Find Old Computers – Using PowerShell with LastLogonTimestamp

Posted on October 6, 2011 by Matt Vogt

[updated with optimization from comment from JR]

Cleaning up Active Directory is a necessary evil. You need to stay under your CAL count and it can be difficult to figure out which computers (or users) have not logged in to the domain recently.

Windows Server 2003 introduced the lastLogonTimestamp attribute which replicates between all DCs in the domain. Now, this isn’t real-time data. In fact it can be up to 14 days behind the current date, depending on your domain settings. If you want that, you’re going to have to get yourself a good syslog server, but for general cleanup and auditing purposes it works great. You can read more about this attribute on Microsoft’s TechNet Blog.

I’ve written a couple very simple PowerShell scripts that will 1) search the entire domain for all computers with a lastLogonTimestamp before a certain date 2) return a computer’s lastLogonTimestamp value in a human readable local format. It’s not so easy to just go out and get the time stamp, because the format that AD stores it UTC (GMT) format, so it needs some converting to human readable, which my scripts do.

get_lastLogonTimestamp_from_host.ps1


# Gets host and lastLogonTimestamp in UTC of specified host

# get Name
$hostname = Read-host "Enter a hostname"

# grab the lastLogonTimestamp attribute
Get-ADComputer $hostname -Properties lastlogontimestamp |

# output hostname and timestamp in human readable format
Select-Object Name,@{Name="Stamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}}

———————————————————–

get_stale_hosts_lastLogonTimestamp.ps1


# Gets time stamps for all computers in the domain that have NOT logged in since after specified date

$time = Read-host "Enter a date in format mm/dd/yyyy"
$time = get-date ($time)
$date = get-date ($time) -UFormat %d.%m.%y

# Get all AD computers with lastLogonTimestamp less than our time
Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -Properties LastLogonTimeStamp |

# Output hostname and lastLogonTimestamp into CSV
select-object Name,@{Name="Stamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}} | export-csv .all_old_computers_timestamps_older_than-$time.csv -notypeinformation

These are two scripts that I use pretty often when I’m trying to determine if I should disable/delete computer accounts in AD. Hope it helps someone else.

Dell Management Plug-in for VMware vCenter Update 1 Released

Posted on October 3, 2011 by Matt Vogt

Today, Dell released Update 1 to the 1.0.1 version of their Management Plug-in for VMware vCenter. The biggest highlight among the fixes and changes would be the added support of ESX5 (vCenter 5). If you’re currently running the 1.0.1 plugin under a vCenter 5 environment (which ‘works’, just not in a supported kind of way), you’ll need to unregister and re-register the Dell Management Plugin after upgrading (see the Release Notes for all issues/resolutions).

One of the major changes from the original 1.0 to the 1.0.1 plug-in was the promise that updates to the appliance/software would come as an RPM patch and not tied to re-deploying another OVF. I’m glad to report that this worked wonderfully. You can find full instructions in the Dell Management Plug-in for VMware vCenter User Guide (page 41), but here’s the quick and dirty:

Always backup your appliance. Always backup pre-upgrade. When? Always.
Open up and log into the web admin portal (https://myApplianceHostname/)
Click on ‘Appliance Management’ in the left menu
Click ‘Upgrade’
– This will boot you out of the portal, upgrade the software and reboot the VM (the User Guide makes no mention that it reboots the VM, so just know that it does).
– I recommend opening up a VM Console so you don’t have to just sit and refresh the page to see if it’s back up or not
Restart your vCenter Client (this might just be me because I was having some DNS issues at the time on my desktop)

The whole process took about 10 minutes for me. It took about 7 minutes before I saw the appliance reboot.

Happy upgrading.

Dell Management Plug-In for VMware vCenter Review

Posted on August 24, 2011 by Matt Vogt

Ok, I’ve had the plug-in running for a few weeks and have gone through some of the primary functions of it (firmware updates, inventory, monitoring, warranty retrieval, create hardware profile for deployment)

I’m not going to go through the initial setup, that’s been covered pretty well on DellTechCenter.com.

Here are the claimed major functionalities with my notes as far as day to day usage as well as some miscellaneous thoughts at the end.

Continue reading →

New Dell EqualLogic Arrays

Posted on August 22, 2011 by Matt Vogt

Dell unveiled an update to 2 of their EqualLogic PS series array platforms today along with their first sub-$10k array. The new PS6100 and PS4100 series arrays are a refresh of their PS6000 and PS4000 units. The new boxes are being touted as having up to a 67% improvement in I/O performance.

