I’ve been really enjoying HueForge lately, having made several shadow boxes of family photos as gifts, I decided I wanted to stretch my legs a little, and really test my HueForge and design skills.

I wont bury the lead, here’s the finished product, stick around if you want to know the hows.

With all the fun stuff out of the way, let’s get down to the real details. So first of all, I used a mix of tools to get the job done. You can probably guess a few.

• HueForge
• Inkscape
• Blender
• GIMP
• PrusaSlicer
• FreeCAD

I’m going to be glosing over a lot of the finer details here, because nobody wants a book. The jist of it was I wanted to make a shadowbox, so I needed to isolate at least 2 distinct layers. A simple background and foreground was enough for this project. So first stop, GIMP.

The Background

I used it to remove Alice and do a ton of touchup work on the original Disney Classics #8 cover. I had to really flatten things out, denoise, redraw a few lines to subtle for the later process.

I moved it from GIMP over to HueForge and started playing with settings and colors. This took a lot of fiddling.

I had to pass it back and forth from GIMP to HueForge to get the colors where I wanted them and make sure it was clean enough to successfully print. Specifically, the compression artifacts from the scans I could find online were quite brutal on the process. For photos, I find compression to be fine, but for drawn art like this, it made a huge difference.

Not bad. It had quite a bit of stringing, but a large part of that was my very old white filament. I hit it with a heatgun and that cleaned up most of them.

If you are a little unsure about how HueForge works, here’s a closeup. Basically it only prints a single color per layer, changing between them.

My first few attempts failed because I disabled the wipe tower, thinking it wasn’t needed. Boy was I wrong. At least on my Prusa MK3 with MMU2S it really needed it to properly change.

The Foreground

With the background out of the way, it came time to forge a new path. HueForge is fun, but I’m already pretty good at that. Time to try something new. I ran through a lot of ideas, including hand painting Alice (A skill I don’t have), laser etching her outline on the acrylic and flood filling the details, but I finally settled on keeping her 3D printed, but doing a very different (although technically similar) process.

I’ve played around with transparent first layers before, it makes a great technique to create a clean first layer, while having complex detail that might not want to stick to the bed. This seemed like a great way to get what I wanted. Unfortunately, the source image was both highly compressed, and had too many colors, so there was but one option, redraw her in vector.

In comes Inkscape. I imported the jpg of her into inkscape and used it to trace. I couldn’t use the original design 100%, and had to make some choices for the 3D printing medium. Specifically, small details had to be eliminated, lines had to be significantly thickened, and colors had to be simplified. Once the design and art work was done, I duplicated my layer in Inkscape, then used it to merge all the various elements together, then split everything back out by color. I exported only the “Selected” elements so that all my work layers weren’t included. I repeated the process for a fully black silhouette version. With 2 SVGs in hand, I went into PrusaSlice and imported both as parts. I set my layer height to 0.2mm, and so the SVGs I imported I, likewise, set to 0.2mm on import.

This may sound like we are almost there, but no, I had more work to do still. I took the color segmented SVG and exported it to STL. I then opened that STL in Blender to do a little post processing work, cleaning up some conversion issues. Then back to STL and imported it back into PrusaSlicer. This took a ton of time to refine, but eventually I got what I wanted.

Finally, now that everything was in the slicer I built the print part by part. Layer 1 was the silhouette, printed in transparent. If you have a keen eye, you might have noticed that the final version of Alice had 5 primary colors, and the Prusa MK3 MMU2 only supports 5 colors, so how did I get transparent worked in? Just a simple manual color swap on the spool while other colors were being used.

Continuing the layering process, layers 2 and 3 were color layers, but I alternated the colors in a few areas like the skirt and the skin to give different tones. The skirt is layer 2 white, layer 3 blue. And the skin is layer 2 gold, layer 3 red. It just gives me a little more dynamic range with my limited palette.

Hopefully this photo helps to highlight the process. You can see the first layer is transparent, that’s our front most layer and it provides a solid bed for the more detailed layers that come next.

Oh, that’s not very impressive at all. Wait, perhaps if we remove it from the bed…

That’s much better. She wasn’t perfect, but pretty sharp none the less. My biggest mistake was going with 0.2mm layer heights. HueForge likes 0.08mm, which really lets the colors mix much better. But at this point I was seeing the finish line and wasn’t willing to do the work that was needed to lower that down.

Frame and Acrylic

The frame was simply generated using my Frame/Shadowbox generator you can find on Printables. This was made for some previous projects, but I’ve found it quite useful time and time again. It was designed in FreeCAD and has a nice spreadsheet embedded in it so you can easily generate frames of any size.

The acrylic cover was simply cut on my laser cutter, nothing particularly special about it, just a nice rectangular piece that could easily be mistaken for glass.

Final Assembly & Conclusion

All that was left was to put it together. I printed a small spacer to hold Alice well above the background, then glued her and the spacer to the background. In hindsight I could have probably printed the space on Alice, and possibly put some holes to screw from behind the background, but glue worked just fine. Then everything slotted into the frame. I also printed a space to give Alice room between the background the the Acrylic. The frame has a nice snap fit, and has a built in comb/rake for hanging on a nail.

