Zoho Banner September 2011

Posts tagged ‘Windows Server 2008’

The other day I had a need to run a demo for a customer that involved showing backup and recovery of AD LDS using Windows Server Backup.  I decided to re-use an existing virtual machine and wanted to start afresh by clearing all existing backups.  Simple enough, I thought, and proceeded to re-format the dedicated backup disk (using diskmgmt.msc).

disks.JPG

When the format was finished I went into the Windows Server Backup UI (wbadmin.msc) and expected to see the jobs cleared.  Instead they appeared as they did before I re-formatted the backup disk.

catalog.JPG

I figured from this that the backup catalog information must be stored elsewhere.  I couldn’t find an option to clear the catalog information from within the UI, so I had a look at the command line (wbadmin.exe) help.  No luck there either.  Eventually, I found an additional Wbadmin delete catalog command in Windows Help and Support.  This had the desired effect of removing the list of backups from the UI (see below). 

messages.JPG 

The only problem now was that the Windows Server Backup UI still displayed messages relating to the previous backup (see screenshot above).  The source of these messages is the Backup event log, as shown in the screenshot below.  If you clear the event log the messages are removed from the Windows Server Backup UI. 

events.JPG

I was hoping for a one-click clear out but, as you can see, it takes a little more effort than that.

I have recently spent some time working with Xpath queries as part of Event Log filtering in Windows Server 2008.  It’s a great feature, but one limitation I found was that it doesn’t appear possible to use the starts-with() function when querying Event Logs with either the UI or Wevtutil.exe.  Here’s an example.

Let’s say I enabled LDAP logging on a DC and want to filter the Directory Service event log to find all LDAP queries coming from a particular IP address.  The IP address is buried in one of the Data nodes of the Event XML, as shown in red below.

<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>

  <System>

    <Provider Name=”Microsoft-Windows-ActiveDirectory_DomainService” Guid=”{0e8478c5-3605-4e8c-8497-1e730c959516}” EventSourceName=”NTDS General” />

    <EventID Qualifiers=”16384″>1644</EventID>

    <Version>0</Version>

    <Level>4</Level>

    <Task>15</Task>

    <Opcode>0</Opcode>

    <Keywords>0×8080000000000000</Keywords>

    <TimeCreated SystemTime=”2009-04-29T20:39:00.886Z” />

    <EventRecordID>339453</EventRecordID>

    <Correlation />

    <Execution ProcessID=”648″ ThreadID=”792″ />

    <Channel>Directory Service</Channel>

    <Computer>DC1.Myco.Com</Computer>

    <Security UserID=”S-1-5-21-854245398-152049171-725345543-4606″ />

  </System>

  <EventData>

    <Data>CN=MyCo Enterprise Issuing CA 1, CN=Public Key Services,CN=Services,CN=Configuration,DC=MyCo,DC=Com</Data>

    <Data> (objectClass=cRLDistributionPoint) </Data>

    <Data>1</Data>

    <Data>1</Data>

    <Data>192.168.40.10:4048</Data>

    <Data>base</Data>

    <Data>deltaRevocationList</Data>

    <Data>

    </Data>

  </EventData>

</Event>

So if I wanted to use Xpath to filter all events in the Directory Service Event Log from that IP address my query would look something like this:

<QueryList>

  <Query Id=”0″ Path=”Directory Service”>

    <Select Path=”Directory Service”>*[System[(Level=4 or Level=0) and (EventID=1644)]] and *[EventData[Data[5]=’192.168.40.10:4048′]]</Select>

  </Query>

</QueryList>

The query works well, but the problem is that the Data node within the XML contains the port number (4048) in addition to the IP address.  I want to find all queries issued from that client, regardless of the port used.  Here’s my attempt to use the starts-with() function to filter the event.

<QueryList>

  <Query Id=”0″ Path=”Directory Service”>

    <Select Path=”Directory Service”>*[System[(Level=4 or Level=0) and (EventID=1644)]] and *[EventData[starts-with(Data[5],’192.168.40.10′)]]</Select>

  </Query>

</QueryList>

This fails with the error “The specified query is invalid“.  Back to the drawing board.  I posted a question to Technet Forums and got some good help from Ivan Ting at Microsoft.  He provided some Javascript that used starts-with() and this worked (after some fun messing around with default namespace issues).  Being something of a Javascript muppet (the antithesis of a Javascript guru), I decided to try my hand at a Powershell version.  Here’s what I came up with.

