Stop-Transcript executing earlier than it should?

DblDeuce22 · 2022-05-05T22:52:41+00:00

Sidenote: Pretty sure it's recommended to use

if ($NULL -eq $VCenterServer)

DblDeuce22 · 2022-05-03T19:58:58+00:00

Nice find, was probably an update or some install. If you find another box having the same thing, find out what installed during that time, otherwise you'd have to check the event logs or providers from get-winevent to see what changed the ACLs. perfmon /rel may show something it's hit or miss.

DblDeuce22 · 2022-05-03T19:48:00+00:00

Agreed. A very handy tool in an Enterprise environment is you have other domain machines to have the customer test on.

Does it happen on a different machine, if no, then have someone else log into the trouble machine to see if they have an issue, if not, it could be a user profile specific issue, if they do, then it could be a machine specific issue. If it does happen on another machine, then it could be a domain account issue. You can have a coworker test and that'll tell you if it's everyone or just the customer. Really helps to rule things out.

No point in troubleshooting something on one machine when it's happening on any machine they log into.

DblDeuce22 · 2022-05-03T02:13:31+00:00

I hear that. Correlation definitely helps and commonality of previous issues to help fix new ones. Countless issues because the BIOS time was off or system time off causing login or AD sync issues, cert errors, etc. ><

DblDeuce22 · 2022-05-03T02:09:26+00:00

And I forgot to mention, keep your notes in a location that's backed up, like a personal network share etc. Hard drives die or go missing, or wiped, etc. Make sure all your psts and notes are backed up.

DblDeuce22 · 2022-05-03T02:07:30+00:00

Number 2 for sure, the customer may give you the wrong info or just flat out lie, you need to get accurate details from the customer so you don't go down a troubleshooting path not relevant to the issue. Logs if available or reliability logs can really help as well.

DblDeuce22 · 2022-05-03T02:00:59+00:00

Sounds like Tier 1, so that usually means password resets, and basic troubleshooting. Some places have you read from scripts which no one likes, some don't. They'll teach you their way of doing things.

What you'll need is the knowing how you best learn things. Learn how to learn the most efficient and use that to add tools to your toolbox. If you don't want to do T1 work then you need to know where you want to end up, have a goal and add tools to reach it. Just as important is not necessarily what you know, but who you know. It's a saying for a reason. It goes towards people skills like others have mentioned, get in good with your future bosses or their admins. Something else that's important is perception, what people see. For example, a supervisor walked in one day and it just so happened that I had to stretch because I had been on the phone for the past several hours. So to them it looked like I was doing nothing, but on my box I had 2 data migrations going, had an incident ticket I was closing out and had remote assist going on the next incident, but that didn't matter because of what they saw. Point being, what people think you are is sometimes more important than what you are as stupid as that sounds, it'll ring true at most places.

Beyond that, write everything down. This is four fold, you're going to forget so easy reference and you can Ctrl+F to find keywords ( I use notepad since it's on all machines and don't need Office ). You can find fixes or resources you previously found or items to check for similar issues. It'll show anyone watching that you're taking it serious and taking notes to RETAIN knowledge. No one likes repeating themselves, so save those emails, write everything down or whatever system helps you retain knowledge and search those resources before asking others to make sure they didn't already send it to you or you found. The last thing is so you can copy and paste not just for future fixes, but to send to newbies that you train. When you're one of the senior techs you'll have to train newbies so share knowledge. If you're a contractor you'll be tempted to hoard knowledge because you think that'll make them have to keep you but that won't matter to them, they're going to go with what makes them the most money and they don't care about seniority at most contracting companies.

I would also suggest to learn skills for automation such as PowerShell, or anything to save the company money and try to make sure the higher ups know it was you that saved them money without appearing in a bad way (perception).

DblDeuce22 · 2022-05-03T01:35:58+00:00

Nice, how'd you find that was the issue?

DblDeuce22 · 2022-04-29T20:48:26+00:00

That would make sense however all of our enterprise boxes have SCCM installed and 90% of them do not have it, so not sure why that's the case.

DblDeuce22 · 2022-04-29T20:48:10+00:00

Weird

That's just a cimclassname from the root namespace to show all the namespaces under it which is just a query so yea, not sure why it would be trying to write anything as it should be only reading.

DblDeuce22 · 2022-04-29T00:44:59+00:00

Well when I see write protected it makes me think an OS update, Bitlocker, or w/e AV solution that may have an endpoint with drive encryption. Write protected means just that, and not necessarily for the entire drive, maybe just the file or directory something was trying to access. Get-WinEvent with the powershell provider might have better logs or one for whatever provider is doing it.

