Techist

Windowsでのプロキシ設定方法

Tue, 21 Apr 2026 10:46:04 GMT

概要

Windowsでのプロキシ設定方法を、ユーザー単位（WinINET） と システム全体（WinHTTP） に分けて解説します。例: ProxyServer = http=<<PROXY_ADDRESS>>;https=<<PROXY_ADDRESS>> のように、環境依存の値は <<変数名>> で表記しています。

変数表記について

本記事では、環境依存の値を以下のように表記しています。実際の環境に合わせて読み替えてください。

変数名	設定例	備考
`<<PROXY_ADDRESS>>`	`proxy.example.com:8080`	プロキシサーバのホスト名とポート番号
`<<PROXY_BYPASS>>`	`intranet.example.com;192.168.*;<local>`	プロキシを経由しないドメインやサブネット、ローカルアドレス指定。;で連結
`<<ADVPROXY_SETTINGS_PATH>>`	`C:\proxy-settings.json`	`advproxy` の設定ファイルを配置するパス

Step 1: プロキシ設定の種類を理解する

種類	対象	用途
ユーザー単位 (WinINET)	ログオンユーザー	ブラウザ、ユーザーアプリケーションの通信。ユーザーの IE/Edge 設定が反映される
システム単位 ((WinHTTP)	サービスアカウント／OS全体	Windows Update、BITS、Defender の更新通信を含むシステム通信

BITS (Background Intelligent Transfer Service) は、Windows Update や Microsoft Defender の定義更新など、バックグラウンドでデータを効率的に転送するサービスです。
システムアカウント（LocalSystem）で動作するため、ユーザー単位のプロキシ設定（WinINET）は反映されません。

Step 2: PowerShellでユーザー単位のプロキシを設定

$proxy = "<<PROXY_ADDRESS>>"
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" `
  -Name ProxyEnable -Value 1
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" `
  -Name ProxyServer -Value "http=$proxy;https=$proxy"
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" `
  -Name ProxyOverride -Value "<<PROXY_BYPASS>>"

確認：

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | Select ProxyEnable, ProxyServer, ProxyOverride

Step 3: システム全体のプロキシを設定（WinHTTP / BITS 用）

① 旧方式（Windows Server 2019以前）

netsh winhttp set proxy <<PROXY_ADDRESS>> "<<PROXY_BYPASS>>"
netsh winhttp show proxy

② 新方式（Windows Server 2022以降推奨）

JSONファイルを作成：

@'
{
  "ProxyIsEnabled": true,
  "Proxy": "http=<<PROXY_ADDRESS>>;https=<<PROXY_ADDRESS>>",
  "ProxyBypass": "<<PROXY_BYPASS>>",
  "AutoConfigIsEnabled": false,
  "AutoDetect": false
}
'@ | Out-File "<<ADVPROXY_SETTINGS_PATH>>" -Encoding ascii

設定を適用：

netsh winhttp set advproxy setting-scope=machine settings-file="<<ADVPROXY_SETTINGS_PATH>>"

JSONファイルを使用しない場合は、以下のようにコマンドで直接指定します。

netsh winhttp set advproxy setting-scope=machine settings='{\"ProxyIsEnabled\":true,\"Proxy\":\"http=<<PROXY_ADDRESS>>;https=<<PROXY_ADDRESS>>\",\"ProxyBypass\":\"<<PROXY_BYPASS>>\",\"AutoConfigIsEnabled\":false,\"AutoDetect\":false}'

JSONファイルを管理する必要がないため、簡単なテストや一時的な環境構築時に便利です。

Step 4: BITSのプロキシ設定をローカルシステムに反映

bitsadmin /util /setieproxy localsystem MANUAL_PROXY <<PROXY_ADDRESS>> "<<PROXY_BYPASS>>"
bitsadmin /util /getieproxy localsystem

Step 5: 設定の確認・トラブルシューティング

netsh winhttp show proxy
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | Select ProxyEnable, ProxyServer, ProxyOverride

もし Windows Update がプロキシ経由で失敗する場合は、AutoDetect を無効化し、Server Core環境では advproxy コマンド形式を利用すること。

プロキシ設定をリセットする場合

不要になったプロキシ設定をリセットする場合は、以下のコマンドを使用します。

ユーザー単位（WinINET）の設定をリセット

Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyEnable -Value 0
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyServer -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyOverride -ErrorAction SilentlyContinue

システム単位（WinHTTP / advproxy）の設定をリセット

netsh winhttp reset proxy

または、Server 2022以降の新形式を使用している場合は以下のように実行します。

netsh winhttp set advproxy setting-scope=machine settings='{\"Proxy\":\"\",\"ProxyBypass\":\"\",\"AutoconfigUrl\":\"\",\"AutoDetect\":false}'

まとめ

Windowsのプロキシ設定は、大きく分けて ユーザー単位（WinINET） と システム単位（WinHTTP / advproxy） の2種類が存在します。

WinINET はユーザーのブラウザやアプリケーション通信に影響し、IEやEdgeの設定に対応します。
WinHTTP / advproxy はWindows UpdateやBITS、Defenderなどのシステム通信に影響します。

Windows Server 2022以降の環境では、advproxy コマンドによる設定が推奨されますが、従来の winhttp コマンドも互換性のため有効です。
また、bitsadmin を併用することで、LocalSystem アカウントに対しても正しくプロキシを反映できます。

運用上は以下の手順を意識するのがポイントです。

通信対象のレイヤーを把握する（ユーザー通信 or システム通信）
該当レイヤーに応じて WinINET / WinHTTP を正しく設定
Server Coreでは advproxy を利用
不要になったら reset proxy / reset advproxy で初期化

これにより、Windows Update や Defender 更新、BITS 転送が安定して動作し、プロキシ経由環境でも通信エラーを回避できます。

LinuxでSquidプロキシサーバーを構築する

Wed, 25 Mar 2026 13:43:13 GMT

概要（What）

本記事では、Linux上にSquidプロキシサーバーをインストール・構成し、クライアント側での接続設定を行う方法を解説します。

利点（Why）

Squidは高性能なキャッシュ型プロキシサーバーで、ブラウジングの高速化、Webフィルタリング、アクセス制御を可能にします。クライアントを適切に設定することで、安全かつ効率的に通信を中継できます。

手順（How）

ステップ1：Squidのインストール

RHEL系（AlmaLinux, Rocky, CentOS）の場合：

sudo dnf install squid -y

Debian系（Ubuntu）の場合：

sudo apt update
sudo apt install squid -y

ステップ2：Squidの設定

設定ファイル /etc/squid/squid.conf を編集：

sudo nano /etc/squid/squid.conf

最小限の動作構成例：

http_port 3128

acl localnet src 192.168.0.0/16
http_access allow localnet
http_access deny all

dns_v4_first on

推奨される追加設定：

cache_mem 64 MB
maximum_object_size_in_memory 512 KB
maximum_object_size 20 MB
access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log

ステップ3：Squidの有効化と起動

sudo systemctl enable --now squid

ステップ4：ファイアウォールの設定

firewalld使用時：

sudo firewall-cmd --add-port=3128/tcp --permanent
sudo firewall-cmd --reload

UFW使用時：

sudo ufw allow 3128/tcp

ステップ5：クライアントの設定

Linux（シェルで一時的に設定）：

export http_proxy="http://<squid-ip>:3128"
export https_proxy="http://<squid-ip>:3128"

Linux（永続設定）：

/etc/environment を編集：

http_proxy="http://<squid-ip>:3128"
https_proxy="http://<squid-ip>:3128"

Windows（PowerShellで現在のユーザーに適用）：

netsh winhttp set proxy <squid-ip>:3128

リセットするには：

netsh winhttp reset proxy

ステップ6：接続確認

クライアント側から：

curl -x http://<squid-ip>:3128 http://example.com

Squidサーバー上でログ確認：

sudo tail -f /var/log/squid/access.log

結論

PACファイルなしでシンプルにプロキシ環境を構築できます。通信制御、ログ取得、柔軟な管理が可能で、ネットワーク管理の一環として有用です。

How to Configure Proxy Settings on Windows

Fri, 20 Feb 2026 20:14:11 GMT

Overview

This article explains how to configure proxy settings on Windows, divided into user-level (WinINET) and system-wide (WinHTTP) settings.
For example: ProxyServer = http=<<PROXY_ADDRESS>>;https=<<PROXY_ADDRESS>> — environment-dependent values are denoted as <<variable>>.

Variable Notation

Variable	Example	Description
`<<PROXY_ADDRESS>>`	`proxy.example.com:8080`	Proxy server hostname and port number
`<<PROXY_BYPASS>>`	`intranet.example.com;192.168.*;<local>`	Domains, subnets, or local addresses to bypass the proxy (separated by `;`)
`<<ADVPROXY_SETTINGS_PATH>>`	`C:\proxy-settings.json`	Path to the `advproxy` configuration file

Step 1: Understanding Proxy Types

Type	Target	Use Case
User-level (WinINET)	Logged-in users	Browser and user applications. Uses Internet Explorer/Edge proxy settings
System-wide (WinHTTP)	System account / OS level	Windows Update, BITS, Defender updates, and other system communications

BITS (Background Intelligent Transfer Service) is used for background data transfer, including Windows Update and Defender definition updates.
Since it runs under the LocalSystem account, it does not inherit user-level (WinINET) proxy settings.

Step 2: Set User-Level Proxy with PowerShell

$proxy = "<<PROXY_ADDRESS>>"
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" `
  -Name ProxyEnable -Value 1
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" `
  -Name ProxyServer -Value "http=$proxy;https=$proxy"
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" `
  -Name ProxyOverride -Value "<<PROXY_BYPASS>>"

Verify:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | Select ProxyEnable, ProxyServer, ProxyOverride

Step 3: Configure System-Wide Proxy (WinHTTP / BITS)

(1) Legacy Method (Windows Server 2019 or earlier)

netsh winhttp set proxy <<PROXY_ADDRESS>> "<<PROXY_BYPASS>>"
netsh winhttp show proxy

(2) Modern Method (Windows Server 2022 or later - Recommended)

Create JSON file:

@'
{
  "ProxyIsEnabled": true,
  "Proxy": "http=<<PROXY_ADDRESS>>;https=<<PROXY_ADDRESS>>",
  "ProxyBypass": "<<PROXY_BYPASS>>",
  "AutoConfigIsEnabled": false,
  "AutoDetect": false
}
'@ | Out-File "<<ADVPROXY_SETTINGS_PATH>>" -Encoding ascii

Apply configuration:

netsh winhttp set advproxy setting-scope=machine settings-file="<<ADVPROXY_SETTINGS_PATH>>"

Alternatively, you can set it directly via command without JSON file (useful for testing or temporary environments):

netsh winhttp set advproxy setting-scope=machine settings='{\"ProxyIsEnabled\":true,\"Proxy\":\"http=<<PROXY_ADDRESS>>;https=<<PROXY_ADDRESS>>\",\"ProxyBypass\":\"<<PROXY_BYPASS>>\",\"AutoConfigIsEnabled\":false,\"AutoDetect\":false}'

Step 4: Apply Proxy for BITS (LocalSystem Account)

bitsadmin /util /setieproxy localsystem MANUAL_PROXY <<PROXY_ADDRESS>> "<<PROXY_BYPASS>>"
bitsadmin /util /getieproxy localsystem

Step 5: Verification and Troubleshooting

netsh winhttp show proxy
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | Select ProxyEnable, ProxyServer, ProxyOverride

If Windows Update fails through a proxy, disable AutoDetect and use the advproxy command format on Server Core.

Reset Proxy Settings

Reset User-Level (WinINET)

Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyEnable -Value 0
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyServer -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyOverride -ErrorAction SilentlyContinue

Reset System-Level (WinHTTP / advproxy)

netsh winhttp reset proxy

For Windows Server 2022 or later:

netsh winhttp set advproxy setting-scope=machine settings='{\"Proxy\":\"\",\"ProxyBypass\":\"\",\"AutoconfigUrl\":\"\",\"AutoDetect\":false}'

Summary

Windows provides two layers of proxy configuration: WinINET (user-level) and WinHTTP / advproxy (system-level).

WinINET affects browsers and user apps (IE/Edge).
WinHTTP / advproxy affects system services (Windows Update, BITS, Defender).

For Windows Server 2022 or later, advproxy is recommended, though winhttp remains backward compatible.
Using bitsadmin, you can correctly apply the proxy for LocalSystem operations.

Operational guidelines:

Identify target layer (user or system).
Configure corresponding proxy type (WinINET / WinHTTP).
Use advproxy on Server Core.
Use reset proxy / reset advproxy when cleaning up.

Proper configuration ensures reliable Windows Update, Defender updates, and BITS transfers even in proxy-restricted environments.

Windows Network Diagnosis Tools Guide

Fri, 20 Feb 2026 20:14:11 GMT

Overview

This article provides a structured approach for identifying communication issues in Windows Server environments using built-in commands and PowerShell tools. It covers ICMP connectivity testing, TCP port checks, DNS resolution, and log analysis.

Variable Notation

The following placeholders represent environment-dependent values. Replace them with your actual settings.

Variable	Example	Description
`<<TARGET_HOST>>`	`192.168.10.1`	Hostname or IP address to test connectivity
`<<PORT_NUMBER>>`	`443`	TCP port number used by the application
`<<LOG_PATH>>`	`C:\Logs\netdiag.txt`	Path to store output logs

Step 1: ICMP Connectivity Check (ping)

Verify reachability at the network layer.

ping <<TARGET_HOST>>

If there is no reply, check the following:

Whether ICMP is blocked by Windows Defender Firewall
Whether the target host is powered on
Whether routing settings are correct (route print)

Note: If ICMP responses are disabled in your environment, perform a TCP connectivity test instead.

Step 2: Route Verification (tracert)

Determine at which hop the communication fails.

tracert <<TARGET_HOST>>

Step 3: TCP Port Connectivity (Test-NetConnection)

Test whether communication at the application layer can be established.

Test-NetConnection -ComputerName <<TARGET_HOST>> -Port <<PORT_NUMBER>>

Key output fields:

Field	Description
`TcpTestSucceeded`	Indicates whether the TCP connection succeeded
`PingSucceeded`	Indicates if ICMP succeeded
`RemoteAddress`	Resolved destination IP address
`SourceAddress`	Source IP address used for the connection

Tip: If DNS is unstable, use the IP address directly for testing.

Step 4: Checking TCP Session Status (netstat / Get-NetTCPConnection)

View current TCP connections and listening ports.

Using netstat

netstat -ano | findstr "<<PORT_NUMBER>>"

Option explanations:

-a: Show all connections and listening ports
-n: Display addresses and ports numerically
-o: Show process IDs

Identify the corresponding process:

tasklist /FI "PID eq <<PID_NUMBER>>"

Using PowerShell

Get-NetTCPConnection -State Established |
  Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess

Get-NetTCPConnection | Where-Object { $_.LocalPort -eq <<PORT_NUMBER>> }

A large number of SYN_SENT or TIME_WAIT states may indicate interrupted or excessively repeated connections.

Step 5: DNS Resolution Verification (nslookup / Resolve-DnsName)

Confirm that name resolution is functioning correctly.

nslookup <<TARGET_HOST>>

Detailed check with PowerShell:

Resolve-DnsName <<TARGET_HOST>> -Type A

Query a specific DNS server:

Resolve-DnsName <<TARGET_HOST>> -Type A -Server 8.8.8.8

Note: For IPv6 environments, use -Type AAAA.

Step 6: Advanced Troubleshooting

Enable Firewall Logging

If communication is blocked, enable firewall logging for analysis.

Set-NetFirewallProfile -Profile Domain,Public,Private `
  -LogAllowed True -LogBlocked True `
  -LogFileName "C:\Windows\System32\LogFiles\Firewall\pfirewall.log" `
  -LogMaxSizeKilobytes 32767

The default log size is 1MB; increasing it simplifies analysis.

Check the ARP Table (Layer 2 Troubles)

arp -a

If MAC address inconsistencies or duplicates are found, suspect switch or virtual NIC cache issues.

Summary

Most network issues can be systematically isolated in five steps:
ICMP connectivity → Route check → TCP connection → DNS resolution → Log analysis

By combining built-in tools such as ping, tracert, and netstat with PowerShell cmdlets like Get-NetTCPConnection, Resolve-DnsName, and Test-NetConnection, you can perform efficient and reproducible troubleshooting in Windows Server environments.

Extracting Log Files with PowerShell

Fri, 20 Feb 2026 20:14:11 GMT

What

This article explains how to extract specific content from log files using PowerShell, enabling efficient log analysis and system monitoring.

Why

In large environments, log files can grow quickly and contain a vast amount of information. PowerShell offers powerful text-processing tools to filter relevant data, detect issues, and automate reporting tasks, making it an essential skill for system administrators.

How

Step 1: Reading a Log File

Use Get-Content to read a log file line-by-line.

Get-Content -Path "C:\Logs\system.log"

Step 2: Filtering by Keyword

Use Select-String to extract only lines containing specific keywords such as “ERROR”.

Get-Content -Path "C:\Logs\system.log" | Select-String -Pattern "ERROR"

Step 3: Searching Multiple Patterns

Use an array of patterns to search for multiple keywords.

$patterns = "ERROR", "WARNING"
Get-Content -Path "C:\Logs\system.log" | Select-String -Pattern $patterns

Step 4: Extracting Logs Within a Date Range

Filter lines by date using a regular expression.

Get-Content -Path "C:\Logs\system.log" | Where-Object { $_ -match "2025-04-(1[5-9]|2[0-5])" }

Step 5: Exporting Results to CSV

Save filtered log data to a CSV file for reporting.

Get-Content -Path "C:\Logs\system.log" | Select-String "ERROR" | ForEach-Object {
    [PSCustomObject]@{
        LineNumber = $_.LineNumber
        Text       = $_.Line
        Path       = $_.Path
    }
} | Export-Csv -Path "C:\Logs\error_report.csv" -NoTypeInformation

Step 6: Automating with a Script

Wrap it all in a reusable .ps1 script for daily use.

$logPath = "C:\Logs\system.log"
$outputPath = "C:\Logs\filtered_log.csv"
$filterPattern = "ERROR"

Get-Content -Path $logPath | Select-String -Pattern $filterPattern | ForEach-Object {
    [PSCustomObject]@{
        LineNumber = $_.LineNumber
        Text       = $_.Line
        Path       = $_.Path
    }
} | Export-Csv -Path $outputPath -NoTypeInformation

Conclusion

With just a few lines of PowerShell, you can efficiently extract and manage critical log information. Whether monitoring for errors or generating daily summaries, scripting log analysis saves time and increases system visibility.

Managing Windows Features and Images with DISM and PowerShell

Fri, 20 Feb 2026 20:14:11 GMT

Overview

This article treats DISM (Deployment Image Servicing and Management) and PowerShell (the DISM API wrapper) side by side. It organizes frequent admin tasks with concise explanations, key options, and ready-to-run examples.

Variable Conventions

Variable	Example	Notes
`<<IMAGE_PATH>>`	`C:\mount` or `E:\Windows`	Path for `/Image:` (mounted offline Windows or another disk’s Windows directory)
`<<FEATURE_NAME>>`	`NetFx3`	Windows feature name
`<<CAPABILITY_NAME>>`	`OpenSSH.Client~~~~0.0.1.0`	Feature on Demand name (FoD)
`<<WIM_PATH>>`	`D:\sources\install.wim`	WIM/ESD image file
`<<INDEX>>`	`1`	Image index
`<<MOUNT_DIR>>`	`C:\mount`	Mount point
`<<DRIVER_DIR>>`	`D:\drivers`	Folder containing driver INF files
`<<PACKAGE_PATH>>`	`C:\Updates\kb5005565.cab`	Update package file
`<<LANG_PACK>>`	`C:\LP\ja-jp\lp.cab`	Language pack CAB
`<<SOURCE_PATH>>`	`D:\sources\sxs`	Source files (e.g., NetFx3)
`<<APPLY_DIR>>`	`C:\`	Apply/extract destination
`<<SCRATCH_DIR>>`	`C:\Temp\Scratch`	Working directory
`<<LOG_PATH>>`	`C:\Temp\dism.log`	Log path

Most commands also accept /ScratchDir:<<SCRATCH_DIR>> and /LogPath:<<LOG_PATH>>.

Step 1: Target Selection (/Online vs /Image)

Most DISM commands require an explicit target.

Option	Meaning	Example
`/Online`	Current running Windows	`dism /Online /Cleanup-Image /CheckHealth`
`/Image:<<IMAGE_PATH>>`	Offline Windows or mounted image	`dism /Image:C:\mount /Add-Driver /Driver:D:\drivers /Recurse`

Step 2: List Features (/Get-Features, /Get-FeatureInfo)

Summary

Enumerate available features and their state: Enabled / Disabled / DisabledWithPayloadRemoved.

Key Options

Option	Meaning	Example
`/Online`	Target running OS	`dism /Online /Get-Features`
`/Image:<<IMAGE_PATH>>`	Target offline image	`dism /Image:C:\mount /Get-Features`
`/Get-Features`	List features	`dism /Online /Get-Features /Format:Table`
`/Get-FeatureInfo`	Detail for one feature	`dism /Online /Get-FeatureInfo /FeatureName:NetFx3`
`/FeatureName:<<FEATURE_NAME>>`	Feature name	`NetFx3`
`/Format:Table`	Tabular output	`dism /Online /Get-Features /Format:Table`

Examples

# List all features and states
dism /Online /Get-Features /Format:Table

# Inspect a specific feature
dism /Online /Get-FeatureInfo /FeatureName:NetFx3

If state is DisabledWithPayloadRemoved, binaries are removed; specify /Source.

Step 3: Enable/Disable Features (/Enable-Feature, /Disable-Feature)

Summary

Enable/disable features such as .NET Framework 3.5 or SMB 1.0.

Key Options

Option	Meaning	Example
`/Online`	Target running OS	`dism /Online /Enable-Feature /FeatureName:NetFx3`
`/FeatureName:<<FEATURE_NAME>>`	Feature to manage	`NetFx3`
`/All`	Include dependencies
`/Source:<<SOURCE_PATH>>`	Payload source when removed	`dism /Online /Enable-Feature /FeatureName:NetFx3 /Source:D:\sources\sxs`
`/LimitAccess`	Don’t use WU/WSUS
`/Enable-Feature`	Enable	`dism /Online /Enable-Feature /FeatureName:SMB1Protocol`
`/Disable-Feature`	Disable	`dism /Online /Disable-Feature /FeatureName:SMB1Protocol`
`/LogPath:<<LOG_PATH>>`	Log output

Examples

# Enable .NET Framework 3.5 from local media without Internet
dism /Online /Enable-Feature /FeatureName:NetFx3 /All /LimitAccess /Source:<<SOURCE_PATH>> /LogPath:<<LOG_PATH>>

# Disable SMB1 for hardening
dism /Online /Disable-Feature /FeatureName:SMB1Protocol /LogPath:<<LOG_PATH>>

Step 4: Inspect Capabilities (/Get-Capabilities, /Get-CapabilityInfo)

Summary

List and inspect FoD (Features on Demand) such as RSAT, OpenSSH.Client, Language.Basic.

Key Options

Option	Meaning	Example
`/Online`	Running OS	`dism /Online /Get-Capabilities`
`/Image:<<IMAGE_PATH>>`	Offline image	`dism /Image:C:\mount /Get-Capabilities`
`/Get-Capabilities`	List FoD	`dism /Online /Get-Capabilities /Format:Table`
`/Get-CapabilityInfo`	Detail	`dism /Online /Get-CapabilityInfo /CapabilityName:OpenSSH.Client~~~~0.0.1.0`
`/Format:Table`	Tabular output	`dism /Online /Get-Capabilities /Format:Table`

Examples

# Enumerate FoD
dism /Online /Get-Capabilities /Format:Table

# Inspect one capability
dism /Online /Get-CapabilityInfo /CapabilityName:<<CAPABILITY_NAME>>

Capabilities can be sourced from Windows Update, WSUS, or FoD ISO/shares.

Step 5: Add/Remove Capabilities (/Add-Capability, /Remove-Capability)

Summary

Add/remove on-demand components like OpenSSH or RSAT tools.

Key Options

Option	Meaning	Example
`/Online`	Running OS	`dism /Online /Add-Capability`
`/CapabilityName:<<CAPABILITY_NAME>>`	Capability to manage	`OpenSSH.Client~~~~0.0.1.0`
`/Source:<<SOURCE_PATH>>`	FoD ISO or share	`dism /Online /Add-Capability /CapabilityName:OpenSSH.Client~~~~0.0.1.0 /Source:D:\ /LimitAccess`
`/LimitAccess`	Use only given source
`/LogPath:<<LOG_PATH>>`	Log output

Examples

# Add OpenSSH.Client (online, from network or ISO)
dism /Online /Add-Capability /CapabilityName:<<CAPABILITY_NAME>> /LogPath:<<LOG_PATH>>

# Remove an unneeded RSAT tool
dism /Online /Remove-Capability /CapabilityName:<<CAPABILITY_NAME>> /LogPath:<<LOG_PATH>>

Step 6: Image Repair & Component Store (/Cleanup-Image)

Summary

Detect/repair WinSxS corruption and optimize disk usage.

Key Options

Option	Meaning	Example
`/Online`	Running OS	`dism /Online /Cleanup-Image /CheckHealth`
`/CheckHealth`	Quick check
`/ScanHealth`	Deep scan
`/RestoreHealth`	Repair	`dism /Online /Cleanup-Image /RestoreHealth`
`/Source:<<SOURCE_PATH>>`	Repair source
`/LimitAccess`	Avoid WU
`/StartComponentCleanup`	Remove superseded updates
`/ResetBase`	Consolidate (no rollback)
`/AnalyzeComponentStore`	Size analysis

Examples

# Quick corruption check
dism /Online /Cleanup-Image /CheckHealth

# Deep scan
dism /Online /Cleanup-Image /ScanHealth

# Repair with local source
dism /Online /Cleanup-Image /RestoreHealth /Source:<<SOURCE_PATH>> /LimitAccess /LogPath:<<LOG_PATH>>

# Cleanup and consolidate updates
dism /Online /Cleanup-Image /StartComponentCleanup /ResetBase /LogPath:<<LOG_PATH>>

Step 7: Image Info (/Get-ImageInfo)

Key Options

Option	Meaning	Example
`/Get-ImageInfo`	Show images inside WIM/ESD	`dism /Get-ImageInfo /ImageFile:install.wim`
`/ImageFile:<<WIM_PATH>>`	WIM to inspect
`/Index:<<INDEX>>`	Target index
`/LogPath:<<LOG_PATH>>`	Log output

Example

# Show editions and indexes in install.wim
dism /Get-ImageInfo /ImageFile:<<WIM_PATH>> /LogPath:<<LOG_PATH>>

Step 8: Mount & Unmount Offline Images

Key Options

Option	Meaning	Example
`/Mount-Wim`	Mount WIM
`/WimFile:<<WIM_PATH>>`	Source WIM
`/Index:<<INDEX>>`	Index to mount
`/MountDir:<<MOUNT_DIR>>`	Mount directory
`/ReadOnly`	Read-only mount
`/Get-MountedWimInfo`	Show mount status
`/Unmount-Wim`	Unmount
`/Commit`	Save changes
`/Discard`	Discard changes

Examples

# Mount for editing
dism /Mount-Wim /WimFile:<<WIM_PATH>> /Index:<<INDEX>> /MountDir:<<MOUNT_DIR>>

# Check current mounts
dism /Get-MountedWimInfo

# Save and unmount
dism /Unmount-Wim /MountDir:<<MOUNT_DIR>> /Commit

Step 9: Integrate Drivers, Packages, and Language Packs

Key Options

Option	Meaning	Example
`/Online`	Running OS
`/Image:<<MOUNT_DIR>>`	Offline image target
`/Add-Driver`	Add drivers
`/Driver:<<DRIVER_DIR>>`	Folder containing INF
`/Recurse`	Include subfolders
`/Add-Package`	Add updates or language packs
`/PackagePath:<<PACKAGE_PATH>>`	Package path
`/Set-AllIntl:ja-JP`	Set locale to Japanese

Notes:

/Add-Driver is offline only.

/Add-Package and /Set-AllIntl work online or offline.

