We’re in the middle of WVD deployment at my MSP. This client is located all over the world and needed an easy way to manage virtual desktops over many regions. This deployment actually got me thinking about how monitoring the WVD environment should be done.

We found that the WVD agent on the VMs at times did not finish the upgrade correctly, or that session hosts became unavailable at inopportune times such as when there is a high logon load. Of course we could’ve setup some Azure Alerts for this but that would be forgoing our RMM system as the single source of alerts, so as always; in comes PowerShell.

As you can’t directly retrieve the information if a session host is available from the VMs themselves I’ve made a script that checks their status via the Azure management plane, it picks up if the updates have been installed correctly, heartbeats aren’t missed, and of course if the session host is actually available. As we’ve also had issues in the past with people forgetting to remove Drain Mode from a WVD pool I’ve also added this.

The Script

The script checks all tenants that are in Lighthouse, if you haven’t configured lighthouse yet, check out my manual here. You can change the alerts to whichever you’d like.

######### Secrets #########S
$ApplicationId = 'AppID'
$ApplicationSecret = 'ApplicationSecret' | ConvertTo-SecureString -Force -AsPlainText
$TenantID = 'YourTenantID'
$RefreshToken = 'yourrefreshtoken'
$UPN = "UPN-Used-To-Generate-Tokens"
######### Secrets #########
If (Get-Module -ListAvailable -Name Az.DesktopVirtualization) { 
    Import-module Az.DesktopVirtualization
}
Else { 
    Install-PackageProvider NuGet -Force
    Set-PSRepository PSGallery -InstallationPolicy Trusted
    Install-Module -Name Az.DesktopVirtualization -force
}
$credential = New-Object System.Management.Automation.PSCredential($ApplicationId, $ApplicationSecret)
$azureToken = New-PartnerAccessToken -ApplicationId $ApplicationID -Credential $credential -RefreshToken $refreshToken -Scopes 'https://management.azure.com/user_impersonation' -ServicePrincipal -Tenant $TenantId
$graphToken = New-PartnerAccessToken -ApplicationId $ApplicationID -Credential $credential -RefreshToken $refreshToken -Scopes 'https://graph.microsoft.com/.default' -ServicePrincipal -Tenant $TenantId
 
Connect-Azaccount -AccessToken $azureToken.AccessToken -GraphAccessToken $graphToken.AccessToken -AccountId $upn -TenantId $tenantID
$Subscriptions = Get-AzSubscription  | Where-Object { $_.State -eq 'Enabled' } | Sort-Object -Unique -Property Id
$SessionHostState = foreach ($Sub in $Subscriptions) {
    $null = $Sub | Set-AzContext

    $WVDHostPools = Get-AzResource -ResourceType 'Microsoft.DesktopVirtualization/hostpools'
    if (!$WVDHostpools) {
        write-host "No hostpool found for tenant $($Sub.name)"
        continue
    }
    write-host "Found hostpools. Checking current availibility status"
    foreach ($HostPool in $WVDHostPools) {
        $AllHPState = get-AzWvdsessionhost -hostpoolname $Hostpool.name -resourcegroupname $hostpool.resourcegroupname 
        Foreach ($State in $AllHPState) {
            [PSCustomObject]@{
                HostName         = $State.Name
                Available        = $State.Status
                Heartbeat        = $State.LastHeartBeat
                UpdateState      = $State.UpdateState
                LastUpdate       = $State.LastUpdateTime
                AllowNewSessions = $State.AllowNewSession
                Subscription     = $Sub.Name
            
            }
        }
    }

}

#Check for WVD Session hosts that have issues updating the agent:

if (($SessionHostState | Where-Object { $_.UpdateState -ne 'Succeeded' })) {
    write-host "Unhealthy - Some session hosts have not updated the Agent correctly."
    $SessionHostState | Where-Object { $_.UpdateState -ne 'Succeeded' }
}
else {
    write-host "Healthy - Session hosts all updated."   
}


#Check for unavailable hosts
if (($SessionHostState | Where-Object { $_.Available -ne 'Available' })) {
    write-host "Unhealthy - Some session hosts are unavailable."
    $SessionHostState | Where-Object { $_.Available -ne 'Available' }
}
else {
    write-host "Healthy - Session hosts all updated."   
}

#Check for hosts in drain mode
if (($SessionHostState | Where-Object { $_.AllowNewSessions -eq $false })) {
    write-host "Unhealthy - Some session hosts are in drain mode"
    $SessionHostState | Where-Object { $_.AllowNewSessions -eq $false }
}
else {
    write-host "Healthy - No sessionhosts in drain mode."   
}

And that’s it. As always, Happy PowerShelling!

