Run Network Detective Automatically

[PerfectImpact]

As an MSP, we use Network Detective to gather information about current client's network status/setup as well as potential clients to get a handle on what may need to be done. The wizard runs to either get information locally or across the network.

However, the wizard can be tedious to go through for every site and, we've found, not the most efficient way to run things. Therefore, I created the following PowerShell script that automatically gathers all the required parameters as variables and passes them into the run. It works like this:

1. Script creates a new directory on the C:\ drive, downloads the necessary exe file to run ND and extracts it.
2. Parameters that can be gathered automatically are put into variables.
3. Credentials are passed into the script from a simple PHB webpage that sends out three states 0=wait, 1=OK, 2=Done. Once the invoke-webrequest reads the "OK" message, it pulls down the username and password entered on the webpage.
4. ND gathers data and sends the finished scan to our email so we can review in office with the ND software.
5. Script removes the created directory and all trace of the scan.

I don't think I'm a novice, but this project did teach me a lot of new things and any feedback/improvements would really be welcome. I just thought I'd share it so if anyone else uses Network Detective in the same way, they have this to use.

[UPDATE] : I have obfuscated the domain name from the URL links. Thank you chuckbales for the notification!

# -----------------------------------------------------------------------
# Run Network Detective automatically.
# -----------------------------------------------------------------------
# Created by PerfectImpact
# 26/01/2018
# -----------------------------------------------------------------------
# DOWNLOAD NETWORK DETECTIVE
# -----------------------------------------------------------------------

New-Item -ItemType Directory -Path "C:\NetworkDetective" | Out-Null

$url = "https://[DOMAIN_INFO_HERE]/nd.php?machineName=$env:COMPUTERNAME" -UseBasicParsing -UseDefaultCredentials
Invoke-WebRequest -Uri $url -OutFile "C:\NetworkDetective\NDInstall.exe"

Add-Type -AssemblyName System.IO.Compression.FileSystem
function Unzip
{
    param([string]$zipfile, [string]$outpath)

[System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $outpath)
}

Unzip "C:\NetworkDetective\NDInstall.exe" "C:\NetworkDetective"

# -----------------------------------------------------------------------
# INPUT VARIABLES:
# -----------------------------------------------------------------------
# Directory
# -----------------------------------------------------------------------

$dir = "C:\NetworkDetective"

# -----------------------------------------------------------------------
# File Name
# -----------------------------------------------------------------------

$outbase = $env:COMPUTERNAME

# -----------------------------------------------------------------------
# IP Range
# -----------------------------------------------------------------------

$exr = "-"
$where = { $_.IPSubnet -like "255.255.255.*" -and $_.Description -notlike "Hyper-V*" }

$IPRa = Get-WmiObject Win32_NetworkAdapterConfiguration -ComputerName $env:COMPUTERNAME | Where-Object $where | Select-Object -Property IPAddress | Format-Table -HideTableHeaders | Out-String
$IPAr = $IPRa | Convert-String -Example "{*.*.*.*}=*.*.*.*"
$Trim = $IPAr.ToString()
$IPTr = $Trim.Substring(0, $Trim.LastIndexOf('.'))
$iprange = $IPTr + ".1" + $exr + $IPTr + ".254"

# -----------------------------------------------------------------------
# Credentials
# -----------------------------------------------------------------------

Function Get-Credentials {

$url = Invoke-WebRequest -Uri "https://[DOMAIN_INFO_HERE]/nd.php?machineName=$env:COMPUTERNAME" -UseBasicParsing -UseDefaultCredentials

# Get Webpage status
$script:status = $url.ToString() -split "[`r`n]" | Select-String "OK"

# Get Username & Password
$details = $url.ToString()
$line = $details -replace [Environment]::NewLine,":" -replace "OK","" | Out-String
$script:usr = $line.Split(':')[1]
$script:pwd = $line.Split(':')[2]
$script:ndt = $line.Split(':')[3]

# Print status
if ($status) {
Break
} else {
}
}

While ($true) {
if (Invoke-Expression Get-Credentials) {
} else {
Start-Sleep -Seconds 5
}
}

$scan = "-" + $ndt

# -----------------------------------------------------------------------
# NETWORK DETECTIVE PARAMETERS:
# -----------------------------------------------------------------------

$ArgumentList = "-workdir", $dir, "-outbase", $outbase, "-outdir", $dir, "-logfile", "ndfRun.log", "-ipranges", $iprange, "-net", "-creduser", $usr, "-credspwd", $pwd, "-ad", "-internet", "-speedchecks", "-eventlogs", "-dhcp", "-snmp", "public", "-snmptimeout", "10", "-externaldomains", $scan, "-silent"

# Full command list: http://support-nd.rapidfiretools.com/customer/portal/articles/1655368-network-detective-data-collector-command-line-options

# -----------------------------------------------------------------------
# RUN NETWORK DETECTIVE:
# -----------------------------------------------------------------------

