Dimitri's Wanderings

Invoke-WebRequest under the System Account

2022-03-01T13:54:31+00:00

Invoke-WebRequest is a versatile Powershell CmdLet. However the way it works behind the scene creates sometimes strange behaviors.

As you may aware the HTML parser engine greatly depends on system components and Web Browser such as Internet Explorer.

A consequence of such a “design”, is that even on Windows Server 2016, you may have non-working Powershell scripts when running under accounts whose profile has not been initialized for the underlying system application.

As such, you will often find that a script which works flawlessly under your account doesn’t retrieve anything when launched under a scheduled task. This typically includes tasks running under the System Account.

A work-around is to run once the iexplore.exe binary under the System Account. This could be accomplished using a command such as psexec.exe -sid "%ProgramFiles%\Internet Explorer\iexplore.exe" under the command prompt or ./psexec.exe -sid "$Env:ProgramFiles\Internet Explorer\iexplore.exe" under Powershell.

Oracle Cloud vs. Azure resource Vocabulary

2022-02-21T21:48:53+00:00

For those who operate on multiple clouds, or prepare certifications such as “Oracle Cloud Infrastructure Certified Architect Associate“, “Oracle Cloud Infrastructure Certified Architect Professional“, “Azure Administrator Associate“, “Azure Solutions Architect Expert” you’ll find below a table which compares Oracle Cloud Infrastructure and Azure resource names

| Domain | **Oracle** | **Azure** | |---|---|---| | Virtual Network | VCN | VNet | | Virtual Circuit | FastConnect | ExpressRoute | | Gateway | Dynamic Route Gateway | Virtual Private Gateway | | Routing | Route table | Route table | | Security, Firewall | SecurityList, NSG | Network Security Group | | Resource Management | Compartment | Resource Group | | Virtual Machines | Compute Instance | Azure VM | | Kubernetes | OKE | AKS |

Slipstreaming SQL Server 2019

2022-02-07T09:26:09+00:00

A while ago, I published a post to slipstream the SQL Server 2008 media. It is time to update it for SQL Server 2019.

Fortunately the setup.exe hasn’t changed much, so it is still a matter of:

Copying the RTM ISO on a read-write filesystem
Unpack the Cumulative update of your choice
Amend the defaultsetup.ini file to indicate where the Cumulative Update files are to be found
Rebuild the ISO with a tool such as OSCDIMG.EXE. This tool can be found in the Windows Assessment and Deployment kit

Here’s the code which can be also found on GitHub.

:: SQL Server 2019 Adding CU in a RTM Distribution and create ISOs

@echo off
if "%3"=="" goto :usage
if errorlevel 9009 echo OSCDIMG.EXE was not found, ISO will not be created, please add /noiso

setlocal
set mediasource=%1
set mediacopy=%~dpn3
if exist %mediacopy% ( echo deleting %mediacopy% && rd %mediacopy% /s /q) 
echo Copying %mediasource% (R/O) to %mediacopy%
robocopy %mediasource% %mediacopy% /E /COPY:DT
set tempcu=%mediacopy%\cu
for %%i in (%2\*.exe) do (echo Extracting %%i to %tempcu% && %%i /x:%tempcu% /q )

for %%i in (x64) do (
Echo creating/adding to defaultsetup.ini if necessary in %%i
if not exist %mediacopy%\%%i\defaultsetup.ini [OPTIONS]>%mediacopy%\%%i\defaultsetup.ini
attrib -r %mediacopy%\%%i\defaultsetup.ini
echo CUSOURCE=".\CU">>%mediacopy%\%%i\defaultsetup.ini
)
Echo creating ISO from %mediacopy% into %3
set label=%~n2
if /I "%4"=="/noiso" goto :noiso
if /I "%5"=="/noiso" goto :noiso

oscdimg -o -l%label% -u2 %mediacopy% %3
:noiso

if /I "%4"=="/nocleanup" goto :nocleanup
if /I "%5"=="/nocleanup" goto :nocleanup

