I am new to PS. Having trouble to understand scriptblock with the invoke-command. Hope someone can help me debug this. Thanks. I am trying to do the following.
So, it’s tough to diagnose because you didn’t format your code here, but when you run this for real do you have the carriage returns before the opening brace? It needs to be
... -Scriptblock {
With no carriage returns. Additionally, your $servers variable has no meaning in the remote machine. That variable only exists locally. I suspect you meant to use the -computername parameter of Invoke-Command, but you’re using it on Get-WmiObject instead.
In this context you don’t actually need Invoke-Command. Just use Get-Wmiobject exactly as you’ve typed it. Add the -AsJob parameter. Good to go
Thanks for helping, Don, Appreciate. All I wanted was to have PS read the serverlist I keep locally, then remote each server in the serverlist in groups of like 5-10 in parallell and ask them to report back in parallel their cpu usage, hence I have to use invoke-command parallel with Get-Wmiobject and throttle to 5. But it seems that it cannot work due to my poor scripting in the scriptblock. I am not sure how to add -AsJob. Thanks.
So, Invoke-Command when used without -ComputerName isn’t really useful, because it’s just running the command on your local machine. But if your goal is to parallelize, jobs are one technique:
Get-WmiObject doesn’t support any kind of throttle, so you’d get the system default of 32. Alternately, if Remoting is enabled on all the remote machines, you could use Invoke-Command.
invoke-command -computername $Servers –throttlelimit 3 -Scriptblock { Get-Wmiobject win32processor } | Measure-Object – property LoadPercentage – Average | Select Average
Notice that in both examples I’ve given, what you’re going to get is a SINGLE AVERAGE FOR ALL COMPUTERS QUERIED. You’re not getting a per-computer average. I’m not sure what the goal was. Compare that to this:
invoke-command -computername $Servers –throttlelimit 3 -Scriptblock { Get-Wmiobject win32processor | Measure-Object – property LoadPercentage – Average | Select Average }
What’s different is that the Measure-Object is being run on the remote computers, so each computer is measuring its own average, and it’s that per-computer average coming back to your machine. PowerShell will add a PSComputerName property to the output, so you can tell which computer’s output is which. But in both of my Invoke-Command examples, notice where -computername is put. It’s my local computer that processes Invoke-Command, sending the -ScriptBlock off to the machines specified in -ComputerName.
Happy to answer questions - I want to make sure you understand the differences and what’s happening where.
Yes, I ran PS as Admin. But computer that I am using is on VPN connection to the network. The computer that I used to run PS is on a domain and the servers which I tried to list usage are just on Workgroup (not in my office domain). How do I make invoke-command works and how do I get remote access to WMI on a non-domain server? Sorry it sounds complicated. Is this related to second hop issue? Is there a possible workaround?
PS C:\Windows\system32> invoke-command -computername Server1 -Scriptblock { Get-Wmiobject win32processor | Measure-Object – property LoadPercentage – Average | Select Average }
[Server1] Connecting to remote server Server1 failed with the following error message
: WinRM cannot process the request. The following error occurred while using Kerberos authentication: Cannot find the computer Server1. Verify that the computer exists on the network and that the name provided is spelled correctly. For more information, see the about_Remote_Troubleshooting Help topic.
PS C:\Windows\system32> invoke-command -computername 123.12.1.2 -Scriptblock { Get-Wmiobject win32processor | Measure-Object – property LoadPercentage – Average | Select Average }
[123.12.1.2] Connecting to remote server 123.12.1.2 failed with the following error message : The WinRM client cannot process the request. Default authentication may be used with an IP address under the following conditions: the transport is HTTPS or the destination is in the TrustedHosts list, and explicit credentials are provided. Use
winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.
“Don, how do I put the ps command line into the box like what you did here earlier? Would be great to learn that to be neat.”
See the bullet point immediately above the posting text box for instructions - enclose code blocks in PRE tags.
Regarding your error, you should really read “Secrets of PowerShell Remoting,” which is free here on the “Resources / eBooks” menu item. Your problem is that, by default, only Kerberos is enabled for authentication in Remoting. Kerberos requires you to connect to a computer’s canonical name from Active Directory - not a nickname, and not an IP address. If you want to use an IP address, you need to (a) enable another authentication mechanism, probably Basic, and (b) either add the computer to a Trusted Hosts list on the initiating side or install an SSL certificate. Using Basic has security concerns as it passes credentials in clear text. But rather than just re-type all of that here, I’d really prefer you read the ebook where it’s all already typed out ;).
You can also, and should, read the help topics referenced in the error messages. This isn’t just a case of “push this button to make it work” - you have decisions to make, and those decisions impact security and functionality. It’s more important you know WHY you are making those decisions than to have someone like me just tell you what will make the error go away.
Don, thanks a lot for your help so far. I have actually enable PSRemoting but it still does not work due to Kerberos thing. I browse through “Secrets of PowerShell Remoting” but nothing on Kerberos stuff. Where can I find this stuff to read and fix my problem? When you say Kerberos requires me to connect to a computer’s canonical name from Active Directory, what do you exactly mean? Does it mean I need to connect my PC to its LAN and connect/login to its office domain? Which means I can’t remote desktop and run Powershell then invoke-command? Sorry, but I don’t get what you actually mean. This remote computer is a blade on a rack and there is no VDU, keyboard etc and my only access is through RDP. Also, there are hundreds of these blades that I need to monitor cpu usage and that’s why parallel invoke-command would help. But, this time, it seems that it cannot work because of kerberos bummer