Examples

# Integrate drivers
dism /Image:<<MOUNT_DIR>> /Add-Driver /Driver:<<DRIVER_DIR>> /Recurse

# Integrate an update
dism /Image:<<MOUNT_DIR>> /Add-Package /PackagePath:<<PACKAGE_PATH>>

# Add a language pack and set locale
dism /Image:<<MOUNT_DIR>> /Add-Package /PackagePath:<<LANG_PACK>>
dism /Image:<<MOUNT_DIR>> /Set-AllIntl:ja-JP

Step 10: Capture, Export, and Apply Images

Key Options

Option	Meaning	Example
`/Capture-Image`	Capture a folder to WIM
`/ImageFile:<<WIM_PATH>>`	Output WIM
`/CaptureDir:<<APPLY_DIR>>`	Source directory
`/Name:"<name>"`	Image name
`/Export-Image`	Export/compress existing WIM
`/Apply-Image`	Apply WIM
`/Compress:max`	Max compression
`/ApplyDir:<<APPLY_DIR>>`	Destination directory

Examples

# Capture current layout to WIM
dism /Capture-Image /ImageFile:D:\Custom.wim /CaptureDir:<<APPLY_DIR>> /Name:"Custom Image"

# Export with maximum compression
dism /Export-Image /SourceImageFile:<<WIM_PATH>> /SourceIndex:<<INDEX>> /DestinationImageFile:D:\install_compressed.wim /Compress:max

# Apply an image
dism /Apply-Image /ImageFile:<<WIM_PATH>> /Index:<<INDEX>> /ApplyDir:<<APPLY_DIR>>

Step 11: PowerShell Equivalents

Mapping Table

Area	DISM Command	PowerShell Cmdlet	Purpose
Features (list/detail)	`/Get-Features`, `/Get-FeatureInfo`	`Get-WindowsOptionalFeature`	Inventory & details
Enable/Disable features	`/Enable-Feature`, `/Disable-Feature`	`Enable-WindowsOptionalFeature`, `Disable-WindowsOptionalFeature`	Toggle features
Capabilities (list/detail)	`/Get-Capabilities`, `/Get-CapabilityInfo`	`Get-WindowsCapability`	Inventory & details
Add/Remove capabilities	`/Add-Capability`, `/Remove-Capability`	`Add-WindowsCapability`, `Remove-WindowsCapability`	FoD management
Packages (info/add)	`/Get-Packages`, `/Add-Package`	`Get-WindowsPackage`, `Add-WindowsPackage`	Updates & LPs
Drivers (info/add/remove)	`/Get-Drivers`, `/Add-Driver`, `/Remove-Driver`	`Get-WindowsDriver`, `Add-WindowsDriver`, `Remove-WindowsDriver`	Primarily offline
Image info/mount	`/Get-ImageInfo`, `/Mount-Wim`, `/Unmount-Wim`	`Get-WindowsImage`, `Mount-WindowsImage`, `Dismount-WindowsImage`	WIM management

11.1 Features

Get-WindowsOptionalFeature

Option	Meaning	Example
`-Online`	Running OS	`Get-WindowsOptionalFeature -Online -FeatureName <<FEATURE_NAME>>`
`-Path <<IMAGE_PATH>>`	Offline image	`Get-WindowsOptionalFeature -Path <<IMAGE_PATH>>`
`-FeatureName <<FEATURE_NAME>>`	Specific feature	`-FeatureName NetFx3`

# List all (online)
Get-WindowsOptionalFeature -Online

# Detail (offline)
Get-WindowsOptionalFeature -Path <<IMAGE_PATH>> -FeatureName <<FEATURE_NAME>>

Enable-/Disable-WindowsOptionalFeature

Option	Meaning	Example
`-Online` / `-Path <<IMAGE_PATH>>`	Target	`Enable-WindowsOptionalFeature -Online`
`-FeatureName <<FEATURE_NAME>>`	Feature name	`-FeatureName NetFx3`
`-All`	Include dependencies	`-All`
`-Source <<SOURCE_PATH>>`	Payload source	`-Source <<SOURCE_PATH>>`

# Enable NetFx3 with local source
Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All -Source <<SOURCE_PATH>>

# Disable SMB1
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

11.2 Capabilities

Get-WindowsCapability

Option	Meaning	Example
`-Online`	Running OS	`Get-WindowsCapability -Online`
`-Name <<CAPABILITY_NAME>>`	Supports wildcard	`Get-WindowsCapability -Online -Name OpenSSH.*`
`-Path <<IMAGE_PATH>>`	Offline target	`Get-WindowsCapability -Path <<IMAGE_PATH>>`

# List (online)
Get-WindowsCapability -Online

# Filter single capability
Get-WindowsCapability -Online -Name <<CAPABILITY_NAME>>

Add-/Remove-WindowsCapability

Option	Meaning	Example
`-Online` / `-Path <<IMAGE_PATH>>`	Target	`Add-WindowsCapability -Online`
`-Name <<CAPABILITY_NAME>>`	Capability name	`-Name OpenSSH.Client~~~~0.0.1.0`
`-Source <<SOURCE_PATH>>`	FoD source	`-Source <<SOURCE_PATH>>`

# Add (online, with source if required)
Add-WindowsCapability -Online -Name <<CAPABILITY_NAME>>

# Remove
Remove-WindowsCapability -Online -Name <<CAPABILITY_NAME>>

11.3 Packages (updates & language packs)

Get-WindowsPackage

Option	Meaning	Example
`-Online` / `-Path <<IMAGE_PATH>>`	Target	`Get-WindowsPackage -Online`
`-PackagePath <<PACKAGE_PATH>>`	Info for a package	`Get-WindowsPackage -Online -PackagePath <<PACKAGE_PATH>>`

# List installed packages
Get-WindowsPackage -Online

Add-WindowsPackage

Option	Meaning	Example
`-Online` / `-Path <<IMAGE_PATH>>`	Target	`Add-WindowsPackage -Online -PackagePath <<PACKAGE_PATH>>`
`-PackagePath <<PACKAGE_PATH>>`	`.cab` (preferred) / `.msu`

# Add an update (online)
Add-WindowsPackage -Online -PackagePath <<PACKAGE_PATH>>

# Add a language pack (offline)
Add-WindowsPackage -Path <<IMAGE_PATH>> -PackagePath <<LANG_PACK>>

11.4 Drivers

Get-WindowsDriver

Option	Meaning	Example
`-Online` / `-Path <<IMAGE_PATH>>`	Target	`Get-WindowsDriver -Path <<IMAGE_PATH>>`
`-All`	Show all drivers	`-All`

# List drivers in an offline image
Get-WindowsDriver -Path <<IMAGE_PATH>> -All

Add-/Remove-WindowsDriver

Option	Meaning	Example
`-Path <<IMAGE_PATH>>`	Target image	`Add-WindowsDriver -Path <<IMAGE_PATH>> -Driver <<DRIVER_DIR>> -Recurse`
`-Driver <<DRIVER_DIR>>`	INF folder
`-Recurse`	Include subfolders
`-Driver <<oem*.inf>>` (Remove)	INF to remove	`Remove-WindowsDriver -Path <<IMAGE_PATH>> -Driver oem1.inf`

# Add drivers (offline)
Add-WindowsDriver -Path <<IMAGE_PATH>> -Driver <<DRIVER_DIR>> -Recurse

# Remove a driver (offline)
Remove-WindowsDriver -Path <<IMAGE_PATH>> -Driver oem1.inf

Important: Add-/Remove-WindowsDriver do not support -Online; use them against offline images.

11.5 Image Info & Mount

Get-WindowsImage

Option	Meaning	Example
`-ImagePath <<WIM_PATH>>`	WIM/ESD path	`Get-WindowsImage -ImagePath <<WIM_PATH>>`
`-Index <<INDEX>>`	Specific index only	`-Index <<INDEX>>`

# Show all indexes of install.wim
Get-WindowsImage -ImagePath <<WIM_PATH>>

Mount-/Dismount-WindowsImage

Option	Meaning
`-ImagePath <<WIM_PATH>>`	Source WIM
`-Index <<INDEX>>`	Index to mount
`-Path <<MOUNT_DIR>>`	Mount directory
`-ReadOnly`	Read-only mount
`-ScratchDirectory <<SCRATCH_DIR>>`	Working dir
`-Save` (Dismount)	Save changes
`-Discard` (Dismount)	Discard changes

# Mount
Mount-WindowsImage -ImagePath <<WIM_PATH>> -Index <<INDEX>> -Path <<MOUNT_DIR>>

# Save and dismount
Dismount-WindowsImage -Path <<MOUNT_DIR>> -Save

Summary

DISM: low-level management of OS components, WIM, updates, and drivers.
PowerShell (DISM API): same scope with scriptability for inventory, selection, and automation.
Capabilities (FoD): on-demand features (OpenSSH, RSAT, language packs).

Windows Server Network Configuration

Fri, 20 Feb 2026 20:14:11 GMT

Overview

This article explains how to manage Windows Server network configuration consistently using PowerShell.
It covers static IP setup, DNS configuration, routing priority adjustment, and key considerations when managing multiple NICs.

Variable Definitions

Variable	Example	Description
`<<INTERFACE_ALIAS>>`	`Ethernet0`	Target network adapter name
`<<IP_ADDRESS>>`	`192.168.10.100`	Static IP address
`<<PREFIX_LENGTH>>`	`24`	Subnet prefix length (e.g., 255.255.255.0 → 24)
`<<GATEWAY>>`	`192.168.10.1`	Default gateway
`<<DNS1>>`	`192.168.10.10`	Primary DNS server
`<<DNS2>>`	`8.8.8.8`	Secondary DNS server (optional)

Step 1: Check Current Network Configuration

List existing NICs and review their IP configurations.

# List adapters
Get-NetAdapter | Select-Object Name, Status, MacAddress, LinkSpeed

# Show IP configuration
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress, PrefixLength, DefaultGateway, PrefixOrigin

OriginType	Meaning	Notes
Manual	Manually assigned static address	Explicitly configured via PowerShell or GUI
DHCP	Automatically assigned by DHCP server	Enabled with `Set-NetIPInterface -Dhcp Enabled`
WellKnown	System-reserved link-local or APIPA address	Used when DHCP is unavailable (e.g., 169.254.x.x)

Step 2: Switch from DHCP to Static IP

Disable DHCP and assign a fixed IP address.

# Disable DHCP
Set-NetIPInterface -InterfaceAlias "<<INTERFACE_ALIAS>>" -Dhcp Disabled

# Remove existing DHCP address (if any)
Get-NetIPAddress -InterfaceAlias "<<INTERFACE_ALIAS>>" -AddressFamily IPv4 |
  Where-Object { $_.PrefixOrigin -eq "Dhcp" } |
  Remove-NetIPAddress -Confirm:$false

# Set static IP
New-NetIPAddress `
  -InterfaceAlias "<<INTERFACE_ALIAS>>" `
  -IPAddress "<<IP_ADDRESS>>" `
  -PrefixLength <<PREFIX_LENGTH>> `
  -DefaultGateway "<<GATEWAY>>"

Note:
Use Remove-NetIPAddress only to remove DHCP-assigned addresses.
Avoid running this command on a remotely connected NIC to prevent connection loss.

Step 3: Configure DNS Servers

Specify DNS servers and confirm the settings.

# Configure DNS
Set-DnsClientServerAddress `
  -InterfaceAlias "<<INTERFACE_ALIAS>>" `
  -ServerAddresses ("<<DNS1>>","<<DNS2>>")

# Verify DNS settings
Get-DnsClientServerAddress -InterfaceAlias "<<INTERFACE_ALIAS>>"

Clear the DNS cache and test name resolution:

Clear-DnsClientCache
Resolve-DnsName "www.microsoft.com"

Step 4: Set Priority in Multi-NIC Environments

When multiple networks exist, manually adjust routing priority (InterfaceMetric).
Smaller values indicate higher priority.

# Check current metrics
Get-NetIPInterface | Sort-Object -Property InterfaceMetric |
  Select-Object InterfaceAlias, AddressFamily, InterfaceMetric

# Set preferred NIC priority (management NIC first)
Set-NetIPInterface -InterfaceAlias "<<INTERFACE_ALIAS>>" -InterfaceMetric 10

Recommended Values:

Management LAN: 10

Backup LAN: 20–50

Cluster / iSCSI traffic: 100 or higher

Step 5: Verify Connectivity

Check network reachability and DNS resolution.

# Test gateway connectivity
Test-Connection "<<GATEWAY>>" -Count 4

# Test DNS name resolution
Resolve-DnsName "www.microsoft.com"

Tip:
If DNS settings are not applied properly, restart the DNS client service:
Terminal window
net stop dnscache && net start dnscache

Step 6: Disable IPv6 (Optional)

By default, Windows Server enables both IPv4 and IPv6.
If IPv6 is unused in your environment, disable it to prevent unnecessary route advertisements and inconsistent name resolution.

# Check IPv6 binding status
Get-NetAdapterBinding `
  -InterfaceAlias "<<INTERFACE_ALIAS>>" `
  -ComponentID "ms_tcpip6"

# Disable IPv6
Disable-NetAdapterBinding `
  -InterfaceAlias "<<INTERFACE_ALIAS>>" `
  -ComponentID "ms_tcpip6" `
  -PassThru

# Verify again
Get-NetAdapterBinding `
  -InterfaceAlias "<<INTERFACE_ALIAS>>" `
  -ComponentID "ms_tcpip6"

Re-enable IPv6 if required:

Enable-NetAdapterBinding `
  -InterfaceAlias "<<INTERFACE_ALIAS>>" `
  -ComponentID "ms_tcpip6"

Step 7: Best Practices

Fix NIC Names
Prevent automatic renaming by assigning a management label:
Terminal window
```
Rename-NetAdapter -Name "<<INTERFACE_ALIAS>>" -NewName "LAN-Primary"
```

Remove Unnecessary Routes
Avoid duplicate or invalid routes by explicitly cleaning them:

Get-NetRoute -AddressFamily IPv4
Remove-NetRoute -DestinationPrefix "0.0.0.0/0" -InterfaceAlias "BackupNIC" -Confirm:$false

Enable or Disable a Network Adapter

# Disable adapter
Disable-NetAdapter -Name "<<INTERFACE_ALIAS>>" -Confirm:$false
# Enable adapter
Enable-NetAdapter -Name "<<INTERFACE_ALIAS>>"

Remove Static IP and Revert to DHCP

Remove-NetIPAddress -InterfaceAlias "<<INTERFACE_ALIAS>>" -IPAddress "<<IP_ADDRESS>>" -Confirm:$false
Set-NetIPInterface -InterfaceAlias "<<INTERFACE_ALIAS>>" -Dhcp Enabled

Conclusion

PowerShell provides a precise and repeatable way to manage Windows Server network configurations.
In multi-NIC environments, routing priority control and explicit DNS configuration are critical for stable operations.
Implement script-based configuration from the start to streamline rebuilds and deployments across environments.

Commands to View and Configure Windows Environment Variables

Fri, 20 Feb 2026 20:14:11 GMT

Overview

Windows environment variables are read from an environment block that is created when a process starts. This article explains in detail the scope of environment variables (process, user, system), how they are persisted, how to view and configure them using CMD and PowerShell, and clarifies exactly how user and system environment variables differ and how they are actually seen from each context.

Notation used for variables

Variable	Example	Description
`<<VAR_NAME>>`	`PATH`	Name of the environment variable to operate on
`<<VALUE>>`	`C:\Tools`	Value to set

Step 1: Scope and storage locations of environment variables

Type	Storage location	Scope	Persistence	Notes
Process environment variables	Memory	Current process only	Temporary	CMD: `set` / PowerShell: `$env:`
User environment variables	`HKCU\Environment`	Current user	Persistent	`setx` / .NET API
System environment variables (Machine)	`HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment`	All users	Persistent	`setx /M` / .NET API (admin)

Process, user, and system are separate layers

Process environment variables: effective only in the current shell/process
User environment variables: specific to the current user profile
System environment variables: shared by all users
PATH often appears as the concatenation of “system PATH + user PATH”

Because “what you see depends on where you look from”, you must decide the intended scope before setting any value.

Step 2: Viewing and setting environment variables in CMD (%VAR%)

2-1. List process environment variables

set

2-2. View a process environment variable

echo %<<VAR_NAME>>%

2-3. Temporarily set a process environment variable (current CMD only)

set <<VAR_NAME>>=<<VALUE>>

2-4. Set persistent environment variables with `setx`

Basic syntax

setx <<VAR_NAME>> "<<VALUE>>"

User scope (default)

setx <<VAR_NAME>> "<<VALUE>>"

System scope (/M required, administrator only)

setx <<VAR_NAME>> "<<VALUE>>" /M

Characteristics of setx

Does not update the current CMD session

Values containing %PATH% are expanded at runtime and stored as fixed text

Long PATH values can be truncated (therefore not recommended for PATH)

Step 3: How to verify user and system environment variables in CMD

User environment variables (HKCU)

reg query HKCU\Environment

System environment variables (HKLM)

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"

Using reg query lets you see the raw value per scope, so you can accurately check whether PATH is concatenated, overridden, or truncated.

Step 4: Safe editing of PATH (warnings when using CMD)

The following is a dangerous pattern and is not recommended:

# setx PATH "%PATH%;C:\Tools"

Reasons:

%PATH% is expanded and saved as a fixed string at that moment
REG_EXPAND_SZ may be converted to REG_SZ, causing loss of %SystemRoot% and other placeholders
PATH may be truncated if it is too long

For editing PATH, you should prefer PowerShell with the .NET API (see below) instead of setx.

Step 5: Viewing and setting environment variables in PowerShell ($env:VAR)

5-1. List process environment variables

Get-ChildItem Env:

5-2. View a process environment variable

$env:<<VAR_NAME>>

5-3. Temporarily set a process environment variable

$env:<<VAR_NAME>> = "<<VALUE>>"

Step 6: Most accurate way to view user and system variables in PowerShell

User environment variables (HKCU)

Get-ItemProperty "HKCU:\Environment"

System environment variables (HKLM)

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"

Step 7: Setting persistent variables with PowerShell (.NET API / recommended)

User scope (User)

[System.Environment]::SetEnvironmentVariable("<<VAR_NAME>>","<<VALUE>>","User")

System scope (Machine, administrator)

[System.Environment]::SetEnvironmentVariable("<<VAR_NAME>>","<<VALUE>>","Machine")

Advantages of this method

Prevents PATH truncation

Preserves REG_EXPAND_SZ where appropriate

Updates values in a safe and predictable way

Step 8: Safely editing the PATH variable (.NET API / strongly recommended)

$add = "C:\Tools"
$current = [System.Environment]::GetEnvironmentVariable("PATH","Machine")
$new = ($current.TrimEnd(';') + ';' + $add).Trim(';')
[System.Environment]::SetEnvironmentVariable("PATH",$new,"Machine")

Step 9: Deleting environment variables

9-1. Delete from the current PowerShell process only

Remove-Item Env:<<VAR_NAME>> -ErrorAction SilentlyContinue

9-2. Delete persistent values (remove from registry)

User

Remove-ItemProperty -Path "HKCU:\Environment" -Name "<<VAR_NAME>>" -ErrorAction SilentlyContinue

System (administrator)

Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" -Name "<<VAR_NAME>>" -ErrorAction SilentlyContinue

Step 10: Applying and verifying changes

10-1. Check value in the current process

Get-ChildItem Env:<<VAR_NAME>>

10-2. Verify in CMD

echo %<<VAR_NAME>>%

10-3. Immediately load the persistent value into the current PowerShell session

$env:<<VAR_NAME>> = [System.Environment]::GetEnvironmentVariable("<<VAR_NAME>>","User")

Step 11: Bulk setting multiple environment variables (user and system)

# User environment
$vars = @{
  "APPDATA_DIR" = "C:\AppData"
  "LOG_PATH"    = "C:\Logs"
  "TOOLS"       = "C:\Tools"
}
foreach ($v in $vars.GetEnumerator()) {
  [System.Environment]::SetEnvironmentVariable($v.Key,$v.Value,"User")
}

# System environment (administrator)
$sysVars = @{
  "JAVA_HOME" = "C:\Program Files\Java\<<VALUE>>"
}
foreach ($v in $sysVars.GetEnumerator()) {
  [System.Environment]::SetEnvironmentVariable($v.Key,$v.Value,"Machine")
}

Summary

Process, user, and system environment variables exist independently.
CMD and PowerShell may show different scopes or combined values (especially for PATH).
To see the true user and system values, inspect HKCU/HKLM directly.
setx can persist values but has serious drawbacks for PATH and is not recommended for it.
The .NET API (SetEnvironmentVariable) is the safest and most reliable way to manage environment variables.

Windows Server Time Synchronization and NTP Configuration

Fri, 20 Feb 2026 20:14:11 GMT

Overview

This article explains how time synchronization works in a Windows Server domain and how to configure NTP using PowerShell.
It focuses on designing around the PDC Emulator as the reference clock, configuring the w32time service, standardizing settings via Group Policy, and key considerations for virtualized environments.

Variable Reference

Variable	Example	Description
`<<PDC_HOST>>`	`DC01.contoso.local`	PDC Emulator (domain time reference)
`<<SECONDARY_DC>>`	`DC02.contoso.local`	Additional domain controller
`<<NTP_SERVER>>`	`ntp.nict.jp`	External NTP server (hostname or IP)
`<<CLIENT_HOST>>`	`SRV01.contoso.local`	Member server or client
`<<DOMAIN_NAME>>`	`contoso.local`	Active Directory domain name

Step 1: Domain Time Hierarchy

Active Directory uses a hierarchical time model:

Tier	Sync Source	Notes
PDC Emulator	External NTP	Single authoritative time source for the forest/domain
Other DCs	PDC Emulator	Maintain domain-wide time consistency
Members/Clients	Nearest DC	Auto-sync for Kerberos tolerance and consistency

In workgroup scenarios, each machine must be configured manually to use an external NTP source.

Step 2: Configure the PDC Emulator with External NTP

Set the PDC Emulator as the domain’s only reliable time source.

# Configure external NTP servers (multiple allowed)
w32tm /config /manualpeerlist:"ntp.nict.jp time.google.com" /syncfromflags:manual /reliable:yes /update

# Advertise as a reliable time source
reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config /v AnnounceFlags /t REG_DWORD /d 5 /f

# Restart the time service
net stop w32time && net start w32time

Verify:

w32tm /query /configuration
w32tm /query /status

Step 3: Configure Other DCs and Members to Follow the Domain

Other DCs and domain members normally follow the PDC automatically. You can enforce it explicitly:

# Follow domain hierarchy
w32tm /config /syncfromflags:domhier /update
net stop w32time && net start w32time

Force a sync and check status:

w32tm /resync /force
w32tm /query /status

Step 4: Standardize Time Settings via GPO (PowerShell-Only Workflow)

Use Group Policy (GPO) to enforce time settings across the domain without using any GUI.

1) Load GPO Module and Inspect Existing Policies

Import-Module GroupPolicy

# List GPOs
Get-GPO -All | Select-Object DisplayName, Id, GpoStatus

# Confirm the Default Domain Policy exists
Get-GPO -Name "Default Domain Policy" | Select-Object DisplayName, ModificationTime

2) Check Current Time Policy Values

# If not found, the value is simply not configured yet
Get-GPRegistryValue -Name "Default Domain Policy" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" `
  -ValueName Type

Get-GPRegistryValue -Name "Default Domain Policy" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" `
  -ValueName NtpServer

A “not found” error here just means the setting hasn’t been defined in the GPO.

3) Enable and Configure the NTP Client

# Enable NTP client
Set-GPRegistryValue -Name "Default Domain Policy" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" `
  -ValueName Enabled -Type DWord -Value 1

# Sync mode (NT5DS = domain hierarchy, NTP = external peers)
Set-GPRegistryValue -Name "Default Domain Policy" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" `
  -ValueName Type -Type String -Value "NT5DS"

# External NTP server (PDC only)
Set-GPRegistryValue -Name "Default Domain Policy" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" `
  -ValueName NtpServer -Type String -Value "<<NTP_SERVER>>,0x8"

# Optional: polling interval (seconds)
Set-GPRegistryValue -Name "Default Domain Policy" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" `
  -ValueName SpecialPollInterval -Type DWord -Value 3600

4) Check GPO Linking and Scope

# Export an HTML report for linkage/scope review
Get-GPOReport -Name "Default Domain Policy" -ReportType Html -Path "$env:TEMP\DefaultDomainPolicy.html"

5) Apply the GPO and Validate

# Apply immediately
gpupdate /force

# Confirm applied policies
gpresult /r

# Generate a detailed HTML report
Get-GPResultantSetOfPolicy -ReportType Html -Path "$env:TEMP\gpresult.html"

6) Confirm Effective Registry Values

reg query "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient"

Example output:

Enabled       REG_DWORD  0x1
Type          REG_SZ     NT5DS
NtpServer     REG_SZ     ntp.nict.jp,0x8
SpecialPollInterval REG_DWORD 0xe10

Notes for Virtualized Environments

In Hyper-V/VMware environments, host and guest time sync can conflict:

Common triggers:

Both host and VM time synchronization enabled
PDC Emulator runs as a VM with a different NTP source
Snapshots or live migrations causing time rollback/drift

Recommendations:

Disable host time sync on the PDC Emulator
Allow host time sync on other VMs if desired
Ensure DC-to-DC synchronization relies solely on w32time

Testing and Troubleshooting

# NTP reachability/offset test
w32tm /stripchart /computer:"<<NTP_SERVER>>" /dataonly /samples:5

# Service state
Get-Service w32time

# Last 10 Time Service events
Get-WinEvent -LogName System | Where-Object { $_.ProviderName -eq "Microsoft-Windows-Time-Service" } |
  Select-Object TimeCreated, Id, LevelDisplayName, Message -First 10

Summary

The PDC Emulator is the domain’s single authoritative time source.
Only the PDC should use external NTP; others follow domhier.
In virtual environments, disable host time sync on the PDC to avoid conflicts.

Disk cleanup and maintenance automation

Fri, 20 Feb 2026 20:14:11 GMT

Overview

This article classifies scheduled disk cleanup tasks on Windows Server into the following four categories, and explains how to automate each of them using dedicated PowerShell scripts:

WinSxS optimization (reducing the component store)
Temp folder cleanup (based on retention days)
Log file rotation (multiple paths with per-path retention)
Event log backup and clear

Variable conventions

Variable	Example	Note
`<<ADMIN_USER>>`	`Administrator`	User account that runs the scheduled tasks
`<<LOG_PATH>>`	`C:\Maintenance\Logs`	Common log directory for all scripts
`<<BACKUP_PATH>>`	`C:\Maintenance\Backups`	Directory for event log backups
`<<DAILY_TEMP_TASK_NAME>>`	`DailyTempCleanup`	Task name for Temp cleanup
`<<DAILY_LOG_TASK_NAME>>`	`DailyLogRotation`	Task name for log rotation
`<<MONTHLY_WINSXS_TASK_NAME>>`	`MonthlyWinSxSCleanup`	Task name for WinSxS optimization
`<<MONTHLY_EVENTLOG_TASK_NAME>>`	`MonthlyEventLogMaintenance`	Task name for event log maintenance

Step 1: Overview of WinSxS folder optimization

C:\Windows\WinSxS is the component store that keeps the history of updates and feature components. It tends to grow over long-term operation. You can optimize it using the following DISM commands:

# Analyze the component store
Dism /Online /Cleanup-Image /AnalyzeComponentStore

# Clean up superseded components
Dism /Online /Cleanup-Image /StartComponentCleanup

# Completely remove old versions (no rollback possible)
Dism /Online /Cleanup-Image /StartComponentCleanup /ResetBase

Since /ResetBase makes it impossible to uninstall older updates, it is safer to run it only at planned times, such as once per month within a maintenance window.

Step 2: Overview of Temp folder cleanup

The directories $env:TEMP and C:\Windows\Temp accumulate temporary files created by installers and applications. Instead of deleting everything blindly, a realistic policy is:

“Delete files older than N days.”

Step 3: Overview of log file rotation

Log directories tend to increase with the number of applications, and long-term retention can heavily consume disk space. Since you often need different retention days per directory, it is better to manage them via a PSD1 configuration file.

Step 4: Overview of event log maintenance

Event logs are critical for troubleshooting and auditing, so they should not be cleared frequently without backup. A common approach is to back them up as .evtx and then clear them, for example about once per month.

# Basic pattern for backup and clear
wevtutil epl System C:\Logs\System_20250101.evtx
wevtutil cl System

Step 5: Script design policy

In this article, we prepare four separate scripts, one per purpose:

cleanup_temp.ps1
Deletes old files in Temp folders (retention days are parameterized).
rotate_logs.ps1
Reads a PSD1 configuration file and deletes .log files under configured folders.
optimize_winsxs.ps1
Runs /StartComponentCleanup /ResetBase on WinSxS and records the reduction amount.
maintain_eventlogs.ps1
Backs up specified event logs and then clears them.

With this structure, you can run each maintenance task independently from Task Scheduler, and flexibly adjust daily/monthly schedules or policies.

