テーマ： powershell
-
PowerShell error handling for admin scripts: terminating errors, $ErrorActionPreference and $LASTEXITCODE
PowerShell has two error classes that behave differently in a script: terminating errors that try/catch can stop, and non-terminating errors that only $ErrorActionPreference or -ErrorAction can turn into a stop. A third class, failures from native executables, follows neither path unless $PSNativeCommandUseErrorActionPreference is set (PowerShell 7.4+, experimental in 7.3).
-
Windows PowerShell 5.1 versus PowerShell 7 on servers: which one a script actually runs under
PowerShell 7 installs side by side with the built-in Windows PowerShell 5.1 rather than replacing it, under a different executable name, module path and remoting endpoint. An agent that runs 'powershell.exe' when it meant 'pwsh.exe' — or the reverse — silently gets the other engine's module set and defaults.
-
Preparing a new disk in Windows Server: Get-Disk through Format-Volume, and why it starts offline
The PowerShell Storage module sequence from Get-Disk to a mounted, formatted volume — Initialize-Disk -PartitionStyle GPT, New-Partition -UseMaximumSize, Format-Volume, and resizing later with Get-PartitionSupportedSize — plus the SAN policy that leaves some newly attached disks offline by default.
-
Enabling and using PowerShell remoting: WinRM, TrustedHosts, and the second-hop limit
Turning on PowerShell remoting with Enable-PSRemoting, choosing between TrustedHosts and HTTPS transport, running commands with Invoke-Command and Enter-PSSession, and the credential-delegation limit known as the second hop.
-
Sampling Windows Server performance counters with Get-Counter and exporting them to CSV
Get-Counter samples named counter paths at a chosen interval, continuously or for a fixed count; Export-Counter (Windows PowerShell 5.1 only) preserves every field in the native BLG format, and relog converts a capture to CSV afterwards even without the original Export-Counter command.
-
Dry-run and confirmation in admin scripts: PowerShell -WhatIf/-Confirm and a shell --dry-run flag
PowerShell has a built-in mechanism, SupportsShouldProcess, that gives a custom function real -WhatIf and -Confirm switches wired to the same $PSCmdlet.ShouldProcess() call the built-in cmdlets use. Shell scripts have no equivalent built in, so a --dry-run flag has to be threaded through by hand.
-
Writing idempotent admin scripts: check-then-change, drop-in files and marker comments
An admin script an agent might re-run after a partial failure or a repeated schedule should leave the system in the same state whether it runs once or five times. Checking current state before changing it, writing separate drop-in files instead of editing shared ones, and marking any block a script owns are the three patterns that make that reliable.
-
再起動待ちを積み重ねずにPowerShellからWindows Serverの役割と機能をインストールする
Get-WindowsFeatureとInstall-WindowsFeature -IncludeManagementToolsで検出とインストールを行い、ローカルのコンポーネントストアにファイルがない場合は-SourceでFeatures-on-Demandメディアを指定する。返されたオブジェクトにより、呼び出し側は再起動がまだ必要かを判断できる。
-
Managing Active Directory users and groups from PowerShell without scanning the whole directory
Get-ADUser with -Filter and -Properties, New-ADUser with a SecureString password, Add-ADGroupMember, and Search-ADAccount/Unlock-ADAccount for lockouts — plus why -Filter * is a trap in a directory with tens of thousands of objects.
-
Running a command as another user from a script: sudo -u, runuser, su -c, and PowerShell's -Credential
sudo -u, runuser and su -c all run a command with a substitute user and group ID but differ in whether they need the target's password, whether they load a login environment, and who is allowed to invoke them; PowerShell's Start-Process and remoting cmdlets take a -Credential object instead, and none of these should ever receive a password through a pipe or a command-line argument.
-
Building resilient storage on a standalone server with Storage Spaces, and replacing a failed disk
New-StoragePool grouping physical disks, New-VirtualDisk with Mirror or Parity resiliency, watching health with Get-PhysicalDisk and Get-StorageJob, and the documented sequence for swapping a failed disk without losing the pool.
-
Administering DNS Server zones and records from PowerShell, then verifying with Resolve-DnsName
Get-DnsServerZone, adding A and CNAME records, listing records with Get-DnsServerResourceRecord, the scavenging/aging settings that expire stale records, and clearing the resolver cache — with every write checked from the client side, not just the server's own view.
-
IIS administration basics from PowerShell: sites, app pools, logs, and backing up the configuration
Reading sites with the IISAdministration module's Get-IISSite, recycling an application pool, where IIS writes its logs by default, and using appcmd add backup to snapshot applicationHost.config before a configuration change.
-
Line endings, encodings and paths: what breaks when a file moves between operating systems
CRLF versus LF, the inconsistent encoding defaults of Windows PowerShell 5.1 versus BOM-less UTF-8 in PowerShell 7, EBCDIC on IBM mainframe-family systems, and filesystems that disagree about case sensitivity and maximum path length: a checklist of what to verify before assuming a text file or a path behaves the same way on a different OS.
-
Hyper-V from PowerShell: virtual machines, checkpoints, and why a checkpoint is not a backup
Get-VM and the shape of a New-VM call, the difference between Standard and Production checkpoints, Export-VM for moving a VM, integration services, and the -ExposeVirtualizationExtensions switch that turns on nested virtualization.
-
Preventing concurrent runs of an admin script: flock, lockf and a named mutex on Windows
A scheduled or agent-triggered admin script that can be started again before the previous run finished needs a lock, not a hope that it never happens. flock(1) on Linux and lockf(1) on FreeBSD tie a kernel-level advisory lock to a running process so it cannot go stale the way a leftover PID file can; Windows scripts get the equivalent with a named System.Threading.Mutex.
-
PowerShellでDHCP Serverロールを管理する：スコープ、予約、承認、バックアップ
Get-DhcpServerv4Scopeとリースの確認、Add-DhcpServerv4Reservationでのアドレス予約、Add-DhcpServerInDCによるADでのサーバー承認、フェールオーバーの概要、危険を伴う変更前のBackup-DhcpServerによる構成バックアップを扱います。
-
Privilege elevation compared: sudo, doas, UAC, runas and AIX RBAC — and how to detect it
sudo, doas, Windows UAC and macOS's admin group all answer the same question — is this session allowed to act as an administrator — with different mechanisms and different ways for a script to check the answer before attempting a privileged action.
-
Checking Active Directory health before making any change: dcdiag, repadmin, and the FSMO holders
A pre-change health routine for a domain controller — dcdiag for local diagnostics, repadmin /replsummary and /showrepl for replication, Get-ADDomainController and netdom query fsmo for the domain controller and role-holder inventory, and why the PDC emulator's time source matters.
-
ScheduledTasks モジュールによる定期タスクの構築：アクション、トリガー、実行主体、結果コード
New-ScheduledTaskAction、-Trigger、-Principal を組み合わせ、Register-ScheduledTask でタスクを登録します。NT AUTHORITY\SYSTEM での実行には保存したパスワードが不要で、Get-ScheduledTaskInfo と文書化されたタスクスケジューラの結果定数から、前回の実行が実際に成功したかを判断できます。
機械可読： JSON