You Gotta Keep 'em Separated

PowerShell, Bash, Cisco IOS, RouterOS.  Terminal fatigue is real.  After a while they all blend together. Windows Terminal puts them all under one roof.  One clone after another gets old fast. I wanted each environment to reflect its own role.

Role-based shells to the rescue!  Windows Terminal owns the look. PowerShell and Bash each own their own environment. SSH launches directly into remote device. The secret sauce is the division of labor.

PowerShell

Show something useful instead of a blank prompt. Winfetch does that:

Install-Module -Name Winfetch -Scope CurrentUser

Then the profile is two lines. Find it with $PROFILE, create the file if it doesn’t exist, and add this:

Clear-Host
winfetch

New tab, screen clears, system info appears. Windows Terminal never has to know about it. Just remember that Windows PowerShell 5.1 and PowerShell 7 keep separate profiles, so run $PROFILE from the one you actually use.

Ubuntu WSL2

Same idea for Linux. Install the tools:

sudo apt update
sudo apt install neofetch figlet

Then at the bottom of ~/.bashrc:

clear
figlet "Ubuntu WSL2"
neofetch

Source it or open a fresh tab. You get the big banner, the Ubuntu art, and the stats.  🤯

Other nodes

The last piece was including a small transparent logo in the bottom-right of each profile.  I can tell at a glance which system I’m on. Each system gets its own PNG. Store them where Terminal can see them (e.g., RoamingState folder) and point at them like this:

"backgroundImage": "ms-appdata:///Roaming/ubuntu.png",
"backgroundImageAlignment": "bottomRight",
"backgroundImageStretchMode": "none",
"backgroundImageOpacity": 0.20

The shared defaults handle the common stuff: Cascadia Code, acrylic at 85% opacity, and a filled-box gold cursor. Individual profiles override color and logo. Cisco ended up dark royal green (#1B4D3E) with the gold cursor. MikroTik is deep navy with steel-blue text (#A0C4FF). Both stay readable and neither looks like a Christmas tree.

My Cisco and MikroTik profiles launch straight to SSH sessions. The remote device owns the CLI. Terminal only owns the window it appears in. Don’t bake credentials into settings.json.

Repeat after me 

I dedicate a folder for settings.json, the PowerShell profile, a copy of .bashrc, and the four images. If I break something or move to a new machine -no big deal.  I drop those files back in place, reinstall the two tools, and I’m done. The gold cursor was an experiment that stuck. Everything else was just making sure the right layer owned the right job.

That's It!

Problem

You need to move the FSMO roles, and you would rather do it in PowerShell than click through the old MMC snap-ins.

Solution

Use the Active Directory PowerShell module. If it is not already loaded, import it first.

Import-Module ActiveDirectory

See who has the forest roles

Get-ADForest contoso.com | ft DomainNamingMaster, SchemaMaster

See who has the domain roles

Get-ADDomain contoso.com | ft InfrastructureMaster, PDCEmulator, RIDMaster

Move one role

This hands the PDC Emulator role to the domain controller named DCX.

Move-ADDirectoryServerOperationMasterRole -Identity "DCX" PDCEmulator

PowerShell also accepts the role as a number:

• 0 = PDCEmulator
• 1 = RIDMaster
• 2 = InfrastructureMaster
• 3 = SchemaMaster
• 4 = DomainNamingMaster

Move several roles

Move-ADDirectoryServerOperationMasterRole -Identity "DCX" -OperationMasterRole DomainNamingMaster,PDCEmulator,RIDMaster,SchemaMaster,InfrastructureMaster

Move all of them by number

Move-ADDirectoryServerOperationMasterRole "DCX" -OperationMasterRole 0,1,2,3,4

That's it. Same command either way. Name the destination domain controller, then list the roles you want it to take.

References

Move-ADDirectoryServerOperationMasterRole

Migrating FSMO roles from Windows Server 2012 R2 to 2016

How to Assign Active Network Location with PowerShell.

Step 1:  Identify networks and associated NICs.

Get-NetConnectionProfile

Name             : domain.com

InterfaceAlias   : Ethernet (Domain)

InterfaceIndex   : 1

NetworkCategory  : DomainAuthenticated

IPv4Connectivity : Internet

IPv6Connectivity : NoTraffic



Name             : Unidentified network

InterfaceAlias   : RDMA

InterfaceIndex   : 2

NetworkCategory  : Public

IPv4Connectivity : NoTraffic

IPv6Connectivity : NoTraffic

The above examples shows two NICs that belong to two different networks.

Step 2.  Change the NetworkCategory:

This example changes the active network for the NIC named RDMA.  The network location changed from Public to Private.  Confirm with Get-NetConnectionProfile.

That't It!

