I use this script :
I modify the scriptblock because my goal is to connect to more 30,000 remote machines via WMI and create a process on them also via WMI.
I can do in a different way, and i do in a different way with a professionnal tool. But i want to explore the way with powershell and WMI.
Before, i must describe the contexte : 30,000 computers in workgroup, not domain, with different “admin” accounts and different “user” “pwd”.
A file gives : "IP,“user”, “pwd”
The computer “sender” : W2K8R2SP1 with PS V3, 4 Go Ram
And i test on a few computers (1000) .
So, in the scriptblock, for each computer, i do :
- connectserveur via WMI with credentials
- create contexte (command, arg, current directory…) for the “createprocess” wmi request
- call the remote “createprocess” wmi request
note : the remote process for my test is “powershell” and the script lauched is present on all remote machine ( write the date/time in a log file )
If necessary I can put my scriptblock code tomorrow because i don’t have it at this time.
My poor investigation :
All things is good if $throttleLimit in egal to 20 ( less than 25 in fact ) for 1,000 remote computers ( but too many hours! ).
Powershell “Sender” hangs along 1 or 2 minutes if $throttleLimit is greater than or egal 30. With WireShark, i see the all connectserver but not one createprocess in the network trames when it fail.
I modify the scriptblock and replace wmi requests connectserver and createprocess with simple commands “net use IP USER PWD and a copy from sender to remote via SMB and copy-item \ip…”.
All things is good is $throttleLimit if egal to 200 !
My questions :
Do you know a limite in “fan out” WMI ? or in Powershell V3 ?
Someone can do or want to do the test?
How can i investigate ? i try to trace WMI with activated ETW-debug but it seem to me that the “sender” don’t log the “out” activity.
Please, help me !
Ps : i’m a poor french guy and i don’t write/read not very well english.