Confession to make

You know that feeling when you are absolutely sure that you are right and another person is wrong, and you claim that publicly in front of that person and the audience around? My experience says that in most cases the more sure you are the more likely it is that you are plain wrong.

I have a confession to make and a public apology to make. On IT Forum (Teched EMEA) last month, I noticed that the PowerShell v2 build which Jeffrey was using in his demoes still had Compare-Object -SyncWindow issue. So I asked Jeffrey about the status of this and to make things worse told everyone that this was one of top ten submissions at the connect site.

Not only was this an extremely unpolite thing to say after Jeffrey was asking everyone to use Connect to submit feedback – turned out (no surprise here) that I was actually wrong in my claims, confusing this one with another item on Connect. What a bummer.

I am really-really sorry. Don’t listen to me, listen to Jeffrey. Please keep submitting your feedback to connect. Jeffrey and his team are awesome and really trying their best to do what is good for the platform and the community.

The full story is that this is a nasty issue which gave me hard times at some point. I did submit the ticket long time ago. But at that time I did not know the exact root cause of the issue so the title of the submission was pretty confusing. The ticket was quickly closed as “by design”, and at that time I was too busy to protest that decision and/or open another one with a proper title and description. So needless to say, this one never got to top 10 and did not really show up in the lists which the team was reviewing.

I have now went ahead and opened a proper change request with proper title and description and I do think that this is something that needs to be fixed, and hope you go and vote for it. However, the main fact remains the same: “When pride comes, then comes disgrace”. I was really-really wrong, and I am now really sorry and apologize.

Tags: Conferences, IT Forum, PowerShell, TechEd, TechEd2008
Add to: | Technorati | Digg | del.icio.us | Yahoo | BlinkList | Spurl | reddit | Furl |

TechEd PowerShell Wrap-Up

I was writing my wrap-up from last week’s TechEd EMEA (IT Forum) when I saw that Jonathan Noble had just posted an excellent summary of the event. So I pressed Ctrl-A Del, typed this intro, left a couple of pictures of the the PowerShell Booth (which I got from Tobias) and the dream team we had there (plus Jonathan who was not at the booth but deserves to be on the picture after his great conference wrap-up post 😉 )

Tobias, Richard, Dmitry and Jonathan

Tobias, Dmitry, and Marc (MoW)

My posts from the conference and minor updates for each of them:

• Full list of Microsoft’s AD cmdlets – these were partly demoed at the event – if you have Windows Server 2008 R2 M3 build from WinHEC or PDC you can start playing with these already.
• PowerShell v2 Release Schedule
• PowerShell Panel Recording – now there’s a video recording of that available in both low and higher definition.
• Server 2008 R2 Active Directory
• PowerShell Dinner at IT Forum – check out Jonathan’s pictures here.

This was a great week! Thanks to everyone who stopped by and said hello. It was great to see how many people are using PowerGUI and also to find out that all the feature requests I was hearing were already on our roadmap and with the majority of items coming by the end of the year. Very encouraging indeed!

Anyways, check out Jonathan’s post here and you will feel like you attended the conference yourself. 😉

Tags: Conferences, IT Forum, PowerShell, TechEd, TechEd2008
Add to: | Technorati | Digg | del.icio.us | Yahoo | BlinkList | Spurl | reddit | Furl |

Full list of Microsoft’s AD cmdlets

Here’s the full list of the Microsoft’s AD cmdlets currently included in Windows Server 2008 R2. For your convenience, I have grouped them by nouns and provided the count in brackets:

ADAccount (4):

• Disable-ADAccount
• Enable-ADAccount
• Search-ADAccount
• Unlock-ADAccount

ADAccountAuthorizationGroup (1):

• Get-ADAccountAuthorizationGroup

ADAccountControl (1):

• Set-ADAccountControl

ADAccountExpiration (2):

• Clear-ADAccountExpiration
• Set-ADAccountExpiration

ADAccountPassword (1):

• Set-ADAccountPassword

ADAccountResultantPasswordReplicationPolicy (1):

• Get-ADAccountResultantPasswordReplicationPolicy

ADComputer (4):

• Get-ADComputer
• New-ADComputer
• Remove-ADComputer
• Set-ADComputer

ADComputerServiceAccount (3):

• Add-ADComputerServiceAccount
• Get-ADComputerServiceAccount
• Remove-ADComputerServiceAccount

ADDefaultDomainPasswordPolicy (2):

• Get-ADDefaultDomainPasswordPolicy
• Set-ADDefaultDomainPasswordPolicy

ADDirectoryServer (1):

