I'm trying to ge the DNS servers of network interfaces via WMI that are static (placed by the user). I have this script that works, except for the static part of course:
Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.DNSServerSearchOrder -ne $null} | Select DnsServerSearchOrder,Index,InterfaceIndex
This leads to an output like so:
DnsServerSearchOrder Index InterfaceIndex
-------------------- ----- --------------
{192.168.122.1} 1 6
{1.1.1.1} 2 10
The interface with 192.168.122.1 has it's DNS setup to DHCP so that value is not good for me. How do I filter out interfaces where dns is not static? Any ideas?
netsh interface ip show config:
Configuration for interface "Ethernet"
DHCP enabled: Yes
IP Address: 192.168.122.130
Subnet Prefix: 192.168.122.0/24 (mask 255.255.255.0)
Default Gateway: 192.168.122.1
Gateway Metric: 0
InterfaceMetric: 35
DNS servers configured through DHCP: 192.168.122.1
Register with which suffix: Primary only
WINS servers configured through DHCP: None
Configuration for interface "Ethernet 2"
DHCP enabled: Yes
IP Address: 10.0.0.17
Subnet Prefix: 10.0.0.0/24 (mask 255.255.255.0)
Default Gateway: 10.0.0.1
Gateway Metric: 0
InterfaceMetric: 35
Statically Configured DNS Servers: 1.1.1.1
Register with which suffix: Primary only
WINS servers configured through DHCP: None
Notice the difference in terms between Statically Configured DNS Servers and DNS servers configured through DHCP. I figured I might parse this output but I'm not sure if I can rely on this text if windows language/locale is changed and I'd rather use the WMI interface if possible.
I thought this might be available in the System.Net.NetworkInformation namespace, but evidently not. I looked through a few lower-level Windows networking APIs thinking certainly it must exist somewhere in there, but no such luck. After running dumpbin on netsh.exe to see what kinds of libraries/functions it's consuming, I did get an idea of one other place to look: the registry.
As it happens, if you look in the registry under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\ key you will see a key for each network interface with the name in GUID format. Within an interface's key you will find two values of interest: DhcpNameServer and NameServer. On my client system where the DNS server is set by DHCP, DhcpNameServer contains that DNS server's IP address and NameServer contains an empty [String]. If I manually set a DNS server while keeping the automatically-assigned address for the interface itself, NameServer then contains that manually-set DNS server address while DhcpNameServer still contains the same DNS server specified by DHCP.
Based on these observations, it would seem that...
The DhcpNameServer value always contains the DNS server(s) specified by DHCP.
The NameServer value always contains the DNS server(s) specified manually.
When you query the system for its nameservers (e.g. via the Win32_NetworkAdapterConfiguration.DNSServerSearchOrder property) the result will contain the value of NameServer, if provided, otherwise the value of DhcpNameServer, if provided. In other words, the system tells you which DNS servers are currently being used, but not how their addresses were specified.
To determine if an interface has manually-assigned DNS servers, check if NameServer has a non-empty value.
Thus, given an interface with ID $interfaceID, you can build a path to its registry key like this...
$interfaceKeyPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\$interfaceID"
...and then retrieve the dynamically-assigned and manually-assigned nameserver values like this...
Get-ItemProperty -Path $interfaceKeyPath -Name 'DhcpNameServer', 'NameServer'
That just leaves the matter of from where you get the value for $interfaceID, and there are numerous sources although the trick will be excluding undesirable interfaces (for example, on my Windows 10 system I have a packet capture loopback adapter and a hypervisor adapter that I'd want to be excluded from such a query). The most compatible way (dating back to .NET 2.0) would be the Id property of the NetworkInterface class...
[System.Net.NetworkInformation.NetworkInterface]::GetAllNetworkInterfaces() `
| Select-Object -ExpandProperty 'Id'
...although the only useful properties on which to filter are Name and NetworkInterfaceType.
On Windows Vista and above the Win32_NetworkAdapter class provides a GUID property...
Get-WmiObject -Class 'Win32_NetworkAdapter' -Property 'GUID' -Filter 'PhysicalAdapter = true'
...although even when filtering on PhysicalAdapter it still returns the loopback and hypervisor adapters and I'm not seeing any definitive property or class relation that can be used to select only hardware adapters.
The Win32_NetworkAdapterConfiguration class is much the same...
Get-WmiObject -Class 'Win32_NetworkAdapterConfiguration' -Property 'SettingID'
...with no properties to filter out non-hardware or even non-physical adapters.
On (I think) Windows 8 and above there's the Get-NetConnectionProfile cmdlet...
Get-NetConnectionProfile | Select-Object -ExpandProperty 'InstanceID'
which is documented to get "a connection profile associated with one or more physical network adapters" and, on my system, it does only return my physical adapter.
There is also the Get-NetAdapter cmdlet...