Here are the major new features for each:

PS41000

– shrinks down to 2U

– 24 x 2.5″ drives – up to 21.6TB

– 12 x 3.5″ drives – up to 32TB

– Now starting at under $10,000

PS6100

– 2U version with 24 x 2.5″ drives – up to 21.6TB

– New 4U design with 24 x 3.5″ drives – up to 72TB

– NEW Dedicated management port

Both arrays will ship with the latest 5.1 firmware and are certified for VMware’s vSphere 5.0 storage APIs (VASA, VAAI, etc.). The SSD options will go up to 400GB per drive, which I’m sure will be slightly over the $10,000 starting price in the PS4100.

This may sound lame, but the addition of the dedicated management port on the PS6100 is something that I’m very excited about. I never understood why there was one on the PS4000 but not the PS6000. It was maddening to lose 25% of my total network throughput on an array if I needed to attach it to a dedicated management network.

Being in the market for a Sumo (Dell’s EqualLogic Monster PS6500 series array), I was hoping that those would get the same refresh, and even though I knew it wasn’t going to be refreshed yet, I’m still a bit bummed that I may have to purchase it just before it gets its own upgrade.

How I Feel After Tech Field Day 7

Posted on August 14, 2011 by Matt Vogt

Full. From great conversations, vendor product information, BBQ and cakeballs. Tech Field Day 7 was quite the event. I was able to meet a few people whom I’ve either followed on twitter or read their blogs for a while who have been influential in my development as an infrastructure professional. I also met others I was not familiar with who have already informed my thinking, and I can only assume that they will continue to be a great resource of experience and knowledge.

Speaking of the delegates, I want to thank Stephen Fosket and Matt Simmons for gathering such a great and diverse group of infrastructure professionals. Also, as one of the younger delegates, both in terms of age and experience, I want to thank the delegates for listening and taking the time to explore topics that were new for me.

I’m fortunate to be able to head straight to vacation right after TFD. Rather than head back to the crazy of work, I’ll (hopefully) be able to better process what just happened in Austin. As I think back through the presentations and conversations, there’s a lot of processing to do.

New Role and Opportunity

Posted on August 9, 2011 by Matt Vogt

For the last 4 years I’ve operated as a Windows Systems Administrator, primarily focusing on (surprise!) Microsoft technologies – patching, security, Active Directory, Group Policy, etc. When I took this position, our virtualization environment was quite small, not very complex, not needing a lot of love or development, and not really my job. We had about 30 virtual machines, 4 hosts running ESX 2.5 all with internal or direct attached storage, 3 hosts running EXS 3.5 with still more internal storage and one single controller NetApp FAS270 with a whopping 1.25TB of iSCSI storage! These ESX 3.5 hosts were also running un-clustered.

With demands growing much faster than our budget (centralized backup, Antivirus, patching, deployment, file and print services, CMS, LMS, better-than-just-pop-email), it was obvious that we could no longer afford physical servers. We had neither the budget nor the physical space, power, cooling, etc and had to come up with a better plan. Virtualization was the answer, and somebody had to do it. I fell in love with the technology and jumped right in. As most of you have probably experienced, it soon became the majority of my daily functions.

We quickly added one more ESX 3.5 host, consolidated 2 of the ESX 2.5 hosts into the 3.5 hosts, added a second shelf to the NetApp (now all of 3.5TB) and added a Dell PowerVault MD1000 attached to a PowerEdge 1950 running Red Hat serving as an NSF store (3TB also).

Sounds great. We should be set, right? Boy was I wrong. I had no idea how fast we could chew through storage and host resources. With our NetApp nearing End of Life (not to mention being well out of warranty), it was time to consider new storage and another host or 2. While we loved the performance of our NetApp, we couldn’t afford a system with multiple controllers, couldn’t afford death by licensed features and found it difficult to administer. Through a process I won’t detail here, and with a price my Dell AE swore me me to protect, we decided to migrate to and standardize on EqualLogic. So we purchased a PS6000XV for primary storage (6.5TB usable) and a PS4000X for replication.??

We’re now sitting with a single ESXi 4.1 cluster with 5 hosts and 3 EqualLogic arrays in two groups. We’re still using the old NetApp iSCSI and MD1000 NFS SANs as tier 2 storage and now have a grand total of 26TB of storage (96TB more coming).