• Move-ADDirectoryServer

ADDirectoryServerOperationMasterRole (1):

• Move-ADDirectoryServerOperationMasterRole

ADDomain (2):

• Get-ADDomain
• Set-ADDomain

ADDomainController (1):

• Get-ADDomainController

ADDomainControllerPasswordReplicationPolicy (3):

• Add-ADDomainControllerPasswordReplicationPolicy
• Get-ADDomainControllerPasswordReplicationPolicy
• Remove-ADDomainControllerPasswordReplicationPolicy

ADDomainControllerPasswordReplicationPolicyUsage (1)
:

• Get-ADDomainControllerPasswordReplicationPolicyUsage

ADDomainMode (1):

• Set-ADDomainMode

ADFineGrainedPasswordPolicy (4):

• Get-ADFineGrainedPasswordPolicy
• New-ADFineGrainedPasswordPolicy
• Remove-ADFineGrainedPasswordPolicy
• Set-ADFineGrainedPasswordPolicy

ADFineGrainedPasswordPolicySubject (3):

• Add-ADFineGrainedPasswordPolicySubject
• Get-ADFineGrainedPasswordPolicySubject
• Remove-ADFineGrainedPasswordPolicySubject

ADForest (2):

• Get-ADForest
• Set-ADForest

ADForestMode (1):

• Set-ADForestMode

ADGroup (4):

• Get-ADGroup
• New-ADGroup
• Remove-ADGroup
• Set-ADGroup

ADGroupMember (3):

• Add-ADGroupMember
• Get-ADGroupMember
• Remove-ADGroupMember

ADObject (7):

• Get-ADObject
• Move-ADObject
• New-ADObject
• Remove-ADObject
• Rename-ADObject
• Restore-ADObject
• Set-ADObject

ADOptionalFeature (3):

• Disable-ADOptionalFeature
• Enable-ADOptionalFeature
• Get-ADOptionalFeature

ADOrganizationalUnit (4):

• Get-ADOrganizationalUnit
• New-ADOrganizationalUnit
• Remove-ADOrganizationalUnit
• Set-ADOrganizationalUnit

ADPrincipalGroupMembership (3):

• Add-ADPrincipalGroupMembership
• Get-ADPrincipalGroupMembership
• Remove-ADPrincipalGroupMembership

ADRootDSE (1):

• Get-ADRootDSE

ADServiceAccount (6):

• Get-ADServiceAccount
• Install-ADServiceAccount
• New-ADServiceAccount
• Remove-ADServiceAccount
• Set-ADServiceAccount
• Uninstall-ADServiceAccount

ADServiceAccountPassword (1):

• Reset-ADServiceAccountPassword

ADUser (4):

• Get-ADUser
• New-ADUser
• Remove-ADUser
• Set-ADUser

ADUserResultantPasswordPolicy (1):

• Get-ADUserResultantPasswordPolicy

As I mentioned before these will RTM with R2 in 2010 and most of them have free 3rd-party alternatives you can use meanwhile.

Tags: AD, AD cmdlets, Active Directory, Conferences, IT Forum, PowerShell, TechEd, TechEd2008, cmdlets
Add to: | Technorati | Digg | del.icio.us | Yahoo | BlinkList | Spurl | reddit | Furl |

PowerShell v2 Release Schedule

Here at TechEd EMEA Jeffrey Snover has just announced detailed release schedule for PowerShell v2 (currently available as CTP 2):

• December 2008 – CTP 3 (Community Technology Preview) or Beta 1 if it meets the internal criteria and all names/features are finalized.
• RTM – end of 2009/early 2010 as part of Windows 7 and Windows Server 2008 R2.
• RTM for XP, 2003, Vista, and 2008 – as a downloadable package (with new WinRM bundled in there) a few months after that (that is H1 2010).

This is the first time these details were announced – common expectation was that PowerShell v2 would become available as a standalone package for all platforms mid-2009.

Tags: Conferences, IT Forum, Microsoft, PowerShell, PowerShell v2, TechEd, TechEd2008
Add to: | Technorati | Digg | del.icio.us | Yahoo | BlinkList | Spurl | reddit | Furl |

PowerShell Panel Recording

Jonathan has just posted the recording from yesterday’s TechEd EMEA PowerShell Panel discussion.

This was a great discussion on PowerShell, the upcoming v2, the ecosystem around PowerShell – and many many topics.

If you are not at the IT Forum this year or missed the panel – you can listen to the recording here.