So Microsoft offers a lot of cool tools for Microsoft 365 users, even if you aren’t using the complete suite. One of these is potential phishing detection, by default Microsoft does an analysis of each received e-mail to check if they are potential phishing attempts. You can check these via the interface by going to protection.office.com, Threat Management and clicking on the dashboard.

Of course that’s nice to do a one-off check, but we like getting alerted whenever we see these phishing attempts get above a specific number. For this, we can of course use PowerShell.

By using the PowerShell cmdlet ‘Get-ATPTotalTrafficReport’ (Don’t worry, you don’t need ATP.) we can get the reports from the interface in text format. This allows us to alert whenever a phishing campaign is started and exceeds a threshold we set.

For these scripts you’ll need the Secure Application Model first, to be able to login securely and according to Microsoft’s partner standards. There’s two different versions of the script; one for a single tenant, and another for all tenants under your administration.

Single tenant version

All you have to do for the single tenant version is to enter your credentials, and set what you believe is the maximum phishing attempts for 2 weeks.

######### Secrets #########
$ApplicationId = 'YourAPPID'
$ApplicationSecret = 'Applicationsecret' | ConvertTo-SecureString -AsPlainText -Force
$TenantID = 'YourTenantID'
$RefreshToken = 'RefreshToken'
$ExchangeRefreshToken = 'ExchangeRefreshToken'
$UPN = "UPN-Used-To-Generate-Tokens"
$TenantToCheck = 'testtenant.onmicrosoft.com'
$MaximumPhishingAttempts = 100
######### Secrets #########

$credential = New-Object System.Management.Automation.PSCredential($ApplicationId, $ApplicationSecret)

$aadGraphToken = New-PartnerAccessToken -ApplicationId $ApplicationId -Credential $credential -RefreshToken $refreshToken -Scopes 'https://graph.windows.net/.default' -ServicePrincipal -Tenant $tenantID 
$graphToken = New-PartnerAccessToken -ApplicationId $ApplicationId -Credential $credential -RefreshToken $refreshToken -Scopes 'https://graph.microsoft.com/.default' -ServicePrincipal -Tenant $tenantID 
$token = New-PartnerAccessToken -ApplicationId 'a0c73c16-a7e3-4564-9a95-2bdf47383716'-RefreshToken $ExchangeRefreshToken -Scopes 'https://outlook.office365.com/.default' -Tenant $TenantToCheck -erroraction SilentlyContinue

$tokenValue = ConvertTo-SecureString "Bearer $($token.AccessToken)" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($upn, $tokenValue)
write-host "Proccessing $TenantToCheck"
$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://ps.outlook.com/powershell-liveid?DelegatedOrg=$($TenantToCheck)&BasicAuthToOAuthConversion=true" -Credential $credential -Authentication Basic -AllowRedirection -ErrorAction SilentlyContinue
$null = Import-PSSession $session -AllowClobber -CommandName 'Get-ATPTotalTrafficReport' -ErrorAction SilentlyContinue
$Reports = Get-ATPTotalTrafficReport -ErrorAction SilentlyContinue
$TenantReports = [PSCustomObject]@{
    TenantDomain       = $TenantToCheck
    TotalSafeLinkCount = ($Reports | where-object { $_.EventType -eq 'TotalSafeLinkCount' }).Messagecount
    TotalSpamCount     = ($Reports | where-object { $_.EventType -eq 'TotalSpamCount' }).Messagecount
    TotalBulkCount     = ($Reports | where-object { $_.EventType -eq 'TotalBulkCount' }).Messagecount
    TotalPhishCount    = ($Reports | where-object { $_.EventType -eq 'TotalPhishCount' }).Messagecount
    TotalMalwareCount  = ($Reports | where-object { $_.EventType -eq 'TotalMalwareCount' }).Messagecount
    DateOfReports      = "$($Reports.StartDate | Select-Object -Last 1) - $($Reports.EndDate | Select-Object -Last 1)"
}
#end of commands
Remove-PSSession $session -ErrorAction SilentlyContinue

$TenantReports | Where-Object {$_.TotalPhishCount -gt $MaximumPhishingAttempts}

Multiple tenant version

This version does the same as above, but then for all tenants under your administration as Microsoft Partner.