Example directory layout:

C:\
└─ Maintenance\
   ├─ cleanup_temp.ps1               # Temp folder cleanup (daily)
   ├─ rotate_logs.ps1                # Log rotation (daily)
   ├─ optimize_winsxs.ps1            # WinSxS optimization (monthly)
   ├─ maintain_eventlogs.ps1         # Event log backup + clear (monthly)
   │
   ├─ log_rotation.psd1              # Log rotation config (multiple paths + retention days)
   │
   ├─ Logs\                          # Execution logs for each script
   │    ├─ cleanup_temp_*.log
   │    ├─ rotate_logs_*.log
   │    ├─ optimize_winsxs_*.log
   │    └─ eventlog_maint_*.log
   │
   └─ Backups\                       # EVTX backups for event logs
        ├─ System_YYYYMMDD.evtx
        ├─ Application_YYYYMMDD.evtx
        └─ Security_YYYYMMDD.evtx

Step 6: Temp cleanup script

This script recursively deletes files and folders older than DaysToKeep days under the folders specified in $TempPaths, and records the results to a log file.
You can override DaysToKeep and LogPath via parameters.

cleanup_temp.ps1

param(
    [string[]]$TempPaths = @("$env:TEMP", "C:\Windows\Temp"),
    [int]$DaysToKeep = 7,
    [string]$LogPath = "<<LOG_PATH>>"
)

if (-not (Test-Path $LogPath)) {
    New-Item $LogPath -ItemType Directory -Force | Out-Null
}

$timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'
$logFile = Join-Path $LogPath "cleanup_temp_$timestamp.log"

function Write-Log($Message) {
    "[{0}] {1}" -f (Get-Date -Format "yyyy-MM-dd HH:mm:ss"), $Message |
        Tee-Object -FilePath $logFile -Append
}

Write-Log "===== Temp cleanup started ====="
Write-Log "DaysToKeep = $DaysToKeep"

$limitDate = (Get-Date).AddDays(-$DaysToKeep)

foreach ($path in $TempPaths) {
    if (-not (Test-Path $path)) {
        Write-Log "Skip: Not found -> $path"
        continue
    }

    Write-Log "Processing: $path"

    Get-ChildItem -Path $path -Recurse -Force -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -lt $limitDate } |
        ForEach-Object {
            try {
                Remove-Item -LiteralPath $_.FullName -Force -Recurse -ErrorAction Stop
                Write-Log "Deleted: $($_.FullName)"
            }
            catch {
                Write-Log "Failed: $($_.FullName) - $($_.Exception.Message)"
            }
        }
}

Write-Log "===== Temp cleanup finished ====="

Step 7: Log rotation script

Log rotation configuration file (PSD1)

This PSD1 file defines multiple directory + retention days pairs. To add a new log directory, just add an entry to this file.

log_rotation.psd1

@{
    RotationTargets = @(
        @{
            Path       = "C:\Logs\App1"
            DaysToKeep = 7
        },
        @{
            Path       = "C:\Logs\App2"
            DaysToKeep = 30
        },
        @{
            Path       = "<<LOG_PATH>>"
            DaysToKeep = 7
        }
    )
}

Log rotation script

This script loads RotationTargets from the PSD1 file and, for each path, deletes .log files older than the configured retention. All operations are written to a log file.

rotate_logs.ps1

param(
    [string]$ConfigPath = "C:\Maintenance\log_rotation.psd1",
    [string]$LogPath = "<<LOG_PATH>>"
)

if (-not (Test-Path $LogPath)) {
    New-Item $LogPath -ItemType Directory -Force | Out-Null
}

$timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'
$logFile = Join-Path $LogPath "rotate_logs_$timestamp.log"

function Write-Log($Message) {
    "[{0}] {1}" -f (Get-Date -Format "yyyy-MM-dd HH:mm:ss"), $Message |
        Tee-Object -FilePath $logFile -Append
}

Write-Log "===== Log rotation started ====="
Write-Log "ConfigPath = $ConfigPath"

if (-not (Test-Path $ConfigPath)) {
    Write-Log "Config file not found. Exit."
    exit 1
}

try {
    $config = Import-PowerShellDataFile -Path $ConfigPath
}
catch {
    Write-Log "Config load failed: $($_.Exception.Message)"
    exit 1
}

foreach ($target in $config.RotationTargets) {
    $targetPath = $target.Path
    $daysToKeep = [int]$target.DaysToKeep

    if (-not (Test-Path $targetPath)) {
        Write-Log "Skip (not found): $targetPath"
        continue
    }

    $limitDate = (Get-Date).AddDays(-$daysToKeep)
    Write-Log "Path=$targetPath DaysToKeep=$daysToKeep Limit=$limitDate"

    Get-ChildItem -Path $targetPath -Recurse -Include *.log -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -lt $limitDate } |
        ForEach-Object {
            try {
                Remove-Item -LiteralPath $_.FullName -Force -ErrorAction Stop
                Write-Log "Deleted: $($_.FullName)"
            }
            catch {
                Write-Log "Failed: $($_.FullName) - $($_.Exception.Message)"
            }
        }
}

Write-Log "===== Log rotation finished ====="

Step 8: WinSxS optimization script

This script measures the size of the WinSxS directory before and after running /StartComponentCleanup /ResetBase, and logs the difference. This allows you to see how much disk space was actually reclaimed.

optimize_winsxs.ps1

param(
    [string]$LogPath = "<<LOG_PATH>>"
)

if (-not (Test-Path $LogPath)) {
    New-Item $LogPath -ItemType Directory -Force | Out-Null
}

$timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'
$logFile = Join-Path $LogPath "optimize_winsxs_$timestamp.log"

function Write-Log($Message) {
    "[{0}] {1}" -f (Get-Date -Format "yyyy-MM-dd HH:mm:ss"), $Message |
        Tee-Object -FilePath $logFile -Append
}

Write-Log "===== WinSxS optimization started ====="

$winsxsPath = "C:\Windows\WinSxS"

Write-Log "Measuring WinSxS size before..."
$sizeBefore = (Get-ChildItem $winsxsPath -Recurse -Force -ErrorAction SilentlyContinue |
               Measure-Object Length -Sum).Sum
$sizeBeforeGB = [math]::Round($sizeBefore / 1GB, 2)
Write-Log "Before: $sizeBeforeGB GB"

Dism /Online /Cleanup-Image /AnalyzeComponentStore |
    Out-File (Join-Path $LogPath "dism_before_$timestamp.txt")

Write-Log "Running StartComponentCleanup /ResetBase..."
Dism /Online /Cleanup-Image /StartComponentCleanup /ResetBase |
    Out-File (Join-Path $LogPath "dism_exec_$timestamp.txt")

Write-Log "Measuring WinSxS size after..."
$sizeAfter = (Get-ChildItem $winsxsPath -Recurse -Force -ErrorAction SilentlyContinue |
              Measure-Object Length -Sum).Sum
$sizeAfterGB = [math]::Round($sizeAfter / 1GB, 2)

Write-Log "After: $sizeAfterGB GB"
Write-Log ("Reduced: {0} GB" -f ([math]::Round(($sizeBefore - $sizeAfter)/1GB,2)))

Dism /Online /Cleanup-Image /AnalyzeComponentStore |
    Out-File (Join-Path $LogPath "dism_after_$timestamp.txt")

Write-Log "===== WinSxS optimization finished ====="

Step 9: Event log maintenance script

This script, for the specified logs (by default System / Application / Security), exports each one to the backup directory as .evtx and then clears the original log. All results are recorded in a detailed log file.

maintain_eventlogs.ps1

param(
    [string]$LogPath = "<<LOG_PATH>>",                  # Destination for .log files
    [string]$BackupPath = "<<BACKUP_PATH>>",            # Destination for EVTX backups
    [string[]]$EventLogs = @("System", "Application", "Security")
)

# Create log directory if missing
if (-not (Test-Path $LogPath)) {
    New-Item $LogPath -ItemType Directory -Force | Out-Null
}

# Create backup directory if missing
if (-not (Test-Path $BackupPath)) {
    New-Item $BackupPath -ItemType Directory -Force | Out-Null
}

$timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'
$logFile = Join-Path $LogPath "eventlog_maint_$timestamp.log"

function Write-Log($Message) {
    "[{0}] {1}" -f (Get-Date -Format "yyyy-MM-dd HH:mm:ss"), $Message |
        Tee-Object -FilePath $logFile -Append
}

Write-Log "===== Event log maintenance started ====="
Write-Log "BackupPath = $BackupPath"

foreach ($name in $EventLogs) {

    # Unique EVTX file per log
    $destEvtx = Join-Path $BackupPath ("{0}_{1}.evtx" -f $name, $timestamp)

    try {
        Write-Log "Export: $name -> $destEvtx"
        wevtutil epl $name $destEvtx

        Write-Log "Clear: $name"
        wevtutil cl $name
    }
    catch {
        Write-Log "Failed: $name - $($_.Exception.Message)"
    }
}

Write-Log "===== Event log maintenance finished ====="

Step 10: Task Scheduler registration examples

The following examples show how to register all maintenance scripts using schtasks.exe.
For a detailed explanation of options like /SC, /D, /ST, /RU, and typical patterns, see:

Managing Task Scheduler with schtasks.exe

Temp cleanup (daily task example)

Runs cleanup_temp.ps1 every day at 02:00, deleting Temp files older than 7 days.
The task runs under <<ADMIN_USER>> with highest privileges (/RL HIGHEST).

schtasks /Create `
  /TN "<<DAILY_TEMP_TASK_NAME>>" `
  /TR "powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Maintenance\cleanup_temp.ps1 -DaysToKeep 7 -LogPath <<LOG_PATH>>" `
  /SC DAILY `
  /ST 02:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Log rotation (daily task example)

Runs rotate_logs.ps1 every day at 02:30, rotating .log files across multiple directories according to the PSD1 configuration.
Retention days are controlled only in log_rotation.psd1.

schtasks /Create `
  /TN "<<DAILY_LOG_TASK_NAME>>" `
  /TR "powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Maintenance\rotate_logs.ps1 -ConfigPath C:\Maintenance\log_rotation.psd1 -LogPath <<LOG_PATH>>" `
  /SC DAILY `
  /ST 02:30 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

WinSxS optimization (monthly task example)

Runs optimize_winsxs.ps1 on the 1st of every month at 03:00, executing StartComponentCleanup /ResetBase and measuring size before/after.
Because this includes a non-reversible operation, align the schedule with a maintenance window.

schtasks /Create `
  /TN "<<MONTHLY_WINSXS_TASK_NAME>>" `
  /TR "powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Maintenance\optimize_winsxs.ps1 -LogPath <<LOG_PATH>>" `
  /SC MONTHLY `
  /D 1 `
  /ST 03:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Event log maintenance (monthly task example)

Runs maintain_eventlogs.ps1 on the 1st of every month at 03:30, backing up event logs (System / Application / Security, etc.) to the backup directory and then clearing them.
Adjust -EventLogs and -BackupPath to match your audit requirements.

schtasks /Create `
  /TN "<<MONTHLY_EVENTLOG_TASK_NAME>>" `
  /TR "powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Maintenance\maintain_eventlogs.ps1 -LogPath <<LOG_PATH>>" `
  /SC MONTHLY `
  /D 1 `
  /ST 03:30 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Summary

This article showed how to separate Windows Server disk maintenance into purpose-specific scripts, and how to use a PSD1 configuration file to flexibly control log rotation targets and retention.

Temp cleanup: daily, configurable retention days
Log rotation: multiple paths + retention days managed via PSD1
WinSxS optimization: monthly, with logged space reduction
Event log maintenance: monthly, with EVTX backup before clear

This structure provides a reusable baseline for automated disk maintenance on Windows Server in production environments and can be extended with additional scripts and scheduled tasks as needed.

Introduction to Ansible

Fri, 20 Feb 2026 20:14:11 GMT

What

This article provides a clear, concise introduction to Ansible, guiding beginners through installation, basic configuration, and running their first automation tasks.

Why

Ansible simplifies IT automation by providing an agentless, easy-to-learn tool for configuration management, application deployment, and task automation. It enhances efficiency, reduces manual errors, and ensures consistent environments.

How

Step 1: Installing Ansible

On Ubuntu/Debian

sudo apt update
sudo apt install -y ansible

On CentOS/RHEL

sudo yum install epel-release
sudo yum install -y ansible

Using pip (for latest version)

pip install ansible

Step 2: Verify Ansible Installation

ansible --version

Step 3: Configure Inventory File

Create an inventory file to define managed hosts.

sudo nano /etc/ansible/hosts

Example content:

[webservers]
192.168.1.10
192.168.1.11

[dbservers]
db01.example.com

Step 4: Test Connection with Ping Module

ansible all -m ping

If using a specific user:

ansible all -m ping -u your_user

Step 5: Create a Simple Playbook

Create a file named install_nginx.yml.

- hosts: webservers
  become: yes
  tasks:
    - name: Install nginx
      apt:
        name: nginx
        state: present

Step 6: Run the Playbook

ansible-playbook install_nginx.yml

Conclusion

Ansible provides a powerful yet simple approach to automate IT tasks. By starting with basic configurations and playbooks, you can quickly scale automation across your infrastructure. Explore advanced features like Roles, Variables, and Ansible Galaxy to enhance your automation workflows.

Configuring Network Settings with PowerShell

Fri, 20 Feb 2026 20:14:11 GMT

What

This article provides a concise guide on how to configure network settings using PowerShell on Windows.

Why

Using PowerShell for network configuration allows automation, consistency, and speed—ideal for system administrators managing multiple systems or remote environments.

How

Step 1: Viewing Network Adapters

List all network adapters on your system.

Get-NetAdapter

Step 2: Assigning a Static IP Address

Set a static IP address, subnet mask, and default gateway.

New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 192.168.1.100 -PrefixLength 24 -DefaultGateway 192.168.1.1

Step 3: Setting DNS Servers

Configure the preferred and alternate DNS servers.

Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("8.8.8.8", "8.8.4.4")

Step 4: Enabling or Disabling a Network Adapter

Disable and then enable a network adapter.

Disable-NetAdapter -Name "Ethernet" -Confirm:$false
Enable-NetAdapter -Name "Ethernet"

Step 5: Removing Static IP Configuration

Remove static IP settings to revert to DHCP.

Remove-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 192.168.1.100 -Confirm:$false
Set-NetIPInterface -InterfaceAlias "Ethernet" -Dhcp Enabled

Step 6: Testing Network Configuration

Use the following command to test connectivity.

Test-Connection -ComputerName google.com -Count 4

Conclusion

PowerShell provides a powerful and efficient way to manage network settings on Windows. By mastering these commands, administrators can streamline network configuration tasks and ensure systems remain consistent and compliant.

Complete Guide to Bash Special Syntax, Variables, and Expansions

Fri, 20 Feb 2026 20:14:11 GMT

Overview

This article provides a comprehensive summary of all special syntax, variables, expansion rules, and control structures used in Bash shell scripting.

Variable Notation

Dynamic or environment-dependent values are denoted as <<variable>>.
All examples below explicitly show their usage.

Variable	Example	Description
`<<var>>`	`name`, `path`, `user`	Arbitrary variable name
`<<default>>`	`guest`, `8080`	Default or fallback value
`<<pattern>>`	`.txt`, `/`	File or string pattern
`<<offset>>`	`0`, `3`	Starting index of substring (0-based)
`<<length>>`	`4`, `10`	Length of substring
`<<prefix>>`	`ENV_`, `HOST`	Prefix pattern for variable names
`<<index>>`	`0`, `1`, `2`	Array or associative key index
`<<file>>`	`/tmp/test.txt`	File path

Step 1: Metacharacters

Symbol	Meaning	Example
`*`	Matches any string	`ls *.txt` → lists all `.txt` files
`?`	Matches any single character	`ls ?.sh` → matches `a.sh`, `b.sh`
`[a-z]`	Range match	`ls [A-Z]*` → files starting with uppercase
`{a,b}`	Brace expansion	`mv {hoge,huga}`
`{1..3}`	Sequence expansion	`touch file{1..3}.txt`
`$`	Variable expansion	`echo $HOME`
`!` (negation)	Logical NOT	`[[ ! -f test.txt ]]`
`!` (history)	History expansion	`!10` → reruns command #10
`~`	Home directory	`cd ~`
`;`	Command separator	`pwd; ls`
`&&`	Execute if previous succeeded	`make && echo OK`
`		`
`&`	Run in background	`sleep 5 &`
`	`	Pipe output
`>`	Redirect stdout	`echo hi > out.txt`
`>>`	Append output	`echo hi >> out.txt`
`<`	Redirect stdin	`wc -l < file.txt`
`()`	Subshell	`(cd /tmp; ls)`
`{}`	Same shell block	`{ echo A; echo B; }`
`\`	Escape character	`echo \$HOME`
`' '`	Literal (no expansion)	`echo '$USER'`
`" "`	Expand variables	`echo "$USER"`

Step 2: Special Variables

Variable	Description	Example
`$0`	Script name	`echo $0` → `script.sh`
`$1–$9`	Positional args	`echo $1`
`$@`	All args as array	`for a in "$@"; do echo $a; done`
`$#`	Arg count	`echo $#`
`$?`	Last exit status	`ls /nope; echo $?`
`$$`	Current PID	`echo $$`
`$!`	Last BG job PID	`sleep 10 & echo $!`
`$-`	Current shell options	`echo $-`
`$_`	Last arg of previous cmd	`echo $_`
`$PPID`	Parent PID	`echo $PPID`
`$RANDOM`	Random number	`echo $RANDOM`
`$SECONDS`	Seconds since shell start	`echo $SECONDS`
`$FUNCNAME`	Function name	`f(){ echo $FUNCNAME; }; f`
`$PIPESTATUS[@]`	Exit status of pipe cmds	`ls

Step 3: Parameter Expansion

Syntax	Description	Example
`${<<var>>}`	Variable expansion	`name=user; echo ${name}`
`${<<var>>:-<<default>>}`	Use default if unset	`echo ${user:-guest}`
`${<<var>>:=<<default>>}`	Assign default if unset	`echo ${port:=8080}`
`${<<var>>:+alt}`	Use alt if set	`x=1; echo ${x:+OK}`
`${<<var>>:?msg}`	Error if unset	`echo ${config:?missing}`
`${#<<var>>}`	String length	`name=user; echo ${#name}`
`${<<var>>%<<pattern>>}`	Remove shortest suffix	`path=/a/b/c; echo ${path%/*}`
`${<<var>>%%<<pattern>>}`	Remove longest suffix	`echo ${path%%/*}`
`${<<var>>#<<pattern>>}`	Remove shortest prefix	`echo ${path#*/}`
`${<<var>>##<<pattern>>}`	Remove longest prefix	`echo ${path##*/}`
`${<<var>>/<<pattern>>/<<repl>>}`	Replace first match	`echo ${msg/foo/bar}`
`${<<var>>//<<pattern>>/<<repl>>}`	Replace all	`echo ${msg// /_}`
`${<<var>>:<<offset>>}`	Substring from offset	`s=abcdef; echo ${s:2}`
`${<<var>>:<<offset>>:<<length>>}`	Substring with length	`echo ${s:1:3}`
`${!<<prefix>>*}`	Vars with prefix	`HOST1=x; HOST2=y; echo ${!HOST*}`
`${!<<var>>}`	Indirect reference	`ref=NAME; NAME=user; echo ${!ref}`
`${<<var>>,}` / `${<<var>>^^}`	Case conversion	`n=abc; echo ${n^^}`
`${<<var>>@Q}`	Quoted form	`x='abc'; echo ${x@Q}`

Step 4: Arrays and Associative Arrays

arr=(a b c)
echo ${arr[<<index>>]}     # Access element
echo ${#arr[@]}            # Count
for i in "${arr[@]}"; do echo $i; done

declare -A map
map[<<index>>]=100
map[name]=user
echo ${map[<<index>>]}     # Value
echo ${!map[@]}            # Keys

Step 5: Arithmetic Expansion

x=5; y=3
echo $((x + y))   # 8
((x *= 2))
echo $x           # 10

Step 6: Conditions and Comparisons

if [ "$USER" = "root" ]; then echo root; fi
if [ "$x" -lt 10 ]; then echo small; fi
if [ -f /etc/passwd ]; then echo exists; fi
s="hello123"
[[ $s =~ [0-9]+ ]] && echo "has number"

Step 7: Command Substitution and Subshells

echo "Today: $(date +%Y-%m-%d)"
(cd /tmp; ls)

Step 8: Redirection and File Descriptors

echo "Hello" > <<file>>
echo "Append" >> <<file>>
wc -l < <<file>>
ls /nope 2> err.log
echo "Error" >&2
exec 3> custom.log
echo "via fd3" >&3
exec 3>&-

File Descriptor Reference

FD	Name	Description	Example
`0`	stdin	Input	`< file.txt`
`1`	stdout	Normal output	`echo test > out.txt`
`2`	stderr	Error output	`ls /nope 2> err.log`
`3+`	Custom	User-defined streams	`exec 3> log.txt`

FD3 is a custom descriptor:

exec 3> process.log
echo "start" >&3
exec 3>&-

Step 9: Traps and Error Handling

set -e
set -u
set -x
set -o pipefail

trap 'echo done' EXIT
trap 'echo error' ERR

Step 10: Job Control

sleep 10 &
jobs
fg %1
bg %1
disown %1
kill %1

Job Reference (`%1`)

Example:

sleep 60 &
jobs

Output:

[1]+ Running sleep 60 &

Symbol	Meaning
`%1`	Job ID 1
`%+`	Current job
`%-`	Previous job

Step 11: Reserved Commands

:        # No-op
true
false
source ~/.bashrc
eval "echo executed"
{ echo A; echo B; }

Summary

This guide comprehensively covered Bash’s special syntax, expansions, variables, metacharacters, and control structures.
Understanding these concepts enables you to write safe, reusable, and automation-ready shell scripts.

How to Set Up an SSH Server on Windows Server

Fri, 20 Feb 2026 20:14:11 GMT

Overview

This article explains how to install and configure OpenSSH Server on Windows Server, including key-based authentication, service setup, and firewall configuration.

Variable Reference

Variable	Example	Description
`<<SERVER>>`	`192.168.1.10`	Target hostname or IP address for SSH connection

Step 1: Install OpenSSH Server

Open PowerShell with administrator privileges and execute:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

Step 2: Start and Enable SSH Service

After installation, start the sshd service and enable automatic startup:

# Start the service
Start-Service sshd

# Enable automatic startup
Set-Service -Name sshd -StartupType Automatic

💡 Note
When sshd is started for the first time, initial configuration files and host keys are automatically generated:

%ProgramData%\ssh\sshd_config (Configuration file)

%ProgramData%\ssh\ssh_host_* (Host keys)

Edit these files only after they have been created.

Step 3: Configure the Firewall

Allow inbound SSH traffic (default port 22) through Windows Defender Firewall:

New-NetFirewallRule -Name "OpenSSH-Server" -DisplayName "OpenSSH Server (sshd)" `
  -Enabled True -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow

Step 4: Configure Key-Based Authentication (Recommended)

See SSH key generation and setup on the client side
Add the public key to the appropriate authorized_keys file:
- For standard users: place it in C:\Users\<User>\.ssh\authorized_keys.
- For Administrators: use %ProgramData%\ssh\administrators_authorized_keys.
On the server, edit sshd_config (typically located at %ProgramData%\ssh\sshd_config) and confirm or add the following lines:
```
PubkeyAuthentication yes
AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
```

Step 5: First Connection and Verification

Connect from the client using:

ssh Administrator@<<SERVER>>

The first connection will prompt you to confirm the host key.
Once logged in, run whoami to confirm that the expected user is connected.

Step 6: Restrictions and Security Hardening

Enhance security by updating the sshd_config file with the following settings:

Port 2222
AllowGroups SSHAdmins
AllowUsers Administrator deployuser
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

Explanation

Port 2222
Changing from the default port 22 reduces the risk of automated attacks.
AllowGroups SSHAdmins
Restricts SSH access to a specific group, minimizing unauthorized access.

⚠️ Note:
From Windows Server 2025 onward, SSH group-based restrictions are applied by default.
Some localized environments may have issues with the built-in “OpenSSH Users” group.
AllowUsers Administrator deployuser
Restricts SSH access to designated user accounts.
PasswordAuthentication no
Disables password-based authentication for improved security.
KbdInteractiveAuthentication no
Disables keyboard-interactive authentication to limit attack surfaces.
PubkeyAuthentication yes
Ensures key-based authentication is enabled for secure access.

Ensure that the SSHAdmins group and deployuser account exist and have minimal privileges.
Set LogLevel VERBOSE to improve audit logging and connection visibility.

Step 7: Check SSH Logs

To view recent SSH event logs in PowerShell:

Get-WinEvent -LogName OpenSSH/Operational `
  | Where-Object { $_.TimeCreated -ge (Get-Date).AddHours(-1) } `
  | Select-Object TimeCreated, Id, LevelDisplayName, Message

💡 Tip
To verify available log names:

wevtutil el | findstr OpenSSH

Use the displayed name for the -LogName parameter.

Conclusion

By setting up OpenSSH Server on Windows Server, you can achieve Linux-like SSH management and secure remote administration.
Proper configuration of key authentication, service behavior, and firewall rules ensures a reliable and hardened remote access environment.

AlmaLinux Initial OS Setup Guide

Fri, 20 Feb 2026 20:14:11 GMT

What

This article provides a practical and minimal initial setup guide for AlmaLinux after a fresh installation, suitable for server environments.

Why

AlmaLinux requires essential system configuration after installation to ensure secure, manageable, and network-accessible operation. These steps establish a solid foundation before deploying any application.

How

Step 1: Change Hostname

hostnamectl set-hostname your-hostname
echo "127.0.0.1   localhost your-hostname" >> /etc/hosts

Step 2: Configure Network (Example: Static IP)

nmcli con mod "eth0" ipv4.addresses 192.168.1.100/24
nmcli con mod "eth0" ipv4.gateway 192.168.1.1
nmcli con mod "eth0" ipv4.dns 8.8.8.8
nmcli con mod "eth0" ipv4.method manual
nmcli con up "eth0"

Step 3: Set Proxy (If Required)

cat <<EOF > /etc/profile.d/proxy.sh
export http_proxy="http://proxy.example.com:8080"
export https_proxy="http://proxy.example.com:8080"
export no_proxy="localhost,127.0.0.1"
EOF
chmod +x /etc/profile.d/proxy.sh
source /etc/profile.d/proxy.sh
echo 'proxy=http://proxy.example.com:8080' >> /etc/dnf/dnf.conf

Step 4: Disable SELinux

sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
setenforce 0

Step 5: Update System

dnf update -y
dnf upgrade -y

Step 6: Configure Firewall

systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload

Step 7: Set Timezone and NTP

timedatectl set-timezone Asia/Tokyo
systemctl enable --now chronyd

Step 8: Create Admin User with SSH Key

useradd adminuser
passwd adminuser
usermod -aG wheel adminuser
mkdir -p /home/adminuser/.ssh
chmod 700 /home/adminuser/.ssh
vi /home/adminuser/.ssh/authorized_keys  # Paste public key
chmod 600 /home/adminuser/.ssh/authorized_keys
chown -R adminuser:adminuser /home/adminuser/.ssh

Step 9: Reboot to Apply SELinux Setting

reboot

Conclusion

This minimal setup prepares an AlmaLinux system for secure and reliable server use. It includes hostname configuration, network and proxy setup, system updates, essential tooling, SELinux disablement, and firewall and time settings.

Managing Task Scheduler with schtasks.exe

Fri, 20 Feb 2026 20:14:11 GMT

Overview

This article explains how to manage the Windows Task Scheduler by using the command-line tool schtasks.exe, which is available by default on Windows Server and Windows client systems.

All examples assume execution from PowerShell, and line continuation is consistently written with the backtick (`) character.

Variable notation

Variable name	Example	Description
`<<SERVER_NAME>>`	`WSRV2025`	Target server name
`<<ADMIN_USER>>`	`Administrator`	Execution account
`<<TASK_NAME>>`	`DailyTempCleanup`	Task name
`<<SCRIPT_PATH>>`	`C:\Maintenance\cleanup_temp.ps1`	Script to execute
`<<LOG_PATH>>`	`C:\Maintenance\Logs`	Log folder
`<<BACKUP_PATH>>`	`C:\Maintenance\Backups`	Event log backup destination

Line continuation in PowerShell vs CMD

All commands in this article are designed to be run from PowerShell.

PowerShell: backtick (`)
CMD: caret (^)

Example (for PowerShell):

schtasks.exe /Create `
  /TN "Example" `
  /SC DAILY `
  /ST 02:00 `
  /TR "powershell.exe -File example.ps1"

Enable the Operational log

The Microsoft-Windows-TaskScheduler/Operational channel may be disabled by default.
Enable it for troubleshooting and detailed history:

wevtutil sl Microsoft-Windows-TaskScheduler/Operational /e:true

Step 1: schtasks.exe subcommand overview

Subcommand	Purpose
`/Create`	Create a new task
`/Delete`	Delete a task
`/Query`	List tasks, show details, export XML
`/Change`	Change task settings
`/Run`	Run a task immediately
`/End`	Stop a running task
`/ShowSid`	Show the SID of the run-as account

Step 2: /Create – basic syntax and main options

Step 2.1 Overall syntax

schtasks.exe /Create `
  /TN "<<TASK_NAME>>" `
  /TR "<<COMMAND_TO_RUN>>" `
  /SC schedule `
  [other options...]

Step 2.2 Commonly used options

Option	Description
`/SC`	Schedule type (DAILY / WEEKLY / MONTHLY / ONLOGON / ONEVENT)
`/MO`	Modifier (interval or position)
`/ST HH:mm`	Start time
`/D`	Run day (1–31 or MON/TUE…)
`/RU`	Run-as user
`/RP`	Password (`*` for interactive input)
`/RL HIGHEST`	Run with highest privileges
`/F`	Force overwrite of existing task

About /MO (modifier)
Parameter that refines the frequency or position of the schedule.

Examples:

“Every 3 hours” → /SC HOURLY /MO 3

“Every 2 weeks” → /SC WEEKLY /MO 2

“Second Wednesday of every month” → /SC MONTHLY /MO SECOND /D WED

“Event-triggered task” → /SC ONEVENT /MO [XPath]

Step 2.3 Available `/SC` schedule types

`/SC`	Description
DAILY	Every day
WEEKLY	Every week
MONTHLY	Every month
ONCE	One-time execution
ONSTART	At system startup
ONLOGON	At user logon
ONIDLE	When the system is idle
ONEVENT	On event log trigger

Step 2.4 Daily task

schtasks.exe /Create `
  /TN "DailyTempCleanup" `
  /TR "powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Maintenance\cleanup_temp.ps1 -DaysToKeep 7 -LogPath <<LOG_PATH>>" `
  /SC DAILY `
  /ST 02:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 2.5 Run at logon (ONLOGON)

schtasks.exe /Create `
  /TN "OnLogonAudit" `
  /SC ONLOGON `
  /TR "powershell.exe -File C:\Scripts\logon_audit.ps1" `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 2.6 Run at startup (ONSTART)

schtasks.exe /Create `
  /TN "OnStartInit" `
  /SC ONSTART `
  /TR "powershell.exe -File C:\Scripts\startup_init.ps1" `
  /RU "SYSTEM" `
  /RL HIGHEST `
  /F

Step 2.7 Event log trigger (ONEVENT)

schtasks.exe /Create `
  /TN "Event101Handler" `
  /SC ONEVENT `
  /EC System `
  /MO "*[System/EventID=101]" `
  /TR "powershell.exe -File C:\Scripts\event_handler.ps1" `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 2.8 Run every 3 hours

schtasks.exe /Create `
  /TN "Every3Hours" `
  /TR "powershell.exe -File script.ps1" `
  /SC HOURLY `
  /MO 3 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 2.9 Run on the second Wednesday of every month

schtasks.exe /Create `
  /TN "SecondWednesdayTask" `
  /TR "powershell.exe -File task.ps1" `
  /SC MONTHLY `
  /MO SECOND `
  /D WED `
  /ST 03:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 2.10 Run on the last day of each month (LASTDAY)

schtasks.exe /Create `
  /TN "LastDayMonthly" `
  /TR "powershell.exe -File script.ps1" `
  /SC MONTHLY `
  /MO LASTDAY `
  /M * `
  /ST 01:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 2.11 Run every 2 weeks

schtasks.exe /Create `
  /TN "Every2Weeks" `
  /TR "powershell.exe -File script.ps1" `
  /SC WEEKLY `
  /MO 2 `
  /D MON `
  /ST 05:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 3: /Query – list and detail view

Option	Description
`/FO TABLE`	Output as a table
`/FO LIST`	Output as key-value list
`/V`	Include detailed information (triggers, actions, etc.)
`/TN "<<TASK_NAME>>"`	Show only the specified task

schtasks.exe /Query /FO TABLE
schtasks.exe /Query /FO LIST /V
schtasks.exe /Query /TN "<<TASK_NAME>>" /FO LIST /V

Step 4: /Change – modify an existing task

Option	Description
`/TN`	Target task name
`/RU`	Change run-as user
`/RP *`	Enter new password interactively
`/TR`	Replace the command to be executed
`/ENABLE` `/DISABLE`	Enable / disable the task

Note: /Change cannot change trigger definitions such as /SC, /MO, /D, /M.
If you need to change the schedule itself, it is safer to /Delete the task and recreate it with /Create.

