|
| 1 | +# Evaluate specific Policies against a Server List |
| 2 | +# Uses the Invoke-PolicyEvaluation Cmdlet |
| 3 | + |
| 4 | +#SAMPLE: #.\EPM_EnterpriseEvaluation_5.ps1 -ConfigurationGroup "DEV" -PolicyCategoryFilter "Name Pattern" –EvalMode “Check” |
| 5 | + |
| 6 | +<# |
| 7 | +Run Powershell ISE as Admin |
| 8 | +
|
| 9 | +https://docs.microsoft.com/en-us/sql/ssms/download-sql-server-ps-module |
| 10 | +
|
| 11 | +#https://www.powershellgallery.com/packages/PowerShellGet/ |
| 12 | +Install-Module -Name PowerShellGet -Force |
| 13 | +
|
| 14 | +#https://www.powershellgallery.com/packages/SqlServer/ |
| 15 | +Install-Module -Name SqlServer -Force -AllowClobber |
| 16 | +
|
| 17 | +#> |
| 18 | + |
| 19 | +param([string]$ConfigurationGroup=$(Throw ` |
| 20 | +"Parameter missing: -ConfigurationGroup ConfigGroup"),` |
| 21 | +[string]$PolicyCategoryFilter=$(Throw "Parameter missing: ` |
| 22 | +-PolicyCategoryFilter Category"), ` |
| 23 | +[string]$EvalMode=$(Throw "Parameter missing: -EvalMode EvalMode")) |
| 24 | + |
| 25 | +Remove-Module SQLPS -Force -ErrorAction SilentlyContinue |
| 26 | +Import-Module SqlServer -DisableNameChecking -MinimumVersion "21.0.171.78" |
| 27 | + |
| 28 | +# Parameter -ConfigurationGroup specifies the |
| 29 | +# Central Management Server group to evaluate |
| 30 | +# Parameter -PolicyCategoryFilter specifies the |
| 31 | +# category of policies to evaluate |
| 32 | +# Parameter -EvalMode accepts "Check" to report policy |
| 33 | +# results, "Configure" to reconfigure any violations |
| 34 | + |
| 35 | +# Declare variables to define the central warehouse |
| 36 | +# in which to write the output, store the policies |
| 37 | +$CentralManagementServer = "Win2012" |
| 38 | +$HistoryDatabase = "MDW" |
| 39 | +# Define the location to write the results of the policy evaluation |
| 40 | +$ResultDir = "E:\Results\" |
| 41 | +# End of variables |
| 42 | + |
| 43 | +#Function to insert policy evaluation results into SQL Server - table policy.PolicyHistory |
| 44 | +function PolicyHistoryInsert($sqlServerVariable, $sqlDatabaseVariable, $EvaluatedServer, $EvaluatedPolicy, $EvaluationResults) |
| 45 | +{ |
| 46 | + &{ |
| 47 | + $sqlQueryText = "INSERT INTO policy.PolicyHistory (EvaluatedServer, EvaluatedPolicy, EvaluationResults) VALUES(N'$EvaluatedServer', N'$EvaluatedPolicy', N'$EvaluationResults')" |
| 48 | + Invoke-Sqlcmd -ServerInstance $sqlServerVariable -Database $sqlDatabaseVariable -Query $sqlQueryText -ErrorAction Stop |
| 49 | + } |
| 50 | + trap |
| 51 | + { |
| 52 | + $ExceptionText = $_.Exception.Message -replace "'", "" |
| 53 | + } |
| 54 | +} |
| 55 | + |
| 56 | +#Function to insert policy evaluation errors into SQL Server - table policy.EvaluationErrorHistory |
| 57 | +function PolicyErrorInsert($sqlServerVariable, $sqlDatabaseVariable, $EvaluatedServer, $EvaluatedPolicy, $EvaluationResultsEscape) |
| 58 | +{ |
| 59 | + &{ |
| 60 | + $sqlQueryText = "INSERT INTO policy.EvaluationErrorHistory (EvaluatedServer, EvaluatedPolicy, EvaluationResults) VALUES(N'$EvaluatedServer', N'$EvaluatedPolicy', N'$EvaluationResultsEscape')" |
| 61 | + Invoke-Sqlcmd -ServerInstance $sqlServerVariable -Database $sqlDatabaseVariable -Query $sqlQueryText -ErrorAction Stop |