Tags: Conferences, IT Forum, PowerShell, TechEd, TechEd2008
Add to: | Technorati | Digg | del.icio.us | Yahoo | BlinkList | Spurl | reddit | Furl |

Server 2008 R2 Active Directory

Here are my notes from today’s “Windows Server 2008 R2 Active Directory: What’s Coming Up?” session at IT Forum (TechEd EMEA IT Pro) by Robert DeLuca and Alain Lissoir.

Looks like this is going to be a pretty big release for the AD team with a lot of exciting features in it: recycle bin, managed service accounts, PowerShell… Here are some details:

Recycle Bin

The way this is implemented is that they are adding a new state in which the objects can be (recycled or whatever is the name). So basically if you delete an account it gets recycled for 180 days, and then tombstoned for 180 days after that.

When an object is recycled you can restore it with all attributes (all backlinks, group membership – everything) as they were when the object was deleted.

Caveats:

• Big one: This functionality will require 2008 R2 functional level
• Minor one: There won’t be any admin UI for that but the APIs are very simple, so getting a freeware utility (or PowerPack) is going to be an hour of work.

Managed Service accounts:

They have new kind of domain accounts (inherited from computer account objects) – managed service accounts. Like computer accounts these will automatically get passwords re-generated by netlogon. The idea is that you can use these as service accounts on your member servers and not care about failures when a password changes.

Caveats:

• In R2 timeframe these accounts cannot spawn servers. I.e. one managed service account can be used on only one server (but for multiple services).
• At the moment Task Scheduler cannot use those. This might get fixed by the time R2 releases.

PowerShell:

They have about 80 PowerShell cmdlets and a provider (i.e. drive-like representation). These rely on web services. Yes, the roadmap is to stop relying on LDAP and make web services the main API. The web services will ship with R2 but the plan is to make them a free download for 2003 and 2008.

The cmdlets can be used against AD, ADLDS (ADAM) or snapshots – like Quest’s cmdlets today. Overall, a very similar syntax which will provide for fairly easy transition path. Plus there are a few nice additional features like advanced server-side filters.

Overall, the team’s commitment was to (over time) move all tools and command-line utilities (like ntdsutil) to PowerShell.

The web services will be very much unified between AD and ILM v2 but cmdlets will not work against ILM v2 because the data model is different.

And, yes, PowerShell and AD cmdlets will be supported on Server Core.

MMC 4:

The new UI for account management (replacing ADUC) is built on the new version of MMC – MUX – all other UIs will for the moment stay on the old MMC 3.0. MUX will only become available with R2, but after that (much like MMC 3.0 today) other Microsoft teams and 3rd parties will be able to start using it in their products.

This new UI will be based on PowerShell but in the R2 timeframe will not expose the code behind your clicks. However, eventually in the post-R2 timeframe there is a dream to make it PowerGUI-like generating scripts for anything you do in the UI.

Offline domain join:

There will be a djoin command-line utility (not a cmdlet 😦 ) you can run it on any server in the domain and it will create the proper computer account in AD and output a blob for subsequent client update. Then you can use that very same utility to import that blob into the client (or VHD) registry. Next time the client (Windows 7 or 2008 R2) boots up it will detect that blob and automatically join the domain (even if it is not in the network.)

What is not going to be added or changed:

ADMT:

Will not change in R2 timeframe. They are considering revamping it (based on PowerShell) after R2.

Dynamic/policy-based access:

They are not going to add dynamic security groups or policy-based access control (e.g. give London helpdesk ability to reset passwords for London users) – like 3-rd party products such as ActiveRoles Server provide today – anything policy-based is supposed to go into Identity Lifecycle Manager (ILM) v2.

Tags: AD, AD cmdlets, Active Directory, Conferences, IT Forum, PowerShell, TechEd, TechEd2008, cmdlets
Add to: | Technorati | Digg | del.icio.us | Yahoo | BlinkList | Spurl | reddit | Furl |

PowerShell panel @ IT Forum

There’s a correction to the TechEd EMEA (IT Forum) PowerShell agenda. Tomorrow (Tuesday, Nov 4) 2-3 pm there will a PowerShell Panel Discussion on a stage adjacent to the Tech´Talk Fishbowl.

This is not in your conference agenda books so please take your pen and add it in yourself!

The invited speakers include:

• Jeffrey Snover
• MoW
• Richard Siddaway
• James O’Neill
• Jonathan Medd
• Tobias Weltner
• Dmitry Sotnikov

It’s going to be fun, so make sure you come and join us in this open panel discussion!