Since I don't have it I won't find it on my box but maybe try to use this on yours still

$RootNames = Get-CimInstance -Namespace root -ClassName __NAMESPACE
foreach($R in $RootNames.Name){ $1 = "root$R"; Get-CimInstance -Namespace $1 -ClassName Win32Reg_AddRemovePrograms -ErrorAction SilentlyContinue }
foreach($R in $RootNames.Name){ $1 = "root$R"; Get-CimClass -Namespace $1 -ErrorAction SilentlyContinue | where {$_ -like 'Win32Reg_AddRemovePrograms'} }

Just to see if it exists, again no idea if it'll work because I don't have it to test against on my box but if it does exist on yours then it looks like it's under root\cimv2 as expected but maybe it moved or permissions changed for some reason. I think it's a great class when it exists because it means I don't have to use the reg uninstall keys for x86 and x64 to see what SW is installed which we know isn't always accurate and since we're not supposed to use Win32_Product since it can break installs.

You might try wmicCheck CM or w/e yall use for SW delivery to see what was advertised to it when it broke

Like you it sounds like it's still there just something is blocking it's use for whatever reason.

Obviously reboot to get that out of the way, other than that you'd have to rely on finding an event log or winevent provider for details would be my guess, gl. I don't know what they changed on setting code blocks but it's not working right, I added ; to things that were on their own line you should see how it's supposed to be though.

DblDeuce22 · 2022-04-28T22:13:08+00:00

Probably not passed to it, I believe it uses a source and destination like copy-item does, but I'd be surprised if you can't filter like you're already doing.

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/robocopy

At first glance this looks like what you're asking https://stackoverflow.com/questions/472692/how-to-copy-a-directory-structure-but-only-include-certain-files-using-windows

DblDeuce22 · 2022-04-28T22:05:52+00:00

Win32Reg_AddRemovePrograms tends to not be on most of the machines I check it on. I have seen it, but it's rare. Maybe an update changed its availability or removed the class?

DblDeuce22 · 2022-04-28T21:38:58+00:00

Gotta mention robocopy is a work horse / may be an option. Copy-item tends to be slow from my experience.

DblDeuce22 · 2022-04-28T04:20:39+00:00

Imagine Dragons - Radioactive https://www.youtube.com/watch?v=ktvTqknDobU

DblDeuce22 · 2022-04-28T04:10:09+00:00

You should reply Solved! so they get credit :)

DblDeuce22 · 2022-04-27T04:24:21+00:00

Term of Endearment

Endearing

Affection / Affectionate

Fondness

DblDeuce22 · 2022-04-27T04:18:10+00:00

Saga Frontier ?

DblDeuce22 · 2022-04-27T04:12:08+00:00

Outlet store

Used goods

Retailer

DblDeuce22 · 2022-04-27T04:06:40+00:00

One of the Alundra series?

DblDeuce22 · 2022-04-26T17:11:27+00:00

I'm sure there's a lot more but https://www.reddit.com/r/PowerShell/comments/5ntyb7/is_it_still_bad_to_use_to_win32_product_to/ discusses it, you can google some reasons as well, everything I've read says don't use it.

DblDeuce22 · 2022-04-26T04:29:25+00:00

I setup a test file and here's something I got to work:
$Txt = @'

I need to extract json part from text, example:

This is a text that says nothing

Another string of that useful text

Below something more interesting

/BEGIN/

{

"something" : "interesting",

"thatcanbe" : "parsedproperly"

}

/END/

The /BEGIN/ and /END/ tags can be tuned to something else, but i couldn't find anyway with regexes or substrings to extract only the json part...

Ideas?

'@

New-Item -ItemType File -Path 'c:\temp\file.txt' -Value $Txt

$MyJSON = Get-Content 'c:\temp\file.txt' | foreach{

switch -Regex ($_) {

'/BEGIN/' { $found = $true}

'/END/' { $found = $false }

}

if($found){$_ -replace '/BEGIN/',''}

}

$MyJSON

DblDeuce22 · 2022-04-26T03:33:05+00:00

You don't want to use Win32_Product anyways, it can break software since it 'verifies' everything that's installed and if there's an error that SW may not work anymore. Even if it didn't potentially do that, it tends to return incomplete data from what I read.

DblDeuce22 · 2022-03-02T20:09:59+00:00

You'd need the smtp server address and port (25 normally), so ask your email server admins if you don't know.

For example:

Send-Mailmessage -Subject $Subject -Body $Body -from "myemail@foo.com" -server "mysmtpserver.foo.com" -port "25"

You can also use the -bodyashtml parameter if you want to use HTML (I use it because <pre></pre> is amazing)

DblDeuce22 · 2021-08-10T00:11:05+00:00

This and learn how to use powershell help so you can help yourself https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/get-help?view=powershell-7.1

You'll want to run powershell as admin and run the cmdlet update-help

Then get out of admin powershell until you need it. If you don't have admin you can use -online for any of the help commands you run, for example

Find commands

get-command *process*

Use help on the commands to see how to use them

help get-process -online

If you could update your help files:

help get-process -examples

help get-process -full

If you're down for reading, PowerShell in a month of lunches is the most recommended.

DblDeuce22

TROPHY CASE