References:

https://docs.microsoft.com/en-us/powershell/module/netconnection/get-netconnectionprofile?view=win10-ps

Problem:  

Import VMWare virtual machine (VM) into Hyper-V hypervisor.  Convert VMDK virtual disk into VHDX disk.

Solution:  

Use Microsoft Virtual Machine Converter (MVMC) 3.1 to import and convert the VMWare ESXi VM into Hyper-V.

Background:   

The MVMC GUI provides a simple import wizard.  Please note, the GUI only imports VMWare hypervisors (including ESXi) connected to VMSphere.  MVMC PowerShell commands can convert stand-alone ESX and ESXi VMs.

Convert:

1. Download MVMC.  The Microsoft download sites lists MVMC as 3.0.  N.B., the file installs version 3.1.
2. Install MVMC on Hyper-V host.
3. Uninstall VMTools from VMDK VM.
4. Copy VMDK to Hyper-V host.
5. Open PowerShell.  Import MVMC PowerShell library.
   
   Import-Module "C:\Program Files\Microsoft Virtual Machine Converter\MvmcCmdlet.psd1"
6. Use PowerShell to convert VMDK to VHD.  N.B., Do not use VMDK_Flat file!
   
   PS D:\TMP> ConvertTo-MvmcVirtualHardDisk -SourceLiteralPath "D:\VMS\DEV.vmdk" -DestinationLiteralPath "S:\VMS" -VhdType DynamicHardDisk
7. Create new VM in Hyper-V.  Add newly created (i.e., system) disk to IDE adapter.  Additional disks can use the SCSI adapter.  This is the time to configure dynamic memory or add additional CPUs.
   N.B., Do not resize the disk until after the VM starts at least once in Hyper-V!
8. Start-up VM.  Install Hyper-V tools.  Restart.
9. Optional:  New NIC "hardware" causes problems with retaining preexisting static IPs.  Resolve problem by deleting the network adapter and restating.  Windows creates a new network adapter upon start-up.  Manually add IP addresses into new adapter.

Error:  

The trust relationship between this workstation and the primary domain failed.

Problem:  

Domain computers use internal passwords to authenticate with Active Directory (AD).  Servers and workstations automatically reset their passwords every 30 days.  Suspended virtual machines or server backups may not logon domain users if the computer has a new password in AD.

Solution:   

Fix domain trust issues: (1) in AD, and (2) on the computer.

1.    Reset the computer account in Active Directory Users and Computers (ADUC). 
   
   Open ADUC → Computers OU → Right-Click on the computer → Reset Accout
   
   
2.  Reset the computer with PowerShell.  N.B., This step requires local Administrative rights.  We can't reset the computer, or even re-join the domain, with out the ability to log on locally.
   
   From PowerShell:  Reset-ComputerMachinePassword 

That's It!

References:  http://technet.microsoft.com/en-us/library/hh849751.aspx

By Steven Jordan on 4/17/2014

Takeaway:  Steps on how to apply Windows updates to the Exchange Data Availability Group (DAG) servers.  Take care when applying Exchange service pack rollups on Patch Tuesday.
References:  http://www.ehloworld.com/167

By Steven Jordan on 4/17/2014.

Takeaway:  Sign PowerShell scripts with a code signing certificate.

Assumptions:  We'll assume a code-signing certificate is already installed the Windows certificate root store.  If you don't already have a code-signing certificate, obtain one:

1. Enroll with the Windows Certificate Authority (CA) server.
2. Enroll with a public CA.  Best option if you plan to publicly distribute your scripts.
3. Generate a self-signed certificate.

Use the code-signing certificate located in the the Windows Certificate Store to sign PowerShell scripts.  First, export the certificate from the Certificate Store.  Export the certificate as follows:

Start → MMC → Add/Remove Snap-In → Certificates → Personal → Right click on the certificate → Export.

Save the certificate as a PFX file in a directory of your choice (e.g., c:\scripts).

Lastly, use the following PowerShell script to sign the code:

PS C:\scripts> $cert = Get-PfxCertificate C:\scripts\codesigncert.pfx  C:\scripts> Set-AuthenticodeSignature -Filepath pruneVSS.ps1 -Cert $cert

Directory: C:\scripts SignerCertificate Status Path ----------------- ------ ---- 2603FCAA10343AE1DD78AB41D984728D657499D3 Valid pruneVSS.ps1

That's it -the PowerShell script is signed.  Time to change the set-execution policy throughout the domain!

By Steven Jordan on 4/15/2014.

There are times when the DPM console GUI cannot remove its inactive data sources.  This PowerShell script removes all inactive data from DPM.  Choose between inactive disk or tape based data sources.