Change run-as user

schtasks.exe /Change `
  /TN "<<TASK_NAME>>" `
  /RU "<<ADMIN_USER>>" `
  /RP *

Change the command

schtasks.exe /Change `
  /TN "<<TASK_NAME>>" `
  /TR "powershell.exe -File <<SCRIPT_PATH>> -LogPath <<LOG_PATH>>"

Enable / disable a task

schtasks.exe /Change /TN "<<TASK_NAME>>" /ENABLE
schtasks.exe /Change /TN "<<TASK_NAME>>" /DISABLE

Step 5: /Run (run now) and /End (stop)

Option	Description
`/Run`	Run the task immediately
`/I`	Ignore schedule constraints (start/end date)
`/End`	Stop a running task
`/TN`	Target task name

schtasks.exe /Run /TN "<<TASK_NAME>>"
schtasks.exe /Run /TN "<<TASK_NAME>>" /I

schtasks.exe /End /TN "<<TASK_NAME>>"

Step 6: Import a task from XML

XML import

Option	Description
`/XML file`	Create a task from an XML definition
`/RU`	Override the run-as account
`/RP *`	Enter the password interactively

schtasks.exe /Create `
  /TN "<<TASK_NAME>>" `
  /XML "C:\TaskTemplates\<<TASK_NAME>>.xml" `
  /RU "<<ADMIN_USER>>" `
  /RP *

XML export (via /Query)

Option	Description
`/XML ONE`	Export the task definition as a single XML block
`> file`	Redirect the output to a file

schtasks.exe /Query `
  /TN "<<TASK_NAME>>" `
  /XML ONE `
  > C:\TaskTemplates\<<TASK_NAME>>.xml

Step 8: /Delete – remove a task

Option	Description
`/Delete`	Delete mode
`/TN`	Target task name
`/F`	Force delete without prompting

schtasks.exe /Delete /TN "<<TASK_NAME>>" /F

Step 9: /ShowSid – display the SID

Option	Description
`/ShowSid`	Show the SID associated with the run-as user
`/TN`	Target task name

schtasks.exe /ShowSid /TN "<<TASK_NAME>>"

Step 10: Managing tasks on remote servers

Option	Description
`/S "<<SERVER_NAME>>"`	Remote server name
`/U`	User for the remote connection
`/P *`	Password for the remote user (`*` for interactive input)
Others	Same task definition options as for local tasks

schtasks.exe /Create `
  /S "<<SERVER_NAME>>" `
  /U "<<ADMIN_USER>>" `
  /P * `
  /TN "<<TASK_NAME>>" `
  /TR "powershell.exe -File <<SCRIPT_PATH>>" `
  /SC DAILY `
  /ST 02:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Conclusion

By using schtasks.exe, you can tightly integrate Task Scheduler into server build procedures and automation workflows.

Combining /SC and /MO allows you to express flexible schedules (daily, weekly, monthly, nth weekday, last day of month, and more).
Triggers such as ONLOGON, ONSTART and ONEVENT enable event-driven automation (logon, startup, log events).
With /Query /XML and /Create /XML, you can export and re-import task definitions as reusable XML templates.
The /Change, /Run, /End, /Delete and /ShowSid subcommands cover the main life-cycle operations for scheduled tasks.
By adding /S /U /P, you can roll out identical task definitions to multiple remote servers, supporting large-scale automation scenarios.

Building a Squid Proxy Server on Linux

Fri, 20 Feb 2026 20:14:11 GMT

What

This article explains how to install and configure a basic Squid proxy server on Linux and how to configure clients to use it.

Why

Squid is a powerful caching proxy server that improves browsing performance, enables web filtering, and provides access control. Proper client configuration ensures traffic is routed through the proxy securely and effectively.

How

Step 1: Install Squid

On RHEL-based systems (AlmaLinux, Rocky, CentOS):

sudo dnf install squid -y

On Debian-based systems (Ubuntu):

sudo apt update
sudo apt install squid -y

Step 2: Configure the Squid Proxy

Edit /etc/squid/squid.conf:

sudo nano /etc/squid/squid.conf

Minimal working config:

http_port 3128

acl localnet src 192.168.0.0/16
http_access allow localnet
http_access deny all

dns_v4_first on

Recommended tuning additions:

cache_mem 64 MB
maximum_object_size_in_memory 512 KB
maximum_object_size 20 MB
access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log

Step 3: Enable and Start Squid

sudo systemctl enable --now squid

Step 4: Configure the Firewall

firewalld:

sudo firewall-cmd --add-port=3128/tcp --permanent
sudo firewall-cmd --reload

UFW:

sudo ufw allow 3128/tcp

Step 5: Configure Client Devices

On Linux (temporary shell setting):

export http_proxy="http://<squid-ip>:3128"
export https_proxy="http://<squid-ip>:3128"

On Linux (persistent system-wide):

Edit /etc/environment:

http_proxy="http://<squid-ip>:3128"
https_proxy="http://<squid-ip>:3128"

On Windows (PowerShell, current user only):

netsh winhttp set proxy <squid-ip>:3128

To reset:

netsh winhttp reset proxy

Step 6: Test the Connection

From a client:

curl -x http://<squid-ip>:3128 http://example.com

On the Squid server:

sudo tail -f /var/log/squid/access.log

Conclusion

This setup provides a simple, functional proxy server and client configuration without relying on PAC files. It offers centralized control, logging, and flexibility for network traffic management.

PowerShell Scripting Best Practices Guide

Fri, 20 Feb 2026 20:14:11 GMT

What

This article provides a comprehensive guide on PowerShell scripting best practices, focusing on code structure, output formatting, error handling, performance optimization, and security measures.

Why

Following best practices in PowerShell scripting ensures your scripts are readable, maintainable, secure, and performant. It reduces technical debt, enhances collaboration, and minimizes risks in production environments.

How

Tool and Controller Design

Decide Whether You’re Coding a ‘Tool’ or a ‘Controller’

Tool: Reusable functions/modules.
Controller: Automates a specific task, not designed for reuse.

Make Your Code Modular

Use functions and script modules to maximize reusability.

Use Standard Naming Conventions

Follow Verb-Noun format using approved PowerShell verbs (Get-Verb).

Standardize Parameter Naming

Use names like $ComputerName instead of custom prefixes.

Output Raw Data from Tools

Tools should output minimally processed data for flexibility.

Controllers Should Output Formatted Data

Controllers can format data for user-friendly reports.

Example

function Get-DiskInfo {
    param ([string]$ComputerName)
    Get-WmiObject Win32_LogicalDisk -ComputerName $ComputerName
}

Avoid Reinventing the Wheel

Use built-in cmdlets like Test-Connection instead of custom ping functions.

# Preferred
Test-Connection $ComputerName -Quiet

Writing Parameter Blocks

Always Write Help

Include comment-based help with .SYNOPSIS, .DESCRIPTION, and at least one .EXAMPLE.

function Test-Help {
    <#
        .SYNOPSIS
            Demonstrates proper help documentation.
        .EXAMPLE
            Test-Help -MandatoryParameter "Example"
            Runs the Test-Help function with a mandatory parameter.
    #>
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true)]
        [Alias("MP")]
        [String]$MandatoryParameter
    )
}

Use `[CmdletBinding()]`

Enables common parameters like -Verbose, -Debug, -ErrorAction.

Support `-WhatIf` and `-Confirm`

For state-changing commands, use SupportsShouldProcess.

[CmdletBinding(SupportsShouldProcess, ConfirmImpact = "Medium")]
param ([switch]$Force)

Strongly Type Parameters

Always define parameter types for validation and clarity.

param (
    [string]$Name,
    [int]$Count
)

Use `[switch]` Correctly

Defaults to $false.
Use boolean logic, avoid treating it as three-state.

Formatting Output

Avoid `Write-Host` Unless Necessary

Use Write-Verbose, Write-Debug, or Write-Output appropriately.

Use `Write-Progress` for Progress Updates

Write-Progress -Activity "Processing" -Status "50% Complete" -PercentComplete 50

Use Format Files for Custom Objects

Define .format.ps1xml files instead of inline formatting.

Output Only One Type at a Time

Use [OutputType()] and avoid mixing object types.

Error Handling Best Practices

Use `-ErrorAction Stop` with Cmdlets

Force terminating errors to handle them with try-catch.

try {
    Get-Item "C:\InvalidPath" -ErrorAction Stop
} catch {
    Write-Warning "Item not found."
}

Use `$ErrorActionPreference` for Non-Cmdlets

Temporarily set to 'Stop' around risky operations.

Avoid Flags and `$?` for Error Handling

Use structured try-catch blocks instead.

Copy `$Error[0]` or `$_` Immediately in `catch`

catch {
    $errorDetails = $_
    Write-Error "An error occurred: $($errorDetails.Exception.Message)"
}

Performance Optimization

PERF-01 Measure Performance When It Matters

Use Measure-Command to benchmark different approaches, especially with large datasets.

Measure-Command {
    foreach ($item in $data) { Process-Item $item }
}

PERF-02 Balance Performance and Readability

For small datasets, prioritize readability.
For large datasets, consider streaming and low-level .NET techniques if necessary.

Readable but less performant:

$content = Get-Content -Path file.txt
foreach ($line in $content) {
    Do-Something -Input $line
}

Streamlined for performance:

Get-Content -Path file.txt | ForEach-Object {
    Do-Something -Input $_
}

High-performance with .NET:

$sr = New-Object System.IO.StreamReader "file.txt"
while ($sr.Peek() -ge 0) {
    $line = $sr.ReadLine()
    Do-Something -Input $line
}

PERF-03 Prefer Language Features Over Cmdlets for Speed

Language constructs (foreach) > .NET methods > Scripts > Cmdlets/Pipeline
Always measure before optimizing prematurely.

Security Best Practices

Always Use `PSCredential` for Credentials

Avoid plain text passwords. Accept credentials as parameters using [Credential()].

param (
    [System.Management.Automation.PSCredential]
    [System.Management.Automation.Credential()]
    $Credential
)

If passing to APIs:

$Insecure.SetPassword($Credential.GetNetworkCredential().Password)

Use `SecureString` for Sensitive Data

Prompt securely and store encrypted values.

$Secure = Read-Host -Prompt "Enter Secure Data" -AsSecureString

Convert SecureString to plain text safely:

$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Secure)
$PlainText = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)
[System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($BSTR)

Save Credentials Securely

Use Export-CliXml for storing credentials.

Get-Credential | Export-CliXml -Path C:\secure\cred.xml
$Credential = Import-CliXml -Path C:\secure\cred.xml

Save Encrypted Strings

ConvertFrom-SecureString -SecureString $Secure | Out-File -Path "${Env:AppData}\secure.bin"
$Secure = Get-Content -Path "${Env:AppData}\secure.bin" | ConvertTo-SecureString

Conclusion

By following these PowerShell best practices across design, documentation, output handling, error management, performance, and security, you can create robust, maintainable, and efficient scripts suitable for both small tasks and enterprise-level automation. Always strive to balance readability, performance, and security to deliver high-quality solutions.

SSH Public Key Authentication Client Setup (Windows/Linux)

Fri, 20 Feb 2026 20:14:11 GMT

Overview

This article explains how to configure SSH public key authentication on the client side for secure server access. The instructions apply to both Windows and Linux environments.

Prerequisites

SSH client is pre-installed (Windows 10 or later, Linux default)
The target server allows public key authentication
The user account exists on the server

Key Types and Encryption Methods

SSH supports several key types, such as RSA, ECDSA, and Ed25519. The following table compares their characteristics, recommended use cases, and compatibility.

Key Type	Features	Recommended Use	Compatibility
RSA	Widely used, adjustable key length, high versatility	Legacy systems or high-compatibility environments	Very High
ECDSA	Uses elliptic curve cryptography, faster with shorter keys	Performance-oriented environments	Moderate
Ed25519	Modern standard, fast, highly secure, small key size	New deployments, security-critical systems	Supported on OpenSSH 6.5+

Recommendation: Ed25519 is the preferred standard. It provides better security and performance, while RSA remains widely used for compatibility.

Variable Conventions

The following variables are used in examples. Replace them with your actual environment values.

Variable	Example	Description
`<<USERNAME>>`	`exampleuser`	Your local login username
`<<SERVER>>`	`192.168.1.10`	Target host or IP address
`<<USER>>`	`ubuntu` or `ec2-user`	SSH username on the server
`<<EMAIL_ADDRESS>>`	`user@example.com`	Optional comment for key identification

Note for Windows Users
The Windows commands in this article assume PowerShell.
If using Command Prompt, replace $env:USERPROFILE with %USERPROFILE%.

Windows Client Setup

Step 1: Generate SSH Key Pair

Open PowerShell as Administrator and run:

ssh-keygen -t ed25519 -C "<<EMAIL_ADDRESS>>"

Example output:

Generating public/private ed25519 key pair.
Enter file in which to save the key (/C:/Users/<<USERNAME>>/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):

Public Key: $env:USERPROFILE\.ssh\id_ed25519.pub
Private Key: $env:USERPROFILE\.ssh\id_ed25519

Step 2: Copy Public Key to Server

cat $env:USERPROFILE\.ssh\id_ed25519.pub | ssh <<USER>>@<<SERVER>> "mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys; chmod 600 ~/.ssh/authorized_keys"

Alternatively, manually paste the content of .pub into the server’s ~/.ssh/authorized_keys.

Step 3: Verify Connection

ssh -i $env:USERPROFILE\.ssh\id_ed25519 <<USER>>@<<SERVER>>

Linux Client Setup

Step 1: Generate SSH Key Pair

ssh-keygen -t ed25519 -C "<<EMAIL_ADDRESS>>"

Public Key: ~/.ssh/id_ed25519.pub
Private Key: ~/.ssh/id_ed25519

Step 2: Register Public Key on Server

Use ssh-copy-id for automated setup:

ssh-copy-id -i ~/.ssh/id_ed25519.pub <<USER>>@<<SERVER>>

Or manually append the public key to ~/.ssh/authorized_keys.

Step 3: Verify Connection

ssh -i ~/.ssh/id_ed25519 <<USER>>@<<SERVER>>

Using Passphrase-Protected Keys

If you generated a key with a passphrase, configure an SSH agent to avoid entering it every time.
The agent securely stores private keys in memory and automatically signs authentication requests.

Step 1: Start SSH Agent

Windows:

Set-Service -Name ssh-agent -StartupType Manual
Start-Service ssh-agent

Linux:

eval "$(ssh-agent -s)"

Auto-Start Configuration

Windows:

Set-Service -Name ssh-agent -StartupType Automatic

Linux: Add the following to ~/.bashrc or ~/.profile:

eval "$(ssh-agent -s)" > /dev/null

Step 2: Add Key to Agent

Windows:

ssh-add $env:USERPROFILE\.ssh\id_ed25519

Linux:

ssh-add ~/.ssh/id_ed25519

Step 3: Verify Registration

ssh-add -l

You should see the fingerprint of your registered key.

SSH Config File for Simplified Access

Avoid repetitive command typing by creating an SSH config file.

Path:

Linux: ~/.ssh/config
Windows: C:\Users\<<USERNAME>>\.ssh\config

Example Configuration

Host myserver
    HostName <<SERVER>>
    User <<USER>>
    IdentityFile ~/.ssh/id_ed25519
    Port 22

Then simply connect using:

ssh myserver

For multiple servers:

Host web
    HostName 192.168.1.10
    User ubuntu
    IdentityFile ~/.ssh/id_ed25519

Host db
    HostName 192.168.1.11
    User ec2-user
    IdentityFile ~/.ssh/id_ed25519

Tip: Use separate key pairs per host for higher security.

Verification and Debugging

To verify or troubleshoot connections:

ssh -vvv -i ~/.ssh/id_ed25519 <<USER>>@<<SERVER>>

Look for:

debug1: Authentication succeeded (publickey)

Troubleshooting

Common failure causes:

Server doesn’t allow public key authentication
→ Check PubkeyAuthentication yes in /etc/ssh/sshd_config.
Incorrect or missing authorized_keys entry
→ Ensure key is properly copied to the correct user’s .ssh directory.
Wrong username or host
→ Verify connection parameters and permissions.

Conclusion

SSH public key authentication enables secure, passwordless server access.
Both Windows and Linux support easy setup via ssh-keygen.
Proper key management and permissions are essential for a reliable configuration.

NIC Teaming Configuration and Redundancy Design

Fri, 20 Feb 2026 20:14:11 GMT

Overview

This article explains how to configure NIC Teaming and design redundancy in a Windows Server environment. It covers how to create an LBFO (Load Balancing and Failover) team using Switch Independent mode + Dynamic Load Balancing, perform failover testing, and monitor related logs.

Variable Conventions

The following variables represent environment-specific values. Replace them as needed for your configuration.

Variable	Example	Description
`<<TEAM_NAME>>`	`Team01`	Team name
`<<ADAPTER1>>`	`Ethernet1`	Physical NIC 1
`<<ADAPTER2>>`	`Ethernet2`	Physical NIC 2
`<<TEAM_NIC>>`	`TeamedNIC`	Virtual team interface name
`<<STATIC_IP>>`	`192.168.10.100`	Static IP address
`<<PREFIX_LENGTH>>`	`24`	Subnet prefix length
`<<GATEWAY>>`	`192.168.10.1`	Default gateway
`<<DNS_SERVER>>`	`192.168.10.10`	DNS server address

Step 1: Check NIC Configuration

Verify the status of the physical NICs that will be used in the team. Ensure all adapters have consistent speed, vendor, and driver versions.

# List available NICs
Get-NetAdapter | Select-Object Name, Status, LinkSpeed, InterfaceDescription, MacAddress

Adapters with Status = Up are eligible for teaming.

Step 2: Create the Team (LBFO Configuration)

Load Balancing Algorithm Comparison (Common Across LBFO Modes)

Algorithm	Supported Modes	Description	Typical Use Case
AddressHash	Switch Independent / Static / LACP	Distributes traffic based on source/destination IP and port hash	General server communication
HyperVPort	Switch Independent / LACP	Distributes per VM or virtual NIC, balancing receive traffic	Hyper-V environments
Dynamic	Switch Independent / LACP	Sends via hash, adjusts receive dynamically based on adapter load	Default and recommended
TransportPorts	Switch Independent	Distributes by TCP/UDP port	High-traffic applications
IPAddresses	Switch Independent	Hashes based on IP pairs	Static IP environments
MACAddresses	Static / LACP	Simple MAC-based distribution	Legacy or fixed setups

Use Switch Independent mode (no switch configuration required) + Dynamic load balancing for optimal performance.

# Create NIC Team
New-NetLbfoTeam `
  -Name "<<TEAM_NAME>>" `
  -TeamMembers "<<ADAPTER1>>","<<ADAPTER2>>" `
  -TeamingMode SwitchIndependent `
  -LoadBalancingAlgorithm Dynamic `
  -TeamNicName "<<TEAM_NIC>>"

Verify configuration:

Get-NetLbfoTeam | Format-Table Name, TeamingMode, LoadBalancingAlgorithm, Status

Step 3: Configure Team Interface

Assign an IPv4 address to the created team NIC. For IPv6, add the parameter -AddressFamily IPv6.

# Set IP configuration
New-NetIPAddress -InterfaceAlias "<<TEAM_NIC>>" -IPAddress "<<STATIC_IP>>" -PrefixLength <<PREFIX_LENGTH>> -DefaultGateway "<<GATEWAY>>"

# Set DNS server
Set-DnsClientServerAddress -InterfaceAlias "<<TEAM_NIC>>" -ServerAddresses "<<DNS_SERVER>>"

Verify settings:

Get-NetIPAddress -InterfaceAlias "<<TEAM_NIC>>"
Get-DnsClientServerAddress -InterfaceAlias "<<TEAM_NIC>>"

Step 4: Check Team Status

Review the operational state of the team members.

# Check team member status
Get-NetLbfoTeamMember -Team "<<TEAM_NAME>>"

All members should show Active. If not, check cable connections and switch port configurations.

Step 5: Perform Failover Test

Validate that redundancy functions properly.

Disconnect <<ADAPTER1>> or disable the NIC:

Disable-NetAdapter -Name "<<ADAPTER1>>" -Confirm:$false

Check the status and re-enable the adapter:

Get-NetLbfoTeamMember -Team "<<TEAM_NAME>>"
Enable-NetAdapter -Name "<<ADAPTER1>>"

If <<ADAPTER1>> shows Inactive while <<ADAPTER2>> remains Active and connectivity is preserved, failover is working correctly.
Repeat in reverse to confirm bidirectional failover.

Step 6: Event Log and Monitoring

Events related to LBFO NIC Teaming are logged here:

# LBFO provider logs
Get-WinEvent -LogName "Microsoft-Windows-MsLbfoProvider/Operational" -MaxEvents 20 |
  Select-Object TimeCreated, Id, LevelDisplayName, Message

System event logs can also be monitored:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-MsLbfoSysEvtProvider'} -MaxEvents 20 |
  Select-Object TimeCreated, Id, LevelDisplayName, Message

Step 7: Modify or Remove Team Configuration

Use the following commands to change or remove the team.

# Change algorithm (example: Hyper-V Port)
Set-NetLbfoTeam -Name "<<TEAM_NAME>>" -LoadBalancingAlgorithm HyperVPort

# Remove the team
Remove-NetLbfoTeam -Name "<<TEAM_NAME>>"

After removal, reassign IP settings to each physical NIC as needed.

Step 8: Redundancy Design Considerations

Configuration Type	Features	Recommended Use
Switch Independent + Dynamic	No switch setup, bidirectional load balancing	Small to medium physical servers
LACP	Requires LAG setup on the switch, better throughput	Networks supporting LACP
Active/Standby	One active, one standby for clear redundancy	Environments prioritizing stability

In virtualized environments, LBFO is deprecated; use SET (Switch Embedded Teaming) instead.

Conclusion

NIC Teaming via LBFO offers simple yet robust redundancy and load balancing.
The Switch Independent + Dynamic configuration is especially easy to manage and suitable for small to medium server deployments.
Regular event monitoring and periodic failover testing ensure stable operation.
For Hyper-V or SDN environments, SET is the recommended approach.

Regular Expressions Reference

Fri, 20 Feb 2026 20:14:11 GMT

Overview

A practical and portable regular expression reference for real-world use.
No flag syntax (e.g., (?s), (?m), (?i)) is used to ensure compatibility across OS and tools.
Only safe, environment-independent patterns are included.

Newline Codes and Platform Differences

OS	Newline Code	Recommended Pattern	Key Point
Windows	`\r\n`	`\r?\n`	Universal pattern for CRLF/LF
macOS / Linux	`\n`	`\r?\n`	Compatible across all platforms

Key Notes

Use \r?\n to safely detect or replace newlines on Windows/macOS/Linux.
To match blocks including newlines, use (?:.|\r|\n) since . alone excludes line breaks.

Part 1: Basic Syntax Overview

1-1. Character Classes and Ranges

Syntax	Meaning	Example	Match
`.`	Any single char except newline	`a.c / abc`	`abc`
`[abc]`	One of a, b, or c	`bag`	`a`
`[^0-9]`	Any non-digit	`a1`	`a`
`[A-Z0-9]`	Uppercase letter or digit	`X8z`	`X`,`8`

1-2. Quantifiers

Syntax	Meaning	Example	Match
`*`	Zero or more	`goooogle`	`goooo`
`+`	One or more	`google`	`oo`
`?`	Zero or one	`color colour`	Both
`{n}`	Exactly n times	`a{3}` / `aaa`	`aaa`
`{n,}`	n or more	`a{2,}` / `aaaa`	`aaaa`
`{n,m}`	Between n and m	`a{2,4}` / `aaaaa`	`aaaa`

1-3. Anchors

Syntax	Meaning	Example	Match
`^abc`	Line start	`abc\nzabc`	`abc` (line 1)
`abc$`	Line end	`zabc\nabc`	Both line ends
`\bword\b`	Word boundary	`word words`	`word`
`\Bing`	Non-boundary	`ringing`	second `ing`

1-4. Shortcuts

Syntax	Meaning	Example	Match
`\d`	Digit `[0-9]`	`ver2.10`	`2`,`10`
`\D`	Non-digit	`a1`	`a`
`\w`	Alphanumeric + `_`	`a_b-1`	`a_b`
`\W`	Non-alphanumeric	`a#`	`#`
`\s`	Whitespace (tab/newline etc.)	`a b`	space
`\S`	Non-whitespace	`a b`	`a`,`b`
`\t`	Tab	`a\tb`	`a[TAB]b`

1-5. Escapes and Special Characters

Syntax	Meaning	Example	Match
`\.`	Literal dot	`a.c`	`a.c`
`\*`	Asterisk	`a*b`	`a*b`
`\+`	Plus sign	`a+b`	`a+b`
`\?`	Question mark	`what?`	`what?`
`$` `$`	Parentheses	`(test)`	`(test)`
`\|`	Pipe	`a	b`
`\\`	Backslash	`C:\\path`	`\\`
`\^`	Caret	`^abc`	`^abc`
`\$`	Dollar	`total$`	`$`
`\[ \]`	Brackets	`[abc]`	`[abc]`
`\{ \}`	Braces	`{a,b}`	`{a,b}`

Part 2: Grouping, Alternation, Lookaround

Syntax	Purpose	Example	Match
`(abc)+`	Repeat as group	`abcabcx`	`abcabc`
`(?:jpg	png)`	Non-capturing OR	`file.png`
`foo	bar`	OR condition	`bar`
`\d+(?=円)`	Numbers before “円”	`合計100円`	`100`
`^(?!.error).`	Line not containing “error”	`ok\nerror`	`ok`
`(?<=￥)\d+`	Number after “￥”	`￥300`	`300`
`(?<!Mr\.)\s[A-Z]`	Uppercase not after “Mr.”	`Ms. Alice`	`A`

Part 3: Matching Multi-line Text

Use Case	Pattern	Example	Match
HTML block	` (?:.	\r	\n)*?`
Log entry	`^[\d{4}-\d{2}-\d{2} [\d:]+](?:.	\r	\n)*?(?=^[\d{4}-\d{2}-\d{2}
Markdown code block	“ ```(?:.	\r	\n)*?``` “
Comment (`/…/`)	`/*(?:.	\r	\n)?/`

Part 4: Pattern Library (Filtering / Extraction)

Purpose	Pattern	Example	Match
Digits only	`^\d+$`	`123`	`123`
Alphanumeric	`^[A-Za-z0-9]+$`	`user01`	`user01`
Email (simple)	`^[\w.-]+@[\w.-]+\.[A-Za-z]{2,}$`	`a@b.com`	`a@b.com`
URL	`https?://[\w.-]+\.[A-Za-z]{2,}(/[\w./?=&%-]*)?`	`https://ex.com/a`	`https://ex.com/a`
ISO date	`\d{4}-\d{2}-\d{2}`	`2025-10-30`	`2025-10-30`
Intl. phone	`\+\d{1,3}[\s-]?\d{1,14}`	`+81 90 1234 5678`	full
Strong password	`^(?=.[a-z])(?=.[A-Z])(?=.*\d).{8,}$`	`Abcd1234`	full
HTML comment	`<!—(?:.	\r	\n)*?—>`
Lines without “error”	`^(?!.error).`	`ok\nerror`	`ok`

Part 5: Replacement Examples

Task	Pattern	Replace	Input	Output
Reverse words	`(\w+)\s+(\w+)`	`${2} ${1}`	`John Doe`	`Doe John`
Change delimiter	`;`	`,`	`a;b;c`	`a,b,c`
Normalize spaces	`\s{2,}`		`a b`	`a b`
Remove HTML tags	`<[^>]+>`	“	`<p>a</p>`	`a`
Trim spaces	`^\s+	\s+$`	“	`a`
Newline → space	`\r?\n`		`a\nb`	`a b`
Remove end comment	`//.*$`	“	`x=1;//note`	`x=1;`
Unify date format	`(\d{4})/(\d{2})/(\d{2})`	`${1}-${2}-${3}`	`2025/10/30`	`2025-10-30`
Compress duplicate lines	`^(.*)(\r?\n\1)+$`	`${1}`	repeated lines	single line

Summary

Regular expressions are a cross-platform and multilingual tool for text processing, scripting, log parsing, and data cleanup.
Using flag-independent, portable patterns ensures stability across diverse environments and editors.

Windows Firewall Configuration

Fri, 20 Feb 2026 20:14:11 GMT

Overview

This article explains how to configure Windows Defender Firewall (formerly Windows Firewall) on Windows Server. It covers design guidance for Domain/Private/Public profiles, optimization of inbound/outbound policies, log collection and analysis, and practical centralized administration via GPO and scripts.

Variable Conventions

Variable	Example	Description
`<<SERVER_NAME>>`	`SRV-CORE01`	Target server hostname
`<<LOG_PATH>>`	`C:\FirewallLogs\pfirewall.log`	Firewall log file path
`<<OU_NAME>>`	`Servers`	OU name

Step 1: Understand Profiles and Plan Application

Windows Defender Firewall provides three profiles:

Profile	Purpose	Typical Environment
Domain	AD-joined networks	Corporate LAN, VPN
Private	Trusted standalone network	Test environments, isolated networks
Public	Untrusted network	Public Wi-Fi, lab/VM

Each profile is independently configurable and switches automatically based on network identification.

Verification command:

# Check each profile's state and default policies
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction

Step 2: Set Baseline Policies (Default Behavior)

By default, Windows Defender Firewall blocks inbound and allows outbound traffic.
Keep this behavior, or introduce explicit outbound control when needed.

# Explicitly set default policies
Set-NetFirewallProfile -Profile Domain,Private,Public `
  -DefaultInboundAction Block `
  -DefaultOutboundAction Allow `
  -NotifyOnListen True

Note: In high-security environments, use -DefaultOutboundAction Block and then allow only necessary outbound traffic (e.g., DNS, NTP, WSUS): a whitelist approach.

Step 3: Operate and Manage Firewall Rules

List and Search Rules

# All rules
Get-NetFirewallRule

# Rules containing "RDP" in the display name
Get-NetFirewallRule | Where-Object DisplayName -Like "*RDP*"

# Only enabled rules
Get-NetFirewallRule | Where-Object Enabled -eq "True"

Create New Rules

# Allow inbound RDP (TCP/3389) on Domain profile
New-NetFirewallRule -DisplayName "Allow RDP (Domain)" `
  -Direction Inbound -Protocol TCP -LocalPort 3389 `
  -Action Allow -Profile Domain

# Allow outbound NTP (UDP/123)
New-NetFirewallRule -DisplayName "Allow NTP Outbound" `
  -Direction Outbound -Protocol UDP -LocalPort 123 `
  -Action Allow -Profile Domain,Private,Public

Parameter Reference: Examples and Formats

Item	Parameter	Example	Accepted Values/Format
Direction	`-Direction`	`Inbound` / `Outbound`	`Inbound`, `Outbound`
Action	`-Action`	`Allow` / `Block`	`Allow`, `Block`
Protocol	`-Protocol`	`TCP` / `UDP` / `ICMPv4` / `ICMPv6` / `Any`	As listed; ICMP can be refined via `-IcmpType`
Local port	`-LocalPort`	`80` / `1024-2048` / `80,443,8080`	Single, range, CSV list
Remote port	`-RemotePort`	`53` / `1000-2000` / `53,67,68`	Single, range, CSV list
Remote address	`-RemoteAddress`	`192.168.1.1` / `192.168.0.0/24` / `Any`	Single IP, CIDR, range, CSV list, `Any`
Local address	`-LocalAddress`	`10.0.0.1` / `10.0.0.0/16` / `Any`	Single IP, CIDR, range, CSV list, keywords, `Any`
Program	`-Program`	`C:\Program Files\App\App.exe`	Full path to executable
Service	`-Service`	`W32Time`	Windows service name
Profile	`-Profile`	`Domain,Private`	Combination of `Domain`, `Private`, `Public`
Interface type	`-InterfaceType`	`Ethernet` / `Wireless` / `RemoteAccess`	Supported interface types

Example: Allow HTTP Only from a Trusted IP

New-NetFirewallRule -DisplayName "Allow HTTP from Trusted IP" `
  -Direction Inbound -Protocol TCP -LocalPort 80 `
  -RemoteAddress 192.168.1.100 `
  -Action Allow -Profile Domain,Private

Example: Allow Outbound by Program

New-NetFirewallRule -DisplayName "Allow Outbound for App.exe" `
  -Direction Outbound -Program "C:\Program Files\App\App.exe" `
  -Action Allow -Profile Domain,Private,Public

Example: Allow Inbound by Service

New-NetFirewallRule -DisplayName "Allow Service XYZ Inbound" `
  -Direction Inbound -Service "W32Time" `
  -Action Allow -Profile Domain,Private

Example: Block Outbound on Wi-Fi Interface

New-NetFirewallRule -DisplayName "Block Outbound on Wireless" `
  -Direction Outbound -InterfaceType Wireless `
  -Action Block -Profile Public

Modify, (Dis)Enable, and Remove Rules

# Disable rule
Disable-NetFirewallRule -DisplayName "Allow RDP (Domain)"

# Enable rule
Enable-NetFirewallRule -DisplayName "Allow RDP (Domain)"

# Change scope (e.g., restrict to Domain and Private)
Set-NetFirewallRule -DisplayName "Allow RDP (Domain)" -Profile Domain,Private

# Remove rule
Remove-NetFirewallRule -DisplayName "Allow RDP (Domain)"

Export/Import Rule Sets

# Export firewall policy
netsh advfirewall export "C:\Backup\FirewallPolicy.wfw"

# Import firewall policy
netsh advfirewall import "C:\Backup\FirewallPolicy.wfw"

Step 4: Configure Logging and Auditing

Record allowed/blocked events and watch for anomalies.