Tags: Conferences, IT Forum, PowerShell, TechEd, TechEd2008
Add to: | Technorati | Digg | del.icio.us | Yahoo | BlinkList | Spurl | reddit | Furl |

IT Forum Ask the Experts

I know this was pre-announced by Richard a few weeks ago 😉 but I’ve just got a confirmation that I am listed for the Ask the Experts area for the upcoming TechEd EMEA IT Forum.

Sounds like we are getting quite a team with Richard, Tobias, and MoW enrolled as well. Once I have a schedule of the actual booth hours I will post these as well. Hope to see you there if you are attending!

Tags: Conferences, IT Forum, PowerShell, TechEd, TechEd2008
Add to: | Technorati | Digg | del.icio.us | Yahoo | BlinkList | Spurl | reddit | Furl |

PowerGUI TechEd Demo

As promised here is the demo I was doing in Jeffrey’s CTP2 talk at TechEd 2008.

The session was on PowerShell v2 and Jeffrey asked me to demo the new capabilities which v2 gives to UI applications. We selected background execution and eventing as the demo features.

The demo was very simple (in fact, thanks to the transparency of these features in v2 surprisingly so). I took the AD user provisioning action (which is a script action, and a fairly long and complicated one), used it on this scv file: presidents.csv

The provisioning took 20 seconds or so and because the execution was synchronous the UI was basically locked until the last presidential account was there. Not good!

But luckily the machine had PowerShell v2 installed so we went ahead and made this script a…

Background job

To do that, I opened the script (I was actually copy/pasting the script to a new Script Action), and added Start-PSJob as the first line, and then enclosed the whole script into a here-string parameter for the command:
Start-PSJob -Name “Provision“ -Command @’
# here goes my script
‘@

Then I jut ran the new action the the UI was back right away! Meanwhile the whole provisioning was being done in the background!

I added a node to the PowerGUI console which was executing Get-PSJob and allowed me to see the status and results of any background jobs I had.

However, obviously another change made more sense – changing the system so the script would just run automatically whenever the CSV file with the information on the new AD accounts to be provisioned appears at a specific location. So we re-did the script – this time using

Eventing

To do this we enclosed the script in a scriptblock (don’t ask me why scriptblocks are required for this one and strings for the previous one – I guess just different people architecting the features ;)) and added the commands creating a file system watcher and registering it with the new Register-ObjectEvent cmdlet:
$action = {
# here goes my script
}

$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = “c:\temp2“
$watcher.Filter = “*.csv“
$watcher.EnableRaisingEvents = $true
Register-ObjectEvent $watcher “Created“ -SourceIdentifier “FileSystemWatcher.Created“ -Action $action

To check out all the triggers I had in place I created a Triggers node in PowerGUI using Get-PSEventSubscriber to show them all.

Now I copy/pasted my CSV to the folder the trigger was watching and all the accounts got provisioned!

Very simple!

As a bonus section here are a couple of tricks I used:

1. I added Add-PSSnapin to the beginning of the script before doing the demo. This was to workaround the issue with background jobs not loading PowerShell profiles and not inheriting the loaded snapins from the current session.
2. I hardcoded the path to the CSV file so I did not have to type the path each time I started the action, and did not have to make slightly more advanced things in the scripts (i.e. passing the parameter to the subscriber action and background job).

Apart from that – no modifications were required! I could just re-use my scripts in these new scenarios!

Tags: Conferences, PowerGUI, PowerShell, TechEd, TechEd2008
Add to: | Technorati | Digg | del.icio.us | Yahoo | BlinkList | Spurl | reddit | Furl |

Breakthrough Product of TechEd 2008

At the TechEd 2008 in Orlando PowerGUI has received the highest award of the show – The Breakthrough Product of the show.

Here’s the award description:

Breakthrough Product

This award is for the best single product of the Tech•Ed 2008 IT Professionals, and could be from any IT Pro award sub-category.

I am super-excited. This is an incredible achievement for the team, and frankly for the whole PowerGUI and PowerShell community. Without you guys providing all the feedback and feature requests, contributing your PowerPacks to the library, localizing us to every language in the world, and simply spreading the word we would not have been where we got. Love you all! 🙂

You can find the list of winners in various subcategories here.

Tags: Conferences, PowerGUI, PowerShell, TechEd, TechEd2008, awards
Add to: | Technorati | Digg | del.icio.us | Yahoo | BlinkList | Spurl | reddit | Furl |