The gift went over well. I didn’t keep track of time on this project, but I’d say in excess of 20 solid hours of work went into it. It was worth it, but boy was I ready to be done by the end of it, it was probably 3 weekends spent on it.

Comments or Questions?

I have no idea how to do this right, but I’ve posted this at Lemmy.World’s 3D Printing Community. A great place to leave a comment or question.

Today marks a big move, I’m now storing my website in git, and using CloudFlare pages to render and host them. This means no more hosting for me at all. Completely takes the risk of web server exploits off my plate, and simplifies the build system so all I have to do is commit and sync and within a few minutes, my website will be public. I’m excited to see the new simplified flow, and hope it will encurage me to publish more often.

Why Do They Need To Make This So Difficult?

A client requested a list of groups in Microsoft 365, members, and the owners/managers of those groups. My first impulse was to use Get-MsolGroup and Get-MsolGroupMember, but I quickly realized that it didn’t return the owner. So I had to go to a completely different module and compile two different list of groups. Microsoft just can’t make this easy.

Code Time

Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline
$DistroGroups = Get-DistributionGroup
$UnifiedGroups = Get-UnifiedGroup
$DistroGroupMembers = $DistroGroups | ForEach-Object{
    [PSCustomObject]@{
        Name = $_.DisplayName
        Type = "DistroGroup"
        ManagedBy = $_.ManagedBy
        Members=(Get-DistributionGroupMember -Identity $_.SamAccountName).Name -join ", "
    }
}

$UnifiedGroupMembers = $UnifiedGroups | ForEach-Object{
    [PSCustomObject]@{
        Name = $_.DisplayName
        Type = "Microsoft 365 Group"
        ManagedBy = $_.ManagedBy
        Members=($_ | Get-UnifiedGroupLinks -linktype Members).Name -join ", "
    }
}

$DistroGroupMembers + $UnifiedGroupMembers | Export-CSV -path "$([Environment]::GetFolderPath('MyDocuments'))\Group Report $(get-date -Format "yyyyMMdd").csv" -NoTypeInformation

Bonus Extra Credit

Here’s something new. I’ve decided to throw in some extra credit. If you are running this at home, try throwing in Out-GridView into middle of the output so you can manually filter what gets saved int the report.

Automate More of The Things

A few weeks ago I wrote about how to maintain a folder structure with PowerShell. That was a lot more involved than this, but when you are managing dozens to hundreds of domains, keeping things tidy is important. A peer over in the MSPGeek Slack was asking for input on just such a thing a few days ago, and I shared with him an ancient and terrible but functional script for creating our minimum required OUs, as well as security groups. Well, I’ve went and cleaned it up a little. This script will create all of the requested OUs, checking to see if they exist first before trying. This means you can regularly run this on an environment to ensure compliance.

Much like my previous script folder maintenance I made a function that does the core of creating an OU. After that, I just call that for every new OU I want created. Reducing code and making revisions easier. I didn’t do the same for making the security group, but if you had a small list of groups you always used, you could certainly do the same for it.

The only real issues you might find are:

1. Azure AD Sync can be configured to sync based on OU, so moving things around may cause accidental deletion in Azure AD
2. There are a lot of other things that work off OU. Be careful when moving things around if you have an Active Directory integrations like LDAP user authentication on firewalls.
3. GPOs are often tied to OU. Better make sure the client doesn’t have GPOs linked to OUs, and if they do, mirror the OU structure and linked GPOs inside your new structure.

It may be wise to audit your client’s use of protocols like LDAP before rearranging everything. Once everything is in the proper OUs, it will make it much easier to find what you are looking for, and

Code Time

Function New-OU {
    param (
        [Parameter(Mandatory = $true)]
        [string]$Name,

        [Parameter(Mandatory = $false)]
        [string]$Path
    )
    $OU = Get-ADOrganizationalUnit -Filter "name -eq '$Name'" ;
    if (!$OU) {
        if ($Path) {
            New-ADOrganizationalUnit -name $Name -Path $Path;
        }
        else {
            New-ADOrganizationalUnit -name $Name;
        }
        $OU = Get-ADOrganizationalUnit -Filter "name -eq '$Name'";
    }
    return $OU
}

#Make the primary OU that all the others will go under
$OUPrimary = New-OU "Company"
if ($OUPrimary) {
    #Make all the Children OUs
    $OUEmployees = New-OU "Employees" $OUPrimary.DistinguishedName
    $OUDisabledEmployees = New-OU "Disabled Employees" $OUPrimary.DistinguishedName
    $OUServiceAccounts = New-OU "Service Accounts" $OUPrimary.DistinguishedName
    $OUSecurityGroups = New-OU "Security Groups" $OUPrimary.DistinguishedName
    #Make Security Groups inside of the Security Groups OU
    if ($OUSecurityGroups) {
        Try {$EmployeeSG = Get-ADGroup -Identity "Employees"}
        Catch {
            write-host "Creating Employees Security Group"
            New-ADGroup -name "Employees" -GroupCategory Security -GroupScope Global -Path $OUSecurityGroups.DistinguishedName;
            $EmployeeSG = Get-ADGroup -Identity "Employees";
        }
    }
}

