Christos Polydorou

Active Directory query. Every Windows administrator has had the need to get a list of objects using some kind of criteria to create a report or update them in one batch. Fortunatelly, Microsoft provides a PowerShell module to interact with Active Directory as part of the RSAT tools and this module is installed by default on the Domain Controllers. The commands in this module interact with the Domain Controller using the Active Directory Web Services. But what if you are not logged on to a Domain Controller or you don't have RSAT installed? There is a way to query the Domain Controller and get the information you want, without the limitations of the Web Services and in a much faster way using .NET. First, we have to create a DirectorySearcher object and configure it's LDAP filter. Calling any of the find methods will return the results for the specified filter. On the following example, I'm using FindOne() to get my account. Keep in mind that you can configure t...

Today I'd like to talk about the Search-IISSiteLog cmdlet that's part of the CPolydorou.IIS module. This cmdlet can be used in order to search text base log files, especially IIS website logs. Let's dive right in and search the Exchange IIS logs for the requests of a specific user! We'll start by getting the sites on an Exchange 2013 server: PS C:\> Get-Website Name             ID State   Physical Path ----             -- -----   ------------- Default Web Site 1  Started %SystemDrive%\inetpub\wwwroot Exchange Back En 2  Started C:\inetpub\wwwroot Since we want to search for a user's requests, we'll use the "Default Web Site" website. Our exchange servers are named "exchange2013a" and "exchange2013b". The Search-IISSiteLog command would be: Search-IISSiteLog -WebSite "Default Web Site" `            ...

I run across a fairly old Powershell script today that I had to use in order to get some information from the Security log of a Domain Controller. The domain controller has been around for a long time and the log was a bit large. I run the script once and it took forever to complete so I decided to take a look under the hood... First of all the script was using the Get-EventLog cmdlet which isn't the best thing... I examined the script for the event id's of the entries we would like to get and then I replaced the Get-EventLog and Where-Object cmdlets with the Get-WinEvent and the XML filter for the events. You may wonder, how are we going to build the XML filter for the WinEvent? Well, I'll show you a little trick. First we open Event Viewer, select the log and then select "Filter Current Log". A window will pop up and you'll have to fill the necessary fields. Wait, don't hit "OK" yet, switch to the XML tab and copy the query text. Nex...