######### Secrets #########
$ApplicationId = 'YourAPPID'
$ApplicationSecret = 'Applicationsecret' | ConvertTo-SecureString -AsPlainText -Force
$TenantID = 'YourTenantID'
$RefreshToken = 'RefreshToken'
$ExchangeRefreshToken = 'ExchangeRefreshToken'
$UPN = "UPN-Used-To-Generate-Tokens"
$MaximumPhishingAttempts = 100
######### Secrets #########


$credential = New-Object System.Management.Automation.PSCredential($ApplicationId, $ApplicationSecret)
$aadGraphToken = New-PartnerAccessToken -ApplicationId $ApplicationId -Credential $credential -RefreshToken $refreshToken -Scopes 'https://graph.windows.net/.default' -ServicePrincipal -Tenant $tenantID 
$graphToken = New-PartnerAccessToken -ApplicationId $ApplicationId -Credential $credential -RefreshToken $refreshToken -Scopes 'https://graph.microsoft.com/.default' -ServicePrincipal -Tenant $tenantID 

Connect-MsolService -AdGraphAccessToken $aadGraphToken.AccessToken -MsGraphAccessToken $graphToken.AccessToken
$customers = Get-MsolPartnerContract -All
$TenantReports = foreach ($customer in $customers) {
    $token = New-PartnerAccessToken -ApplicationId 'a0c73c16-a7e3-4564-9a95-2bdf47383716'-RefreshToken $ExchangeRefreshToken -Scopes 'https://outlook.office365.com/.default' -Tenant $customer.TenantId -erroraction SilentlyContinue
    $tokenValue = ConvertTo-SecureString "Bearer $($token.AccessToken)" -AsPlainText -Force
    $credential = New-Object System.Management.Automation.PSCredential($upn, $tokenValue)
    $customerId = $customer.DefaultDomainName
    write-host "Proccessing $customerid"
    $session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://ps.outlook.com/powershell-liveid?DelegatedOrg=$($customerId)&BasicAuthToOAuthConversion=true" -Credential $credential -Authentication Basic -AllowRedirection -ErrorAction SilentlyContinue
    $null = Import-PSSession $session -AllowClobber -CommandName 'Get-ATPTotalTrafficReport' -ErrorAction SilentlyContinue
    #From here you can enter your own commands
    $Reports = Get-ATPTotalTrafficReport -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        TenantID           = $customer.TenantId
        TenantName         = $customer.name
        TenantDomain       = $customer.DefaultDomainName
        TotalSafeLinkCount = ($Reports | where-object { $_.EventType -eq 'TotalSafeLinkCount' }).Messagecount
        TotalSpamCount     = ($Reports | where-object { $_.EventType -eq 'TotalSpamCount' }).Messagecount
        TotalBulkCount     = ($Reports | where-object { $_.EventType -eq 'TotalBulkCount' }).Messagecount
        TotalPhishCount    = ($Reports | where-object { $_.EventType -eq 'TotalPhishCount' }).Messagecount
        TotalMalwareCount  = ($Reports | where-object { $_.EventType -eq 'TotalMalwareCount' }).Messagecount
        DateOfReports      = "$($Reports.StartDate | Select-Object -Last 1) - $($Reports.EndDate | Select-Object -Last 1)"
    }
    #end of commands
    Remove-PSSession $session -ErrorAction SilentlyContinue
}

$TenantReports | Where-Object {$_.TotalPhishCount -gt $MaximumPhishingAttempts}

And that’s it! as always, Happy PowerShelling.

So let’s talk about Storage Sense. Storage Sense is a new-ish feature in Windows 10 which should replace the standard disk cleanup utilities. It has a lot more power than just disk cleanup as it can detect how long files have been in use and react based on age.

Storage Sense is pretty easy to use and can save a lot of disk space for modern clients, especially when they use OneDrive too. Storage Sense has support for OneDrive files on demand. By default it does not clear anything, but it could be setup to clear the local cache if files have not been in use for days, weeks, or even months. This helps with those pesky OneDrive database size limits.

So the first blog about Storage Senses will be monitoring its optimal settings. We’re using the RunAsUser Module for this, because the registry keys will be located in the HKEY_Current_User hive.