Automate All The Things

At the office we were discussing a new process that needed a new folder in our client documents folder. To add the folder to every single client’s directory, I created a very quick little PowerShell command that did it for me. Something like this:

Get-Item "D:\Clients\*\5. Misc\" | %{New-Item "$($_.FullName)\1. New Folder"}

Totally worked. Took about 5 minutes to write it off the top of my head, and I had created hundreds of folders.

Let’s do a quick breakdown of what I did there. First, I used Get-Item with a wildcard to give me an object for every 5. Misc folder for every client. I then piped that into a ForEach-Object using the % abbreviation. The ForEach-Object command will loop through every directory, running the command for each. In this case I simply used a New-Item command to create the folder under each 5. Misc folder.

But it reminded me that creating all those client folders was a manual process, which is kinda dumb. In addition, changes were all being done manually, things like archiving old clients. Lastly, nothing was enforcing using the proper structure.

The Simple Solution

So I sat down on a lunch break and wrote out the following script. It isn’t full featured, but for less than an hour’s work it does the job quite nicely. Recommended improvements would be parameterization of inputs, and possibly CVS inputs. My testing did not show any issues, but if I had to guess I’d say long file names would be a problem, especially with the archiving sections.

Features:

1. Create Client Folders
2. Create Client Sub-folders
3. Archive Old Clients with Timestamp
4. Move Unmanaged Client Sub-folders and Documents into an Orphan Folder

For future updates, check out the Set-DirectoryStructure page on GitHub

$Clients = "ABC", "NMO", "XYZ"
$Folders = "1. Vendor Info", "2. Network Infrastructure", "2. Network Infrastructure\1. Firewall Configs", "3. Reports"
$ClientArchive = "Z. Archived"
$OrphanFolder = "Z. Orphans"

$TargetFolder = "D:\Clients"

#Check if path already exists, if it doesn't, create it
function New-DirectoryIfNeeded {
    param (
        [Parameter(Mandatory = $true)]
        $Path
    )
    if (!(Test-Path $Path)) {
        New-Item $Path -ItemType Directory
    }
    return (Test-Path $Path)
}

if (Test-Path $TargetFolder) {
    ForEach ($Client in $Clients) {
        #Make the Client Folder
        $ClientFolder = New-DirectoryIfNeeded "$TargetFolder\$Client"
        if ($ClientFolder) {
            $Folders | ForEach-Object { 
                $Folder = New-DirectoryIfNeeded "$TargetFolder\$Client\$_"
            }
            #Create Orphan Folder
            $OrphanFolderObj = New-DirectoryIfNeeded "$TargetFolder\$Client\$OrphanFolder"
            #Move Orphaned Objects to the Orphan folder
            if ($OrphanFolderObj) {
                $ExistingFolders = Get-ChildItem "$TargetFolder\$Client"
                $ExistingFolders | ForEach-Object {
                    if ($_.Name -notin $Folders -and $_.Name -ne $OrphanFolder) {
                        $NewName = "$($_.Name) - Archived $(Get-Date -Format "yyyy-MM-dd_hhmmss")"
                        $NewObject = Rename-Item -Path $_.FullName -NewName $NewName -PassThru
                        Move-Item -Path $NewObject.FullName -Destination "$TargetFolder\$Client\$OrphanFolder\"
                    }
                }
            }

        }
    } 
    #Create Client Archive
    $ClientArchiveFolder = New-DirectoryIfNeeded "$TargetFolder\$ClientArchive"
    #Move any items from the root folder into archived if they aren't current clients
    if ($ClientArchiveFolder) {
        $ExistingClientFolders = Get-ChildItem $TargetFolder
        $ExistingClientFolders | ForEach-Object {
            if ($_.Name -notin $Clients -and $_.Name -ne $ClientArchive) {
                $NewName = "$($_.Name) - Archived $(Get-Date -Format "yyyy-MM-dd_hhmmss")"
                $NewObject = Rename-Item -Path $_.FullName -NewName $NewName -PassThru
                Move-Item -Path $NewObject.FullName -Destination "$TargetFolder\$ClientArchive"
            }
        }
    }
}

Always Something New to Learn

Most of you probably already know about Out-Gridview, a great command to output data into a human readable grid. Not great for automation, but sometimes you just want to gather information, or pull a detailed sanity check before fully automating something.

Let’s do a quick example.

Get-Process | Out-Gridview

Pretty nifty, no? Way better than Format-Table in a lot of use cases. What if it could do more? Well, you are in luck. Check out the -OutputMode parameter. It’s the real magic!