rd %mediacopy% /s /q
goto :theend
:nocleanup
echo No cleanup made. Intermediate files in %mediacopy%
:theend
endlocal
goto :eof
:usage
echo %~n0 SQLSource-Directory CU-Directory TargetDirectory [/nocleanup] [/noiso] 
:: echo SQLSource-Directory will be modified, so make a copy of the RTM distribution before applying this batch!
echo e.g.
echo %~nx0 E:\ C:\CU14 D:\Temp\SQLSERVER2019CU14.ISO
echo.
echo E:\ is a read-only source for the RTM version of SQL Server (e.g. mounted ISO)
echo C:\CU14 is the location of the *untouched* KB exe of the CU 
echo    CU14 will be then the label of the ISO, so you may want to name the directory like SQL2019CU14 instead.
echo D:\temp\SQLSERVER2019CU14 side-by-side with the iso will be a temporary directory which will be erased afterwards
echo   /nocleanup will not remove  D:\temp\SQLSERVER2019CU14  
echo   /noiso builds the structure and not the ISO
echo. 
echo the build of the iso requires ISOCDIMG.EXE in the path

Are Windows Event Logs displaying local time or UTC? There’s a trap!

2021-08-24T13:25:25+00:00

Often the question arises to know if the time stamps in the Windows Event Logs are local or UTC. The answer is more subtle than that. Let’s discuss which time zone is used in the Windows Event Logs and where.

First of all, please note that this discussion apply to the “Operating System Event Logs” you can view with the Event Viewer, such as Application, System, Security and the newer Vista-like Logs such as CAPI/Operational. It does not apply to the various “.log” files you can find in the temp folders, such as the installation traces of Visual Studio.

If you look at your PC or server right now, you will see that the events seem displayed with your local time. But beware This is only valid for the field “Date and Time” as the timestamp is recorded in fact as UTC and the offset is calculated by the client application.

However anything else is just text and is recorded as such so it is recorded by using the timezone of the application which recorded the message. Sounds logical but unclear about the consequences. Let’s take the unexpected shutdown event of a server far far away in another datacenter you would monitor.

You could end up with messages such as:

Log Name: System Source: EventLog Date: 24/08/2021 07:30:36 Event ID: 6008 Task Category: None Level: Error Keywords: Classic User: N/A Computer: mycomputer.example.com Description: The previous system shutdown at 09:30:12 on ‎24/‎08/‎2021 was unexpected.

The timestamp of the event was perfectly recorded as a UTC time value which is converted by the application you are using on your own PC to look at the logs whereas the message that the previous shutdown was unexpected is a text message formatted by the machine in its own time zone.

To demonstrate this, you can execute the following powershell script. (You’ll hear a nice sound when your time zone changes).

# esent is just a source present on any windows pc
Write-EventLog -LogName Application -Source "ESENT" -EntryType Information -EventId 1234 "Hey I'm recording this event at $(Get-Date)"
$evt=Get-EventLog -LogName Application -InstanceId 1234  -Newest 1
$evt
# Look at the time field
$evt.Message
# Look at the time within the message (discard the error at the beginning)
$mytz=Get-TimeZone
(Get-TimeZone -ListAvailable)[-1] | Set-Timezone
# we're now in a different time zone
$evt
$evt.message
# Look at both times
# back to our time zone
Set-TimeZone $mytz

[![](https://dimitri.janczak.net/wp-content/uploads/2021/08/Powershell-Time-Zone-EventLog-1-1024x515.png)](https://dimitri.janczak.net/wp-content/uploads/2021/08/Powershell-Time-Zone-EventLog-1.png)

In the above example, the Time field is changed when you’re changing your time zone, whereas the message remains identical.

Length of a SQL Server instance name

2021-08-17T14:16:32+00:00

Recently a colleague of mine in charge of an inventory tool asked me what is the maximum length of a SQL Server instance name.

So let’s dig into the various locations where Microsoft speaks about length of names in Windows

First stop, the SQL Server documentation itself. A quick search conducts us to this link in the legacy documentation of SQL Server 2008 R2

There’s a good explanation of the instance part, aka. the name part after the backslash if your instance is named. Short reminder: if that part is not mentioned it is supposed to be MSSQLSERVER, but that doesn’t give us the upper limit for the number of characters. That part is limited to 16 characters, must start with a letter, but subsequent characters can be made of letters, digits, the dollar sign or the underscore. Some other punctuation signs are explicitly forbidden such as space, comma, semi-colon, colon, ampersand, single quote, at sign, but other are in the gray area as not mentioned: what about double-quotes for example?

