+ additional policy settings Extends management for client computersPowerShell 2.0 Provides new cmdlets for GPMC operations Provides for PowerShell scripting inside GP

GP Preferences and Starter GPOs GP Preferences New Client Side Extensions in R2 allow better management of desktops Replaces logon scripts Starter GPOs Includes Starter GPOs “in-box” for Windows 7 Includes best practices that map to the security guide

Preference settings are not true “policy” Users are not restricted from changing settingsNew Client Side Extensions in R2 allowbetter management of desktops Power Plan settings Scheduled Task settings Immediate Task settings Internet Explorer 8 settingsR2 provides for improved Targeting Better administration through a rich UI

Backup, restore, export, import, duplicate PowerShell: Backup all GPOs in • Backup-GPO –all –path current domain to ‘C:BackupFiles’ directory

To implement a basic PKIinfrastructure: Root CA (standalone; offline) Set up a root standalone CA Set up an enterprise subordinate CA Create a certificate template Enterprise Subordinate CA with AutoEnroll permissions Configure Certificate AutoEnrollment (GPO)

New AD CS role services support policy-based certificate enrollment over HTTPIn extranet deployments, mobile workerscan enroll over the InternetCertificate selection is easier for users

Restricts communications to domainmember computers to mitigate risks posedby rogue or unmanaged devicesSecures traffic between domain membercomputersSupplements other security mechanisms toprovide “Defense in Depth”Encourages domain membership

Desktopsand DCsServers

Great built-in features can be leveraged atNO COST to youCheck out technet.microsoft.comCheck out sysinternals.microsoft.comMore Info – http://chrisavis.com

http://blogs.technet.com	1073
http://webcache.googleusercontent.com	2
http://fanyi.youdao.com	1
https://blogs.technet.com	1

Admin on the cheap

by Chris Avis on Nov 10, 2011

Accessibility

Categories

Tags

Upload Details

Usage Rights

4 Embeds 1,077

Statistics

Admin on the cheap — Presentation Transcript