Update Offline Virtual Machine

If you’ve created a golden image VM, you may have run across the hassle of keeping it updated.  You can fire it up monthly and run updates, or just wait and update as the first step in deploying a new machine.  OR…  You can deploy updates to the offline VM with a little prep work and powershell.

These notes are for deploying the monthly cumulative update on Windows Server 2016, but it should work for older versions and other updates.

The first step is to download the update file.  Then use the Expand program (built in) to extract the contents:

expand <PATHTOUPDATEFILE> -F:* <EXTRACTDESTINATION>

In the extract folder, find the .cab file for the update. Copy that to the VM host.  In this example, I’m using C:\Temp.

Now either open a PS Session or from the VM host open PowerShell.

Go to a folder on the local disk (this process failed when mounting into a CSV) and create a temporary folder to use as a mount point. It’s easiest if this is also where you’ve put the .cab file.

mkdir -Path C:\Temp\MountDir

Now mount the offline VHD(X) you want to update.

Mount-WindowsImage -ImagePath $VHDtoUpdate -Path C:\Temp\MountDir -Index 1

Now apply the image.

Add-WindowsPackage -Path C:\Temp\MountDir -PackagePath $updatepath

Wait while the process runs, then dismount the VHD(X).

Dismount-WindowsImage -Path C:\Temp\MountDir -Save

Now repeat for additional virtual machines, or clean up your temporary mount folder.

rd -Path C:\Temp\MountDir

Now you can start up your updated VM.

Full script:

$vmhost = <yourhost>
Enter-PSSession -ComputerName $vmhost

$cummupdatepath = "C:\Temp\Windows10.0-KB4022715-x64.cab"
$VHDtoUpdate = "C:\ClusterStorage\Volume1\Example\Virtual Hard Disks\Example.vhdx"

mkdir -Path C:\Temp\MountDir
Mount-WindowsImage -ImagePath $VHDtoUpdate -Path C:\Temp\MountDir -Index 1
Add-WindowsPackage -Path C:\Temp\MountDir -PackagePath $cummupdatepath
pause
Dismount-WindowsImage -Path .\MountDir -Save
rd -Path C:\Temp\MountDir

Exit-PSSession

 

Uninstall Application with Server Core

There is no way to directly uninstall a program with PowerShell, but you can get there in a PSRemote Session using WMI.  Note, this won’t work for Nano since it doesn’t have WMI.

First you need to open your connection and get the programs with WMI.

Enter-PSSession - ComputerName <YOURCOMPUTER>
$programs = Get-WmiObject -Class win32_product
$programs | Select Name

Now you can see the installed programs.  Find the one you want to remove, counting from zero to get its index in the array.  I want to remove program 5 in my example.  To test, I run a quick command to make sure I have the right entry.

$programs[5].Name

If you get the right program back, proceed to uninstall.

$programs[5].Uninstall()

You can rerun the initial commands to make sure it is no longer listed.  When you’re done, make sure to exit your PSRemote session.

Exit-PSSession

Block SMB to your Workstations

When was the last time you had a business need to reach the C$ share on one of your workstations?  When was the last time you wanted a user workstation to reach the C$ share on another workstation?

If your answer was never or rarely, then you should block them.  It helps slow lateral movement of an attacker and if you were unpatched against MS17-010, but had this in place it would have prevented the spread of WannaCry.

This has been available since the introduction of the integrated firewall in Windows XP SP2.  It can be configured by Group Policy, so it’s easy to have it automatically applied to new machines as they are put into production.

Modify DPM Schedule with PowerShell

We recently ran into an issue where we wanted to update the backup schedules for a number of our protection groups.  I did one through the GUI and then decided to write up something in PowerShell.  This script is built to copy the settings from one protection group to another, so you do need to use the GUI once to set it up, or you could use these commands to do that initial change in PowerShell as well.

The odd thing is that you can’t actually copy a schedule from one to the other, so you put the schedule into a variable and pull out the pieces to copy it over.