The Main Event

Now that we know about the -OutputMode parameter, let’s put it in practice.

Get-Process | Out-GridView -OutputMode Single | Stop-Process

That’s it for the quickie today. Hope you had fun.

The Quick Gist

A user in the MSPGeek Slack asked a question about monitoring a file for not being changed. He wanted to setup an alert if the file hadn’t been modified in x number of days, so I wrote this quick one liner to help him, then over the next hour I came back and tweaked it several times. Here is the final result.

get-item test1.txt,test2.txt | %{if($_.LastWriteTime -lt (Get-Date).AddDays(-5)) {Write-Output ('Failure: {0} - {1}' -f $_.Name, $_.LastWriteTime)} else { Write-Output ('Success: {0} - {1}' -f $_.Name, $_.LastWriteTime)}}

A quick and dirty command to do the job. I could end the blog post here, but…

%? What’s that?

% is an alias for ForEach-Object. When you are making a quick and dirty one liner, it’s nice to keep things shorter, but might be a little hard to reader to read. That’s why when you are writing a full script, you should probably explode that out completely.

Write-Output vs Write-Host

If you’ve been PowerShelling on the side for some time, you might have picked up the habit of using Write-Host. Very, very rarely is it the right option. Write host writes to the console no mater what. Write-Output, however, will write into the stream. In my example, that doesn’t matter much, but what if you wanted to pump the results into a variable? We could do $results = get-item .... Now it is in a variable we could use later down on the line. Although if we were doing that, I’d probably just push the objects, or create new objects, but for the scope we were working at, it was fine.

What’s with the weird strings?

In this use case, double quotes were likely to cause problems. They would need to be escaped. Not to mention that inside those strings inside of For-EachObject would need to be wrapped in $() because the string would get confused with $_. and not realize you wanted the Name and LastWriteTime. So instead I used a single quote, then used the -f parameter on the string to fill in variables where the {0} and {1} are. Pretty handy when you are embedding the powershell scripts in your RMM or somewhere else that might have conflicting quotes.

What if we wanted it to be more dynamic?

So it’s setup pretty well to be expanded or embedded in another script. Let’s blow it out past a one liner.

$files = 'test1.txt','test2.txt'
$MaximumAgeDays = 5
get-item $files | ForEach-Object {
    if( $_.LastWriteTime -lt (Get-Date).AddDays(-$MaximumAgeDays) ) {
        Write-Output ('Failure: {0} - {1}' -f $_.Name, $_.LastWriteTime)
    } else {
        Write-Output ('Success: {0} - {1}' -f $_.Name, $_.LastWriteTime)
    }
}

Hey look at that, with a few small edits, we can now easily change the files and age. Great if you are getting the list of files from another location like registry keys. Could be embedded well in an existing script, and is easy to understand.

Why?

For a long time I’ve been using the alert box feature built into my RMM to alert end users that updates may be installed that night. It is technically functional, but the the style is quite aged. I also am interested in not relying on my RMM where it isn’t needed. So I sat down and wrote up this powershell script to send an alert to the signed in user. I’m using my RMM to detect when a user is signed in, and to only run the script when they are, otherwise it keeps trying through the day until the user is logged on and it can send them the alert.

Tools Used

I used a few tools for this script. I highly recommend checking out Kelvin Tegelaar’s RunAsUser powershell module. It’s what makes this pretty easy. Kelvin was nice enough to add the CacheToDisk flag when I tried to feed this script to it and the length broke the function. I also used SMSAgent’s Customizable WPF MessageBox as the base for my message box. I ripped out all of the unneeded code though. I highly recommend spending time with his code if you want to better understand WPF based windows. Theoretically you should be able to lookup details on making WPF windows, and use that in powershell just like any other programming language.

Caveat Emptor

I wrote this and locked the version of Kelvin’s module at 2.0. This is for 2 reasons: 1) To make sure future changes to his module do not cause compatibility issues. B) To make sure if Kelvin’s accounts were ever compromised, changes couldn’t be introduced that were security risks. Since this will be running as system, across entire client bases, it’s a very juicy target. I trust Kelvin, but the world is a wild place for security, best to plan for the worst. With that in mind, I highly recommend forking his entire module, and running your own, instead taking his directly. I recommend that for any module you use in an automated fashion. Supply chain attacks are getting powerful, and if you aren’t careful, a silly dependency might result in your entire infrastructure being compromised.

Get to the Monkey!