| 62 | + } |
| 63 | + trap |
| 64 | + { |
| 65 | + $ExceptionText = $_.Exception.Message -replace "'", "" |
| 66 | + } |
| 67 | +} |
| 68 | + |
| 69 | +#Function to delete files from this policy only |
| 70 | +function PolicyFileDelete($File) |
| 71 | +{ |
| 72 | + # Delete evaluation files in the directory. |
| 73 | + Remove-Item -Path $File |
| 74 | + # ugly but moves on... |
| 75 | + trap |
| 76 | + { |
| 77 | + continue; |
| 78 | + } |
| 79 | +} |
| 80 | + |
| 81 | +# Connection to the policy store |
| 82 | +$conn = new-object Microsoft.SQlServer.Management.Sdk.Sfc.SqlStoreConnection("server=$CentralManagementServer;Trusted_Connection=true"); |
| 83 | +$PolicyStore = new-object Microsoft.SqlServer.Management.DMF.PolicyStore($conn); |
| 84 | + |
| 85 | +# Create recordset of servers to evaluate |
| 86 | +$sconn = new-object System.Data.SqlClient.SqlConnection("server=$CentralManagementServer;Trusted_Connection=true"); |
| 87 | +$q = "SELECT DISTINCT server_name FROM $HistoryDatabase.[policy].[pfn_ServerGroupInstances]('$ConfigurationGroup');" |
| 88 | + |
| 89 | +$sconn.Open() |
| 90 | +$cmd = new-object System.Data.SqlClient.SqlCommand ($q, $sconn); |
| 91 | +$cmd.CommandTimeout = 0; |
| 92 | +$dr = $cmd.ExecuteReader(); |
| 93 | + |
| 94 | +# Loop through the servers and then loop through |
| 95 | +# the policies. For each server and policy, |
| 96 | +# call cmdlet to evaluate policy on server and delete xml file afterwards |
| 97 | + |
| 98 | +while ($dr.Read()) { |
| 99 | + $ServerName = $dr.GetValue(0); |
| 100 | + foreach ($Policy in $PolicyStore.Policies) |
| 101 | + { |
| 102 | + if (($Policy.PolicyCategory -eq $PolicyCategoryFilter)-or ($PolicyCategoryFilter -eq "")) |
| 103 | + { |
| 104 | + &{ |
| 105 | + $OutputFile = $ResultDir + ("{0}_{1}.xml" -f (Encode-SqlName $ServerName ), ($Policy.Name)); |
| 106 | + Invoke-PolicyEvaluation -Policy $Policy -TargetServerName $ServerName -AdHocPolicyEvaluationMode $EvalMode -OutputXML > $OutputFile; |
| 107 | + $PolicyResult = Get-Content $OutputFile -encoding UTF8; |
| 108 | + $PolicyResult = $PolicyResult -replace "'", "" |
| 109 | + PolicyHistoryInsert $CentralManagementServer $HistoryDatabase $ServerName $Policy.Name $PolicyResult; |
| 110 | + $File = $ResultDir + ("*_{0}.xml" -f ($Policy.Name)); |
| 111 | + PolicyFileDelete $File; |
| 112 | + } |
| 113 | + trap [Exception] |
| 114 | + { |
| 115 | + $File = $ResultDir + ("*_{0}.xml" -f ($Policy.Name)); |
| 116 | + PolicyFileDelete $File; |
| 117 | + $ExceptionText = $_.Exception.Message -replace "'", "" |
| 118 | + $ExceptionMessage = $_.Exception.GetType().FullName + ", " + $ExceptionText |
| 119 | + PolicyErrorInsert $CentralManagementServer $HistoryDatabase $ServerName $Policy.Name $ExceptionMessage; |
| 120 | + continue; |
| 121 | + } |
| 122 | + } |
| 123 | + } |
| 124 | + } |
| 125 | + |
| 126 | +$dr.Close() |
| 127 | +$sconn.Close() |
| 128 | + |
| 129 | +#Shred the XML results to PolicyHistoryDetails |
| 130 | +Invoke-Sqlcmd -ServerInstance $CentralManagementServer -Database $HistoryDatabase -Query "EXEC policy.epm_LoadPolicyHistoryDetail `$(PolicyCategory)" -Variable "PolicyCategory='${PolicyCategoryFilter}'" -QueryTimeout 65535 -Verbose -ErrorAction Stop |
0 commit comments