# Enable both allowed and blocked logging; max size 32 MB
Set-NetFirewallProfile -Profile Domain,Private,Public `
  -LogAllowed True -LogBlocked True `
  -LogFileName "<<LOG_PATH>>" -LogMaxSizeKilobytes 32767

Tail logs:

Get-Content "<<LOG_PATH>>" -Tail 20 -Wait

Caution: Enabling LogAllowed=True increases log volume. In production, consider enabling allowed-traffic logging only for critical profiles (e.g., Public) and implement rotation/archiving.
The -LogMaxSizeKilobytes limit is 32767 KB; higher values cause an error.

Step 5: Centralized Management via GPO

Firewall settings can be edited and automated through GPO using the GroupPolicy module.
Key cmdlets: Set-GPRegistryValue, Get-GPO, New-GPO, New-GPLink, Set-GPInheritance.

Create a GPO and Apply Domain Profile Logging

Create or retrieve GPO
Terminal window
```
$gpo = New-GPO -Name "Firewall-Policy-Domain"
```
To edit an existing GPO: Get-GPO -Name "<GPO_NAME>".

Apply values via GPO Registry keys

# Enable logging for Domain profile
Set-GPRegistryValue -Name $gpo.DisplayName `
  -Key "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile" `
  -ValueName "EnableLogging" -Type DWord -Value 1

# Log path and size
Set-GPRegistryValue -Name $gpo.DisplayName `
  -Key "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging" `
  -ValueName "LogFilePath" -Type String -Value "%systemroot%\system32\logfiles\firewall\pfirewall.log"

Set-GPRegistryValue -Name $gpo.DisplayName `
  -Key "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging" `
  -ValueName "LogFileSize" -Type DWord -Value 32767

These settings take effect when the GPO is linked to an OU via New-GPLink.

Link to OU (New-GPLink)

Pass the DN of the OU (or the domain DN) to -Target.

Import-Module ActiveDirectory

$gpo = Get-GPO -Name "Firewall-Policy-Domain"

# Find OU by name and get its DN
$ou = Get-ADOrganizationalUnit -LDAPFilter '(name=<<OU_NAME>>)' `
      -SearchBase (Get-ADDomain).DistinguishedName -SearchScope Subtree |
      Select-Object -First 1
$ouDn = $ou.DistinguishedName

# Link GPO to the OU (enabled; Enforced optional)
New-GPLink -Name $gpo.DisplayName -Target $ouDn -LinkEnabled Yes -Enforced No

Prerequisites: ActiveDirectory and GroupPolicy (RSAT) modules installed on the admin workstation.

Step 6: Periodic Validation and Troubleshooting

# Currently active rules
Get-NetFirewallRule | Where-Object {$_.Enabled -eq "True"} |
  Select-Object DisplayName, Direction, Action, Profile

# Port reachability test
Test-NetConnection -ComputerName <<SERVER_NAME>> -Port 3389

Summary

Windows Defender Firewall provides robust, built-in network protection on Windows Server. By combining explicit inbound/outbound control, log analysis, and centralized/automated management via GPO and PowerShell, you achieve strong visibility and security aligned with modern hardening and zero-trust practices.

Advanced Operations with Task Scheduler and Trigger Control

Fri, 20 Feb 2026 20:14:11 GMT

Overview

This article explains advanced automation with Windows Task Scheduler:
conditional triggers, event-log–driven execution, registering and controlling tasks via PowerShell, and security-minded operational practices.

Variable notation

Variable	Example	Note
`<<TASK_NAME>>`	`Daily-Backup`	Task name
`<<SCRIPT_PATH>>`	`C:\Scripts\backup.ps1`	Script path to execute
`<<EVENT_ID>>`	`4625`	Event ID that triggers the task
`<<USERNAME>>`	`Administrator`	User that runs the task
`<<TASK_PATH>>`	`\MyCompany\Maintenance`	Task folder path in the library (optional)

Step 1: Register tasks and set the basics

When registering a task with PowerShell, you combine three primary cmdlets:

Cmdlet	Role
`New-ScheduledTaskAction`	Defines the program/script to run
`New-ScheduledTaskTrigger`	Defines when to run (time/event)
`Register-ScheduledTask`	Registers the full task (Action + Trigger + Settings)

① Key options for `New-ScheduledTaskAction`

Option	Description	Example
`-Execute`	Executable	`"powershell.exe"`
`-Argument`	Command-line arguments	`"-NoProfile -NonInteractive -ExecutionPolicy Bypass -File <<SCRIPT_PATH>>"`
`-WorkingDirectory`	Working directory	`"C:\Scripts"`
`-Id`	Identifier when multiple actions exist	`"Action1"`

💡 To configure multiple actions, create several New-ScheduledTaskAction objects and pass them as an array.

② Key options for `New-ScheduledTaskTrigger`

Option	Description	Example
`-Daily`	Run daily	Combine with `-At 3:00AM`
`-Weekly`	Run weekly	`-DaysOfWeek Monday,Wednesday`
`-Once`	Run once	`-At (Get-Date).AddHours(1)`
`-AtStartup`	Run at system startup	—
`-AtLogOn`	Run at user logon	—
`-RepetitionInterval`	Repeat interval	`(New-TimeSpan -Minutes 30)`
`-RepetitionDuration`	Repeat duration	`(New-TimeSpan -Days 1)`
`-RandomDelay`	Jitter	`(New-TimeSpan -Minutes 5)`
`-StartBoundary` / `-EndBoundary`	Validity window	`"2025-01-01T00:00:00"`

⚠️ -RepetitionInterval and -RepetitionDuration are only valid for certain trigger types (e.g., Daily/Once).

③ Key options for `New-ScheduledTaskSettingsSet` (optional)

Option	Description	Example
`-AllowStartIfOnBatteries`	Allow on battery power	`$false`
`-DontStopIfGoingOnBatteries`	Keep running if power switches to battery	`$false`
`-StartWhenAvailable`	Run as soon as possible	`$true`
`-Hidden`	Hide the task	`$true`
`-RunOnlyIfNetworkAvailable`	Require network connectivity	`$true`
`-ExecutionTimeLimit`	Max run time	`(New-TimeSpan -Hours 2)`
`-MultipleInstances`	Multi-instance policy (IgnoreNew/Parallel/Queue)	`"IgnoreNew"`
`-RestartCount` / `-RestartInterval`	Retry count and interval	`3`, `(New-TimeSpan -Minutes 5)`

💡 New-ScheduledTaskSettingsSet builds the object passed to -Settings so you can centrally control power, retry, and network conditions.

④ Key options for `Register-ScheduledTask`

Option	Description	Example
`-TaskName`	Name to register	`"Daily-Backup"`
`-TaskPath`	Library folder	`"\MyCompany\Maintenance"`
`-Action`	Predefined action object	`$action`
`-Trigger`	Predefined trigger object	`$trigger`
`-Settings`	Additional settings (power, retry, etc.)	`$settings`
`-Description`	Admin description	`"Daily maintenance backup task"`
`-User`	Run account	`"SYSTEM"` or `"Administrator"`
`-RunLevel`	Privilege level	`Highest`
`-Force`	Overwrite existing	—

💡 A complete task is Action + Trigger + Settings combined.

⑤ Example configuration

# Define the action
$action = New-ScheduledTaskAction -Execute "powershell.exe" `
  -Argument "-NoProfile -ExecutionPolicy Bypass -File <<SCRIPT_PATH>>"

# Define the trigger (daily at 03:00)
$trigger = New-ScheduledTaskTrigger -Daily -At 3:00AM

# Register the task
Register-ScheduledTask -TaskName "<<TASK_NAME>>" `
  -TaskPath "<<TASK_PATH>>\Daily" `
  -Action $action -Trigger $trigger `
  -User "<<USERNAME>>" -Description "Run every day at 03:00"

⑥ Operational notes

Use -ExecutionPolicy Bypass only in controlled internal environments; in production prefer signed scripts.
Run as SYSTEM or a dedicated service account (principle of least privilege).
Minimum -RepetitionInterval is 1 minute; default upper bound for -RepetitionDuration is often 1 day.
Use -Force to overwrite existing tasks.
Use -RunLevel Highest only when admin privileges are required.

Step 2: Event-log triggers (with XML template)

New-ScheduledTaskTrigger does not currently expose an event trigger (e.g., -OnEvent).
To use event-based triggers, import an XML task definition.

Register:

$xml = @'
<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Author><<USERNAME>></Author>
    <Description>Run script on Security Event ID <<EVENT_ID>></Description>
  </RegistrationInfo>
  <Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription><![CDATA[
        <QueryList>
          <Query Id="0" Path="Security">
            <Select Path="Security">*[System[(EventID=<<EVENT_ID>>)]]</Select>
          </Query>
        </QueryList>
      ]]></Subscription>
    </EventTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>SYSTEM</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>true</StartWhenAvailable>
    <ExecutionTimeLimit>PT1H</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Command>
      <Arguments>-NoProfile -ExecutionPolicy Bypass -File "<<SCRIPT_PATH>>"</Arguments>
    </Exec>
  </Actions>
</Task>
'@

Register-ScheduledTask -TaskName "<<TASK_NAME>>" -TaskPath "<<TASK_PATH>>\OnEvent" -Xml $xml -User "SYSTEM"

This article explains how to use PowerShell on Windows Server to build an Active Directory (AD) environment and add a second Domain Controller (DC).

Variable Conventions

The following variables represent environment-dependent values. Replace them with those appropriate for your setup.

Variable	Example	Description
`<<DOMAIN_NAME>>`	`example.local`	Active Directory domain name
`<<NETBIOS_NAME>>`	`EXAMPLE`	NetBIOS name (recommended in uppercase)
`<<ADMIN_PASSWORD>>`	`P@ssw0rd!`	DSRM (Directory Services Restore Mode) password
`<<DOMAIN_ADMIN>>`	`Administrator`	Domain administrator account
`<<DOMAIN_ADMIN_PASSWORD>>`	`P@ssw0rd!`	Domain administrator password (for automation)
`<<INTERFACE_ALIAS>>`	`Ethernet`	Network adapter name (e.g., Ethernet, Ethernet0)
`<<PRIMARY_DC_IP>>`	`192.168.1.10`	IP address of the primary domain controller

Step 1: Install the AD DS Role on the First Server

Install the Active Directory Domain Services (AD DS) role on the first server.

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

Step 2: Create a New Forest and Promote to Domain Controller

Use PowerShell to create a new forest and promote the first server as the Primary Domain Controller.

Forest/Domain Functional Levels

Functional Level	Enum Name
Windows Server 2008	Window2008
Windows Server 2008 R2	Window2008R2
Windows Server 2012	Window2012
Windows Server 2012 R2	Window2012R2
Windows Server 2016	WinThreshold
Windows Server 2025	Win2025

💡 In this example, both forest and domain functional levels are set to Windows Server 2016 (WinThreshold).

Install-ADDSForest `
 -DomainName "<<DOMAIN_NAME>>" `
 -DomainNetbiosName "<<NETBIOS_NAME>>" `
 -SafeModeAdministratorPassword (ConvertTo-SecureString "<<ADMIN_PASSWORD>>" -AsPlainText -Force) `
 -InstallDNS:$true `
 -ForestMode WinThreshold `
 -DomainMode WinThreshold `
 -Force

⚠️ If prompted to reboot, run the following command:

Restart-Computer

Step 3: Verify the First Domain Controller

After promotion, confirm that the domain structure was successfully created.

Get-ADDomain
Get-ADDomainController
Get-Service DNS

Step 4: Install the AD DS Role on the Second Server

Install the AD DS feature on the second server.

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

Step 5: Verify and Configure DNS Settings

Before promoting the second server, ensure DNS settings are correct.
The secondary DC must reference the primary DC’s DNS server for domain join and replication.

# Check current DNS settings
Get-DnsClientServerAddress

# Set DNS to primary DC
Set-DnsClientServerAddress -InterfaceAlias "<<INTERFACE_ALIAS>>" -ServerAddresses "<<PRIMARY_DC_IP>>"

⚠️ If the second DC points to itself as the DNS server, promotion will fail.
Always configure the primary DC as the first DNS server before promotion.

Step 6: Promote the Second Server as an Additional Domain Controller

# Credentials
$User = "<<NETBIOS_NAME>>\<<DOMAIN_ADMIN>>"
$Pass = ConvertTo-SecureString "<<DOMAIN_ADMIN_PASSWORD>>" -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential($User, $Pass)

Install-ADDSDomainController `
 -DomainName "<<DOMAIN_NAME>>" `
 -Credential $Cred `
 -SafeModeAdministratorPassword (ConvertTo-SecureString "<<ADMIN_PASSWORD>>" -AsPlainText -Force) `
 -InstallDNS:$true `
 -Force

⚠️ Reboot if prompted:

Restart-Computer

Step 7: Verify Domain Controller Configuration

Ensure both domain controllers are listed and properly replicating.

Get-ADDomainController -Filter *

To check replication status in detail:

repadmin /replsummary
repadmin /showrepl

Step 8: Check DNS and Time Synchronization (Optional)

Verify DNS service and time synchronization on both DCs.

Get-Service DNS
w32tm /query /status

Conclusion

By following these steps, you can use PowerShell to build a complete Active Directory environment and quickly deploy redundant domain controllers. Automating these steps ensures consistent, repeatable deployments across multiple sites or recovery environments.

PowerShell Style Guide

Fri, 20 Feb 2026 20:14:11 GMT

Introduction

This article provides a comprehensive PowerShell style guide focusing on readability, consistency, and best practices for writing clean and maintainable scripts. This guide is based on the recommendations from the PowerShell Practice and Style Guide.

Code Layout & Formatting

Maintain Consistency in Layout

Ensure consistent indentation, line length, and capitalization across your codebase to enhance readability.

Capitalization Conventions

Use PascalCase for all public identifiers.
Use lowercase for language keywords.
Use UPPERCASE for comment-based help keywords.

function Write-Host {
    [CmdletBinding()]
    param(
        [psobject]$Object,
        [switch]$NoNewline
    )
}

One True Brace Style (OTBS)

Place opening braces at the end of a line and closing braces on a new line.

if ($value -gt 0) {
    "Positive"
} else {
    "Non-Positive"
}

CmdletBinding and Block Order

Start functions with [CmdletBinding()] and use param(), begin, process, end in execution order.

[CmdletBinding()]
param ()
process { }
end { }

Indentation

Use four spaces per indentation level.

foreach ($item in $list) {
    Do-Something -Param $item
}

Maximum Line Length

Limit lines to 115 characters. Use splatting or parentheses for clean line breaks.

$Params = @{
    Name = "Explorer"
    Verbose = $true
}
Get-Process @Params

Blank Lines and Whitespace

Surround functions with two blank lines.
No trailing spaces.
Use single spaces around operators and parameters.

$Value = 5 + 3

Avoid Semicolons

Do not use semicolons as line terminators.

$Options = @{
    Margin = 2
    Padding = 2
}

Functions

Basic Functions

Avoid return. Output objects directly.
Leave a space between function name and parameters.

function MyFunction ($param1, $param2) {
    ...
}

Advanced Functions

Use <Verb>-<Noun> naming.
Always use [CmdletBinding()].
Return objects in process {} block.
Specify OutputType.

function Get-Example {
    [CmdletBinding()]
    [OutputType([psobject])]
    param (
        [int]$Id
    )
    process {
        New-Object -TypeName psobject -Property @{ ID = $Id }
    }
}

Documenting and Comments

General Comment Guidelines

Keep comments updated.
Write in English, using complete sentences when necessary.
Explain reasoning, not what the code does.

# Adjust margin due to UI overlap
$Margin = $Margin + 2

Block Comments

Use single-line # or <# ... #> for longer blocks.

<#
    .SYNOPSIS
        Example of block comment usage.
#>

Inline Comments

Align inline comments for clarity.

$Options = @{
    Margin = 2      # Adjust for UI
    Padding = 2     # Space around text
}

Comment-Based Help

Always include help in your scripts.

function Get-Example {
    <#
    .SYNOPSIS
        Retrieves example data.
    .EXAMPLE
        Get-Example
    #>
}

Readability

Indent Your Code

Indent within constructs for clarity.

foreach ($item in $items) {
    Process-Item $item
}

Avoid Backticks

Use splatting instead of backticks for line continuation.

$Params = @{
    Class = "Win32_LogicalDisk"
    Filter = "DriveType=3"
}
Get-WmiObject @Params

Naming Conventions

Use Full Command and Parameter Names

Avoid aliases and short forms.

Get-Process -Name Explorer

Use Explicit Paths

Prefer full paths or $PSScriptRoot.

Get-Content "$PSScriptRoot\README.md"

Avoid Using `~`

Use ${Env:UserProfile} instead of ~.

cd ${Env:UserProfile}

Conclusion

Following these guidelines ensures your PowerShell scripts are clean, consistent, and easier to maintain across teams and projects.

For more details, refer to the original PowerShell Practice and Style Guide.

Cómo configurar el proxy en Windows

Fri, 20 Feb 2026 20:14:11 GMT

Resumen

Esta guía explica cómo configurar el proxy en Windows, a nivel de usuario (WinINET) y a nivel de sistema (WinHTTP / BITS). Usamos notaciones como ProxyServer = http=<<PROXY_ADDRESS>>;https=<<PROXY_ADDRESS>>, donde <<VARIABLE>> indica valores dependientes del entorno.

Notación de variables

En esta guía utilizamos las siguientes variables para valores dependientes del entorno. Sustitúyalas según su caso:

Variable	Ejemplo	Comentario
`<<PROXY_ADDRESS>>`	`proxy.ejemplo.com:8080`	Dirección y puerto del servidor proxy
`<<PROXY_BYPASS>>`	`intranet.ejemplo.com;192.168.*;<local>`	Dominios/subredes que no usan proxy, separados por “;”
`<<ADVPROXY_SETTINGS_PATH>>`	`C:\proxy-settings.json`	Ruta del archivo JSON de configuración para advproxy

Paso 1: Entender los tipos de ajustes de proxy

Tipo	Objetivo	Uso principal
Usuario (WinINET)	Ajustes del usuario que ha iniciado sesión	Navegador, aplicaciones del usuario (IE/Edge, etc.)
Sistema (WinHTTP / advproxy)	Ajustes para el sistema completo o servicios	BITS, Windows Update, servicios de sistema que usan cuenta LocalSystem

Importante: BITS funciona bajo la cuenta LocalSystem, por lo que los ajustes de usuario (WinINET) no se aplican a esos servicios.

Paso 2: Configurar el proxy a nivel de usuario (WinINET) mediante PowerShell

$proxy = "<<PROXY_ADDRESS>>"
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" `
  -Name ProxyEnable -Value 1
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" `
  -Name ProxyServer -Value "http=$proxy;https=$proxy"
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" `
  -Name ProxyOverride -Value "<<PROXY_BYPASS>>"

Confirmar configuración:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | Select ProxyEnable, ProxyServer, ProxyOverride

Paso 3: Configurar el proxy a nivel sistema (WinHTTP / advproxy)

① Método clásico (para Windows Server 2019 o anterior)

netsh winhttp set proxy <<PROXY_ADDRESS>> "<<PROXY_BYPASS>>"
netsh winhttp show proxy

② Método recomendado (Windows Server 2022 en adelante)

Crear archivo JSON con la configuración:

@'
{
  "ProxyIsEnabled": true,
  "Proxy": "http=<<PROXY_ADDRESS>>;https=<<PROXY_ADDRESS>>",
  "ProxyBypass": "<<PROXY_BYPASS>>",
  "AutoConfigIsEnabled": false,
  "AutoDetect": false
}
'@ | Out-File "<<ADVPROXY_SETTINGS_PATH>>" -Encoding ascii

Aplicar la configuración:

netsh winhttp set advproxy setting-scope=machine settings-file="<<ADVPROXY_SETTINGS_PATH>>"

Alternativamente (sin archivo JSON):

netsh winhttp set advproxy setting-scope=machine settings='{\"ProxyIsEnabled\":true,\"Proxy\":\"http=<<PROXY_ADDRESS>>;https=<<PROXY_ADDRESS>>\",\"ProxyBypass\":\"<<PROXY_BYPASS>>\",\"AutoConfigIsEnabled\":false,\"AutoDetect\":false}'

Paso 4: Reflejar la configuración del proxy para BITS (LocalSystem)

bitsadmin /util /setieproxy localsystem MANUAL_PROXY <<PROXY_ADDRESS>> "<<PROXY_BYPASS>>"
bitsadmin /util /getieproxy localsystem

Paso 5: Verificación y solución de problemas

netsh winhttp show proxy
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | Select ProxyEnable, ProxyServer, ProxyOverride

Si Windows Update da errores vía proxy, asegúrese de que AutoDetect está en false y que se utilice advproxy para Server Core.
Verifique que los servicios del sistema estén utilizando configuración de sistema (no solo usuario).

Paso 6: Restablecer la configuración del proxy

Usuario (WinINET)

Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyEnable -Value 0
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyServer -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name ProxyOverride -ErrorAction SilentlyContinue

Sistema (WinHTTP / advproxy)

netsh winhttp reset proxy

O para el método advproxy:

netsh winhttp set advproxy setting-scope=machine settings='{\"Proxy\":\"\",\"ProxyBypass\":\"\",\"AutoconfigUrl\":\"\",\"AutoDetect\":false}'

Conclusión

La configuración de proxy en Windows se divide básicamente en dos niveles: usuario (WinINET) y sistema (WinHTTP / advproxy).

WinINET afecta a aplicaciones del usuario (IE/Edge, navegador, apps de usuario).
WinHTTP / advproxy impacta actualizaciones de sistema, BITS, servicios de fondo.

En entornos modernos (Windows Server 2022+), se recomienda usar advproxy mediante JSON. Gestionar correctamente ambos niveles asegura que actualizaciones, transferencias BITS y comunicaciones de sistema funcionen sin errores bajo entorno de proxy.

Pasos clave:

Identifique el nivel de comunicación (usuario vs sistema).
Aplique configuración adecuada (WinINET o WinHTTP).
En entornos Server Core use advproxy.
Cuando ya no se requiera proxy, restablezca usando los comandos correspondientes.

Con este enfoque, reducirá fallos de comunicación bajo proxy, y asegurará que servicios de sistema y de usuario operen correctamente.

Guía para el uso de herramientas de diagnóstico de red

Fri, 20 Feb 2026 20:14:11 GMT

Descripción general

Este artículo presenta una guía sistemática para identificar la causa de problemas de comunicación en entornos Windows Server, utilizando comandos estándar y herramientas de PowerShell. Se abordan pruebas de conectividad ICMP, verificación de puertos TCP, resolución de DNS y análisis de registros.

Convenciones de variables

Los valores dependientes del entorno se expresan como se indica a continuación. Sustitúyalos según su configuración real.

Variable	Ejemplo	Descripción
`<<TARGET_HOST>>`	`192.168.10.1`	Nombre o dirección IP del host de destino
`<<PORT_NUMBER>>`	`443`	Puerto TCP utilizado por la aplicación
`<<LOG_PATH>>`	`C:\Logs\netdiag.txt`	Ruta donde se guardarán los registros

Paso 1: Verificar conectividad ICMP (ping)

Comprueba la accesibilidad a nivel de red.

ping <<TARGET_HOST>>

Si no hay respuesta, verifique:

Si Windows Defender Firewall está bloqueando ICMP
Si el host de destino está en ejecución
Si la tabla de rutas es correcta (route print)

Nota: En entornos donde ICMP está deshabilitado, es necesario verificar la conectividad mediante TCP.

Paso 2: Verificar la ruta (tracert)

Determina en qué salto de la ruta se interrumpe la comunicación.

tracert <<TARGET_HOST>>

Paso 3: Comprobación de puertos TCP (Test-NetConnection)

Evalúa si la comunicación a nivel de aplicación se establece correctamente.

Test-NetConnection -ComputerName <<TARGET_HOST>> -Port <<PORT_NUMBER>>

Campos principales de salida:

Campo	Descripción
`TcpTestSucceeded`	Indica si la conexión TCP fue exitosa
`PingSucceeded`	Indica si el ICMP respondió
`RemoteAddress`	Dirección IP de destino resuelta
`SourceAddress`	Dirección IP de origen utilizada

Consejo: Si el DNS es inestable, utilice la dirección IP directamente.

Paso 4: Estado de las sesiones TCP (netstat / Get-NetTCPConnection)

Permite visualizar las conexiones TCP activas y los puertos en escucha.

Con netstat

netstat -ano | findstr "<<PORT_NUMBER>>"

Opciones:

-a: muestra todas las conexiones y puertos en espera
-n: muestra direcciones y puertos en formato numérico
-o: muestra el ID del proceso

Identificar el proceso correspondiente:

tasklist /FI "PID eq <<PID_NUMBER>>"

Con PowerShell

Get-NetTCPConnection -State Established |
  Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess

Get-NetTCPConnection | Where-Object { $_.LocalPort -eq <<PORT_NUMBER>> }

Si hay muchas conexiones en estado SYN_SENT o TIME_WAIT, puede indicar interrupciones o reconexiones frecuentes.

Paso 5: Comprobar resolución DNS (nslookup / Resolve-DnsName)

Verifica si la resolución de nombres funciona correctamente.

nslookup <<TARGET_HOST>>

Análisis detallado con PowerShell:

Resolve-DnsName <<TARGET_HOST>> -Type A

Consulta a un servidor DNS específico:

Resolve-DnsName <<TARGET_HOST>> -Type A -Server 8.8.8.8

Nota: En entornos IPv6, utilice -Type AAAA.

Paso 6: Solución avanzada de problemas

Habilitar registros del Firewall

Si la comunicación está bloqueada, active el registro del Firewall para análisis.

Set-NetFirewallProfile -Profile Domain,Public,Private `
  -LogAllowed True -LogBlocked True `
  -LogFileName "C:\Windows\System32\LogFiles\Firewall\pfirewall.log" `
  -LogMaxSizeKilobytes 32767

El tamaño predeterminado del registro es de 1 MB; aumentar el límite facilita el análisis.

Comprobar tabla ARP (problemas de capa 2)

arp -a

Si se observan direcciones MAC duplicadas o inconsistentes, sospeche de caché en switches o NICs virtuales.

Conclusión

La mayoría de los problemas de red pueden diagnosticarse sistemáticamente en cinco pasos:
ICMP → Ruta → TCP → DNS → Registro

Con herramientas estándar como ping, tracert, netstat y cmdlets de PowerShell como Get-NetTCPConnection, Resolve-DnsName y Test-NetConnection, es posible realizar un diagnóstico eficiente, estructurado y reproducible en entornos Windows Server.

Extracción de archivos de registro con PowerShell

Fri, 20 Feb 2026 20:14:11 GMT

Qué

Este artículo explica cómo extraer líneas específicas de archivos de registro utilizando PowerShell para facilitar el análisis de registros y la supervisión del sistema.

Por qué

Los archivos de registro pueden ser extensos y difíciles de analizar manualmente. PowerShell ofrece potentes capacidades para procesar texto, lo que permite filtrar errores, advertencias y otra información relevante de forma automatizada, lo cual es esencial para los administradores de sistemas.

Cómo

Paso 1: Leer un archivo de registro

Usa Get-Content para leer el archivo línea por línea.

Get-Content -Path "C:\Logs\system.log"

Paso 2: Filtrar por palabra clave

Usa Select-String para mostrar solo las líneas que contienen palabras clave como “ERROR”.

Get-Content -Path "C:\Logs\system.log" | Select-String -Pattern "ERROR"

Paso 3: Buscar múltiples patrones

Filtra múltiples palabras clave simultáneamente.

$patterns = "ERROR", "WARNING"
Get-Content -Path "C:\Logs\system.log" | Select-String -Pattern $patterns

Paso 4: Filtrar por rango de fechas

Utiliza expresiones regulares para extraer registros dentro de un rango de fechas específico.

Get-Content -Path "C:\Logs\system.log" | Where-Object { $_ -match "2025-04-(1[5-9]|2[0-5])" }

Paso 5: Exportar a CSV

Guarda los resultados filtrados en un archivo CSV para análisis posterior.

Get-Content -Path "C:\Logs\system.log" | Select-String "ERROR" | ForEach-Object {
    [PSCustomObject]@{
        LineNumber = $_.LineNumber
        Text       = $_.Line
        Path       = $_.Path
    }
} | Export-Csv -Path "C:\Logs\informe_errores.csv" -NoTypeInformation

Paso 6: Automatizar con un script

Agrupa el proceso en un script .ps1 para ejecución automática diaria.

$logPath = "C:\Logs\system.log"
$outputPath = "C:\Logs\registro_filtrado.csv"
$filterPattern = "ERROR"

Get-Content -Path $logPath | Select-String -Pattern $filterPattern | ForEach-Object {
    [PSCustomObject]@{
        LineNumber = $_.LineNumber
        Text       = $_.Line
        Path       = $_.Path
    }
} | Export-Csv -Path $outputPath -NoTypeInformation

Conclusión

Con solo unas líneas de PowerShell, puedes extraer y gestionar eficazmente información crítica desde archivos de registro. Automatizar este proceso facilita la detección de errores y mejora la eficiencia operativa.