Monitoring script

#Settings
$PrefSched = 'Low Diskspace'
$ClearTemporaryFiles = $true
$ClearRecycler = $true
$ClearRecyclerDays = '60'
$ClearDownloads = $true
$ClearDownloadsDays = '60'
$AllowClearOneDriveCache = $true
#

If (Get-Module -ListAvailable -Name "RunAsUser") { 
    Import-module RunAsUser
}
Else { 
    Install-PackageProvider NuGet -Force
    Set-PSRepository PSGallery -InstallationPolicy Trusted
    Install-Module RunAsUser -force -Repository PSGallery
}


$ExpectedSettings = [PSCustomObject]@{
    'Storage Sense Enabled'         = $true
    'Clear Temporary Files'         = $ClearTemporaryFiles
    'Clear Recycler'                = $ClearRecycler
    'Clear Downloads'               = $ClearDownloads
    'Allow Clearing Onedrive Cache' = $AllowClearOneDriveCache
    'Storage Sense schedule'        = $PrefSched
    'Clear Downloads age (Days)'    = $ClearDownloadsDays
    'Clear Recycler age (Days)'     = $ClearRecyclerDays
} 

$ScriptBlock = {
    $StorageSenseKeys = Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\StoragePolicy\'

    $StorageSenseSched = switch ($StorageSenseKeys.'2048') {
        1 { 'Weekly' }
        7 { 'Every week' }
        30 { 'Every Month' }
        0 { 'Low Diskspace' }
        Default { 'Unknown - Could not retrieve.' }
    }

    [PSCustomObject]@{
        'Storage Sense Enabled'         = [boolean]$StorageSenseKeys.'01'
        'Clear Temporary Files'         = [boolean]$StorageSenseKeys.'04'
        'Clear Recycler'                = [boolean]$StorageSenseKeys.'08'
        'Clear Downloads'               = [boolean]$StorageSenseKeys.'32'
        'Allow Clearing Onedrive Cache' = [boolean]$StorageSenseKeys.CloudfilePolicyConsent
        'Storage Sense schedule'        = $StorageSenseSched
        'Clear Downloads age (Days)'    = $StorageSenseKeys.'512'
        'Clear Recycler age (Days)'     = $StorageSenseKeys.'256'
    } | ConvertTo-Json | Out-File "C:\windows\Temp\CurrentStorageSenseSettings.txt" -Force

 
}

$null = Invoke-AsCurrentUser -ScriptBlock $ScriptBlock -UseWindowsPowerShell -NonElevatedSession
$CurrentSettings = Get-Content  "C:\windows\Temp\CurrentStorageSenseSettings.txt" | ConvertFrom-Json

$ComparedObjects = Compare-Object $CurrentSettings $ExpectedSettings -Property $CurrentSettings.PsObject.Properties.name

if ($ComparedObjects) {
    Write-Host "Unhealthy - The Storage Sense settings are not the same as the expected settings."
}
else {
    write-host "Healthy - Storage Sense Settings are set correctly."
}

And that’s it. Next week I’ll be demonstrating how to setup Storage Sense automatically, including adding OneDrive sites. As always, Happy PowerShelling!

One of my team members was following Blackhat today and showed me a pretty cool tool they demonstrated during the conference. The presenters showed a method of checking if your O365 domain was being Typosquated. The tool can be found here. The presenters made a Python tool, and I figured to create an alternative in PowerShell.

I’ve checked their method and found they use two different typosquating detection techniques; they’ve applied homoglyphs and BitSquating. These two techniques are most common in Typosquats, its either replacing characters with similar looking ones, or minor typos in the URL.

In my version, I’ve also introduced pluralization and omission, just to get a bit more domain names, I’m not saying this is a 100% extensive list. If you have any suggested changes feel free to make a GitHub PR here.

The script

To run the script, simply change the domain name at the end of the script and execute it. The script contains two functions; New-TypoSquatDomain which generate a list of typosquated domains and Get-O365TypoSquats which checks if the .onmicrosoft.com, .sharepoint.com and the domain itself are available.

So what can you do with this information? if the .onmicrosoft.com version exists, you can add this to your spamfilter to prevent spam, If the .sharepoint.com version exist people might be phishing you using SharePoint online URLS, and if the domain exists you could add it to the spamfilter or check what’s running there and notify your users.

