UnManage Scripts & Maintenance Windows

rionoskae

It's no secret that SolarWinds lacks any great options for managing Maintenance Windows / Scheduled Reboots.

Instead of using the dated GUI tool that SolarWinds provides or trying to manually attribute 160 unique reboot windows to over 2,800 nodes in our environment manually ( I'm well aware it's a mess!), We decided it would be more practical to trigger an UnManage Node script whenever a server was rebooted via the ShutDown GPO. However we ran into x2 problems pretty quickly....

     1.) If we wanted to run this locally, it would require the Orion SDK be installed on every single server.

     2.) If we try to execute the script remotely on the primary SolarWinds Server, The local system account that the Shutdown GPO was running under would not allow any commands or modules to run that would be capable of executing code on a remote server.

So here's my work-around.

Part 1 - Trigger the "Call" script from your shutdown GPO.

1. Want to navigate to Group Policy Editor > Windows Settings > Scripts > Shutdown
2. Add the Script Name under the "PowerShell" tab.
3. ex: C:\Temp\Call-UnManage-Script.ps1

Part 2 - Run the call script to pull in your encrypted credentials and then execute your target script.

This is where the magic happens

$CredsPath = "C:\Temp\Creds"

$Script = "C:\Temp\UnManage-Server.ps1"

$Password = Get-Content $CredsPath\password.txt | ConvertTo-SecureString -Key (Get-Content $CredsPath\aes.key)

$Credential = New-Object System.Management.Automation.PsCredential("corp\<domain user name>",$password)

Invoke-Command -ScriptBlock {

$credential = $using:credential

$script = $using:Script

& $script -credential $credential

} -ComputerName localhost -Credential $Credential -Verbose

Part 3 - Execute your target script - you should now be able to execute remote commands under the NT Authority\System account.

param($credential)

$nodename = $Env:Computername

#Run The Following Commands On Remote Server

$Server = New-PSsession -ComputerName "SolarWinds-Server-Name-Here" -Credential $credential

Invoke-Command -Session $Server -Scriptblock {

# Load the SolarWinds Powershell snapin. Needed in order to execute the script.

# Requires the Orion SDK 1.9 installed on the machine this script is running from.

#######################################################################################################

if (!(Get-PSSnapin -Name "SwisSnapin" -ErrorAction SilentlyContinue)){Add-PSSnapin SwisSnapin -ErrorAction SilentlyContinue  }

# SolarWinds user name and password section. Should not be in plain text after done testing!

# SWnodemgt user is an Orion local account that only has node management rights.

#######################################################################################################

$node = $using:nodename

$username = "SWnodemgt"

$password = "***********"

# This section allows the password to be embedded in this script. Without it the script will not work.

#######################################################################################################

$secstr = New-Object -TypeName System.Security.SecureString

$password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)}

$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username,$secstr

# Declare Variables & UnManage Node For 30 Minutes

#######################################################################################################

$ORIONSERVERNAME = 'SolarWinds-Server-Name-Here.yourdomain.com'

$swis = Connect-Swis -Credential $cred -host $orionservername

$nodeid = Get-SwisData $swis "SELECT NodeID FROM Orion.Nodes WHERE SysName LIKE '$node'"

$now =[DateTime ]::UTCNow

$later = $now.AddMinutes(30)

Invoke-SwisVerb $swis Orion.Nodes Unmanage @(&quot;N: $nodeid ", $now ,$later , "false")

}

Remove-PSSession $Server

***Note***

Script has been tested working in Windows Server 2016, however It's still currently using credentials as plain text.

I will update the script when I transition this to PROD and pass the credentials from Part 2 to the final script successfully.

This Un-Manage Node script adapted from this post @ Powershell scripts to automatically unmanage\remanage a node using the Orion SDK