Gestión de funcionalidades e imágenes de Windows con DISM y PowerShell

Fri, 20 Feb 2026 20:14:11 GMT

Resumen

Este artículo aborda en paralelo DISM (Deployment Image Servicing and Management) y PowerShell (envoltorios de la API de DISM), organizando operaciones frecuentes con ejemplos, opciones y comportamiento esperado.

Notación de variables

Variable	Ejemplo	Nota
`<<IMAGE_PATH>>`	`C:\mount` o `E:\Windows`	Ruta para `/Image:` que apunta a un Windows fuera de línea (carpeta montada o directorio Windows en otro disco)
`<<FEATURE_NAME>>`	`NetFx3`	Nombre de la funcionalidad de Windows
`<<CAPABILITY_NAME>>`	`OpenSSH.Client~~~~0.0.1.0`	Funcionalidad bajo demanda (FoD: Features on Demand)
`<<WIM_PATH>>`	`D:\sources\install.wim`	Archivo de imagen WIM/ESD
`<<INDEX>>`	`1`	Índice de imagen
`<<MOUNT_DIR>>`	`C:\mount`	Directorio de montaje
`<<DRIVER_DIR>>`	`D:\drivers`	Carpeta con INF de controladores
`<<PACKAGE_PATH>>`	`C:\Updates\kb5005565.cab`	Archivo de paquete de actualización
`<<LANG_PACK>>`	`C:\LP\ja-jp\lp.cab`	CAB de paquete de idioma
`<<SOURCE_PATH>>`	`D:\sources\sxs`	Ruta de origen (p. ej., NetFx3)
`<<APPLY_DIR>>`	`C:\`	Destino de aplicación
`<<SCRATCH_DIR>>`	`C:\Temp\Scratch`	Carpeta de trabajo
`<<LOG_PATH>>`	`C:\Temp\dism.log`	Ruta del registro

Casi todos los comandos aceptan /ScratchDir:<<SCRATCH_DIR>> y /LogPath:<<LOG_PATH>>.

Paso 1: Seleccionar el destino (/Online o /Image)

Muchos comandos de DISM requieren especificar explícitamente el destino.

Opción	Significado	Ejemplo
`/Online`	Sistema Windows en ejecución	`dism /Online /Cleanup-Image /CheckHealth`
`/Image:<<IMAGE_PATH>>`	Windows fuera de línea o imagen montada	`dism /Image:C:\mount /Add-Driver /Driver:D:\drivers /Recurse`

Paso 2: Consultar funcionalidades (/Get-Features, /Get-FeatureInfo)

Descripción

Obtiene la lista de funcionalidades instalables y su estado (Enabled / Disabled / DisabledWithPayloadRemoved).

Opciones principales

Opción	Significado	Ejemplo
`/Online`	Contra el SO activo	`dism /Online /Get-Features`
`/Image:<<IMAGE_PATH>>`	Contra una imagen fuera de línea	`dism /Image:C:\mount /Get-Features`
`/Get-Features`	Muestra el listado	`dism /Online /Get-Features /Format:Table`
`/Get-FeatureInfo`	Detalle de una funcionalidad	`dism /Online /Get-FeatureInfo /FeatureName:NetFx3`
`/FeatureName:<<FEATURE_NAME>>`	Nombre de la funcionalidad	`NetFx3`
`/Format:Table`	Salida tabular	`dism /Online /Get-Features /Format:Table`

Ejemplos

# Listar todas las funcionalidades con su estado
dism /Online /Get-Features /Format:Table

# Ver el detalle de NetFx3
dism /Online /Get-FeatureInfo /FeatureName:NetFx3

El estado DisabledWithPayloadRemoved indica que faltan archivos de la funcionalidad y se requiere /Source.

Paso 3: Habilitar o deshabilitar funcionalidades (/Enable-Feature, /Disable-Feature)

Descripción

Activa o desactiva funcionalidades como .NET Framework 3.5 o SMB 1.0.

Opciones principales

Opción	Significado	Ejemplo
`/Online`	SO activo	`dism /Online /Enable-Feature /FeatureName:NetFx3`
`/FeatureName:<<FEATURE_NAME>>`	Funcionalidad a gestionar	`NetFx3`
`/All`	Incluye dependencias
`/Source:<<SOURCE_PATH>>`	Origen para payload eliminado	`dism /Online /Enable-Feature /FeatureName:NetFx3 /Source:D:\sources\sxs`
`/LimitAccess`	No usa Windows Update/WSUS
`/Enable-Feature`	Habilitar	`dism /Online /Enable-Feature /FeatureName:SMB1Protocol`
`/Disable-Feature`	Deshabilitar	`dism /Online /Disable-Feature /FeatureName:SMB1Protocol`
`/LogPath:<<LOG_PATH>>`	Ruta del log

Ejemplos

# Habilitar .NET Framework 3.5 (NetFx3) con origen local (sin internet)
dism /Online /Enable-Feature /FeatureName:NetFx3 /All /LimitAccess /Source:<<SOURCE_PATH>> /LogPath:<<LOG_PATH>>

# Deshabilitar SMB1 para hardening
dism /Online /Disable-Feature /FeatureName:SMB1Protocol /LogPath:<<LOG_PATH>>

Paso 4: Consultar Capabilities (/Get-Capabilities, /Get-CapabilityInfo)

Descripción

Lista componentes FoD y su estado, por ejemplo RSAT, OpenSSH.Client, Language.Basic.

Opciones principales

Opción	Significado	Ejemplo
`/Online`	SO activo	`dism /Online /Get-Capabilities`
`/Image:<<IMAGE_PATH>>`	Imagen fuera de línea	`dism /Image:C:\mount /Get-Capabilities`
`/Get-Capabilities`	Lista de capabilities	`dism /Online /Get-Capabilities /Format:Table`
`/Get-CapabilityInfo`	Detalle de una capability	`dism /Online /Get-CapabilityInfo /CapabilityName:OpenSSH.Client~~~~0.0.1.0`
`/Format:Table`	Salida tabular	`dism /Online /Get-Capabilities /Format:Table`

Ejemplos

# Lista completa
dism /Online /Get-Capabilities /Format:Table

# Detalle de una capability concreta
dism /Online /Get-CapabilityInfo /CapabilityName:<<CAPABILITY_NAME>>

Las capabilities pueden agregarse desde Windows Update, WSUS o una ISO/compartido.

Paso 5: Agregar o quitar Capabilities (/Add-Capability, /Remove-Capability)

Descripción

Instala o elimina FoD como OpenSSH o herramientas RSAT.

Opciones principales

Opción	Significado	Ejemplo
`/Online`	SO activo	`dism /Online /Add-Capability`
`/CapabilityName:<<CAPABILITY_NAME>>`	Capability objetivo	`OpenSSH.Client~~~~0.0.1.0`
`/Source:<<SOURCE_PATH>>`	ISO FoD o recurso compartido	`dism /Online /Add-Capability /CapabilityName:OpenSSH.Client~~~~0.0.1.0 /Source:D:\ /LimitAccess`
`/LimitAccess`	Solo usa el origen especificado
`/LogPath:<<LOG_PATH>>`	Ruta del log

Ejemplos

# Agregar OpenSSH.Client
dism /Online /Add-Capability /CapabilityName:<<CAPABILITY_NAME>> /LogPath:<<LOG_PATH>>

# Quitar un RSAT innecesario
dism /Online /Remove-Capability /CapabilityName:<<CAPABILITY_NAME>> /LogPath:<<LOG_PATH>>

Paso 6: Reparación de imagen y Component Store (/Cleanup-Image)

Descripción

Detecta/corrige corrupción del WinSxS y optimiza espacio.

Opciones principales

Opción	Significado	Ejemplo
`/Online`	SO activo	`dism /Online /Cleanup-Image /CheckHealth`
`/CheckHealth`	Comprobación rápida
`/ScanHealth`	Examen detallado
`/RestoreHealth`	Reparación	`dism /Online /Cleanup-Image /RestoreHealth`
`/Source:<<SOURCE_PATH>>`	Origen para reparación
`/LimitAccess`	Sin Windows Update
`/StartComponentCleanup`	Limpia actualizaciones antiguas
`/ResetBase`	Fija la base (sin rollback)
`/AnalyzeComponentStore`	Analiza tamaño del almacén

Ejemplos

# Comprobación rápida
dism /Online /Cleanup-Image /CheckHealth

# Escaneo detallado
dism /Online /Cleanup-Image /ScanHealth

# Reparar especificando origen
dism /Online /Cleanup-Image /RestoreHealth /Source:<<SOURCE_PATH>> /LimitAccess /LogPath:<<LOG_PATH>>

# Limpieza y fijación de base
dism /Online /Cleanup-Image /StartComponentCleanup /ResetBase /LogPath:<<LOG_PATH>>

Paso 7: Información de imágenes (/Get-ImageInfo)

Opciones principales

Opción	Significado	Ejemplo
`/Get-ImageInfo`	Muestra info de WIM/ESD	`dism /Get-ImageInfo /ImageFile:install.wim`
`/ImageFile:<<WIM_PATH>>`	Archivo WIM objetivo
`/Index:<<INDEX>>`	Índice objetivo
`/LogPath:<<LOG_PATH>>`	Ruta del log

Ejemplo

# Ver ediciones e índices de install.wim
dism /Get-ImageInfo /ImageFile:<<WIM_PATH>> /LogPath:<<LOG_PATH>>

Paso 8: Montaje y desmontaje de imágenes fuera de línea

Opciones principales

Opción	Significado	Ejemplo
`/Mount-Wim`	Monta un WIM
`/WimFile:<<WIM_PATH>>`	WIM de origen
`/Index:<<INDEX>>`	Índice a montar
`/MountDir:<<MOUNT_DIR>>`	Carpeta de montaje
`/ReadOnly`	Solo lectura
`/Get-MountedWimInfo`	Ver montajes actuales
`/Unmount-Wim`	Desmontar
`/Commit`	Guardar cambios
`/Discard`	Descartar cambios

Ejemplos

# Montar para edición
dism /Mount-Wim /WimFile:<<WIM_PATH>> /Index:<<INDEX>> /MountDir:<<MOUNT_DIR>>

# Estado de montajes
dism /Get-MountedWimInfo

# Guardar y desmontar
dism /Unmount-Wim /MountDir:<<MOUNT_DIR>> /Commit

Paso 9: Integración de controladores, paquetes e idiomas

Opciones principales

Opción	Significado	Ejemplo
`/Online`	Contra el SO activo
`/Image:<<MOUNT_DIR>>`	Contra imagen fuera de línea
`/Add-Driver`	Agregar controladores
`/Driver:<<DRIVER_DIR>>`	Carpeta con INF
`/Recurse`	Incluye subcarpetas
`/Add-Package`	Integrar paquete/idioma
`/PackagePath:<<PACKAGE_PATH>>`	Ruta del paquete
`/Set-AllIntl:ja-JP`	Establece configuración regional

Notas:

/Add-Driver es solo para imágenes fuera de línea.

/Add-Package y /Set-AllIntl funcionan en modo online y offline.

Ejemplos

# Integrar controladores
dism /Image:<<MOUNT_DIR>> /Add-Driver /Driver:<<DRIVER_DIR>> /Recurse

# Integrar actualización
dism /Image:<<MOUNT_DIR>> /Add-Package /PackagePath:<<PACKAGE_PATH>>

# Agregar paquete de idioma y fijar locale
dism /Image:<<MOUNT_DIR>> /Add-Package /PackagePath:<<LANG_PACK>>
dism /Image:<<MOUNT_DIR>> /Set-AllIntl:ja-JP

Paso 10: Capturar, exportar y aplicar imágenes

Opciones principales

Opción	Significado	Ejemplo
`/Capture-Image`	Captura una carpeta a WIM
`/ImageFile:<<WIM_PATH>>`	WIM de salida
`/CaptureDir:<<APPLY_DIR>>`	Carpeta origen
`/Name:"<nombre>"`	Nombre de la imagen
`/Export-Image`	Reexporta/comprime un WIM
`/Apply-Image`	Aplica un WIM
`/Compress:max`	Compresión máxima
`/ApplyDir:<<APPLY_DIR>>`	Destino de aplicación

Ejemplos

# Capturar configuración actual
dism /Capture-Image /ImageFile:D:\Custom.wim /CaptureDir:<<APPLY_DIR>> /Name:"Custom Image"

# Reexportar con compresión
dism /Export-Image /SourceImageFile:<<WIM_PATH>> /SourceIndex:<<INDEX>> /DestinationImageFile:D:\install_compressed.wim /Compress:max

# Aplicar imagen
dism /Apply-Image /ImageFile:<<WIM_PATH>> /Index:<<INDEX>> /ApplyDir:<<APPLY_DIR>>

Paso 11: Equivalentes en PowerShell

Mapa rápido

Área	DISM	PowerShell	Objetivo
Consultar funcionalidades	`/Get-Features`, `/Get-FeatureInfo`	`Get-WindowsOptionalFeature`	Listado/detalle
Habilitar/deshabilitar funcionalidades	`/Enable-Feature`, `/Disable-Feature`	`Enable-WindowsOptionalFeature`, `Disable-WindowsOptionalFeature`	Activar/desactivar
Consultar capabilities	`/Get-Capabilities`, `/Get-CapabilityInfo`	`Get-WindowsCapability`	Listado/detalle
Agregar/quitar capabilities	`/Add-Capability`, `/Remove-Capability`	`Add-WindowsCapability`, `Remove-WindowsCapability`	Gestionar FoD
Consultar/agregar paquetes	`/Get-Packages`, `/Add-Package`	`Get-WindowsPackage`, `Add-WindowsPackage`	Integrar updates/idiomas
Controladores: listar/agregar/quitar	`/Get-Drivers`, `/Add-Driver`, `/Remove-Driver`	`Get-WindowsDriver`, `Add-WindowsDriver`, `Remove-WindowsDriver`	Principalmente offline
Info/montaje de imágenes	`/Get-ImageInfo`, `/Mount-Wim`, `/Unmount-Wim`	`Get-WindowsImage`, `Mount-WindowsImage`, `Dismount-WindowsImage`	Gestión de WIM

11.1 Funcionalidades (Features)

Get-WindowsOptionalFeature

Opción	Significado	Ejemplo
`-Online`	SO activo	`Get-WindowsOptionalFeature -Online -FeatureName <<FEATURE_NAME>>`
`-Path <<IMAGE_PATH>>`	Imagen offline	`Get-WindowsOptionalFeature -Path <<IMAGE_PATH>>`
`-FeatureName <<FEATURE_NAME>>`	Funcionalidad concreta	`-FeatureName NetFx3`

# Todas las funcionalidades (online)
Get-WindowsOptionalFeature -Online

# Detalle específico (offline)
Get-WindowsOptionalFeature -Path <<IMAGE_PATH>> -FeatureName <<FEATURE_NAME>>

Enable-/Disable-WindowsOptionalFeature

Opción	Significado	Ejemplo
`-Online` / `-Path <<IMAGE_PATH>>`	Selección de destino	`Enable-WindowsOptionalFeature -Online`
`-FeatureName <<FEATURE_NAME>>`	Nombre de funcionalidad	`-FeatureName NetFx3`
`-All`	Incluye dependencias	`-All`
`-Source <<SOURCE_PATH>>`	Origen del payload	`-Source <<SOURCE_PATH>>`

# Habilitar (NetFx3 con origen)
Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All -Source <<SOURCE_PATH>>

# Deshabilitar (SMB1)
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

11.2 Capabilities

Get-WindowsCapability

Opción	Significado	Ejemplo
`-Online`	SO activo	`Get-WindowsCapability -Online`
`-Name <<CAPABILITY_NAME>>`	Soporta comodines	`Get-WindowsCapability -Online -Name OpenSSH.*`
`-Path <<IMAGE_PATH>>`	Imagen offline	`Get-WindowsCapability -Path <<IMAGE_PATH>>`

# Listado (online)
Get-WindowsCapability -Online

# Solo una capability
Get-WindowsCapability -Online -Name <<CAPABILITY_NAME>>

Add-/Remove-WindowsCapability

Opción	Significado	Ejemplo
`-Online` / `-Path <<IMAGE_PATH>>`	Destino	`Add-WindowsCapability -Online`
`-Name <<CAPABILITY_NAME>>`	Capability	`-Name OpenSSH.Client~~~~0.0.1.0`
`-Source <<SOURCE_PATH>>`	Origen FoD	`-Source <<SOURCE_PATH>>`

# Agregar (online, con origen si es necesario)
Add-WindowsCapability -Online -Name <<CAPABILITY_NAME>>

# Quitar
Remove-WindowsCapability -Online -Name <<CAPABILITY_NAME>>

11.3 Paquetes (actualizaciones e idiomas)

Get-WindowsPackage

Opción	Significado	Ejemplo
`-Online` / `-Path <<IMAGE_PATH>>`	Destino	`Get-WindowsPackage -Online`
`-PackagePath <<PACKAGE_PATH>>`	Info del paquete	`Get-WindowsPackage -Online -PackagePath <<PACKAGE_PATH>>`

# Listar paquetes instalados (online)
Get-WindowsPackage -Online

Add-WindowsPackage

Opción	Significado	Ejemplo
`-Online` / `-Path <<IMAGE_PATH>>`	Destino	`Add-WindowsPackage -Online -PackagePath <<PACKAGE_PATH>>`
`-PackagePath <<PACKAGE_PATH>>`	Preferible `.cab` (también `.msu`)

# Integrar actualización (online)
Add-WindowsPackage -Online -PackagePath <<PACKAGE_PATH>>

# Paquete de idioma (offline)
Add-WindowsPackage -Path <<IMAGE_PATH>> -PackagePath <<LANG_PACK>>

11.4 Controladores

Get-WindowsDriver

Opción	Significado	Ejemplo
`-Online` / `-Path <<IMAGE_PATH>>`	Destino	`Get-WindowsDriver -Path <<IMAGE_PATH>>`
`-All`	Muestra todos los controladores	`-All`

# Listar controladores de una imagen offline
Get-WindowsDriver -Path <<IMAGE_PATH>> -All

Add-/Remove-WindowsDriver

Opción	Significado	Ejemplo
`-Path <<IMAGE_PATH>>`	Imagen objetivo	`Add-WindowsDriver -Path <<IMAGE_PATH>> -Driver <<DRIVER_DIR>> -Recurse`
`-Driver <<DRIVER_DIR>>`	Carpeta con INF
`-Recurse`	Incluye subcarpetas
`-Driver <<oem*.inf>>` (Remove)	INF a eliminar	`Remove-WindowsDriver -Path <<IMAGE_PATH>> -Driver oem1.inf`

# Agregar (offline)
Add-WindowsDriver -Path <<IMAGE_PATH>> -Driver <<DRIVER_DIR>> -Recurse

# Eliminar (offline)
Remove-WindowsDriver -Path <<IMAGE_PATH>> -Driver oem1.inf

Importante: Add-/Remove-WindowsDriver no ofrecen -Online; su uso práctico es offline.

11.5 Información y montaje de imágenes

Get-WindowsImage

Opción	Significado	Ejemplo
`-ImagePath <<WIM_PATH>>`	Ruta de WIM/ESD	`Get-WindowsImage -ImagePath <<WIM_PATH>>`
`-Index <<INDEX>>`	Índice concreto	`-Index <<INDEX>>`

# Todos los índices de install.wim
Get-WindowsImage -ImagePath <<WIM_PATH>>

Mount-/Dismount-WindowsImage

Opción	Significado
`-ImagePath <<WIM_PATH>>`	WIM de entrada
`-Index <<INDEX>>`	Índice a montar
`-Path <<MOUNT_DIR>>`	Carpeta de montaje
`-ReadOnly`	Solo lectura
`-ScratchDirectory <<SCRATCH_DIR>>`	Carpeta de trabajo
`-Save` (Dismount)	Guardar cambios
`-Discard` (Dismount)	Descartar cambios

# Montar
Mount-WindowsImage -ImagePath <<WIM_PATH>> -Index <<INDEX>> -Path <<MOUNT_DIR>>

# Guardar y desmontar
Dismount-WindowsImage -Path <<MOUNT_DIR>> -Save

Conclusión

DISM: gestión de bajo nivel de componentes del SO, WIM, actualizaciones y controladores.
PowerShell (API de DISM): mismas capacidades con foco en scripting y automatización.
Capabilities (FoD): funcionalidades bajo demanda como OpenSSH, RSAT y paquetes de idiomas.

Configuración de red en Windows Server

Fri, 20 Feb 2026 20:14:11 GMT

Resumen

En este artículo se explica cómo gestionar la configuración de red en Windows Server utilizando PowerShell.
Se cubren las configuraciones de IP estática, DNS, ajuste de prioridad de enrutamiento y consideraciones para entornos con múltiples interfaces de red (NIC).

Definición de variables

Variable	Ejemplo	Descripción
`<<INTERFACE_ALIAS>>`	`Ethernet0`	Nombre del adaptador de red
`<<IP_ADDRESS>>`	`192.168.10.100`	Dirección IP estática
`<<PREFIX_LENGTH>>`	`24`	Longitud del prefijo de subred (por ejemplo: 255.255.255.0 → 24)
`<<GATEWAY>>`	`192.168.10.1`	Puerta de enlace predeterminada
`<<DNS1>>`	`192.168.10.10`	Servidor DNS primario
`<<DNS2>>`	`8.8.8.8`	Servidor DNS secundario (opcional)

Paso 1: Ver la configuración actual de red

Verifique los adaptadores disponibles y su configuración IP actual.

# Listar adaptadores de red
Get-NetAdapter | Select-Object Name, Status, MacAddress, LinkSpeed

# Ver configuración IP
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress, PrefixLength, DefaultGateway, PrefixOrigin

OriginType	Significado	Nota
Manual	Dirección configurada manualmente	Establecida desde PowerShell o la interfaz gráfica
DHCP	Dirección asignada automáticamente por servidor DHCP	Activada mediante `Set-NetIPInterface -Dhcp Enabled`
WellKnown	Dirección reservada del sistema (link-local/APIPA)	Se usa cuando DHCP no responde (169.254.x.x)

Paso 2: Cambiar de DHCP a IP estática

Desactive DHCP y asigne una IP fija.

# Desactivar DHCP
Set-NetIPInterface -InterfaceAlias "<<INTERFACE_ALIAS>>" -Dhcp Disabled

# Eliminar dirección DHCP (si existe)
Get-NetIPAddress -InterfaceAlias "<<INTERFACE_ALIAS>>" -AddressFamily IPv4 |
  Where-Object { $_.PrefixOrigin -eq "Dhcp" } |
  Remove-NetIPAddress -Confirm:$false

# Establecer IP estática
New-NetIPAddress `
  -InterfaceAlias "<<INTERFACE_ALIAS>>" `
  -IPAddress "<<IP_ADDRESS>>" `
  -PrefixLength <<PREFIX_LENGTH>> `
  -DefaultGateway "<<GATEWAY>>"

Atención:
Remove-NetIPAddress solo debe usarse para eliminar asignaciones DHCP.
Evite ejecutarlo en un adaptador usado por la sesión remota activa.

Paso 3: Configurar servidores DNS

Defina los servidores DNS y confirme la aplicación de los cambios.

# Configurar DNS
Set-DnsClientServerAddress `
  -InterfaceAlias "<<INTERFACE_ALIAS>>" `
  -ServerAddresses ("<<DNS1>>","<<DNS2>>")

# Verificar configuración
Get-DnsClientServerAddress -InterfaceAlias "<<INTERFACE_ALIAS>>"

Limpiar la caché DNS y probar la resolución:

Clear-DnsClientCache
Resolve-DnsName "www.microsoft.com"

Paso 4: Definir prioridad en entornos con múltiples NIC

En servidores con varias interfaces de red, se debe controlar la prioridad de enrutamiento mediante InterfaceMetric.
Cuanto menor el valor, mayor la prioridad.

# Ver prioridades actuales
Get-NetIPInterface | Sort-Object -Property InterfaceMetric |
  Select-Object InterfaceAlias, AddressFamily, InterfaceMetric

# Cambiar prioridad (dar preferencia a la NIC de administración)
Set-NetIPInterface -InterfaceAlias "<<INTERFACE_ALIAS>>" -InterfaceMetric 10

Ejemplo de valores recomendados:

LAN de administración: 10

LAN de respaldo: 20–50

Tráfico de clúster/iSCSI: 100 o más

Paso 5: Verificar funcionamiento

# Comprobar conexión al gateway
Test-Connection "<<GATEWAY>>" -Count 4

# Probar resolución DNS
Resolve-DnsName "www.microsoft.com"

Nota:
Si los cambios DNS no surten efecto, reinicie el servicio de cliente DNS:
Terminal window
net stop dnscache && net start dnscache

Paso 6: Deshabilitar IPv6 (si aplica)

De forma predeterminada, IPv4 e IPv6 están habilitados. Si su entorno no usa IPv6, puede desactivarlo para evitar rutas o resoluciones no deseadas.

# Verificar estado de IPv6
Get-NetAdapterBinding `
  -InterfaceAlias "<<INTERFACE_ALIAS>>" `
  -ComponentID "ms_tcpip6"

# Deshabilitar IPv6
Disable-NetAdapterBinding `
  -InterfaceAlias "<<INTERFACE_ALIAS>>" `
  -ComponentID "ms_tcpip6" `
  -PassThru

# Confirmar
Get-NetAdapterBinding `
  -InterfaceAlias "<<INTERFACE_ALIAS>>" `
  -ComponentID "ms_tcpip6"

Para volver a habilitarlo:

Enable-NetAdapterBinding `
  -InterfaceAlias "<<INTERFACE_ALIAS>>" `
  -ComponentID "ms_tcpip6"

Paso 7: Mejores prácticas

Fijar nombre de la NIC
Evite cambios automáticos renombrando la interfaz manualmente:
Terminal window
```
Rename-NetAdapter -Name "<<INTERFACE_ALIAS>>" -NewName "LAN-Primary"
```

Eliminar rutas innecesarias
Evite rutas duplicadas o incorrectas limpiando las entradas de enrutamiento:

Get-NetRoute -AddressFamily IPv4
Remove-NetRoute -DestinationPrefix "0.0.0.0/0" -InterfaceAlias "BackupNIC" -Confirm:$false

Habilitar o deshabilitar un adaptador de red

# Deshabilitar adaptador
Disable-NetAdapter -Name "<<INTERFACE_ALIAS>>" -Confirm:$false
# Habilitar adaptador
Enable-NetAdapter -Name "<<INTERFACE_ALIAS>>"

Eliminar IP estática y volver a DHCP

Remove-NetIPAddress -InterfaceAlias "<<INTERFACE_ALIAS>>" -IPAddress "<<IP_ADDRESS>>" -Confirm:$false
Set-NetIPInterface -InterfaceAlias "<<INTERFACE_ALIAS>>" -Dhcp Enabled

Conclusión

Usar PowerShell permite gestionar las configuraciones de red de Windows Server de forma precisa y reproducible.
En sistemas con múltiples NIC, el control de prioridad de enrutamiento y la configuración explícita de DNS son esenciales para la estabilidad.
Automatizar estas tareas desde el inicio garantiza una administración de red consistente, escalable y confiable.

Comandos para consultar y configurar variables de entorno en Windows

Fri, 20 Feb 2026 20:14:11 GMT

Resumen

Las variables de entorno de Windows se leen desde un bloque de entorno creado en el momento en que se inicia un proceso. Este artículo explica con precisión el alcance de las variables (proceso, usuario, sistema), cómo se almacenan de forma persistente, cómo consultarlas y configurarlas mediante CMD y PowerShell y, sobre todo, cómo difieren y se muestran las variables de usuario y de sistema.

Notación de variables

Nombre	Ejemplo	Descripción
`<<VAR_NAME>>`	`PATH`	Nombre de la variable a operar
`<<VALUE>>`	`C:\Tools`	Valor a configurar

Step 1: Alcance y ubicación de almacenamiento

Tipo	Ubicación	Alcance	Persistencia	Nota
Variable de proceso	Memoria	Solo el proceso actual	Temporal	CMD: `set` / PowerShell: `$env:`
Variable de usuario	`HKCU\Environment`	Usuario actual	Persistente	`setx` / `.NET API`
Variable del sistema (Machine)	`HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment`	Todos los usuarios	Persistente	`setx /M` / `.NET API` (admin)

Proceso, usuario y sistema son independientes

Proceso: solo visible para la sesión actual
Usuario: específico por perfil de usuario
Sistema: compartido para todos
PATH puede mostrarse como concatenación de PATH del sistema + PATH del usuario

Es fundamental verificar el alcance adecuado antes de definir una variable.

Step 2: CMD (%VAR%) — Consulta y configuración

2-1. Listar variables de proceso

set

2-2. Consultar variable

echo %<<VAR_NAME>>%

2-3. Establecer variable temporal (solo CMD actual)

set <<VAR_NAME>>=<<VALUE>>

2-4. Configurar variable persistente (setx)

Sintaxis básica

setx <<VAR_NAME>> "<<VALUE>>"

Alcance de usuario (por defecto)

setx <<VAR_NAME>> "<<VALUE>>"

Alcance del sistema (requiere admin, /M obligatorio)

setx <<VAR_NAME>> "<<VALUE>>" /M

Características de setx

No actualiza la sesión CMD actual

Los valores con %PATH% se expanden y se guardan estáticos

Puede truncarse el PATH si es demasiado largo (no recomendado)

Step 3: Cómo verificar variables de usuario y sistema en CMD

Usuario (HKCU)

reg query HKCU\Environment

Sistema (HKLM)

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"

reg query permite ver valores sin combinar, tal como están en cada ámbito.

Step 4: Edición segura de PATH (precauciones en CMD)

Este es un mal ejemplo y no se recomienda:

# setx PATH "%PATH%;C:\Tools"

Motivos:

%PATH% se expande y se almacena como texto fijo
REG_EXPAND_SZ puede convertirse en REG_SZ, perdiendo referencias como %SystemRoot%
PATH largo puede truncarse

La modificación del PATH debe hacerse con PowerShell + .NET API (se explica más adelante).

