First of all I would like to thank everyone who attended the Swedish PowerShell Community Day 2013.
The Community day was a success with lots of great discussions and sessions. Thank You!
And a special thanks to TrueSec & Labcenter for letting us use your facilities!
PowerShell 3.0 Technical Drilldown (remote & workflows)
Part 1: Running PowerShell V 2.0 Specific CmdLets from PowerShell V 3.0
Running SharePoint CmdLets in PowerShell V 3.0 is a little problematic since it’s not supported with version 4.0.30319.296 of the Microsoft .Net Runtime.
Here’s what happens if you try to run a SharePoint CmdLet in PowerShell V 3.0
Add-PSSNapin Microsoft.SharePoint.PowerShell
The local farm is not accessible. Cmdlets with FeatureDependencyId are not registered.
Get-SPSite
Get-SPSite : Microsoft SharePoint is not supported with version 4.0.30319.296 of the Microsoft .Net Runtime.
At line:1 char:1
+ Get-SPSite
+ ~~~~~~~~~~
+ CategoryInfo : InvalidData: (Microsoft.Share...SPCmdletGetSite:SPCmdletGetSite) [Get-SPSite], PlatformNotSupportedException
+ FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletGetSite
One way of solving this is by running powershell.exe with the -Version parameter and start PowerShell in version 2.0.
powershell.exe -Version 2.0
Another way is to set up a dedicated SessionConfiguration that runs powershell in version 2.0.
First, create a configuration file and include the -PowerShellVersion parameter
New-PSSessionConfigurationFile -Path C:\ps\SP.pssc -PowerShellVersion 2.0
Next, Register the Session Configuration. In the example below I use the -Name parameter to specify a name for my Session Configuration.
I also add a StartupScript that loads the SharePoint Snapin, and I include -Path,pointing it to the Configuration File that I just created.
# SharePoint.ps1 Script contains one line # Script Start Add-PSSNapin Microsoft.SharePoint.PowerShell # Script End Register-PSSessionConfiguration -Name SP -StartupScript C:\PS\SharePoint.ps1 -Path C:\PS\SP.pssc
Now i can simply connect to my Session Configuration and execute any SharePoint CmdLet. Here’s an example:
PS > Enter-PSSession -ComputerName localhost -ConfigurationName SP [localhost]: PS > Get-SPSite Url --- http://sp01 http://sp01/my [localhost]: PS > Exit-PSSession
Part 2: Setting up Restricted Endpoints
Next demo showed how to set up a restricted endpoint. A restricted endpoint allows you to specify which CmdLets a user is permitted to run through the endpoint.
In the example below we restrict the user to the following cmdlets: Get-ADUser,Set-ADUser,Get-ADComputer,Set-ADComputer,Get-ADGroup,Set-ADGroup.
We also use the ModulesToImport parameter and set it to ActiveDirectory when creating the Configuration File.
New-PSSessionConfigurationFile -Path C:\PS\AD.pssc -SessionType RestrictedRemoteServer -ModulesToImport ActiveDirectory -VisibleCmdlets Get-ADUser,Set-ADUser,Get-ADComputer,Set-ADComputer,Get-ADGroup,Set-ADGroup
The CmdLet generates a Configuration File that we can use when we register the endpoint.
When setting up an endpoint we have the possibility to run commands with the permissions of a different user account, such as a service account.
First store the users credentials in a PSCredential object.
$runAsCred = Get-Credential powershell\UserManagement
Next, use PSCredential object when registering a Session Configuration using the RunAsCredential parameter.
We also add the Path to the Configuration File generated earlier.
Register-PSSessionConfiguration -Name AD -Path C:\PS\AD.pssc -Force -RunAsCredential $runAsCred
In a default setup you have to be member of the builtin\administrators group or the builtin\remote management users group.
It’s also possible to add a custom group and allow the custom group to access the remote endpoint. You can do this
by using the Set-PSSessionConfiguration CmdLet with the ShowSecurityDescriptorUI switch.
Set-PSSessionConfiguration -Name AD -ShowSecurityDescriptorUI
Now any user who is member of the domain group RemoteUsers can access the restricted endpoint and run the cmdlets exposed by the endpoint under the service accounts credentials.
$cred = Get-Credential powershell\testuser Enter-PSSession -ComputerName SRV01 -ConfigurationName AD -Credential $cred [SRV01]: PS> Get-Command CommandType Name ModuleName ----------- ---- ---------- Function Exit-PSSession Function Get-Command Function Get-FormatData Function Get-Help Function Measure-Object Function Out-Default Function Select-Object Cmdlet Get-ADComputer ActiveDirectory Cmdlet Get-ADGroup ActiveDirectory Cmdlet Get-ADUser ActiveDirectory Cmdlet Set-ADComputer ActiveDirectory Cmdlet Set-ADGroup ActiveDirectory Cmdlet Set-ADUser ActiveDirectory
Part 3: Disconnected Sessions
In PowerShell V 3.0 it’s possible to disconnect from a remote session and connect to it at a later time.
This is useful if you start a job friday afternoon and don’t want to leave your computer or spend the night at your office.
You can simply disconnect from the powershell session, go home, and connect to the session again.
First, create a new session against a machine.
$session = New-PSSession -ComputerName DC01 -Name Demo
Next, run some PowerShell code and add the AsJob switch.
Invoke-Command -Session $session -ScriptBlock {
1..100 | ForEach-Object {
"Run: $_"
Start-Sleep -Seconds 2
}
} -AsJob
Next, use the Disconnect-PSSession CmdLet to disconnect the session.
Disconnect-PSSession -Session $session
When you want to connect to the session again you can simply use the Receive-PSSession CmdLet.
Get-PSSession -ComputerName DC01 Receive-PSSession -Name Demo -ComputerName DC01
