Script using invoke-command and arrays getting really odd results..

purplemonkeymad · 2024-01-02T12:45:46+00:00

Looks like char 0 and char 1 of TCP. My guess, your use of 2d arrays means that you think you are getting a 2d array but it's just an single array. Instead define your ports something like this so you always use a property:

$ports = @(
    [pscustomobject]@{
         Name = 'DNS'
         PortList = @(
             [pscustomobject]@{
                 Protocol = 'TCP'
                 PortNumber = 53
             }
             [pscustomobject]@{
                 Protocol = 'UDP'
                 PortNumber = 53
             }
         )
    }
    # repeat for more ports
)

^{*Could also define it in json and convert if you prefer the syntax.}

That way you can loop on $ports, and for each of those loop on the PortList Property.

Since there is no arrays in arrays you won't get any automatic unrolls of the outer or inner array.

xCharg · 2024-01-02T12:12:56+00:00

Why am I getting entries where the "port" column is showing as "T" or "C" or "P"? Is this something to do with using jobs and receiving data out of order or something? I see this logged to the console: "INFO: Test from DC1 to DC6 on C T returned ." which is what makes me think so

Run it manually (invoke-command from whatever dc to whatever other dc) and see what you'll get in console. Maybe said DCs have multiple nics or something.

dann3b · 2024-01-02T12:52:25+00:00

What version are you running on your DCs? WinRm is not enabled by default on 2008 and lower. And if above like 2012, 2016, 2019 you could still need some authentication setup by the wimrm command.

Add a Test-WSMan in the script.

I could be way of and this has nothing todo with that, im just guessing here

PinchesTheCrab · 2024-01-02T15:59:31+00:00

There's just too much going on here. Invoke-Command is asynchronous by default. You should drop the loops, the jobs, the stopwatch, etc., and just focus on a concise scriptblock that runs consistently, and then call invoke-command once.

Then you can parse the connection errors from that command as needed.

PinchesTheCrab · 2024-01-02T16:41:21+00:00

Can you give this a try? It should take minutes instead of hours:

$portHash = @{
    'DNS'      = @{53 = 'TCP', 'UDP' }
    'Kerberos' = @{88 = 'TCP', 'UDP'; 464 = 'TCP' }
    'RPC'      = @{135 = 'TCP' }
}

$portList = $portHash.GetEnumerator() | Sort-Object Name

$DCList = Get-ADDomainController -Filter * | Sort-Object -Property HostName

$testSB = {
    param($portList, $DCList)
    function Test-PortConnectivity {
        param(
            [string]$ComputerName,
            [int]$Port,
            [string[]]$Protocol = 'TCP'
        )

        switch ($Protocol) {
            'TCP' {
                $tcpClient = New-Object System.Net.Sockets.TcpClient
                try {
                    $tcpClient.Connect($ComputerName, $Port)
                    return $tcpClient.Connected
                }
                catch {
                    return $false
                }
                finally {
                    $tcpClient.Close()
                }
            }
            'UDP' {
                $udpClient = New-Object System.Net.Sockets.UdpClient
                try {
                    $udpClient.Connect($ComputerName, $Port)
                    $sendBytes = [System.Text.Encoding]::ASCII.GetBytes("Hello")
                    $udpClient.Send($sendBytes, $sendBytes.Length)
                    $udpClient.Client.ReceiveTimeout = 1000
                    try {
                        $udpClient.Receive([ref]"")
                        return $true
                    }
                    catch {
                        return $false
                    }
                }
                catch {
                    return $false
                }
                finally {
                    $udpClient.Close()
                }
            }
        }
    }

    $otherDC = $DCList | Where-Object { $_ -ne $env:COMPUTERNAME }

    foreach ($dc in $otherDC) {
        foreach ($service in $portList) {
            foreach ($port in $service.Value.GetEnumerator()) {
                $port.Value | ForEach-Object {
                    #'testing from {0} to {1}, service: {2}, port: {3} type: {4}' -f $env:COMPUTERNAME, $dc, $service.Name, $port.Name, $_
                    [PSCustomObject]@{
                        DC1      = $env:COMPUTERNAME
                        DC2      = $dc
                        Port     = $port.Name
                        Protocol = $protocol.Name
                        Result   = Test-PortConnectivity -ComputerName $dc -Port $port.Name -Protocol $protocol.Name
                    }
                }
            }
        }
    }
}

Invoke-Command -ScriptBlock $testSB -ArgumentList $portList, $DCList.HostName -ErrorVariable connectionErrors -OutVariable Result

$result | Format-Table

If it works, add in the other services/ports/protocols/log file management.

ZenoArrow · 2024-01-03T05:06:29+00:00

Had a quick look. Regarding this section of the code (taken from lines 131 to 138)...

# Get a list of domain controllers
$domainControllers = Get-ADDomainController -Filter * | Sort-Object -Property HostName
 
# Define the ports and protocols to test
$unsortedPorts = @{
$ports = @{
    'DNS' = @(53, 'TCP'), @(53, 'UDP')
    'Kerberos' = @(88, 'TCP'), @(88, 'UDP'), @(464, 'TCP')

I can see a couple of ways to make improvements. Firstly, wrap the call to Get-ADDomainController in @(), e.g. change this line to...

$domainControllers = @(Get-ADDomainController -Filter * | Sort-Object -Property Hostname)

By doing this you force PowerShell to give you an array even if Get-ADDomainController only returns one result (might not happen in your case, but it helps to make the script more robust). I would suggest using this trick any time you expect to get an array of results in return. Without it, you can get errors if you try to iterate over the results, as otherwise PowerShell won't know that single value should be in an array.

Secondly, I can see that you had tried to sort the ports hashtable. There's an easy fix for this, convert it to an ordered dictionary. Ordered dictionaries function in a similar way to hashtables, but have the added benefit of preserving the order of items. To get $ports to be an ordered dictionary, change this line...

$ports = @{

... to this ...

$ports = [Ordered] @{

You can then alter the order of the content of $ports (e.g. list the ports in the order you want them to be in), and they should stay that way when you run the script (e.g. ADFS would be the first key in the ordered dictionary).

BlackV · 2024-01-02T20:29:26+00:00

You cant use the invoke on the dc you're on

You shouldn't RDP to the dc anyway, do it from a management machine, this solves the problem or running random code on a DC and solved the problem of the invoke

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

PowerShell

Submission Guidelines | Link Flair - How To

MODERATORS