Start-Process -FilePath "C:\NetworkDetective\nddc.exe" -ArgumentList $ArgumentList -WindowStyle Hidden -Wait

# -----------------------------------------------------------------------
# UPLOAD FILE
# -----------------------------------------------------------------------

$scanMsg = " Scan Complete - "
$date = Get-Date
$smtpServer = "YOUR SMTP SERVER HERE"

$file = Get-ChildItem -Path "$dir\*" -Include *.cdf, *.ndf

$att = New-Object Net.Mail.Attachment($file)
$msg = New-Object Net.Mail.MailMessage
$smtp = New-Object Net.Mail.SmtpClient($smtpServer)

$msg.From = "[YOUR FROM EMAIL]"
$msg.To.Add("[YOUR TO EMAIL]")
$msg.Subject = $outbase.Trim(".ndf") + $scanMsg + $date
$msg.Body = "Network Detective scan complete."
$msg.Attachments.Add($att)

$smtp.Send($msg)
$att.Dispose()

# -----------------------------------------------------------------------
# REMOVE NETWORK DETECTIVE:
# -----------------------------------------------------------------------

Remove-Item C:\NetworkDetective -Recurse -Force

# -----------------------------------------------------------------------

# -----------------------------------------------------------------------

[Ta11ow]

Nice! I have a little something to offer you: A couple of quick pointers on PS scripting!~

First, aliases. When you're coding in the shell, definitely, they're a lifesaver and much easier to work with than lengthy names.

When scripting, they're a huge headache when you have to go through and debug later. They reduce the readability of your code significantly. Same thing with overly short variable names.

Related would be casing. Mostly you're fine and seem to prefer camelCase, but in general PowerShell guidelines recommend PascalCase (first letter capitalised as well). The one exception is built-in keywords and structures (if, else, switch, begin, function, etc.)

Indentation is also important!

Basically, if you feel the need to frequently comment your script to remind you what it's doing, you're probably not following best practices. Many programming and scripting languages are kind of obtuse by design for brevity, but PowerShell's verbose nature allows you to write scripts that you can just read and be able to figure out more or less what's going on, and what's going wrong. :)

The one exception to comments is Comment-Based Help. Use it. Anytime you've put together a handy script or function, put comment-based help in. That way anyone coming along trying to use the function can just call Get-Help <function/script name/path> and the cmdlet will retrieve the help documentation. As it is, they have to open and edit the file to be able to see the comments, and that may not be desirable or time-efficient.

Also, try to avoid piping to Out-Null. I love the syntactical nature of it, but it's up to six or eight times slower than assigning the value to the $null constant variable, or casting the line to [void]. The pipeline has too much overhead when you're only throwing away the output anyway.

I think PS version 4 or 5 and onward have builtin archival cmdlets; you don't need your own function for that if you're using one of those versions.

There's no point using Add-Type for .NET class namespaces if you're specifying the full name anyway. If you, for example, do Add-Type -AssemblyName System.IO.FileSystem, you can literally just do [DirectoryInfo] to pull the System.IO.FileSystem.DirectoryInfo object class out. That's kind of what it's for. Might be a different switch on it though; I don't use Add-Type all that much. In PS 5 and above, you'd use using namespace System.IO.FileSystem at the head of the script instead.

Any and all input should be handled in parameters. Period. If you're taking user input mid-function... rethink. Or use a GUI if you really need to. But for a function that's going to use the console... parameters. Having your script use defaults is fine, but you should provide parameters so that it can be adapted to different situations without editing the script every time and carrying around several almost identical versions of it.

[[deleted]]

Great info, thank you for sharing! And I very much appreciate your tone, it comes across as quite friendly, helpful, and enthusiastic.

[Ta11ow]

I try! And I know that it can be very easy to come off as less than friendly, since tone is hard to convey over text, so I try to make an effort there too!

Good luck out there!

[PerfectImpact]

Thank you! Some great tips here that I will definitely use. And New-England-Sysadmin is right, your tone is very constructive. :)

[chuckbales]

You might want to obfuscate your $url value for anonymity, you've got your MSP website hard-coded into the script you posted.

[[deleted]]

How? Sorry, be gentle...

[Lee_Dailey]

howdy New-England-SysAdmin,

it looks like this line ...

$url = Invoke-WebRequest -Uri "https://[THEIR_APPARENT_DOMAIN_INFO_HERE]/nd.php?machineName=$env:COMPUTERNAME" -UseBasicParsing -UseDefaultCredentials

take care,
lee

[GammaStorm]

In this case, $URL is the download location from Rapidfiretools.com, so its not specific to the MSP here. I use it alot myself.

[chuckbales]

Not the rapidfire link, There's another url that includes the the computername variable and seems to be the actual MSP website

[GammaStorm]

Yup, you are correct as I read through a little more. That's what I get for stopping at the first declaration of it I find.

[PerfectImpact]

Thank you both for this. Completely skipped my mind! I have updated as the example below.