With the evolution of my workload and focus, as well as a new project building a remote data center in Houston as both a multi site cluster and DR site, I was offered the new position of Sr. Systems Administrator – Virtualization and Storage, which I gladly accepted. While this in part realigns my job title and description with what I actually do and where the Datacenter and IT services field is headed, it also adds more opportunities for growth. I will be taking on the role of Scrum Master (Srum is our internal project management framework), operate as lead/backup technician for the rest of the Sys Admin team and be responsible for server/service patch management oversight.

It’s big and a little bit scary, but if im?? not a little bit scared of what I’m doing, I get complacent and don’t learn nearly as much.

Here’s to being scared.

Contact Sharing at VMWorld

Posted on August 4, 2011 by Matt Vogt

Connecting with new people and exchanging contacts at VMWorld is a crucial component of the conference (or any other conference, for that matter). I’ve networked with many people over my admittedly short conference going history, and the value of being able to easily contact colleagues in the field post-conference is only outdone by their willingness to help out.

It can be a terrifying experience to go these conferences and try to ask questions of these experts because no one wants to show that they may not know exactly what they’re doing. Once you do that and have the experience of not being treated like an idiot or as a lesser admin, you’ll see that it doesn’t matter how much you know or don’t know. What matters is that we all are in this together, to help our respective constituents use technology to their greatest benefit. Someone will always have made a design decision that you never thought of. Some one will have tested and re-tested theories and made mistakes for you so that you don’t have to. This enables you try new designs, theories, technology based on other’s work and the field (and our knowledge) advances that much quicker. The more we all, as operators of these technologies. cooperate in community, the better we admins, consultants, integrators, vendors and the industry as a whole become. This includes everyone from the newbies to the seasoned vets.

That all being said, you want to make it as easy as possible for people to not only get your information, but to save it. 2 weeks before VMWorld last year, I lost all of my business cards in an office move. I didn’t have time to get any made up through my employer, but I needed something. What I came up with was a QR Code picture shortcut on my Droid. So when someone wanted my contact info and they, too, had a smart phone, they could just scan my QR code and my contact information would be automatically entered into their address book. It was a huge success!

This year, I’m going to have both a QR code and Microsoft Tag on the back of my business cards as well as shortcuts on my Droid. I’m adding the Tag because it can hold so much more information in the vcard than the QR code can. I would suggest you consider enhancing your contact info before your business card becomes a soggy wad in the bottom of the Bellagio fountain.

Tech Field Day 7 – Austin, TX

Posted on July 23, 2011 by Matt Vogt

Just got word Tuesday that I’ll have the honor to be a delegate for Gestalt IT’s Tech Field Day 7 focusing on Datacenter IT Infrastructure. The event seeks to bring together some of the industries great thinkers, authors, bloggers, influencers and vendors to engage each other. You can read more about the Tech Field Day at their site to get an idea of what these guys are about.

As excited as I am to get some pretty good face time with a few great vendors, I’m stoked about being able to meet some people in the IT community whom I’ve admired for quite a while. These are guys whose resources I’ve been reading for a while for a good deal of information as I’ve built up my knowledge and experience specifically in the virtualization and storage arenas. They are, in my mind, rock stars in the Datacenter IT world. I’m humbled to be brought in as a newer member of this event along side some veterans. The complete list of delegates is:

The event this time will be in Austin, Texas on August 11th and 12th. The sponsors are Dell (it’s Austin, after all), Veeam, SolarWinds and Symantec. All vendors that I either currently use or have used in the past. Looking forward to our discussions, hands on experience and feedback with them.

You can follow all the madness on Twitter with the #techfieldday hash tag, by following the delegates from the official Tech Field Day 7 List or keeping up with the TFD7 Links page.

Thank you to Stephen Fosket and Matt Simmons for organizing this and to the vendors for their sponsorship and belief that this type of interaction with the community is worthwhile.

LA VMUG – vCenter Operations

Posted on July 21, 2011 by Matt Vogt

The Los Angeles VMUG was held today at the DoubeTree Hotel at LAX and the primary topic was a product discussion and demo of vCenter Operations. Much of the time was dedicated to what needs and gaps it fills.

The dilemma now is that we have essentially 3 layers: Hardware, Hypervisor, OS/App. For each of those 3 layers there are a multitude of ways to monitor capacity, get health checks and gain deep visibility into performance metrics and bottlenecks. This is the goal of the vCenter Operations along with the promise of capacity planning, compliance checks and change management.

Continue reading →