For the server part, things are a bit more complicated as we are depending on the OS limits. On Windows, there is an article about the machine naming limits.

Here the legacy NetBIOS name is a 1 to 15 character field, but the list of invalid characters interestingly does not comprise the “dot”, nor the “space”, just the usual filename invalid character suspects: backslash, slash, colon, asterisk, question mark, double quote, pipe sign, less and greater than sign mark.

If you go for the DNS name, you can extend the limit to 255 characters by 63 bytes chunks but the list of invalid characters is first defined by what is allowed: letters, digits, minus sign. Do not forget that officially the underscore is not supported albeit Microsoft DNS Servers if configured allow it and it is listed as disallowed character in that same article,

To summarize, if I had to store SQL Server instance names into databases into single tenant environments, I would probably choose 32 characters, by adding up the NetBIOS server name limit of 15 characters, the backslash and the 16 characters limit of the instance name part.

In multiple tenant environments, I may choose to widen the server name part to 255 characters to store the FQDN as given by the DNS.

Get-ADDomainController, Get-ADUser, Get-ADComputer, Get-ADObject: A referral was returned from the server

2021-07-12T12:41:02+00:00

When you are using Active Directory Powershell cmdlets such as Get-ADDomainController, Get-ADUser, Get-ADComputer, Get-ADObject, you may receive the following error message:

```
A referral was returned from the server

Such an exception is linked to the difficulty those commands have to work in a multi-domain environment, whether that multi-domain be a single forest with multiple child domains, various trust relationships.

Let’s imagine you have a forest with domains called Top, Child1 and Child2. If your user is Top\\myadmin and your trying to get information for the domain controller dc1child1 in the child domain child1, you may want to issue the following command from a machine in the “Top” domain

$MyDCInfo = Get-ADDomainController dc1child1
```

The answer will be:

```
TerminatingError(Get-ADDomainController): "A referral was returned from the server"
Get-ADDomainController : A referral was returned from the server
At line:1 char:94
+ ... oryServers | % { $domaincontrollers[$_]=Get-ADDomainController $_  }}
+                                             ~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (dc1child1.child1.com:ADDomainController) [Get-ADDomainController], ADException
    + FullyQualifiedErrorId : 
ActiveDirectoryServer:8235,Microsoft.ActiveDirectory.Management.Commands.GetADDomainController
Get-ADDomainController : A referral was returned from the server
```

To circumvent this, you must specify a target server from the domain you want the object from. In our case, you will have to type,:

```
$MyDCInfo = Get-ADDomainController dc1child1 -Server dc1child1
```

Here the name is repeated twice, as the object we are searching for is also the name of the server you’re asking to answer. But in such a case as a domain user, this would be:

```
$myuser = Get-ADUser mychilduser -Server dc1child1
```

Note that to find a correct Domain Controller for a given domain, Get-ADDomainController with the discover switch may be very helpful.

Find the MS SQL Servers by using SPN in your AD

2021-01-13T11:12:53+00:00

In an old post, I was writing about the commands you could use to retrieve the list of your RDS Licensing servers in a domain.

Generalizing this LDAP Filter example, you can retrieve a list of Service Principal Names enabled accounts. The examples are as follows:

dsquery * -filter "(servicePrincipalName=*)"

Get-ADObject -Filter { serviceprincipalname -like '*' }
# or directly translated as:
# Get-ADObject -LDAPFilter "(servicePrincipalName=*)"

In the powershell syntax with Filter you can not write something like { servicePrincipalName -ne $null}.