Install-PackageProvider -Name NuGet
# We demand an exact version of RunAsUser because theoretically future versions could be uploaded that were malicious.
# By setting a static version number, we always know we get a version we trust. You may want to go one step further and fork the repo, inspect, and use your fork.
Install-Module RunAsuser -RequiredVersion 2.0
Import-Module RunASuser -RequiredVersion 2.0
Invoke-AsCurrentUser -CacheToDisk -scriptblock {
    $Title = "Maintenance Notification"
    $Message = "System maintenance is being performed tonight. Please save your work & leave your system on. A reboot may occur. If 3 of these are missed, updates will occur the next time the system comes online."
    $ImageSource = "https://domain.com/notificationlogo.png"
    $ButtonMessage = "OK"

    # Required to draw the window
    Add-Type -AssemblyName PresentationFramework
    
    # Setup the logo to show next to the text.
    $Image = New-Object System.Windows.Controls.Image
    $Image.Source = $ImageSource
    $Image.Margin = 10
    # I recommend matching the source image resolution, and the height/width defined here. Windows doesn't do a great job of scaling the image.
    $Image.Height = 128
    $Image.Width = 128

    # Setup the main message text.
    $TextBlock = New-Object System.Windows.Controls.TextBlock
    $TextBlock.Text = $Message
    $TextBlock.Padding = 10
    $TextBlock.FontSize = 20
    $TextBlock.VerticalAlignment = "Center"
    $TextBlock.TextWrapping = "Wrap"
    $TextBlock.MaxWidth = "600"
    $TextBlock.Foreground = "White"

    # Combine the two into a "Horizontal" panel. Depending on your logo or styling concerns, you can switch this to "Vertical".
    $Content = New-Object System.Windows.Controls.StackPanel
    $Content.Orientation = "Horizontal"
    $Content.AddChild($Image)
    $Content.AddChild($TextBlock)

    # XML defining the main window.
    [XML]$Xaml = @"
    <Window 
            xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
            xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
            x:Name="Window" Title="" SizeToContent="WidthAndHeight" WindowStartupLocation="CenterScreen" WindowStyle="None" ResizeMode="NoResize" AllowsTransparency="True" Background="Transparent" Opacity="1">
        <Window.Resources>
            <Style TargetType="{x:Type Button}">
                <Setter Property="Template">
                    <Setter.Value>
                        <ControlTemplate TargetType="Button">
                            <Border>
                                <Grid Background="{TemplateBinding Background}">
                                    <ContentPresenter />
                                </Grid>
                            </Border>
                        </ControlTemplate>
                    </Setter.Value>
                </Setter>
            </Style>
        </Window.Resources>
        <Border x:Name="MainBorder" Margin="10" CornerRadius="0" BorderThickness="2" BorderBrush="Gray" Padding="0" >
            <Border.Effect>
                <DropShadowEffect x:Name="DSE" Color="Black" Direction="270" BlurRadius="20" ShadowDepth="3" Opacity="0.6" />
            </Border.Effect>
            <Border.Triggers>
                <EventTrigger RoutedEvent="Window.Loaded">
                    <BeginStoryboard>
                        <Storyboard>
                            <DoubleAnimation Storyboard.TargetName="DSE" Storyboard.TargetProperty="ShadowDepth" From="0" To="3" Duration="0:0:1" AutoReverse="False" />
                            <DoubleAnimation Storyboard.TargetName="DSE" Storyboard.TargetProperty="BlurRadius" From="0" To="20" Duration="0:0:1" AutoReverse="False" />
                        </Storyboard>
                    </BeginStoryboard>
                </EventTrigger>
            </Border.Triggers>
            <Grid >
                <Border Name="Mask" CornerRadius="0" Background="Black" />
                <Grid x:Name="Grid" Background="Black">
                    <Grid.OpacityMask>
                        <VisualBrush Visual="{Binding ElementName=Mask}"/>
                    </Grid.OpacityMask>
                    <StackPanel Name="StackPanel" >                   
                        <TextBox Name="TitleBar" IsReadOnly="True" IsHitTestVisible="False" Text="$Title" Padding="10" FontFamily="Segoe UI" FontSize="14" Foreground="White" FontWeight="Normal" Background="Black" HorizontalAlignment="Stretch" VerticalAlignment="Center" Width="Auto" HorizontalContentAlignment="Center" BorderThickness="0"/>
                        <DockPanel Name="ContentHost" Margin="0,10,0,10"  >
                        </DockPanel>
                        <DockPanel Name="ButtonHost" LastChildFill="False" HorizontalAlignment="Center" >
                        </DockPanel>
                    </StackPanel>
                </Grid>
            </Grid>
        </Border>
    </Window>
"@
    
    # XML Defining the confirm button.
    [XML]$ButtonXaml = @"
    <Button xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" Width="Auto" Height="30" FontFamily="Segui" FontSize="16" Background="Transparent" Foreground="White" BorderThickness="1" Margin="10" Padding="20,0,20,0" HorizontalAlignment="Right" Cursor="Hand"/>
"@
    
    [XML]$ButtonTextXaml = @"
    <TextBlock xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" FontFamily="Segoe UI" FontSize="16" Background="Gray" Foreground="Black" Padding="20,5,20,5" HorizontalAlignment="Center" VerticalAlignment="Center"/>
"@
    # Create the window.
    $Window = [Windows.Markup.XamlReader]::Load((New-Object -TypeName System.Xml.XmlNodeReader -ArgumentList $xaml))