$PG = Get-DPMProtectionGroup -DPMServerName <YOURDPMSERVER>
for ($i=0;$i -le ($pg.Count-1);$i++) {
Write-Output ('[' + $i.ToString() +'] ' + $pg[$i].Name)
}
$pgchoice1 = Read-Host -Prompt 'Choose Protection Group to copy schedule FROM'

$sched = Get-DPMPolicySchedule -ProtectionGroup $PG[$pgchoice1] -ShortTerm

for ($i=0;$i -le ($pg.Count-1);$i++) {
Write-Output ('[' + $i.ToString() +'] ' + $pg[$i].Name)
}
$pgchoice2 = Read-Host -Prompt 'Choose Protection Group to copy schedule TO'

$MPG = Get-DPMModifiableProtectionGroup -ProtectionGroup $PG[$pgchoice2]

Set-DPMPolicySchedule -ProtectionGroup $MPG -Schedule (Get-PolicySchedule $MPG -ShortTerm) -DaysofWeek $sched.WeekDays -TimesOfDay $sched.TimesOfDay

Set-DPMProtectionGroup -ProtectionGroup $MPG

Modify Replica Size with PowerShell

With DPM you may get errors that the DPM is out of disk space for the replica. (ID 58 Details: There is not enough space on the disk (0x80070070))  Assuming you’re not actually out of space, the replica size just needs to be increased.
Unfortunately, the menu option to Modify disk allocation isn’t selectable.
Capture
Luckily, we have PowerShell.  NOTE: These scripts assume you’re local to the DPM server, if not you’ll need to add on the -DPMServer switch to the initial commands.
First, we need to get the list of protection groups.  This script block pulls the groups into an array, then outputs their names with the array index.
$pg = Get-DPMProtectionGroup
for ($i=0;$i -le ($pg.Count-1);$i++) {
Write-Output ('[' + $i.ToString() +'] ' + $pg[$i].Name)
}
Now that you can get the name of the protection group, run the next script block with the index of that entry (in this example, I’m grabbing the second PG, or index 1).  The second bit outputs the datasources in the protection group with their index value in the array and the datasource name.
$ds = Get-DPMDatasource -ProtectionGroup $pg[1]
for ($i=0;$i -le ($pg.Count-1);$i++) {
Write-Output ('[' + $i.ToString() +'] ' + $ds[$i].Name)
}
Now you can grab the datasource you need to modify.  This script block grabs the individual datasource from the array of datasources, then outputs the name (to make sure you’ve got the right one) and then shows you the current replica size, in GB.
$d = $ds[0]
$d.Name
$d.ReplicaSize/1024/1024/1024
We can now modify the replica size.  Make sure you update the value for the ReplicaSize switch to match what you need.
Edit-DPMDiskAllocation -Datasource $d -ReplicaSize (24*1024*1024*1024)
Once that completes the Replica should have been resized.  You can use the UI to start a consistency check, but we’re in PowerShell, so let’s just do that here as well.
$cc = Start-DPMDatasourceConsistencyCheck -Datasource $d
Write-Output $cc.Status

Setup New Disk on 2016 Server Core

When adding a disk to a server core machine, we don’t have the GUI and will need to use PowerShell to finish the disk setup.

To start, you’ll want to use Get-Disk to show your disks, you’ll want to note the disk number of the new disk you are setting up.  For this example, I’ll be working with disk 2.

snap2

Then you need to make sure the disk is online and set to read/write (by default it will be offline and read-only).

Get-Disk -Number 2 | Set-Disk –IsOffline:$false
Get-Disk -Number 2 | Set-Disk –IsReadOnly:$false

Then you need to initialize the disk, create a partition, and format it.  We can do all of this in one command.  Be careful that you’ve picked the right disk!

Get-Disk -Number 2 | Initialize-Disk –Passthru | New-Partition -AssignDriveLetter -UseMaximumSize | Format-Volume -FileSystem NTFS -Confirm:$false –Force

Note that it automatically picks the first free drive letter.  In this case, it picked drive F.

snap3

If you want to use a different drive letter, you need to mix some PowerShell and WMI to make the change.  In my example I’m going to change drive F to be drive S.

$drive = Get-WMIObject –Class win32_volume –Filter "DriveLetter = 'f:'"
Set-WMIInstance –input $drive –arguments @{DriveLetter="s:"}

Once you’re all done, you can use Get-Volume to make sure everything is set the way you want.