Get-NetAdapter -Physical `
| Where-Object -Property 'EndPointInterface' -NE -Value $true `
| Select-Object -ExpandProperty 'InterfaceGuid'
I found that passing the -Physical parameter excluded the hypervisor adapter but not the loopback adapter, so filtering out where EndPointInterface is $true was necessary to eliminate that. The HardwareInterface and Virtual properties might also be of interest.
Another option would be to invoke the Get-NetAdapterHardwareInfo cmdlet, which seems to know how to distinguish true hardware adapters, and let that determine which adapters are retrieved by Get-NetAdapter...
Get-NetAdapterHardwareInfo `
| Get-NetAdapter `
| Select-Object -ExpandProperty 'InterfaceGuid'
The Get-Net* cmdlets above return CIM instances so, for example, instead of Get-NetAdapter -Physical you could use something like...
Get-WmiObject -Namespace 'Root\StandardCimv2' -Class 'MSFT_NetAdapter' `
-Property 'InterfaceGuid' -Filter 'HardwareInterface = true AND EndPointInterface = false'
to retrieve the MSFT_NetAdapter instances just the same. I'm not really sure what the guidance is on using one versus the other. It would seem like one should prefer the cmdlets, and yet, unlike WMI/CIM, they offer limited/no parameters for efficiently filtering the output or specifying which properties are desired so you have to do that in the pipeline. I think it's noteworthy, though, that I wasn't able to find any current documentation for these MSFT_* class; they all say they're no longer updated, except for the MSFT_NetConnectionProfile class for which I couldn't find any documentation page at all. That says to me Microsoft doesn't want you relying on any definite structure of these classes, and yet if the cmdlets just pass along those class instances...I'm not sure how can you meaningfully and reliably interact with them if nothing is documented.
Also, keep in mind that you'll want to prefer Get-CimInstance and its ilk over Get-WmiObject, where possible. I don't think I've yet encountered an instance where it was any more complicated than changing Get-WmiObject to Get-CimInstance, although there are more differences (not necessarily bad) than the name.
After enough bashing I found a solution but I'm not 100% positive is the right path. On all DHCP DNS servers the DNS values contain a single ip address and that IP address is equal to the Default Gateway value. When those values match we're dealing with a DHCP DNS server and not statically configured.
Related
Is there a way to identify the network adapter (or interface) name used for a successful ping
eg I have the following adapters:
I perform the command
ping google.com
which is successful, I would like to know that the adapter used is either "Wi-Fi" Sunrise_5GHz_387918
There is a similar question for c#
Identifying active network interface
But I am looking for a windows batch file way (possibly powershell).
You can do that in PS using:
get-wmiobject win32_networkadapter | select netconnectionid, name, InterfaceIndex, netconnectionstatus
OR,
You can use netsh
netsh interface ipv4 show interfaces
In the newer version of PS like in windows 8, you can even directly use:
Get-NetAdapter | SELECT name, status, speed, fullduplex | where status -eq 'up'
Note by that the netconnectionstatus value indicates the connection status. 2 indicates connected
What I am trying to do seems simple but I need help knitting all the pieces together.
What I want to do is search all the firewall rules based on local port and protocol (i.e. 3389 TCP) then, if I find one, ensure that the RemoteAddress is set to x.x.x.x. If I don't find one, then add it.
I can't seem to find out how to knit together Get-NetFirewallPortFilter, Get-NetFirewallAddressFilter, and Get-NetFirewallRule to do what I want.
We have a Remote Desktop Gateway and Multi-Factor Authentication and as part of compliance, all RDP connections must go through the RDGateway so that Two Factor is used. There is a rule in place at the firewall but I want to find some way to enforce this on mass using Powershell (in an SCCM compliance item) at the Windows Firewall level too. Sure I could do a Group Policy Objects but I want to be able to report on compliance which is why I am trying to do this via System Center Configuration Manager.
Ugh. I believe this will work. You can pipe these things both ways. I believe it's pretty self explanatory, but it takes 2 minutes on my computer. At least I got a progress bar. The whatif output is actually incorrect. That's the name, not the displayname.
EDIT: Oh I see. It's much faster without the first command. I guess that's the point. I never understood. It's like the -filter parameter to other commands like get-childitem, that make it faster. Get-NetfirewallPortFilter actually returns the name of the firewall rule if you look at all the properties.
# Get-NetFirewallRule |
Get-NetFirewallPortFilter -Protocol TCP |
Where LocalPort -eq 3389 | Get-NetFirewallRule |
Set-NetFirewallRule -RemoteAddress 192.168.1.1 -WhatIf
Output:
What if: Set-NetFirewallRule DisplayName: RemoteDesktop-UserMode-In-TCP
Piping each command to the next takes the input and filters to the end where your result showing the list of Scopes (RemoteAddress) by expanding the selected property, which you can then use to Edit your Set. Each Command shows a subset of the prior one...