    # Create the button
    $Button = [Windows.Markup.XamlReader]::Load((New-Object -TypeName System.Xml.XmlNodeReader -ArgumentList $ButtonXaml))
    $ButtonText = [Windows.Markup.XamlReader]::Load((New-Object -TypeName System.Xml.XmlNodeReader -ArgumentList $ButtonTextXaml))
    $ButtonText.Text = $ButtonMessage
    $Button.Content = $ButtonText
    $Button.Add_MouseEnter( { $This.Content.FontSize = "20" })
    $Button.Add_MouseLeave( { $This.Content.FontSize = "20" })
    $Button.Add_Click( { $Window.Close() })
    $Window.FindName('ButtonHost').AddChild($Button)
    $Window.FindName('ContentHost').AddChild($Content)        
    $Window.Add_Loaded( { $This.Activate() })

    # Set the window to be always on top.
    $Window.Topmost = $true
    $null = $window.Dispatcher.InvokeAsync{ $window.ShowDialog() }.Wait()
}

Shortly after I posted Powershell: Reporting on File Permissions, I was asked about how it could be done for remote target. Although in my case it easy to run it on the server I want to scan, in many organizations getting permissions to access servers directly, or getting the server team to implement scheduled scanning might not be possible. Thankfully, it only takes rather minor change to make the exact same script hit a target server.

The big gotcha would be if you have permissions or not to view a share, or files in a share. If you don’t have permissions, it will put an error on the console, but the reports won’t mention them, it will just skip right past. Maybe error reporting will be a future feature.

Enumerating Shares on a Remote Server

Looking online, I only found one simple, built in, reliable way to enumerate the shares on a remote server without needing WMI access to the target server. net view servername.

Shared resources at localhost



Share name  Type  Used as  Comment

-------------------------------------------------------------------------------
Test Share  Disk
Users       Disk
The command completed successfully.

It’s simple, but the output really stinks for automation. So let’s get that into a powershell useful output.

$ServerName = "localhost"
net view $ServerName | ForEach-Object {
    if($_.indexof(" Disk ") -gt 0) {
        $ShareName = ($_ -split "\s{2,}")[0]
    }
}

Let’s break that down. First we call net view as normal, but we pipe that directly in to a ForEach-Object, which loops through each line of the output as separate strings.

Once in a loop, we use indexof() to count how many times " Disk " shows up in the line. Note the spaces on both sides. That filters out all of the none share lines.

Next, we use -split to break the string into pieces. We are making an assumption, that’s not 100% certain, that none of your share names include any double spaces. \s{2,} tells split to look for 2 concurrent spaces. Because the output of net view always seems to put at least 2 spaces between Share name and Type. Once we have it all split up, we ask for the first result, which will always be share name. [0] might not be obviously the first part of the split up strings, but in programming, lists normally start at 0 instead of 1 the way humans normally think of it. So when you have a list on computers, you generally ask for 0 to get the first.

Alright, we have a nice output of every share on the machine now, that’s a great start. But how do we re-factor that back into my original script.

Well, if you look down low in my script, you will see it expects the $Share to have objects with 2 properties, Name and Path. So what we want to do is create an object out of the output of net view that replicates what we were using from Get-SmbShare. Thankfully we already have all the info we need, the share name and the server name are all we need to create an object that the rest of my script can use.

[PSCustomObject]@{
    'Name' = $ShareName
    'Path' = "\\$ServerName\$ShareName"
}

See, custom objects aren’t that hard. But how to we build that into the script? We put it in the ForEach-Object section.

$ServerName = "localhost"
net view "$ServerName" | ForEach-Object {
    if($_.indexof(" Disk ") -gt 0) {
        $ShareName = ($_ -split "\s{2,}")[0]
        [PSCustomObject]@{
            'Name' = $ShareName
            'Path' = "\\$ServerName\$ShareName"
        }
    }
}

So when that loops through, it is going to return just the custom object we built there. So right now, if we replace Get-SmbShare function, we’d pretty much have it working. But let’s modify the Where-Object part to account for it.

$ServerName = "localhost"
$Shares = net view "$ServerName" | ForEach-Object {
    if($_.indexof(" Disk ") -gt 0) {
        $ShareName = ($_ -split "\s{2,}")[0]
        [PSCustomObject]@{
            'Name' = $ShareName
            'Path' = "\\$ServerName\$ShareName"
        }
    }
} | Where-Object {$_.Name -ne "SYSVOL" -and $_.Name -ne "NETLOGON"}

And there we have it, that technically works. We don’t need the *$ part, because net view doesn’t return hidden shares. And we don’t need FileSystemDirectory, because we are already filtering to disk shares only, and ShareType isn’t a valid variable on the share.