Step 5: PowerShell ($env:VAR) — Consulta y configuración

5-1. Listar variables de proceso

Get-ChildItem Env:

5-2. Consultar variable

$env:<<VAR_NAME>>

5-3. Configuración temporal

$env:<<VAR_NAME>> = "<<VALUE>>"

Step 6: Ver valores correctos de usuario y sistema en PowerShell

Usuario (HKCU)

Get-ItemProperty "HKCU:\Environment"

Sistema (HKLM)

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"

Step 7: Configuración persistente mediante PowerShell (.NET API / Recomendado)

Usuario (User)

[System.Environment]::SetEnvironmentVariable("<<VAR_NAME>>","<<VALUE>>","User")

Sistema (Machine – requiere privilegios)

[System.Environment]::SetEnvironmentVariable("<<VAR_NAME>>","<<VALUE>>","Machine")

Ventajas:

Evita truncamiento del PATH
Mantiene REG_EXPAND_SZ
Edición segura y controlada

Step 8: Actualizar PATH de forma segura (.NET API / Mejor práctica)

$add = "C:\Tools"
$current = [System.Environment]::GetEnvironmentVariable("PATH","Machine")
$new = ($current.TrimEnd(';') + ';' + $add).Trim(';')
[System.Environment]::SetEnvironmentVariable("PATH",$new,"Machine")

Step 9: Eliminación de variables

9-1. Proceso (solo en sesión actual)

Remove-Item Env:<<VAR_NAME>> -ErrorAction SilentlyContinue

9-2. Eliminación persistente (registro)

Usuario

Remove-ItemProperty -Path "HKCU:\Environment" -Name "<<VAR_NAME>>" -ErrorAction SilentlyContinue

Sistema (requiere admin)

Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" -Name "<<VAR_NAME>>" -ErrorAction SilentlyContinue

Step 10: Aplicar y validar configuración

10-1. Ver valor en proceso actual

Get-ChildItem Env:<<VAR_NAME>>

10-2. Validar en CMD

echo %<<VAR_NAME>>%

10-3. Volver a cargar valor persistente

$env:<<VAR_NAME>> = [System.Environment]::GetEnvironmentVariable("<<VAR_NAME>>","User")

Step 11: Configurar múltiples variables (usuario y sistema)

# Usuario
$vars = @{
  "APPDATA_DIR" = "C:\AppData"
  "LOG_PATH"    = "C:\Logs"
  "TOOLS"       = "C:\Tools"
}
foreach ($v in $vars.GetEnumerator()) {
  [System.Environment]::SetEnvironmentVariable($v.Key,$v.Value,"User")
}

# Sistema
$sysVars = @{
  "JAVA_HOME" = "C:\Program Files\Java\<<VALUE>>"
}
foreach ($v in $sysVars.GetEnumerator()) {
  [System.Environment]::SetEnvironmentVariable($v.Key,$v.Value,"Machine")
}

Resumen final

Las variables de proceso, usuario y sistema existen por separado.
CMD y PowerShell pueden mostrar valores combinados o distintos.
HKCU/HKLM muestran los valores reales de cada ámbito.
setx puede persistir, pero no es adecuado para PATH.
La API de .NET (SetEnvironmentVariable) es el método más seguro y fiable.

Sincronización de tiempo y configuración NTP en Windows Server

Fri, 20 Feb 2026 20:14:11 GMT

Descripción general

Este artículo explica el funcionamiento de la sincronización de tiempo en un entorno de dominio de Windows Server.
Se abordan el diseño basado en el PDC Emulator, la configuración del servicio w32time, la aplicación centralizada mediante GPO y las consideraciones para entornos virtualizados.

Referencia de variables

Variable	Ejemplo	Descripción
`<<PDC_HOST>>`	`DC01.contoso.local`	PDC Emulator (referencia de tiempo del dominio)
`<<SECONDARY_DC>>`	`DC02.contoso.local`	Controlador de dominio secundario
`<<NTP_SERVER>>`	`ntp.nict.jp`	Servidor NTP externo
`<<CLIENT_HOST>>`	`SRV01.contoso.local`	Servidor miembro o cliente
`<<DOMAIN_NAME>>`	`contoso.local`	Nombre del dominio de Active Directory

Paso 1: Estructura básica de sincronización en el dominio

En Active Directory, la sincronización del tiempo sigue una jerarquía:

Nivel	Fuente de sincronización	Descripción
PDC Emulator	Servidor NTP externo	Fuente de tiempo principal y confiable del dominio
Otros DC	PDC Emulator	Mantienen la jerarquía de tiempo del dominio
Servidores miembros / Clientes	DC más cercano	Se sincronizan automáticamente para mantener la coherencia de Kerberos

En entornos workgroup, cada servidor debe configurarse manualmente con una fuente NTP.

Paso 2: Configuración del PDC Emulator con NTP externo

El PDC Emulator se configura como la única fuente de tiempo confiable del dominio.

# Configurar servidores NTP externos (se pueden definir varios)
w32tm /config /manualpeerlist:"ntp.nict.jp time.google.com" /syncfromflags:manual /reliable:yes /update

# Anunciar como fuente de tiempo confiable
reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config /v AnnounceFlags /t REG_DWORD /d 5 /f

# Reiniciar el servicio
net stop w32time && net start w32time

Verificación:

w32tm /query /configuration
w32tm /query /status

Paso 3: Configuración de otros DC y servidores miembros

Los demás controladores de dominio y servidores obtienen la hora automáticamente del PDC, aunque también puede configurarse manualmente.

# Configuración según la jerarquía del dominio
w32tm /config /syncfromflags:domhier /update
net stop w32time && net start w32time

Forzar sincronización y comprobar el estado:

w32tm /resync /force
w32tm /query /status

Paso 4: Política unificada de sincronización mediante GPO (PowerShell)

Las configuraciones de tiempo pueden aplicarse globalmente mediante Política de Grupo (GPO).
Se gestionan completamente con PowerShell, sin usar interfaces gráficas.

1. Cargar el módulo de GPO y revisar políticas existentes

Import-Module GroupPolicy

# Listar políticas
Get-GPO -All | Select-Object DisplayName, Id, GpoStatus

# Comprobar la existencia de la Default Domain Policy
Get-GPO -Name "Default Domain Policy" | Select-Object DisplayName, ModificationTime

2. Comprobar configuraciones actuales de tiempo

# Consultar valores existentes (si no existen, no hay configuración)
Get-GPRegistryValue -Name "Default Domain Policy" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" `
  -ValueName Type

Get-GPRegistryValue -Name "Default Domain Policy" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" `
  -ValueName NtpServer

Si aparece el error “no encontrado”, significa simplemente que el valor aún no está definido.

3. Activar y configurar el cliente NTP

# Activar cliente NTP
Set-GPRegistryValue -Name "Default Domain Policy" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" `
  -ValueName Enabled -Type DWord -Value 1

# Modo de sincronización (NT5DS=jerarquía del dominio / NTP=externo)
Set-GPRegistryValue -Name "Default Domain Policy" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" `
  -ValueName Type -Type String -Value "NT5DS"

# Servidor NTP externo (solo para el PDC)
Set-GPRegistryValue -Name "Default Domain Policy" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" `
  -ValueName NtpServer -Type String -Value "<<NTP_SERVER>>,0x8"

# Intervalo de sondeo (en segundos)
Set-GPRegistryValue -Name "Default Domain Policy" `
  -Key "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient" `
  -ValueName SpecialPollInterval -Type DWord -Value 3600

4. Verificar el enlace y ámbito de la GPO

Get-GPOReport -Name "Default Domain Policy" -ReportType Html -Path "$env:TEMP\DefaultDomainPolicy.html"

5. Aplicar y validar la GPO

gpupdate /force
gpresult /r
Get-GPResultantSetOfPolicy -ReportType Html -Path "$env:TEMP\gpresult.html"

6. Comprobar valores reflejados en el registro

reg query "HKLM\SOFTWARE\Policies\Microsoft\W32Time\TimeProviders\NtpClient"

Ejemplo de salida:

Enabled       REG_DWORD  0x1
Type          REG_SZ     NT5DS
NtpServer     REG_SZ     ntp.nict.jp,0x8
SpecialPollInterval REG_DWORD 0xe10

Consideraciones en entornos virtualizados

En entornos virtualizados (Hyper-V, VMware, etc.) pueden generarse conflictos si tanto el host como la VM tienen sincronización activa.
Casos comunes:

Sincronización activa en host y VM
PDC ejecutándose en VM con fuente NTP distinta
Snapshots o migraciones que provocan retrocesos de tiempo

Recomendaciones:

Desactivar sincronización del host en el PDC Emulator
Permitir sincronización del host en otras VM
Unificar la sincronización entre DC mediante w32time

Pruebas y resolución de problemas

# Prueba de sincronización NTP
w32tm /stripchart /computer:"<<NTP_SERVER>>" /dataonly /samples:5

# Estado del servicio
Get-Service w32time

# Últimos 10 eventos relacionados con W32Time
Get-WinEvent -LogName System | Where-Object {$_.ProviderName -eq "Microsoft-Windows-Time-Service"} |
  Select-Object TimeCreated, Id, LevelDisplayName, Message -First 10

Resumen

El PDC Emulator es la única fuente de tiempo confiable del dominio.
Solo el PDC usa servidores NTP externos; los demás siguen la jerarquía domhier.
En entornos virtualizados, desactive la sincronización del host en el PDC para evitar conflictos.

Limpieza de disco y automatización de mantenimiento

Fri, 20 Feb 2026 20:14:11 GMT

Descripción general

En este artículo se muestran las tareas periódicas de limpieza de disco en Windows Server divididas en cuatro categorías y se explica cómo automatizarlas mediante scripts independientes de PowerShell para cada propósito:

Optimización de WinSxS (reducción del almacén de componentes)
Limpieza de carpetas temporales (por días de retención)
Rotación de archivos de registro (varias rutas, cada una con su propio período de retención)
Copia de seguridad y limpieza de registros de eventos

Convención de variables

Nombre de la variable	Ejemplo	Comentario
`<<ADMIN_USER>>`	`Administrator`	Usuario con el que se ejecutan las tareas programadas
`<<LOG_PATH>>`	`C:\Maintenance\Logs`	Directorio común de registros de ejecución
`<<BACKUP_PATH>>`	`C:\Maintenance\Backups`	Directorio de copia de seguridad de registros de eventos
`<<DAILY_TEMP_TASK_NAME>>`	`DailyTempCleanup`	Nombre de la tarea de limpieza de Temp
`<<DAILY_LOG_TASK_NAME>>`	`DailyLogRotation`	Nombre de la tarea de rotación de logs
`<<MONTHLY_WINSXS_TASK_NAME>>`	`MonthlyWinSxSCleanup`	Nombre de la tarea de optimización de WinSxS
`<<MONTHLY_EVENTLOG_TASK_NAME>>`	`MonthlyEventLogMaintenance`	Nombre de la tarea de mantenimiento de registros de eventos

Step 1: Resumen de la optimización de la carpeta WinSxS

C:\Windows\WinSxS es el almacén de componentes (component store) donde se conserva el historial de actualizaciones y componentes. Tiende a crecer con el tiempo y puede optimizarse con los siguientes comandos DISM:

# Análisis del almacén de componentes
Dism /Online /Cleanup-Image /AnalyzeComponentStore

# Limpieza de componentes antiguos
Dism /Online /Cleanup-Image /StartComponentCleanup

# Eliminación completa de versiones antiguas (sin posibilidad de rollback)
Dism /Online /Cleanup-Image /StartComponentCleanup /ResetBase

Como /ResetBase impide desinstalar actualizaciones antiguas, lo más seguro es ejecutarlo únicamente en momentos planificados, por ejemplo una vez al mes durante una ventana de mantenimiento.

Step 2: Resumen de la limpieza de carpetas temporales

En $env:TEMP y C:\Windows\Temp se acumulan archivos temporales creados por instaladores y aplicaciones. En lugar de eliminarlos todos sin distinción, en la práctica es más razonable aplicar la política:

“eliminar archivos más antiguos que X días”.

Step 3: Resumen de la rotación de archivos de registro

Los directorios de logs crecen con el número de aplicaciones y con el tiempo pueden consumir mucho espacio de disco. Como es deseable establecer días de retención específicos por directorio, utilizaremos un archivo de configuración PSD1 para definir múltiples rutas y su retención de forma flexible.

Step 4: Resumen del mantenimiento de registros de eventos

Los registros de eventos son fundamentales para el análisis de incidencias y la auditoría, por lo que no deben limpiarse con frecuencia sin copia de seguridad previa. Un patrón habitual, ejecutado aproximadamente una vez al mes, es exportar primero a .evtx y luego limpiar el registro.

# Forma básica de copia de seguridad y limpieza
wevtutil epl System C:\Logs\System_20250101.evtx
wevtutil cl System

Step 5: Directrices de diseño de los scripts

En este artículo se definen cuatro scripts, uno para cada objetivo:

cleanup_temp.ps1
Elimina archivos antiguos en carpetas temporales (días de retención configurables como parámetro).
rotate_logs.ps1
Elimina archivos .log en los directorios definidos en un archivo de configuración PSD1.
optimize_winsxs.ps1
Ejecuta /StartComponentCleanup /ResetBase en WinSxS y registra la cantidad de espacio liberado.
maintain_eventlogs.ps1
Exporta determinados registros de eventos a .evtx y posteriormente limpia dichos registros.

Con esta estructura, cada script se puede ejecutar de forma independiente desde el Programador de tareas, lo que permite combinar tareas diarias/mensuales y ajustar la política con flexibilidad.

Estructura de directorios de ejemplo:

C:\
└─ Maintenance\
   ├─ cleanup_temp.ps1               # Limpieza de carpetas Temp (diaria)
   ├─ rotate_logs.ps1                # Rotación de logs (diaria)
   ├─ optimize_winsxs.ps1            # Optimización de WinSxS (mensual)
   ├─ maintain_eventlogs.ps1         # Copia de seguridad + limpieza de registros de eventos (mensual)
   │
   ├─ log_rotation.psd1              # Configuración de rotación (varias rutas + días)
   │
   ├─ Logs\                          # Registros de ejecución de cada script
   │    ├─ cleanup_temp_*.log
   │    ├─ rotate_logs_*.log
   │    ├─ optimize_winsxs_*.log
   │    └─ eventlog_maint_*.log
   │
   └─ Backups\                       # Copias de seguridad de registros de eventos (EVTX)
        ├─ System_YYYYMMDD.evtx
        ├─ Application_YYYYMMDD.evtx
        └─ Security_YYYYMMDD.evtx

Step 6: Script de limpieza de Temp

Este script elimina archivos y carpetas más antiguos que DaysToKeep días bajo los directorios definidos en $TempPaths, y registra los resultados en un archivo de log.
Los parámetros DaysToKeep y LogPath pueden sobrescribirse en la llamada.

cleanup_temp.ps1

param(
    [string[]]$TempPaths = @("$env:TEMP", "C:\Windows\Temp"),
    [int]$DaysToKeep = 7,
    [string]$LogPath = "<<LOG_PATH>>"
)

if (-not (Test-Path $LogPath)) {
    New-Item $LogPath -ItemType Directory -Force | Out-Null
}

$timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'
$logFile = Join-Path $LogPath "cleanup_temp_$timestamp.log"

function Write-Log($Message) {
    "[{0}] {1}" -f (Get-Date -Format "yyyy-MM-dd HH:mm:ss"), $Message |
        Tee-Object -FilePath $logFile -Append
}

Write-Log "===== Temp cleanup started ====="
Write-Log "DaysToKeep = $DaysToKeep"

$limitDate = (Get-Date).AddDays(-$DaysToKeep)

foreach ($path in $TempPaths) {
    if (-not (Test-Path $path)) {
        Write-Log "Skip: Not found -> $path"
        continue
    }

    Write-Log "Processing: $path"

    Get-ChildItem -Path $path -Recurse -Force -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -lt $limitDate } |
        ForEach-Object {
            try {
                Remove-Item -LiteralPath $_.FullName -Force -Recurse -ErrorAction Stop
                Write-Log "Deleted: $($_.FullName)"
            }
            catch {
                Write-Log "Failed: $($_.FullName) - $($_.Exception.Message)"
            }
        }
}

Write-Log "===== Temp cleanup finished ====="

Step 7: Script de rotación de logs

Archivo de configuración de rotación (PSD1)

Este archivo PSD1 define varios directorios de destino y sus correspondientes días de retención. Para añadir un nuevo directorio de logs, basta con incluir una nueva entrada.

log_rotation.psd1

@{
    RotationTargets = @(
        @{
            Path       = "C:\Logs\App1"
            DaysToKeep = 7
        },
        @{
            Path       = "C:\Logs\App2"
            DaysToKeep = 30
        },
        @{
            Path       = "<<LOG_PATH>>"
            DaysToKeep = 7
        }
    )
}

Script de rotación de logs

Este script lee RotationTargets desde el PSD1 y elimina los archivos .log en cada ruta cuyo LastWriteTime sea anterior al límite calculado. Todas las acciones se registran en un archivo de log.

rotate_logs.ps1

param(
    [string]$ConfigPath = "C:\Maintenance\log_rotation.psd1",
    [string]$LogPath = "<<LOG_PATH>>"
)

if (-not (Test-Path $LogPath)) {
    New-Item $LogPath -ItemType Directory -Force | Out-Null
}

$timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'
$logFile = Join-Path $LogPath "rotate_logs_$timestamp.log"

function Write-Log($Message) {
    "[{0}] {1}" -f (Get-Date -Format "yyyy-MM-dd HH:mm:ss"), $Message |
        Tee-Object -FilePath $logFile -Append
}

Write-Log "===== Log rotation started ====="
Write-Log "ConfigPath = $ConfigPath"

if (-not (Test-Path $ConfigPath)) {
    Write-Log "Config file not found. Exit."
    exit 1
}

try {
    $config = Import-PowerShellDataFile -Path $ConfigPath
}
catch {
    Write-Log "Config load failed: $($_.Exception.Message)"
    exit 1
}

foreach ($target in $config.RotationTargets) {
    $targetPath = $target.Path
    $daysToKeep = [int]$target.DaysToKeep

    if (-not (Test-Path $targetPath)) {
        Write-Log "Skip (not found): $targetPath"
        continue
    }

    $limitDate = (Get-Date).AddDays(-$daysToKeep)
    Write-Log "Path=$targetPath DaysToKeep=$daysToKeep Limit=$limitDate"

    Get-ChildItem -Path $targetPath -Recurse -Include *.log -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -lt $limitDate } |
        ForEach-Object {
            try {
                Remove-Item -LiteralPath $_.FullName -Force -ErrorAction Stop
                Write-Log "Deleted: $($_.FullName)"
            }
            catch {
                Write-Log "Failed: $($_.FullName) - $($_.Exception.Message)"
            }
        }
}

Write-Log "===== Log rotation finished ====="

Step 8: Script de optimización de WinSxS

Este script mide el tamaño del directorio WinSxS antes y después de la limpieza y ejecuta /StartComponentCleanup /ResetBase. De esta forma, se puede comprobar numéricamente cuánto espacio se ha recuperado.

optimize_winsxs.ps1

param(
    [string]$LogPath = "<<LOG_PATH>>"
)

if (-not (Test-Path $LogPath)) {
    New-Item $LogPath -ItemType Directory -Force | Out-Null
}

$timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'
$logFile = Join-Path $LogPath "optimize_winsxs_$timestamp.log"

function Write-Log($Message) {
    "[{0}] {1}" -f (Get-Date -Format "yyyy-MM-dd HH:mm:ss"), $Message |
        Tee-Object -FilePath $logFile -Append
}

Write-Log "===== WinSxS optimization started ====="

$winsxsPath = "C:\Windows\WinSxS"

Write-Log "Measuring WinSxS size before..."
$sizeBefore = (Get-ChildItem $winsxsPath -Recurse -Force -ErrorAction SilentlyContinue |
               Measure-Object Length -Sum).Sum
$sizeBeforeGB = [math]::Round($sizeBefore / 1GB, 2)
Write-Log "Before: $sizeBeforeGB GB"

Dism /Online /Cleanup-Image /AnalyzeComponentStore |
    Out-File (Join-Path $LogPath "dism_before_$timestamp.txt")

Write-Log "Running StartComponentCleanup /ResetBase..."
Dism /Online /Cleanup-Image /StartComponentCleanup /ResetBase |
    Out-File (Join-Path $LogPath "dism_exec_$timestamp.txt")

Write-Log "Measuring WinSxS size after..."
$sizeAfter = (Get-ChildItem $winsxsPath -Recurse -Force -ErrorAction SilentlyContinue |
              Measure-Object Length -Sum).Sum
$sizeAfterGB = [math]::Round($sizeAfter / 1GB, 2)

Write-Log "After: $sizeAfterGB GB"
Write-Log ("Reduced: {0} GB" -f ([math]::Round(($sizeBefore - $sizeAfter)/1GB,2)))

Dism /Online /Cleanup-Image /AnalyzeComponentStore |
    Out-File (Join-Path $LogPath "dism_after_$timestamp.txt")

Write-Log "===== WinSxS optimization finished ====="

Step 9: Script de mantenimiento de registros de eventos

Este script exporta los registros especificados (por defecto: System / Application / Security) a archivos .evtx en un directorio de copia de seguridad y luego limpia los registros originales. El archivo de log detalla todos los éxitos y errores.

maintain_eventlogs.ps1

param(
    [string]$LogPath = "<<LOG_PATH>>",                  # Directorio de registros (.log)
    [string]$BackupPath = "<<BACKUP_PATH>>",            # Directorio de backup EVTX
    [string[]]$EventLogs = @("System", "Application", "Security")
)

# Crear el directorio de logs, si es necesario
if (-not (Test-Path $LogPath)) {
    New-Item $LogPath -ItemType Directory -Force | Out-Null
}

# Crear el directorio de backup, si es necesario
if (-not (Test-Path $BackupPath)) {
    New-Item $BackupPath -ItemType Directory -Force | Out-Null
}

$timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'
$logFile = Join-Path $LogPath "eventlog_maint_$timestamp.log"

function Write-Log($Message) {
    "[{0}] {1}" -f (Get-Date -Format "yyyy-MM-dd HH:mm:ss"), $Message |
        Tee-Object -FilePath $logFile -Append
}

Write-Log "===== Event log maintenance started ====="
Write-Log "BackupPath = $BackupPath"

foreach ($name in $EventLogs) {

    # Generar un nombre de archivo EVTX único por log
    $destEvtx = Join-Path $BackupPath ("{0}_{1}.evtx" -f $name, $timestamp)

    try {
        Write-Log "Export: $name -> $destEvtx"
        wevtutil epl $name $destEvtx

        Write-Log "Clear: $name"
        wevtutil cl $name
    }
    catch {
        Write-Log "Failed: $name - $($_.Exception.Message)"
    }
}

Write-Log "===== Event log maintenance finished ====="

Step 10: Ejemplos de registro en el Programador de tareas

A continuación, todos los scripts de mantenimiento se registran usando schtasks.exe.
Para una explicación detallada de las opciones /SC, /D, /ST, /RU, etc., consulte:

Administración del Programador de tareas con schtasks.exe

Ejemplo de tarea diaria de limpieza de Temp

Ejecuta cleanup_temp.ps1 todos los días a las 2:00, eliminando archivos temporales más antiguos que 7 días.
La tarea se ejecuta como <<ADMIN_USER>> con máximos privilegios (/RL HIGHEST).

schtasks /Create `
  /TN "<<DAILY_TEMP_TASK_NAME>>" `
  /TR "powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Maintenance\cleanup_temp.ps1 -DaysToKeep 7 -LogPath <<LOG_PATH>>" `
  /SC DAILY `
  /ST 02:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Ejemplo de tarea diaria de rotación de logs

Ejecuta rotate_logs.ps1 todos los días a las 2:30 y rota los archivos .log de varios directorios según la configuración definida en el PSD1.
Los días de retención se controlan exclusivamente a través de log_rotation.psd1.

schtasks /Create `
  /TN "<<DAILY_LOG_TASK_NAME>>" `
  /TR "powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Maintenance\rotate_logs.ps1 -ConfigPath C:\Maintenance\log_rotation.psd1 -LogPath <<LOG_PATH>>" `
  /SC DAILY `
  /ST 02:30 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Ejemplo de tarea mensual de optimización de WinSxS

Ejecuta optimize_winsxs.ps1 el día 1 de cada mes a las 3:00, realizando StartComponentCleanup /ResetBase con medición del tamaño.
Dado que no existe posibilidad de rollback, este script debe ejecutarse dentro de una ventana de mantenimiento planificada.

schtasks /Create `
  /TN "<<MONTHLY_WINSXS_TASK_NAME>>" `
  /TR "powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Maintenance\optimize_winsxs.ps1 -LogPath <<LOG_PATH>>" `
  /SC MONTHLY `
  /D 1 `
  /ST 03:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Ejemplo de tarea mensual de mantenimiento de registros de eventos

Ejecuta maintain_eventlogs.ps1 el día 1 de cada mes a las 3:30, exportando registros como System / Application / Security al directorio de copia de seguridad y limpiándolos a continuación.
Ajuste -EventLogs y -BackupPath según sus requisitos de auditoría.

schtasks /Create `
  /TN "<<MONTHLY_EVENTLOG_TASK_NAME>>" `
  /TR "powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Maintenance\maintain_eventlogs.ps1 -LogPath <<LOG_PATH>>" `
  /SC MONTHLY `
  /D 1 `
  /ST 03:30 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Resumen

En este artículo se ha mostrado cómo dividir el mantenimiento de disco en Windows Server en scripts específicos por objetivo y cómo utilizar un archivo de configuración PSD1 para controlar de forma flexible los destinos de rotación de logs y sus períodos de retención.

Limpieza de Temp: diaria, con días de retención configurables
Rotación de logs: varios caminos y retenciones definidos en PSD1
Optimización de WinSxS: mensual, con registro del espacio liberado
Mantenimiento de registros de eventos: mensual, con copia de seguridad en EVTX seguida de limpieza

Con ello se obtiene una automatización de mantenimiento robusta y extensible para entornos de producción.

Introducción a Ansible

Fri, 20 Feb 2026 20:14:11 GMT

What

Este artículo ofrece una introducción clara y concisa a Ansible, guiando a los principiantes en la instalación, configuración básica y ejecución de sus primeras tareas de automatización.

Why

Ansible simplifica la automatización de TI con una herramienta sin agentes y fácil de aprender para la gestión de configuraciones, despliegue de aplicaciones y automatización de tareas. Mejora la eficiencia, reduce errores manuales y garantiza entornos consistentes.

How

Paso 1: Instalar Ansible

En Ubuntu/Debian

sudo apt update
sudo apt install -y ansible

En CentOS/RHEL

sudo yum install epel-release
sudo yum install -y ansible

Usando pip (para la versión más reciente)

pip install ansible

Paso 2: Verificar la instalación

ansible --version

Paso 3: Configurar el archivo de inventario

Cree un archivo de inventario para definir los hosts gestionados.

sudo nano /etc/ansible/hosts

Contenido de ejemplo:

[webservers]
192.168.1.10
192.168.1.11

[dbservers]
db01.example.com

Paso 4: Probar la conexión con el módulo ping

ansible all -m ping

Si necesita usar un usuario específico:

ansible all -m ping -u your_user

Paso 5: Crear un Playbook simple

Cree un archivo llamado install_nginx.yml.

- hosts: webservers
  become: yes
  tasks:
    - name: Instalar Nginx
      apt:
        name: nginx
        state: present

Paso 6: Ejecutar el Playbook

ansible-playbook install_nginx.yml

Conclusion

Ansible ofrece un enfoque potente y sencillo para automatizar tareas de TI. Comenzando con configuraciones básicas y playbooks, puede escalar rápidamente la automatización en su infraestructura. Explore funciones avanzadas como Roles, Variables y Ansible Galaxy para mejorar sus flujos de trabajo de automatización.

Configurar ajustes de red con PowerShell

Fri, 20 Feb 2026 20:14:11 GMT

Qué es

Este artículo proporciona una guía clara sobre cómo configurar los ajustes de red en Windows usando PowerShell.

Por qué

PowerShell permite una configuración de red automatizada, rápida y consistente, ideal para administradores de sistemas que gestionan múltiples equipos o entornos remotos.

Cómo

Paso 1: Ver adaptadores de red

Muestra todos los adaptadores de red disponibles en el sistema.

Get-NetAdapter

Paso 2: Asignar una dirección IP estática

Configura una dirección IP estática, máscara de subred y puerta de enlace predeterminada.

New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 192.168.1.100 -PrefixLength 24 -DefaultGateway 192.168.1.1

Paso 3: Configurar servidores DNS

Establece los servidores DNS preferido y alternativo.

Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("8.8.8.8", "8.8.4.4")

Paso 4: Habilitar o deshabilitar un adaptador de red

Desactiva y luego vuelve a activar un adaptador de red.

Disable-NetAdapter -Name "Ethernet" -Confirm:$false
Enable-NetAdapter -Name "Ethernet"

Paso 5: Eliminar configuración IP estática y activar DHCP

Elimina la configuración de IP estática y activa DHCP.

Remove-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 192.168.1.100 -Confirm:$false
Set-NetIPInterface -InterfaceAlias "Ethernet" -Dhcp Enabled

Paso 6: Probar la conectividad de red

Verifica la conexión a un host externo.

Test-Connection -ComputerName google.com -Count 4

Conclusión

PowerShell ofrece una forma poderosa y eficiente de gestionar la configuración de red en Windows. Dominar estos comandos permite una administración de red más rápida, automatizada y confiable.

Guía completa sobre estructuras especiales, variables especiales y expansiones en Bash

Fri, 20 Feb 2026 20:14:11 GMT

Descripción general

Este artículo resume de forma sistemática todas las estructuras especiales, variables, expansiones y construcciones de control utilizadas en el shell Bash.

Sobre la notación de variables

Los valores dinámicos o dependientes del entorno se expresan como <<nombre_variable>> y se muestran con ejemplos concretos.