Get-NetFirewallRule -DisplayName "Allow Port 3389 - RDP Access" |Get-NetFirewallAddressFilter |Select -expandproperty RemoteAddress
Have a smidge of a problem. I am trying to completely blank out the IP address, subnet mask, and default gateway of a single NIC on one of my VMs.
I open up IPv4 Properties on that NIC and set it to DHCP (there is no DHCP server available to it and it isn't getting a Windows APIPA address) and then I look in Advanced and make sure there aren't alternate addresses assigned. I close out all of the windows. Then, I open up CMD and type ipconfig and it shows that it has an IP address, subnet mask, and a default gateway. I even tried Disabling and Enabling the NIC and typing Restart-NetAdapter -Name "Ethernet" and there are no changes.
In PS, I type Get-NetAdapterAdvancedProperty -DisplayName "Network Address" and it shows -- under the DisplayValue.
For some reason, and I'm not sure why (I didn't give it the ol' College Try), but when I type Set-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress "0.0.0.0" it shows red. I try putting in a valid address to see if maybe the cmdlet won't take all zeros and it does the same thing. I checked the man page and I'm fairly sure that the format is correct (I tried $ip = #("0.0.0.0") and gave it $ip and $ip[0] but it still, no joy).
I just want all of the NIC settings wiped and it seems like it is but ipconfig and Get-NetIPAddress, and Get-NetIPConfiguration keep showing addresses whereas Get-NetAdapterAdvancedProperty -DisplayName "Network Address" show that it's blank.
Why won't it let me wipe the configs (without doing an OOBE SysPrep)? I feel like the answer is probably something simple that I'm just overlooking but I haven't really found anything online--it's mostly just ways to work with your NIC configurations within Powershell.
Could anyone help shine some light on what is actually going on?
Thanks.
If you have several NICs, Get-NetAdapter will list all adapters with their respective index, Get-NetAdapter -ifIndex $ | Get-NetIPAddress | Remove-NetIPAddress (substitute $ with desired adapter index) will wipe IP configuration.
In case of a vm with a single adapter you can omit the index:
Get-NetAdapter | Get-NetIPAddress | Remove-NetIPAddress
I have a VM with 3 network adapters:
vNIC1 : OldPortGroup1
vNIC2 : OldPortGroup2
vNIC3 : OldPortGroup3
I need to change the port group of these adapters to NewPortGroup1, NewPortGroup2, NewPortGroup3. I do not know which vNIC is currently assign to what port group but I do know the old port group names. I need to assign the New port group to the vNIC based on its membership to the old port group. The following code does not work:
Get-Datacenter MyDatcenter | Get-VM MyVM | Get-NetworkAdapter | Where-Object { $_.NetworkName -like "OldPortGroup1" } | Set-NetworkAdapter -NetworkName NewPortGroup1
This will return all the vNICs for all virtual machines that are on that network. It does not obey the -VM parameter on Get-VM. As far as I am concerned it is impossible to do what I am thinking. I have tried if statements, switch statements, etc. Any ideas?
Apparently it doesn't work right if you don't actually manually import the Vds plugin. This can be done using the following command:
Get-PSSnapin -Registered -Name VMware.VimAutomation.Vds
Is it possible to get the public virtual IP (VIP) of an azure service using powershell?
One approach would be to use the Get-AzureEndpoint command
Get-AzureVM -Name "thevmname" -ServiceName "theservicename" | Get-AzureEndpoint | select { $_.Vip }
I'm not sure, but I doubt there is an easy way, because it might change (although it rarely does).
Windows Azure provides a friendly DNS name like “blogsmarx.cloudapp.net” or “botomatic.cloudapp.net.” There’s a reason for providing these (other than simply being prettier than an IP address). These are a necessary abstraction layer that lets the Virtual IP addresses (VIPs) underneath change without disrupting your service. It’s rare for the VIP of an application to change, but particularly thinking ahead to geo-location scenarios, it’s important that Windows Azure reserves the right to change the VIP. The friendly DNS entries provide a consistent interface for users to get to your application.
Source: http://blog.smarx.com/posts/custom-domain-names-in-windows-azure
However, if you get the dns name you could do a dns lookup.
To obtain the Virtual IP of an Azure CloudService deployment via powershell, you can use the Get-AzureService cmdlet combined with the Get-AzureDeployment cmdlet like this:
(Get-AzureService -ServiceName "myCloudService" `
| Get-AzureDeployment -Slot Production).VirtualIPs[0].Address
(Just assign the previous command to, e.g., $CloudServiceIp to plug the IP into subsequent commands.)
You can also get a list of all cloud services and virtual IPs for your subscription by running the following:
Get-AzureService | Select-Object -Property ServiceName, `
#{Name='ProdIP';Expression={(Get-AzureDeployment -Slot Production `
-ServiceName $_.ServiceName).VirtualIPs[0].Address}} | Format-Table -AutoSize