Making it Easier to Run Against More Targets

The script works as is, but imagine you want to be able to set this up on a schedule, perhaps saving the logs to specific directories, targeting multiple servers. Perhaps even scanning from workstations or user accounts to see what they see. Well, you could have 20 different copies of the script, one for each server and save target, or you could include parameters on the script, which would allow you, when you run the PS1, to specify a target server and path to save the reports to. Thankfully, all we need to do is replace all the variables at the beginning with parameters we can pass data into.

param(
    [Parameter(Mandatory=$true)]
    [ValidatePattern('^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$')]
    [String] $ServerName,
    [Parameter(Mandatory=$false)][String] $OutputPath = ".",
    [Parameter(Mandatory=$false)][String] $OutputFileName = "$ServerName-Shares",
    [Parameter(Mandatory=$false)][Int] $RecurseDepth = 2
)

That’s going to force whoever is running it to supply a server name, but nothing else. But optionally the other things can be tweaked. I have added a simple validation pattern to the server name to prevent accidental errors that may result in very big problems (running unexpected commands on a command line). It’s not a 100% safeguard, I’m guessing, but it should prevent accidents.

Let’s put it all together now.

param(
    [Parameter(Mandatory=$true)]
    [ValidatePattern('^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$')]
    [String] $ServerName,
    [Parameter(Mandatory=$false)][String] $OutputPath = ".",
    [Parameter(Mandatory=$false)][String] $OutputFileName = "$ServerName-Shares",
    [Parameter(Mandatory=$false)][Int] $RecurseDepth = 2
)

#Automatically gets the list of shares. Excludes system shares and non-file shares like printers.
$Shares = net view "$ServerName" | ForEach-Object {
    if($_.indexof(" Disk ") -gt 0) {
        $ShareName = ($_ -split "\s{2,}")[0]
        [PSCustomObject]@{
            'Name' = $ShareName
            'Path' = "\\$ServerName\$ShareName"
        }
    }
}
#Gets NTDomain to help with name filters
$Domain = (Get-WmiObject Win32_NTDomain).DomainName

#List of names to filter out. Great for client facing reports, might not be best for change monitoring.
$NameFilter = "$Domain\MSPAdmin", 'BUILTIN\Administrators', 'NT AUTHORITY\SYSTEM', "$Domain\Domain Admins"


#Converts the Propagation and Inheritance flags into human readable output
Function Get-HumanReadablePropagation($PropagationFlags, $InheritanceFlags) {
    switch ($PropagationFlags) {
        "None" {
            switch ($InheritanceFlags) {
                "None" { return "This Folder Only" }
                "Container" { return "This Folder and Sub-folders" }
                "Object" { return "This Folder and Files" }
                Default { return "This Folder, Sub-folders and Files" }
            }
        }
        Default {
            switch ($InheritanceFlags) {
                "Container" { return"Sub-Folders" }
                "Object" { return "Files" }
                Default { return "Sub-folders and Files" }
            }
        }
    }
}
$Output = foreach ($Share in $Shares) {  
    $RootPath = $Share.Path
    $FolderPath = Get-ChildItem -Directory -Path $RootPath -Recurse -Depth $RecurseDepth -Force | Where-Object { $_.PSPath -notlike "*DfsrPrivate*" }
    $MainFolderACL = Get-Acl -Path $RootPath
    ForEach ($Access in $MainFolderACL.Access) {
        $Propagation = Get-HumanReadablePropagation($Access.PropagationFlags, $Access.InheritanceFlags)
        [PSCustomObject]@{
            'Share' = $Share.Name
            'Folder Name' = $RootPath
            'Group/User' = $Access.IdentityReference
            'Permissions' = $Access.FileSystemRights
            'Inherited' = $Access.IsInherited
            'Propagation' = $Propagation
        }
    }
    ForEach ($Folder in $FolderPath) {
        $Acl = Get-Acl -Path $Folder.FullName
        if ($Acl.Access.IsInherited -contains $false) {
            ForEach ($Access in $Acl.Access) {
                $Propagation = Get-HumanReadablePropagation($Access.PropagationFlags, $Access.InheritanceFlags)
                [PSCustomObject]@{
                    'Share' = $Share.Name
                    'Folder Name' = $Folder.FullName
                    'Group/User' = $Access.IdentityReference;
                    'Permissions' = $Access.FileSystemRights
                    'Inherited' = $Access.IsInherited
                    'Propagation' = $Propagation
                }
            }
         }
    }   
}

#Output Phase

$Output | Group-Object "Share" | ForEach-Object {
    $ShareOutput = $_.Group
    $FilteredOutput = $ShareOutput | Where-Object { $_."Group/User" -notin $NameFilter } 
    $FormattedOutput = $FilteredOutput | Format-Table "Group/User", "Permissions", "Inherited", "Propagation" -GroupBy "Folder Name"
    $FormattedOutput | Out-File "$OutputPath\$OutputFileName-$($_.Name).txt" -Width 120
    Write-Host "================`n$($_.Name)`n================"
    $FormattedOutput
}


$FilteredOutput = $Output | Where-Object { $_."Group/User" -notin $NameFilter } 
$FilteredOutput | Export-Csv -Path "$OutputPath\$OutputFileName.csv"

Hello everyone, I’ve decided to decouple my stuff from RMM specific scripts where possible. This starts a new blog series for me, just pure PowerShell. We have several clients that need regular reports on who has access to what files, but making those reports is either a lot of manual work, or at the very least, tedious amounts of documentation that will likely fall out of sync when a tech doesn’t bother updating it when they make a change.