#####
# Author: Tony Murray
# File name: LDAPEvents.ps1
# Date: 28th April 2009
# Purpose: Extracts LDAP Search information from Directory Service Event
# Log. Requires LDAP logging to be switched on.
#####

# Function to create an object for XML document navigation
# Source: Technet Scriptcenter
function get-xpn ($text)
{
$rdr = [System.IO.StreamReader] $text
$trdr = [system.io.textreader]$rdr
$xpdoc = [System.XML.XPath.XPathDocument] $trdr
$xpdoc.CreateNavigator()
}

# Run Wevtutil.exe to export the Event log to file
# Could use Powershell to do this but it creates odd-looking xml!

$file = “c:\util\dumplog.xml”
& $env:windir\System32\wevtutil qe `”Directory Service` /e:Events | Out-File $file

# Remove the namespace from the xml file. It won’t work if it stays

$findStr = ” xmlns=`’http://schemas.microsoft.com/win/2004/08/events/event`’”
$ReplStr = “”
$newcontent = (Get-Content $file) -replace ($findStr,$ReplStr)
Set-Content $file $newcontent

# Invoke the navigator
$xb = get-xpn $file

# Define the Xpath query we want to use
$query = “//*[ System[(Level=4 or Level=0) and (EventID=1644)] `
and EventData[starts-with(Data[5],’192.168.40.10′)]]”

# Create a CSV file with the output. Each line represents the details
# we want from a single Event.

Write-Output $xb.Select($query) | %{[xml] $_.OuterXml} | Select-Object `
@{name = “Date&Time”;Expression = {$_.Event.System.TimeCreated.SystemTime}}, `
@{name = “SearchBase”;Expression = {$_.Event.EventData.Data[0]}}, `
@{name = “Filter”;Expression = {$_.Event.EventData.Data[1]}}, `
@{name = “Visited”;Expression = {$_.Event.EventData.Data[2]}}, `
@{name = “Returned”;Expression = {$_.Event.EventData.Data[3]}}, `
#@{name = “SourceIP”;Expression = {$_.Event.EventData.Data[4]}}, `
@{name = “SearchScope”;Expression = {$_.Event.EventData.Data[5]}} `
| export-csv ds.csv -notype
# Replace the previous line with the following line to change the output format
#ConvertTo-HTML | Out-File “LDAPEvent.html”

Having to write a script is more effort than simply issuing the query from within Eventvwr, but it does have the advantage of allowing you to return only the information you are interested in – and in the format that you want.  Hopefully, my experience will save you a bit of time and effort if you are trying to achieve something similar.

Microsoft Technet describes how to back up an AD LDS instance using either Windows Server Backup or Dsdbutil.exe.  Interestingly, the Dsdbutil method leverages the Install From Media (IFM) feature to perform the backup.  Here’s a small batch file that you can use to schedule the backup using the Task Scheduler.

@echo off
rd /s c:\backup\adlds\Instance1\ /q
%windir%\system32\dsdbutil.exe “ac i Instance1″ ifm “create full c:\backup\adlds\Instance1″ q q

Enjoy!

If you’ve spent some time with Vista or Windows Server 2008 you’ll have noticed that there are some fundamental changes to the event viewer.  One of the changes is in the way in which event logs can be filtered.  In addition to the point-and-click filter selection you can now also enter an xpath query by accessing the XML tab (see screenshots below).  This gives you the ability to filter using a much wider range of criteria.  Basically, you can search using anything that is presented in the list of XML values.

event_filtering1.JPG

-

event_filtering2.JPG

The xpath queries take a bit of getting used to and as yet there don’t appear to be many publicly available examples.  Here are a few to get you started. This query searches the Security Event log for 4624 events that include a TargetUsername of “User1″ and corresponding to a logon type of “2″ (interactive). 

<QueryList>
  <Query Id=”0″ Path=”Security”>
    <Select Path=”Security”>*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4624)] and EventData[Data[@Name='TargetUserName']=’User1′] and EventData[Data[@Name='LogonType']=’2′]]</Select>
  </Query>
</QueryList>

The query below also looks for 4624 events, but this time for those that include a WorkstationName of “Workstation1″ and a logon type of “3″ (network). 