Removeinactivedatasource.ps1:

 

param([string] $DPMServerName, [string] $RemoveOption)

function Usage()
{
 write-host
     write-host "Usage::"
 write-host "Remove-InactiveDatasource.ps1 -DPMServerName [DPMServername] -RemoveOption [Remove Options]"
 write-host
 write-host "Run 'Remove-InactiveDatasource.ps1 -detailed' for detailed help"
 write-host
 write-host
}

if(("-?","-help") -contains $args[0])
{
 Usage
 exit 0
}

if(("-detailed") -contains $args[0])
{
 write-host
 write-host "Detailed Help :  Use this script to remove inactive datasources on disk or tape or both"
 write-host "Valid inputs of RemoveOption"
 write-host "OnDisk : Removes all inactive datasources on Disk only"
 write-host "OnTape : Removes all inactive datasources on Tape only"
 write-host "OnBoth : Removes all inactive datasources on both Disk and Tape"
 write-host
 write-host
 exit 0
}

if(!$DPMServerName)
{
     $DPMServerName = read-host "DPMServerName:"
}
$dpmServer = Connect-DPMServer $DPMServerName
if (!$dpmServer)
{
    write-Error "Failed To Connect To DPM Server::$DPMServerName"
    exit 1
}

$dsList = get-datasource $dpmservername
if (!$dsList -or ($dsList.Count -eq 0) )
{
    write-verbose   "No Datasources found"
    disconnect-dpmserver $dpmservername
    exit 2
}


if(!$RemoveOption)
{
 $RemoveOption = read-host "RemoveOption:"
}
if($RemoveOption)
{
 if ("ONDISK" -eq $RemoveOption)
 {
  $RemoveOption = "OnDisk"
 }
 elseIf ("ONTAPE" -eq $RemoveOption)
 {
  $RemoveOption = "OnTape"
 }
 elseIf("ONBOTH" -eq $RemoveOption)
 {
  $RemoveOption = "OnBoth"
 }
 else
 {
  write-Error "Invalid Value::$RemoveOption For Parameter -RemoveOption[OnDisk/OnTape/OnBoth]"
  Disconnect-dpmserver
  exit 1
 }
}
else
{
 Usage
 Disconnect-dpmserver
 exit 1
}

foreach($ds in $dsList)
{
 if($RemoveOption -eq "OnDisk" -and 
            ($ds.InactiveProtectionStatus -eq [Microsoft.Internal.EnterpriseStorage.Dls.UI.ObjectModel.OMCommon.InactiveProtection]::Disk -or
             $ds.InactiveProtectionStatus -eq [Microsoft.Internal.EnterpriseStorage.Dls.UI.ObjectModel.OMCommon.InactiveProtection]::DiskAndTape)
      )
 {
  write-host "Removing inactive Disk protection of " $ds.Name
  $confirm = read-host "Confirm(y/n):"
  if($confirm -eq "y")
  {
   Remove-DatasourceReplica -Datasource $ds -Disk
   write-host "Inactive disk protection for " $ds.Name " removed" 
  }
 }

 if($RemoveOption -eq "OnTape" -and 
            ($ds.InactiveProtectionStatus -eq [Microsoft.Internal.EnterpriseStorage.Dls.UI.ObjectModel.OMCommon.InactiveProtection]::Tape -or
             $ds.InactiveProtectionStatus -eq [Microsoft.Internal.EnterpriseStorage.Dls.UI.ObjectModel.OMCommon.InactiveProtection]::DiskAndTape)
      )
 {
  write-host "Removing inactive Tape protection of " $ds.Name
  $confirm = read-host "Confirm(y/n):"
  if($confirm -eq "y")
  {
   Remove-DatasourceReplica -Datasource $ds -Tape
   write-host "Inactive tape protection for " $ds.Name " removed" 
  }  
 }

 if($RemoveOption -eq "OnBoth" -and 
          $ds.InactiveProtectionStatus -ne [Microsoft.Internal.EnterpriseStorage.Dls.UI.ObjectModel.OMCommon.InactiveProtection]::None)
 {
  write-host "Removing inactive Disk and Tape protection of " $ds.Name
  $confirm = read-host "Confirm(y/n):"
  if($confirm -eq "y")
  {
   if($ds.InactiveProtectionStatus -eq [Microsoft.Internal.EnterpriseStorage.Dls.UI.ObjectModel.OMCommon.InactiveProtection]::Disk) 
   {
    Remove-DatasourceReplica -Datasource $ds -Disk
   }
   elseif($ds.InactiveProtectionStatus -eq [Microsoft.Internal.EnterpriseStorage.Dls.UI.ObjectModel.OMCommon.InactiveProtection]::Tape)
   {
    Remove-DatasourceReplica -Datasource $ds -Tape
   }
   else
   {
    Remove-DatasourceReplica -Datasource $ds -Disk
    Remove-DatasourceReplica -Datasource $ds -Tape
   }
   write-host "Inactive protection for " $ds.Name " removed" 
  }  
 }
}

Disconnect-dpmserver