So I sat down with the task of creating the reports in an automated way. As generic as possible so it could hit multiple clients with minimal or no modifications. What I’ve made is a script that will loop through all network shares, and grab the file permissions of them, and write each to a file. It, by default, only goes 2 folders deep, to prevent scanning millions of folders all of which have the same permissions as their parent. It only reports on folders that have permissions that do not match their parent, so the reports are no longer than they need to be. It prints them to text files that are pretty easy for humans to read. A crafty person might even write them to more user friendly reports.

Ideally you would parameterize the output path and recursedepth for easy changes without having to change the code, but for an easy quick run, I have left them not.

Small warning, -depth parameter of Get-ChildObject is only valid for PowerShell 5.1 and up. So that may create issues. You can exclude that parameter, but doing so will significantly increase scan times. You can get the same limits by removing -Depth and -Recurse, but changing the path to be something like “-Path $RootPath\*, $RootPath\*\*”

#Edit these to meet your liking.
$OutputPath = "."
$OutputFileName = "Shares"
$RecurseDepth = 2

#Automatically gets the list of shares. Excludes system shares and non-file shares like printers.
$Shares = Get-SmbShare | Where-Object { $_.Name -NotLike "*$" -and $_.Name -ne "SYSVOL" -and $_.Name -ne "NETLOGON" -and $_.ShareType -eq "FileSystemDirectory" }
#Gets NTDomain to help with name filters
$Domain = (Get-WmiObject Win32_NTDomain).DomainName

#List of names to filter out. Great for client facing reports, might not be best for change monitoring.
$NameFilter = "$Domain\MSPAdmin", 'BUILTIN\Administrators', 'NT AUTHORITY\SYSTEM', "$Domain\Domain Admins"


#Converts the Propagation and Inheritance flags into human readable output
Function Get-HumanReadablePropagation($PropagationFlags, $InheritanceFlags) {
    switch ($PropagationFlags) {
        "None" {
            switch ($InheritanceFlags) {
                "None" { return "This Folder Only" }
                "Container" { return "This Folder and Sub-folders" }
                "Object" { return "This Folder and Files" }
                Default { return "This Folder, Sub-folders and Files" }
            }
        }
        Default {
            switch ($InheritanceFlags) {
                "Container" { return"Sub-Folders" }
                "Object" { return "Files" }
                Default { return "Sub-folders and Files" }
            }
        }
    }
}
$Output = foreach ($Share in $Shares) {  
    $RootPath = $Share.Path
    $FolderPath = Get-ChildItem -Directory -Path $RootPath -Recurse -Depth $RecurseDepth -Force | Where-Object { $_.PSPath -notlike "*DfsrPrivate*" }
    $MainFolderACL = Get-Acl -Path $RootPath
    ForEach ($Access in $MainFolderACL.Access) {
        $Propagation = Get-HumanReadablePropagation($Access.PropagationFlags, $Access.InheritanceFlags)
        [PSCustomObject]@{
            'Share' = $Share.Name
            'Folder Name' = $RootPath
            'Group/User' = $Access.IdentityReference
            'Permissions' = $Access.FileSystemRights
            'Inherited' = $Access.IsInherited
            'Propagation' = $Propagation
        }
    }
    ForEach ($Folder in $FolderPath) {
        $Acl = Get-Acl -Path $Folder.FullName
        if ($Acl.Access.IsInherited -contains $false) {
            ForEach ($Access in $Acl.Access) {
                $Propagation = Get-HumanReadablePropagation($Access.PropagationFlags, $Access.InheritanceFlags)
                [PSCustomObject]@{
                    'Share' = $Share.Name
                    'Folder Name' = $Folder.FullName
                    'Group/User' = $Access.IdentityReference;
                    'Permissions' = $Access.FileSystemRights
                    'Inherited' = $Access.IsInherited
                    'Propagation' = $Propagation
                }
            }
         }
    }   
}

#Output Phase

$Output | Group-Object "Share" | ForEach-Object {
    $ShareOutput = $_.Group
    $FilteredOutput = $ShareOutput | Where-Object { $_."Group/User" -notin $NameFilter } 
    $FormattedOutput = $FilteredOutput | Format-Table "Group/User", "Permissions", "Inherited", "Propagation" -GroupBy "Folder Name"
    $FormattedOutput | Out-File "$OutputPath\$OutputFileName-$($_.Name).txt" -Width 120
    Write-Host "================`n$($_.Name)`n================"
    $FormattedOutput
}


$FilteredOutput = $Output | Where-Object { $_."Group/User" -notin $NameFilter } 
$FilteredOutput | Export-Csv -Path "$OutputPath\$OutputFileName.csv"