If you want to narrow down your searches to the SQL Servers for which Kerberos is enabled you can use

dsquery * -filter "(servicePrincipalName=MSSQLSvc/*)"

Get-ADObject -Filter { serviceprincipalname -like 'MSSQLSvc/*' }
# or directly translated as:
# Get-ADObject -LDAPFilter "(servicePrincipalName=MSSQLSvc/*)"

Refinements to that query could be to target SQL Servers SPN on computer objects when you are using SYSTEM / NT Service accounts or on the contrary user accounts when you are using domain users. Such filters would be:

dsquery -filter "(&(objectcategory=computer)(servicePrincipalName=MSSQLSvc/*))"
REM or dsquery -filter "(&(objectcategory=user)(servicePrincipalName=MSSQLSvc/*))"

Get-ADObject -Filter { (serviceprincipalname -like 'MSSQLSvc/*') -and  (objectcategory -eq 'computer') }
# or directly translated as:
# Get-ADObject -LDAPFilter "(&(objectcategory=computer)(servicePrincipalName=MSSQLSvc/*))"

Additional complex filters can be found in the Active Directory filter Powershell help page.

Get-ADObject is a more generic Powershell cmdlet as its Get-ADComputer and Get-ADUser counterparts, as it doesn’t assume an objectCategory hence its broader use but more complex syntax.

Always remember that the syntax of the LDAPFilter immediately matches the one you find in the dsquery command, whereas the Filter option must be written using Powershell Script block Syntax.

WMI filters to target sites and non Domain Controllers

2020-12-23T14:25:58+00:00

Designing Group Policy Objects is sometimes tricky. Let’s review some useful WMI filters in Group Policy Objects for sites and domain controllers inclusion or exclusion.

When linking Group Policy Objects, you are always bound to the LSDOU rule, which means that GPOs are processed in the following order:

L for Local GPOs
S for Active Directory Sites
D for Domain
OU for… OU, Organizational Units

Basically, a GPO that targets an OU will always takeover precedence over a GPO assigned to the domain, which itself takes precedence over a Site.

By cleverly ordering GPOs, you usually have no problem to get the result you want when 2 GPOs target the same setting.

However there are edge cases, such as Domain Controllers being in their own OU. Microsoft clearly tells you that moving Domain Controllers to other OUs or using sub-OUs to divide your domain controllers is an unsupported scenario.

What can you do then when you want to have different GPOs for Domain Controllers and the “rest of computers”?

The Computers built-in folder is a not an OU but a simple container and a container does not support GPO link. You may then think to link to the domain, and override the policy at the Domain Controllers OU, but it is not always feasible if you want the setting not to apply, instead of being applied with another value.

You may then think to move all your computers under a “TopRootOU” but this is not always feasible if the structure is already in place, or for those reason you cannot afford that root OU:

you do not want to have computers getting no GPO while they are sitting in the Computers container
you want to keep the GPO link to the domain for better readability
or avoid restructuring your multiple root OUs already in place

In that case, designing a WMI filter that target computers which are not Domain Controllers allow to achieve this:

SELECT * FROM Win32_ComputerSystem Where DomainRole <> 4 AND DomainRole <> 5

[![WMI filter To select non domain controllers](https://dimitri.janczak.net/wp-content/uploads/2020/12/WMI-Filter-Non-DC.png)](https://dimitri.janczak.net/wp-content/uploads/2020/12/WMI-Filter-Non-DC.png)

In a related area, the GPO processing order makes it difficult to have different GPOs for different domain controllers based on dynamic criterias since sub-OUs within the “Domain Controllers” OU are not supported, and Site GPOs are overriden by OU-linked GPOs.

You could rely on Group Membership or Computer Account in the Security Tab but this requires an additional step when promoting or demoting a domain controller. Recreating sites with a WMI Filter can however be accomplished.

Select * FROM Win32_NTDomain WHERE (DcSiteName = 'YourSite' AND DomainName = 'DomainShortName')

The DomainName part is needed when computer or users accounts from multiple domains are living next to each other on the same subnets and sites. Note that if your sites follow some convention, you can use the like operator, e.g.

Select * FROM Win32_NTDomain WHERE (DcSiteName like 'Start%' AND DomainName = 'DomainShortName')

Domain Short name is the name of your domain without any dot, aka the NetBios name, not the fully qualified domain name.

How to connect to a Windows Internal Database WID such as WSUS

2020-12-13T10:37:44+00:00

The Windows Internal Database is nothing more than an embedded lite SQL Server instance running under specific credentials and with a few protocols enabled.