function New-TypoSquatDomain {
    param (
        $DomainName
    )
    $ReplacementGylph = [pscustomobject]@{
        0  = 'b', 'd' 
        1  = 'b', 'lb' 
        2  = 'c', 'e'
        3  = 'd', 'b'
        4  = 'd', 'cl'
        5  = 'd', 'dl' 
        6  = 'e', 'c' 
        7  = 'g', 'q' 
        8  = 'h', 'lh' 
        9  = 'i', '1'
        10 = 'i', 'l' 
        11 = 'k', 'lk'
        12 = 'k', 'ik'
        13 = 'k', 'lc' 
        14 = 'l', '1'
        15 = 'l', 'i' 
        16 = 'm', 'n'
        17 = 'm', 'nn'
        18 = 'm', 'rn'
        19 = 'm', 'rr' 
        20 = 'n', 'r'
        21 = 'n', 'm'
        22 = 'o', '0'
        23 = 'o', 'q'
        24 = 'q', 'g' 
        25 = 'u', 'v' 
        26 = 'v', 'u'
        27 = 'w', 'vv'
        28 = 'w', 'uu' 
        29 = 'z', 's' 
        30 = 'n', 'r' 
        31 = 'r', 'n'
    }
    $i = 0

    $TLD = $DomainName -split '\.' | Select-Object -last 1
    $DomainName = $DomainName -split '\.' | Select-Object -First 1
    $HomoGlyph = do {
        $NewDomain = $DomainName -replace $ReplacementGylph.$i
        $NewDomain
        $NewDomain + 's'
        $NewDomain + 'a'
        $NewDomain + 't'
        $NewDomain + 'en'
        $i++
    } while ($i -lt 29)

    $i = 0
    $BitSquatAndOmission = do {
        $($DomainName[0..($i)] -join '') + $($DomainName[($i + 2)..$DomainName.Length] -join '')
        $($DomainName[0..$i] -join '') + $DomainName[$i + 2] + $DomainName[$i + 1] + $($DomainName[($i + 3)..$DomainName.Length] -join '')
        $i++
    } while ($i -lt $DomainName.Length)
    $Plurals = $DomainName + 's'; $DomainName + 'a'; $domainname + 'en' ;  ; $DomainName + 't'

    $CombinedDomains = $HomoGlyph + $BitSquatAndOmission + $Plurals | ForEach-Object { "$($_).$($TLD)" }
    return ( $CombinedDomains | Sort-Object -Unique | Where-Object { $_ -ne $DomainName })
}

function Get-O365TypoSquats {
    param (
        $TypoSquatedDomain
    )
    $DomainWithoutTLD = $TypoSquatedDomain -split '.' | Select-Object -First 1
    $DomainTest = Resolve-DnsName -Type A "$($TypoSquatedDomain)" -ErrorAction SilentlyContinue
    $Onmicrosoft = Resolve-DnsName -Type A "$($DomainWithoutTLD).onmicrosoft.com" -ErrorAction SilentlyContinue
    $Sharepoint = Resolve-DnsName -Type A "$($DomainWithoutTLD).sharepoint.com" -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        'Onmicrosoft test' = [boolean]$Onmicrosoft
        'Sharepoint test'  = [boolean]$Sharepoint
        'Domain test'      = [boolean]$DomainTest
        Domain             = $TypoSquatedDomain
    }
}

New-TypoSquatDomain -DomainName 'Google.com' | ForEach-Object { Get-O365TypoSquats -TypoSquatedDomain $_ }

You can load this script into your RMM system and alert whenever results are found.

And that’s it! as always, Happy PowerShelling!

This was actually requested a couple of times but I’ve always seem to hold off on it, mostly because we don’t use that many NAS devices anymore. I did decide to make it a bit more universal than just NAS devices really – It’s about monitoring any device that has SSH access and of which you know the commands that you need. I’ve just used NAS’s as an example in this case.

We’re using SSH because most NAS devices support it – e.g. QNAP/Synology/etc. I like this method more than SNMP monitoring because I strongly believe more in agent based monitoring than SNMP probing.

So lets get started.

The Script

The script itself is very straight-forward; we download the SSH-Posh module by Carlos Perez and then connect to the NAS using SSH, we execute our command defined in $Command. In the case of most NAS devices you can use the command “cat /proc/mdstat”. After executing this command we compare if it contains any words we don’t like, such as fail, rebuild, recovery, etc. 🙂

$Command = 'cat /proc/mdstat'
$NotHealthyStates = "*recovery*", "*failed*", "*failure*", "*offline*", "*rebuilding*"
$DeviceIP = 'YOURRDEVICEIP OR HOSTNAME'
$Creds = Get-Credential #Replace this with your RMMs method to handle credentials.