<QueryList>
  <Query Id=”0″ Path=”Security”>
    <Select Path=”Security”>*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4624)] and EventData[Data[@Name='WorkstationName']=’Workstation1′] and EventData[Data[@Name='LogonType']=’3′]]</Select>
  </Query>
</QueryList>

Even though Xpath can appear a little daunting at first it is worth spending a bit of time with as it’s potentially quite powerful.  As with Powershell it is something that is likely to be here to stay.

Yesterday I blogged about some of the confusion that Windows Server 2008 User Account Control can cause.  Continuing on the same theme, here is another example – this time using slmgr.vbs to query the licence activation status of a Windows Server 2008 machine.

This is what you see when you run the command line from a command window that was opened without elevated privileges.

cscript %windir%\system32\slmgr.vbs -dli

Name: Windows Server(R), ServerStandard edition
Description: Windows Operating System – Windows Server(R), VOLUME_KMSCLIENT channel
Partial Product Key: BFGM2
License Status: Licensed
Volume activation expiration: 250200 minute(s) (173 day(s))

Key Management Service client information
    Client Machine ID (CMID): 3af05e3c-b291-47ad-bbf9-cc6278b3c923
    DNS auto-discovery: KMS name not available
    KMS machine extended PID: 55032-00152-339-003838-03-5129-6001.0000-0062009
    Activation interval: 120 minutes
    Renewal interval: 10080 minutes

As you can see, the name of the Key Management Server (KMS) is unavailable, which is not very helpful if you are trying to troubleshoot a KMS issue. 

But now look what happens when you run the same command as Administrator (i.e. with elevated privleges).

Name: Windows Server(R), ServerStandard edition
Description: Windows Operating System – Windows Server(R), VOLUME_KMSCLIENT channel
Partial Product Key: BFGM2
License Status: Licensed
Volume activation expiration: 250200 minute(s) (173 day(s))

Key Management Service client information
    Client Machine ID (CMID): 3af07e3c-b291-47ad-bbf9-cc6278b3c923
    KMS machine name from DNS: kms1.contoso.com:1688
    KMS machine extended PID: 55032-00152-339-003838-03-5129-6001.0000-0062009
    Activation interval: 120 minutes
    Renewal interval: 10080 minutes

In this case the name of the KMS server is shown correctly.

I think it would be more helpful if, in the first example above, the whole command were to fail with an error indicating that elevated privileges are required to successfully complete the command.  The fact that the command partially completes only causes confusion.

Windows Server 2008 (and Vista) offer improved options for event log management.  For example, you now have the option to forward events to a central event collector server.  You also now have powerful filtering capabilities.  One of the features I like is the Wevtutil command-line tool that allows you to retrieve, query, archive, export and clear events.   It’s the best option you have if you use Server Core and don’t want to open the firewall to allow remote access using the Event Viewer UI.

Recently, I had to schedule the export of events using Wevtutil using a time-based query.  It took me a little while to get the query syntax right, so I thought I would share it with you here.

Let’s take a scenario in which you want to export all events from in the past 24 hours from the security log to a *.evtx file.  (Note. The default format for exported event log files in Vista and Windows Server 2008 is *.evtx.  For a good explanation of the differences between evt and evtx see this blog entry).   You can leverage the Windows Event Viewer (eventvwr) to assist you with obtaining the query required to filter the log to show only events from the past 24 hours.  To do this, click on your event log of choice (in this case Security).  In the right-hand action pane click Filter Current Log.  Within the Filter tab, select the drop-down list next to Logged and choose Last 24 hours.  Now click on the XML tab.   The query is embedded within the XML content, as follows:

 *[System[TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]

xml-query.jpg

The Wevtutil command to use the filter is shown below (may wrap).

wevtutil.exe epl Security C:\SecurityLog24hours.evtx “/q:*[System[TimeCreated[timediff(@SystemTime) <= 86400000]]]” /ow:true

Note that you have to replace the “&lt;” escape sequence meaning “less than” from the XML original with the “<” character, otherwise the query does not work and you will receive the error:

Failed to export log Security. The specified query is invalid.

The time-based filter I have used in this example only scratches the surface of the query capabilities you have with Wevtutil.  The fact that you can leverage the capabilities within the Event Viewer UI to assist with building the queries takes a lot of the pain away.  For more information about Wevtutil, including all the available command line options, see this page on Microsoft Technet.