Therefore in order to connect, you can use any SQL Server client tool: SQL Server Management Studio, SQLCMD, …

![](https://dimitri.janczak.net/wp-content/uploads/2020/12/WSUS-Windows-Internal-Database-Connection-String-Windows-2012R2-2016.png)

Starting with Windows Server 2012, the named pipe to access is \\.\pipe\MICROSOFT##WID\tsql\query. For older systems, the pipe is different and is named \\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query.

From this we can already sense that this is some kind of named instance now called MICROSOFT##WID and MICROSOFT##SSEE in the past.

Please note that the tools must be run with elevated privileges, otherwise you’ll get an access denied message.

![Windows Internal Database Login failed](https://dimitri.janczak.net/wp-content/uploads/2020/12/WSUS-Windows-Internal-Database-Connection-Login-Failed.png)

Once logged in we can see that Windows 2016 Windows Internal database feature hosts a SQL Server 2014 RTM like version.

![WSUS SUSDB in SSMS](https://dimitri.janczak.net/wp-content/uploads/2020/12/WSUS-Windows-Internal-Database-From-SSMS-18.png)

The SUSDB is a regular user database created by the WSUS feature. If we look into logins, they can be split into 3 groups:

the built-in logins you’ll find in every SQL Server, the ##XXXX certificate ones, sa, etc.
a set of logins for the WID feature, which get the sysadmin role. The NT Service\WIDWriter and the NT Service\MSSQL$MICROSOFT##WID will again make you think about a named instance MICROSOFT#WID,
a group here created by the client application (MACHINE\WSUS administrators)

![SQL Login in Windows Internal Database WSUS](https://dimitri.janczak.net/wp-content/uploads/2020/12/WSUS-WID-Logins.png)

![NT SERVICE\MSSQL$MICROSOFT##WID](https://dimitri.janczak.net/wp-content/uploads/2020/12/WSUS-WID-Login-WID-Sysadmin.png)

If we dig into the characteristics of the SUSDB database, we see a regular user database for which some user roles are defined and attached to the specific logins we mentioned earlier.

![WSUS SUSDB Views in SSMS](https://dimitri.janczak.net/wp-content/uploads/2020/12/WSUS-SUS-DB-Views-From-SSMS-18.png)

![SUSDB Database security users & roles](https://dimitri.janczak.net/wp-content/uploads/2020/12/WSUS-SUSDB-Database-Security.png)

Needless to say that you can issue backups of the SUSDB as you would for any regular database, although officially Microsoft maintains there is no need to deploy any maintenance solution.

You may want to note that this SQL Server “Edition” behaves like the Express Edition under some circumstances, e.g. contrary to the Standard, Enterprise or Web Edition, it doesn’t eat as much as RAM as it can.

Publishing certificates in the Active Directory

2020-12-11T14:13:49+00:00

Deploying certificates and CRL in a domain or a forest in an automated fashion can done using GPO like many other settings.

However a less well-known possibility is to use the certutil -dspublish command. Let’s review how it works.

When using that option, certificates are stored in one of the “PKI Container”s of the forest, and every time GPO are refresh they are copied into the registry of the computer.

The PKI Settings of a forest are stored under the “Configuration” naming context of the forest.

![ADSI Edit PKI tree](https://dimitri.janczak.net/wp-content/uploads/2020/11/adsiedit-certificatation-authorities-configuration-container.png)

Configuration container in AD

Under that container, “Certification Authorities” will contain one entry for each Certification Authority Root you want the computers in your forest to trust.

To add a certificate use the following command:

certutil -dspublish -f CACertificate.cer RootCA

The CACertificate.cer is a file containing the certificate public key to publish in one of the standard X509 formats.

Once you’ve done that, you may want to wait for the Active Directory replication to happen in case the computer you’re testing receives GPOs from another Domain Controller as the one you targeted.

Then wait for the Group Policy refresh to occur (90 minutes more or less in a standard AD environment) or use gpupdate /force.

Your certificate authority will be then trusted, as it is now stored in the registry under HKLM\Software\Microsoft\SystemCertificates\Root\Certificates.

You’ll find a key with the thumbprint of the certificate and a blob entry containing the certificate.

The full list of registry locations that can be targeted with dspublish are now documented by Microsoft.