If (Get-Module -ListAvailable -Name "Posh-SSH") { Import-module "Posh-SSH" } Else { install-module "Posh-SSH" -Force; import-module "Posh-SSH" }

try {
    $null = New-SSHSession -ComputerName $DeviceIP -Credential $Creds -AcceptKey -force
    $SSHOutput = (Invoke-SSHCommand -Index 0 -Command $command).output
    $null = Get-SSHSession | Remove-SSHSession
}
catch {
    write-host "Unhealthy - Could not connect to SSH."
    break
}
if (!$SSHOutput) { write-host "Unhealthy - No SSH output found" ; break }

$HealthState = foreach ($State in $NotHealthyStates) {
    if ($SSHOutput -like $State) {
        "Unhealthy - $State found."
    }
}

if (!$HealthState) { write-host "Healthy - No issues found." } else { write-host $HealthState }

And that’s it! as always, Happy PowerShelling. 🙂

So this one is related to my recent blog about documenting printers; right after the blog I got some comments that I never focused on printer monitoring. I think that’s because printers have a mental block in my mind as I see them as pure evil. 🙂

But without jokes; of course we can monitor printers and print queues. We have some clients that printing is a key part of business so I’ve created the monitoring component below. This monitors both the printer status(e.g. offline/error/no toner, etc) and the Job status. Sometimes jobs get stuck in the queue blocking all others so it’s a good one to cover.

The Script

$Printers = get-printer

$PrintStatus = foreach ($Printer in $Printers) {
    $PrintJobs = get-PrintJob -PrinterObject $printer
    $JobStatus = foreach ($job in $PrintJobs) {
        if ($Job.JobStatus -ne "normal") { "Not Healthy - $($Job)" }
    }
    [PSCustomObject]@{
        PrinterName   = $printer.Name
        PrinterStatus = $Printer.PrinterStatus
        PrinterType   = $Printer.Type
        JobStatus     = $JobStatus
    }
}

$PrintersNotNormal = $PrinterStatus.PrinterStatus | Where-Object { $_.PrinterStatus -ne "normal" }
if (!$PrintersNotNormal) {
    write-host "Healthy - No Printer Errors found" 
}
else {
    Write-Host "Unhealthy - Printers with errors found."
    $PrintersNotNormal
}
$JobsNotNormal = $PrinterStatus.PrinterStatus | Where-Object { $_.JobStatus -ne "normal" -and $_.JobStatus -ne $null }
if (!$JobsNotNormal) {
    write-host "Healthy - No Job Errors found" 
}
else {
    Write-Host "Unhealthy - JJobs with errors found."
    $JobsNotNormal
}

And that’s it! a simple but short one. I’ll be posting some more information about my bigger project AzPam somewhere in December. For next week I have some Azure Function stuff planned – One of them being a method to join a Microsoft Teams meeting, using a code instead of a super long URL. 🙂

As always, Happy PowerShelling!

I was talking to a friend the other day and he was using my user experience script in his RMM system for a while. He told me that he loved having the ability to measure the users experience but he had some clients with in-house applications that would write errors to the system log constantly, or he had other clients with crashing services that could not be prevented.

This caused him to disable the User Experience Monitoring script for those clients, which is a shame because it’s what we should be focusing on as MSPs these days. I figured I’d make a lighter version that does not rely on the Windows Reliability Index instead. That way we could avoid some of the crashing services or other issues. So lets get to the script!

The Script

Instead of grabbing the Reliability index – We’re collecting all logs for the last 15 minutes and counting how many AppHangs have been experienced. An AppHang is when the application gives the famous “Not responding” pop-up. We also grab hard application crashes, but filter our those that we don’t want to see such as the LOB application spoken about above.

$IDs = "1002", "1000"
$ExcludedApplications = "*Slack*"
$MaxCount = '1'

$LogFilter = @{
    LogName = 'Application'
    ID      = $IDs
    StartTime = (get-date).AddMinutes(-15)
} 

$Last15Minutes = Get-WinEvent -FilterHashTable $LogFilter -ErrorAction SilentlyContinue | where-object { $_.message -notlike $ExcludedApplications }


if ($Last15Minutes.count -ge $MaxCount) {
    write-host "Unhealthy - The maximum application crash logs are higher than $MaxCount"
}

if (!$Last15Minutes) {
    write-host "Healthy - No app crash logs found"
}

Now this is just an example on how you can achieve this really – If anything I’d suggest to expand on this and get some information to compile your own reliability score. I also don’t specifically love getting Windows Events instead of directly monitoring yourself, but Apphangs aren’t really documented elsewhere.

And that’s it! as always, Happy PowerShelling 🙂