Variable	Ejemplo	Descripción
`<<var>>`	`name`, `path`, `user`	Nombre de variable arbitrario
`<<default>>`	`guest`, `8080`	Valor por defecto o alternativo
`<<pattern>>`	`.txt`, `/`	Patrón de nombre o cadena
`<<offset>>`	`0`, `3`	Posición inicial del substring (base 0)
`<<length>>`	`4`, `10`	Longitud del substring
`<<prefix>>`	`ENV_`, `HOST`	Coincidencia inicial del nombre
`<<index>>`	`0`, `1`, `2`	Índice o clave en un array/asociativo
`<<file>>`	`/tmp/test.txt`	Ruta de archivo

Paso 1: Caracteres especiales (metacaracteres)

Símbolo	Significado	Ejemplo
`*`	Coincide con cualquier cadena	`ls *.txt` → lista todos los `.txt`
`?`	Coincide con un solo carácter	`ls ?.sh` → `a.sh`, `b.sh`, etc.
`[a-z]`	Rango de coincidencia	`ls [A-Z]*` → archivos en mayúscula
`{a,b}`	Expansión de llaves	`mv {hoge,huga}`
`{1..3}`	Rango numérico	`touch file{1..3}.txt`
`$`	Expansión de variable	`echo $HOME`
`!` (negación)	Operador lógico de negación	`[[ ! -f test.txt ]]`
`!` (historial)	Expansión de comando previo	`!10` → ejecuta el comando n.º 10
`~`	Directorio home	`cd ~`
`;`	Encadenamiento de comandos	`pwd; ls`
`&&`	Ejecuta si el anterior tuvo éxito	`make && echo OK`
`		`
`&`	Ejecución en background	`sleep 5 &`
`	`	Pipe
`>`	Redirección de salida	`echo hi > out.txt`
`>>`	Añadir al final	`echo hi >> out.txt`
`<`	Redirección de entrada	`wc -l < file.txt`
`()`	Subshell	`(cd /tmp; ls)`
`{}`	Ejecución en el mismo shell	`{ echo A; echo B; }`
`\`	Escape	`echo \$HOME`
`' '`	Literal sin expansión	`echo '$USER'`
`" "`	Con expansión	`echo "$USER"`

Paso 2: Variables especiales

Variable	Contenido	Ejemplo
`$0`	Nombre del script	`echo $0` → `script.sh`
`$1〜$9`	Argumentos	`echo $1`
`$@`	Todos los argumentos	`for a in "$@"; do echo $a; done`
`$#`	Número de argumentos	`echo $#`
`$?`	Código de salida del comando previo	`ls /nope; echo $?`
`$$`	PID actual	`echo $$`
`$!`	PID del último proceso en background	`sleep 10 & echo $!`
`$-`	Opciones del shell actual	`echo $-`
`$_`	Último argumento del comando anterior	`echo $_`
`$PPID`	PID del proceso padre	`echo $PPID`
`$RANDOM`	Número aleatorio 0–32767	`echo $RANDOM`
`$SECONDS`	Segundos desde el inicio del shell	`echo $SECONDS`
`$FUNCNAME`	Nombre de la función actual	`myf(){ echo $FUNCNAME; }; myf`
`$PIPESTATUS[@]`	Códigos de salida en un pipe	`ls

Paso 3: Expansión de variables (Parameter Expansion)

Sintaxis	Significado	Ejemplo
`${<<var>>}`	Expansión simple	`name=user; echo ${name}`
`${<<var>>:-<<default>>}`	Usa valor por defecto si está indefinida	`echo ${user:-guest}`
`${<<var>>:=<<default>>}`	Asigna valor por defecto	`echo ${port:=8080}`
`${<<var>>:+alt}`	Usa `alt` si está definida	`x=1; echo ${x:+OK}`
`${<<var>>:?msg}`	Error si no está definida	`echo ${config:?missing}`
`${#<<var>>}`	Longitud de la cadena	`name=user; echo ${#name}`
`${<<var>>%<<pattern>>}`	Elimina patrón más corto al final	`path=/a/b/c; echo ${path%/*}`
`${<<var>>%%<<pattern>>}`	Elimina patrón más largo al final	`echo ${path%%/*}`
`${<<var>>#<<pattern>>}`	Elimina patrón más corto al inicio	`echo ${path#*/}`
`${<<var>>##<<pattern>>}`	Elimina patrón más largo al inicio	`echo ${path##*/}`
`${<<var>>/<<pattern>>/<<repl>>}`	Sustituye primera coincidencia	`echo ${msg/foo/bar}`
`${<<var>>//<<pattern>>/<<repl>>}`	Sustituye todas	`echo ${msg// /_}`
`${<<var>>:<<offset>>}`	Subcadena desde posición	`s=abcdef; echo ${s:2}`
`${<<var>>:<<offset>>:<<length>>}`	Subcadena con longitud	`echo ${s:1:3}`
`${!<<prefix>>*}`	Lista de variables por prefijo	`HOST1=x; echo ${!HOST*}`
`${!<<var>>}`	Referencia indirecta	`ref=NAME; NAME=user; echo ${!ref}`
`${<<var>>^^}` / `${<<var>>,}`	Mayúsculas/minúsculas	`n=abc; echo ${n^^}`
`${<<var>>@Q}`	Expansión entrecomillada	`x='abc'; echo ${x@Q}`

Paso 4: Arrays y arrays asociativos

# Array normal
arr=(a b c)
echo ${arr[<<index>>]}
echo ${#arr[@]}
for i in "${arr[@]}"; do echo $i; done

# Array asociativo
declare -A map
map[<<index>>]=100
map[name]=user
echo ${map[<<index>>]}
echo ${!map[@]}

Paso 5: Expansión aritmética

x=5
y=3
echo $((x + y))
((x *= 2))
echo $x

Paso 6: Condicionales y comparaciones

# Cadenas
if [ "$USER" = "root" ]; then echo root; fi

# Números
if [ "$x" -lt 10 ]; then echo "small"; fi

# Archivos
if [ -f /etc/passwd ]; then echo "exists"; fi

# Expresión regular
s="hello123"
[[ $s =~ [0-9]+ ]] && echo "contains number"

Paso 7: Sustitución de comandos y subshell

echo "Hoy es: $(date +%Y-%m-%d)"
(cd /tmp; ls)

Paso 8: Redirección y descriptores de archivo (FD)

echo "Hola" > <<file>>
echo "Append" >> <<file>>
wc -l < <<file>>
ls /notfound 2> err.log
echo "Error" >&2
exec 3> custom.log
echo "via fd3" >&3
exec 3>&-

Descriptores de archivo (FD)

FD	Nombre	Descripción	Ejemplo
`0`	stdin	Entrada estándar	`< file.txt`
`1`	stdout	Salida estándar	`echo test > out.txt`
`2`	stderr	Errores	`ls /nope 2> err.log`
`3+`	FD personalizados	Streams definidos por el usuario	`exec 3> log.txt`

FD3 es un descriptor definido por el usuario. Ejemplo:

exec 3> process.log
echo "Inicio" >&3
exec 3>&-

Paso 9: Trampas y control de errores

set -e
set -u
set -x
set -o pipefail

trap 'echo Finalizado' EXIT
trap 'echo Error' ERR

Paso 10: Control de trabajos

sleep 10 &
jobs
fg %1
bg %1
disown %1
kill %1

%1 hace referencia al número de trabajo mostrado por jobs.

Paso 11: Comandos y palabras reservadas

:
true
false
source ~/.bashrc
eval "echo ejecutado"
{ echo A; echo B; }

Conclusión

Esta guía abarca de forma completa los símbolos, variables, expansiones y estructuras de control en Bash.
Comprender estos mecanismos permite diseñar scripts más seguros, portables y eficientes para automatización avanzada en entornos Linux.

Cómo instalar y configurar un servidor SSH en Windows Server

Fri, 20 Feb 2026 20:14:11 GMT

Descripción general

En este artículo, aprenderás a instalar OpenSSH Server en Windows Server, habilitar la autenticación mediante claves, configurar el servicio y permitir el tráfico SSH en el firewall, todo paso a paso.

Convenciones de variables

Variable	Ejemplo	Descripción
`<<SERVER>>`	`192.168.1.10`	Nombre de host o dirección IP del destino

Paso 1: Instalar el servidor OpenSSH

Abre PowerShell con privilegios de administrador y ejecuta el siguiente comando:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

Paso 2: Iniciar el servicio y configurarlo para inicio automático

Después de la instalación, inicia el servicio sshd y configúralo para que se inicie automáticamente:

# Iniciar el servicio
Start-Service sshd

# Habilitar inicio automático
Set-Service -Name sshd -StartupType Automatic

💡 Nota
Al iniciar sshd por primera vez, se generan automáticamente los archivos de configuración y claves de host.
Entre ellos:

%ProgramData%\ssh\sshd_config (archivo de configuración)

%ProgramData%\ssh\ssh_host_* (claves de host)

Realiza cualquier modificación después de que estos archivos se hayan creado.

Paso 3: Configurar el firewall

Para permitir el tráfico SSH (puerto 22 por defecto), agrega una regla de entrada en el firewall de Windows Defender:

New-NetFirewallRule -Name "OpenSSH-Server" -DisplayName "OpenSSH Server (sshd)" `
  -Enabled True -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow

Paso 4: Configurar autenticación por clave (recomendado)

Consulta la guía de generación y configuración de claves SSH en el cliente
Registra la clave pública en el servidor:
- Para usuarios normales: agrega la clave en .ssh\authorized_keys dentro del perfil del usuario.
- Para administradores: utiliza %ProgramData%\ssh\administrators_authorized_keys.

Edita el archivo sshd_config (ubicado en %ProgramData%\ssh\sshd_config) y asegúrate de tener:

PubkeyAuthentication yes
AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

Paso 5: Primera conexión y verificación

Desde el cliente, conecta al servidor con:

ssh Administrator@<<SERVER>>

Durante la primera conexión, se mostrará un aviso para verificar la clave del host.
Una vez conectado, ejecuta whoami para confirmar que has iniciado sesión con el usuario correcto.

Paso 6: Restricciones y fortalecimiento de la seguridad

En el archivo sshd_config, añade o modifica las siguientes líneas según sea necesario:

Port 2222
AllowGroups SSHAdmins
AllowUsers Administrator deployuser
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

Port 2222
Cambiar el puerto predeterminado 22 reduce los intentos automáticos de ataque.
AllowGroups SSHAdmins
Restringe el acceso SSH solo a un grupo definido, reduciendo el riesgo de intrusión.

ℹ️ Nota
En Windows Server 2025 o posterior, esta restricción puede aplicarse de manera predeterminada.
AllowUsers Administrator deployuser
Define qué usuarios pueden conectarse.
PasswordAuthentication no
Desactiva la autenticación por contraseña para aumentar la seguridad.
KbdInteractiveAuthentication no
Desactiva métodos interactivos de autenticación.
PubkeyAuthentication yes
Garantiza que solo se use autenticación mediante claves.

Asegúrate de crear los usuarios y grupos (SSHAdmins, deployuser, etc.) con los permisos mínimos necesarios.
También es recomendable establecer LogLevel VERBOSE para mejorar la auditoría de conexiones.

Paso 7: Ver logs

Para revisar los registros recientes de OpenSSH, usa PowerShell:

Get-WinEvent -LogName OpenSSH/Operational `
  | Where-Object { $_.TimeCreated -ge (Get-Date).AddHours(-1) } `
  | Select-Object TimeCreated, Id, LevelDisplayName, Message

💡 Consejo
Puedes listar los nombres de registro disponibles con:

wevtutil el | findstr OpenSSH

Utiliza el nombre mostrado en -LogName.

Conclusión

Con OpenSSH configurado en Windows Server, puedes administrar tu entorno de forma remota igual que en Linux o Unix.
La combinación de autenticación por clave, configuración de servicio y firewall te permitirá operar un sistema seguro y estable.

Guía de Configuración Inicial de AlmaLinux

Fri, 20 Feb 2026 20:14:11 GMT

Qué

Este artículo proporciona una guía práctica y mínima para la configuración inicial de AlmaLinux después de una instalación limpia, adecuada para entornos de servidor.

Por Qué

Después de la instalación, AlmaLinux requiere configuraciones esenciales del sistema para garantizar una operación segura, manejable y accesible en red. Estos pasos establecen una base sólida antes de desplegar cualquier aplicación.

Cómo

Paso 1: Cambiar el nombre del host

hostnamectl set-hostname tu-hostname
echo "127.0.0.1   localhost tu-hostname" >> /etc/hosts

Paso 2: Configurar la red (Ejemplo: IP Estática)

nmcli con mod "eth0" ipv4.addresses 192.168.1.100/24
nmcli con mod "eth0" ipv4.gateway 192.168.1.1
nmcli con mod "eth0" ipv4.dns 8.8.8.8
nmcli con mod "eth0" ipv4.method manual
nmcli con up "eth0"

Paso 3: Configurar Proxy (si es necesario)

cat <<EOF > /etc/profile.d/proxy.sh
export http_proxy="http://proxy.example.com:8080"
export https_proxy="http://proxy.example.com:8080"
export no_proxy="localhost,127.0.0.1"
EOF
chmod +x /etc/profile.d/proxy.sh
source /etc/profile.d/proxy.sh
echo 'proxy=http://proxy.example.com:8080' >> /etc/dnf/dnf.conf

Paso 4: Deshabilitar SELinux

sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
setenforce 0

Paso 5: Actualizar el sistema

dnf update -y
dnf upgrade -y

Paso 6: Configurar el cortafuegos

systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload

Paso 7: Configurar zona horaria y NTP

timedatectl set-timezone Asia/Tokyo
systemctl enable --now chronyd

Paso 8: Crear usuario administrador con clave SSH

useradd adminuser
passwd adminuser
usermod -aG wheel adminuser
mkdir -p /home/adminuser/.ssh
chmod 700 /home/adminuser/.ssh
vi /home/adminuser/.ssh/authorized_keys  # Pegar la clave pública
chmod 600 /home/adminuser/.ssh/authorized_keys
chown -R adminuser:adminuser /home/adminuser/.ssh

Paso 9: Reiniciar para aplicar la configuración de SELinux

reboot

Conclusión

Esta configuración mínima prepara un sistema AlmaLinux para su uso como servidor seguro y confiable. Incluye ajustes de red, hostname, proxy, actualizaciones del sistema, desactivación de SELinux, herramientas esenciales, firewall y sincronización horaria.

Administración del Programador de tareas con schtasks.exe

Fri, 20 Feb 2026 20:14:11 GMT

Descripción general

En este artículo se explica cómo administrar el Programador de tareas de Windows utilizando la herramienta de línea de comandos schtasks.exe, incluida de forma predeterminada en entornos Windows Server y Windows Cliente.

Todos los ejemplos suponen la ejecución desde PowerShell, usando el acento grave (`) como carácter de continuación de línea de forma uniforme.

Convención de variables

Nombre de variable	Ejemplo	Descripción
`<<SERVER_NAME>>`	`WSRV2025`	Nombre del servidor de destino
`<<ADMIN_USER>>`	`Administrator`	Cuenta que ejecuta la tarea
`<<TASK_NAME>>`	`DailyTempCleanup`	Nombre de la tarea
`<<SCRIPT_PATH>>`	`C:\Maintenance\cleanup_temp.ps1`	Script que se va a ejecutar
`<<LOG_PATH>>`	`C:\Maintenance\Logs`	Carpeta de registros
`<<BACKUP_PATH>>`	`C:\Maintenance\Backups`	Destino para copia de logs de eventos

Sobre los caracteres de continuación de línea en PowerShell y CMD

Los comandos de este artículo están pensados para ejecutarse en PowerShell.

PowerShell: acento grave (`)
CMD: circunflejo (^)

Ejemplo (PowerShell):

schtasks.exe /Create `
  /TN "Example" `
  /SC DAILY `
  /ST 02:00 `
  /TR "powershell.exe -File example.ps1"

Habilitar el registro operacional (Operational)

El canal Microsoft-Windows-TaskScheduler/Operational puede estar deshabilitado por defecto.
Habilítalo para troubleshooting e historial detallado.

wevtutil sl Microsoft-Windows-TaskScheduler/Operational /e:true

Step 1: Resumen de los subcomandos de schtasks.exe

Subcomando	Uso
`/Create`	Crear una nueva tarea
`/Delete`	Eliminar una tarea
`/Query`	Listar tareas, ver detalles y exportar XML
`/Change`	Modificar la configuración de una tarea
`/Run`	Ejecutar una tarea de forma inmediata
`/End`	Detener una tarea en ejecución
`/ShowSid`	Mostrar el SID de la cuenta de ejecución

Step 2: /Create – sintaxis básica y opciones principales

Step 2.1 Sintaxis general

schtasks.exe /Create `
  /TN "<<TASK_NAME>>" `
  /TR "<<COMANDO_A_EJECUTAR>>" `
  /SC PROGRAMACIÓN `
  [otras_opciones...]

Step 2.2 Opciones de uso frecuente

Opción	Contenido
`/SC`	Tipo de programación (DAILY / WEEKLY / MONTHLY / ONLOGON / ONEVENT)
`/MO`	Modificador
`/ST HH:mm`	Hora de inicio
`/D`	Día de ejecución (1–31 o MON/TUE…)
`/RU`	Cuenta que ejecuta la tarea
`/RP`	Contraseña (`*` para entrada interactiva)
`/RL HIGHEST`	Ejecutar con privilegios elevados
`/F`	Forzar sobrescritura

Sobre /MO (modificador)
Parámetro que ajusta la frecuencia o posición de la programación.

Ejemplos:

Cada 3 horas → /SC HOURLY /MO 3

Cada 2 semanas → /SC WEEKLY /MO 2

Segundo miércoles de cada mes → /SC MONTHLY /MO SECOND /D WED

Disparo por evento → /SC ONEVENT /MO [XPath]

Step 2.3 Lista de valores para `/SC`

`/SC`	Descripción
DAILY	Diario
WEEKLY	Semanal
MONTHLY	Mensual
ONCE	Una sola vez
ONSTART	Al iniciar el sistema
ONLOGON	Al iniciar sesión el usuario
ONIDLE	En estado inactivo
ONEVENT	Cuando se produce un evento en el registro de eventos

Step 2.4 Tarea diaria

schtasks.exe /Create `
  /TN "DailyTempCleanup" `
  /TR "powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Maintenance\cleanup_temp.ps1 -DaysToKeep 7 -LogPath <<LOG_PATH>>" `
  /SC DAILY `
  /ST 02:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 2.5 Ejecución al iniciar sesión (ONLOGON)

schtasks.exe /Create `
  /TN "OnLogonAudit" `
  /SC ONLOGON `
  /TR "powershell.exe -File C:\Scripts\logon_audit.ps1" `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 2.6 Ejecución al iniciar el sistema (ONSTART)

schtasks.exe /Create `
  /TN "OnStartInit" `
  /SC ONSTART `
  /TR "powershell.exe -File C:\Scripts\startup_init.ps1" `
  /RU "SYSTEM" `
  /RL HIGHEST `
  /F

Step 2.7 Disparo basado en registro de eventos (ONEVENT)

schtasks.exe /Create `
  /TN "Event101Handler" `
  /SC ONEVENT `
  /EC System `
  /MO "*[System/EventID=101]" `
  /TR "powershell.exe -File C:\Scripts\event_handler.ps1" `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 2.8 Ejecución cada 3 horas

schtasks.exe /Create `
  /TN "Every3Hours" `
  /TR "powershell.exe -File script.ps1" `
  /SC HOURLY `
  /MO 3 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 2.9 Segundo miércoles de cada mes

schtasks.exe /Create `
  /TN "SecondWednesdayTask" `
  /TR "powershell.exe -File task.ps1" `
  /SC MONTHLY `
  /MO SECOND `
  /D WED `
  /ST 03:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 2.10 Último día del mes (LASTDAY)

schtasks.exe /Create `
  /TN "LastDayMonthly" `
  /TR "powershell.exe -File script.ps1" `
  /SC MONTHLY `
  /MO LASTDAY `
  /M * `
  /ST 01:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 2.11 Cada 2 semanas

schtasks.exe /Create `
  /TN "Every2Weeks" `
  /TR "powershell.exe -File script.ps1" `
  /SC WEEKLY `
  /MO 2 `
  /D MON `
  /ST 05:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Step 3: /Query – listado y detalles

Opción	Descripción
`/FO TABLE`	Salida en formato tabla
`/FO LIST`	Salida en formato lista por campos
`/V`	Incluye información detallada (disparadores, acciones, etc.)
`/TN "<<TASK_NAME>>"`	Muestra solo la tarea especificada

schtasks.exe /Query /FO TABLE
schtasks.exe /Query /FO LIST /V
schtasks.exe /Query /TN "<<TASK_NAME>>" /FO LIST /V

Step 4: /Change – modificación de configuración

Opción	Descripción
`/TN`	Nombre de la tarea
`/RU`	Cambia la cuenta de ejecución
`/RP *`	Solicita interactivamente la nueva contraseña
`/TR`	Sustituye el comando de ejecución
`/ENABLE` `/DISABLE`	Habilita o deshabilita la tarea

Atención: con /Change no se pueden modificar las definiciones de disparador (/SC, /MO, /D, /M).
Si necesita cambiar la programación, es más seguro eliminar la tarea con /Delete y volver a crearla con /Create.

Cambio de cuenta de ejecución

schtasks.exe /Change `
  /TN "<<TASK_NAME>>" `
  /RU "<<ADMIN_USER>>" `
  /RP *

Cambio de comando de ejecución

schtasks.exe /Change `
  /TN "<<TASK_NAME>>" `
  /TR "powershell.exe -File <<SCRIPT_PATH>> -LogPath <<LOG_PATH>>"

Habilitar/Deshabilitar tarea

schtasks.exe /Change /TN "<<TASK_NAME>>" /ENABLE
schtasks.exe /Change /TN "<<TASK_NAME>>" /DISABLE

Step 5: /Run (ejecución inmediata) y /End (detener)

Opción	Descripción
`/Run`	Ejecuta la tarea inmediatamente
`/I`	Ignora las restricciones de programación (fecha de inicio/fin, etc.)
`/End`	Detiene la tarea en ejecución
`/TN`	Nombre de la tarea objetivo

schtasks.exe /Run /TN "<<TASK_NAME>>"
schtasks.exe /Run /TN "<<TASK_NAME>>" /I

schtasks.exe /End /TN "<<TASK_NAME>>"

Step 6: Importar tareas desde XML

Importación desde XML

Opción	Descripción
`/XML archivo`	Crea la tarea a partir de una definición XML
`/RU`	Sobrescribe la cuenta de ejecución
`/RP *`	Solicita la contraseña de forma interactiva

schtasks.exe /Create `
  /TN "<<TASK_NAME>>" `
  /XML "C:\TaskTemplates\<<TASK_NAME>>.xml" `
  /RU "<<ADMIN_USER>>" `
  /RP *

Exportación a XML (mediante Query)

Opción	Descripción
`/XML ONE`	Exporta la definición de la tarea como un único XML
`> archivo`	Redirige la salida a un archivo

schtasks.exe /Query `
  /TN "<<TASK_NAME>>" `
  /XML ONE `
  > C:\TaskTemplates\<<TASK_NAME>>.xml

Step 8: /Delete – eliminación de tareas

Opción	Descripción
`/Delete`	Modo de eliminación
`/TN`	Nombre de la tarea
`/F`	Forzar eliminación sin confirmación

schtasks.exe /Delete /TN "<<TASK_NAME>>" /F

Step 9: /ShowSid – mostrar SID de la cuenta de ejecución

Opción	Descripción
`/ShowSid`	Muestra el SID asociado a la cuenta de ejecución
`/TN`	Nombre de la tarea

schtasks.exe /ShowSid /TN "<<TASK_NAME>>"

Step 10: Administración de tareas en servidores remotos

Opción	Descripción
`/S "<<SERVER_NAME>>"`	Servidor de destino (remoto)
`/U`	Usuario para la conexión remota
`/P *`	Contraseña del usuario remoto (`*` para entrada interactiva)
Resto de opciones	Definición de la tarea, igual que en el caso local

schtasks.exe /Create `
  /S "<<SERVER_NAME>>" `
  /U "<<ADMIN_USER>>" `
  /P * `
  /TN "<<TASK_NAME>>" `
  /TR "powershell.exe -File <<SCRIPT_PATH>>" `
  /SC DAILY `
  /ST 02:00 `
  /RU "<<ADMIN_USER>>" `
  /RL HIGHEST `
  /F

Conclusión

El uso de schtasks.exe facilita la integración del Programador de tareas de Windows en escenarios de construcción de servidores y automatización operativa.

La combinación de /SC y /MO permite definir programaciones flexibles (diaria, semanal, mensual, enésima semana, último día del mes).
Los disparadores ONLOGON, ONSTART y ONEVENT permiten automatización basada en eventos.
Con /Query /XML y /Create /XML es posible exportar e importar definiciones de tareas como plantillas reutilizables.
Los comandos /Change, /Run, /End, /Delete y /ShowSid cubren todo el ciclo de administración de tareas.
Mediante /S /U /P, las mismas definiciones se pueden desplegar fácilmente en varios servidores remotos.

Crear un Servidor Proxy Squid en Linux

Fri, 20 Feb 2026 20:14:11 GMT

Qué

Este artículo explica cómo instalar y configurar un servidor proxy Squid básico en Linux y cómo configurar los clientes para usarlo.

Por qué

Squid es un potente servidor proxy de caché que mejora el rendimiento de navegación, permite el filtrado web y proporciona control de acceso. Una configuración adecuada del cliente garantiza que el tráfico se enrute de manera segura y efectiva a través del proxy.

Cómo

Paso 1: Instalar Squid

En sistemas basados en RHEL (AlmaLinux, Rocky, CentOS):

sudo dnf install squid -y

En sistemas basados en Debian (Ubuntu):

sudo apt update
sudo apt install squid -y

Paso 2: Configurar el Proxy Squid

Edita /etc/squid/squid.conf:

sudo nano /etc/squid/squid.conf

Configuración mínima funcional:

http_port 3128

acl localnet src 192.168.0.0/16
http_access allow localnet
http_access deny all

dns_v4_first on

Ajustes recomendados:

cache_mem 64 MB
maximum_object_size_in_memory 512 KB
maximum_object_size 20 MB
access_log /var/log/squid/access.log
cache_log /var/log/squid/cache.log

Paso 3: Habilitar y arrancar Squid

sudo systemctl enable --now squid

Paso 4: Configurar el cortafuegos

firewalld:

sudo firewall-cmd --add-port=3128/tcp --permanent
sudo firewall-cmd --reload

UFW:

sudo ufw allow 3128/tcp

Paso 5: Configurar los dispositivos cliente

En Linux (configuración temporal en shell):

export http_proxy="http://<squid-ip>:3128"
export https_proxy="http://<squid-ip>:3128"

En Linux (persistente a nivel del sistema):

Edita /etc/environment:

http_proxy="http://<squid-ip>:3128"
https_proxy="http://<squid-ip>:3128"

En Windows (PowerShell, solo para el usuario actual):

netsh winhttp set proxy <squid-ip>:3128

Para restablecer:

netsh winhttp reset proxy

Paso 6: Probar la conexión

Desde un cliente:

curl -x http://<squid-ip>:3128 http://example.com

En el servidor Squid:

sudo tail -f /var/log/squid/access.log

Conclusión

Esta configuración proporciona un servidor proxy funcional y simple sin depender de archivos PAC. Ofrece control centralizado, registro de acceso y flexibilidad en la gestión del tráfico de red.

Guía de Mejores Prácticas para Scripting en PowerShell

Fri, 20 Feb 2026 20:14:11 GMT

Qué es

Este artículo ofrece una guía completa sobre las mejores prácticas para scripting en PowerShell, enfocándose en la estructura del código, formato de salida, manejo de errores, optimización del rendimiento y medidas de seguridad.

Por qué

Seguir las mejores prácticas en scripting de PowerShell garantiza que tus scripts sean legibles, mantenibles, seguros y eficientes. Esto reduce la deuda técnica, mejora la colaboración y minimiza los riesgos en entornos de producción.

Cómo

Diseño de Herramientas y Controladores

Decide si estás creando una ‘Herramienta’ o un ‘Controlador’

Herramienta: Funciones/módulos reutilizables.
Controlador: Automatiza una tarea específica, no diseñado para reutilización.

Haz tu código modular

Utiliza funciones y módulos para maximizar la reutilización.

Usa convenciones estándar de nomenclatura

Sigue el formato Verbo-Sustantivo utilizando los verbos aprobados por PowerShell (Get-Verb).

Estandariza los nombres de los parámetros

Usa nombres como $ComputerName en lugar de prefijos personalizados.

Las herramientas deben devolver datos en bruto

Proporciona datos mínimamente procesados para mayor flexibilidad.

Los controladores deben devolver datos formateados

Formatea la salida para generar reportes fáciles de leer.

Ejemplo

function Get-DiskInfo {
    param ([string]$ComputerName)
    Get-WmiObject Win32_LogicalDisk -ComputerName $ComputerName
}

Evita reinventar la rueda

Utiliza cmdlets integrados como Test-Connection en lugar de crear funciones personalizadas.

# Recomendado
Test-Connection $ComputerName -Quiet

Escritura de Bloques de Parámetros

Escribe siempre la ayuda

Incluye ayuda basada en comentarios con .SYNOPSIS, .DESCRIPTION y al menos un .EXAMPLE.

function Test-Help {
    <#
        .SYNOPSIS
            Demuestra documentación de ayuda adecuada.
        .EXAMPLE
            Test-Help -MandatoryParameter "Ejemplo"
            Ejecuta la función Test-Help con un parámetro obligatorio.
    #>
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true)]
        [Alias("MP")]
        [String]$MandatoryParameter
    )
}

Usa `[CmdletBinding()]`

Activa parámetros comunes como -Verbose, -Debug, -ErrorAction.

Soporta `-WhatIf` y `-Confirm`

Para comandos que cambian el estado, usa SupportsShouldProcess.

[CmdletBinding(SupportsShouldProcess, ConfirmImpact = "Medium")]
param ([switch]$Force)

Define tipos fuertes en los parámetros

Especifica siempre los tipos para validación y claridad.

param (
    [string]$Name,
    [int]$Count
)

Usa `[switch]` correctamente

Por defecto es $false.
Úsalo como booleano, evitando lógica de tres estados.

Formateo de Salida

Evita `Write-Host` salvo que sea necesario

Prefiere Write-Verbose, Write-Debug o Write-Output según corresponda.

Usa `Write-Progress` para mostrar avances

Write-Progress -Activity "Procesando" -Status "50% Completado" -PercentComplete 50

Usa archivos de formato para objetos personalizados

Define archivos .format.ps1xml en lugar de formateo inline.

Devuelve solo un tipo de objeto a la vez

Utiliza [OutputType()] y evita mezclar tipos de objetos.

Mejores Prácticas de Manejo de Errores

Usa `-ErrorAction Stop` con cmdlets

Forzar errores para manejarlos con try-catch.

try {
    Get-Item "C:\RutaInvalida" -ErrorAction Stop
} catch {
    Write-Warning "Elemento no encontrado."
}

Usa `$ErrorActionPreference` para operaciones fuera de cmdlets

Configúralo temporalmente a 'Stop' en operaciones críticas.

Evita usar flags y `$?` para manejo de errores

Prefiere bloques estructurados try-catch.

Copia `$Error[0]` o `$_` inmediatamente dentro de `catch`

catch {
    $errorDetails = $_
    Write-Error "Ocurrió un error: $($errorDetails.Exception.Message)"
}

Optimización del Rendimiento

PERF-01 Mide el rendimiento cuando sea necesario

Utiliza Measure-Command para comparar métodos.

Measure-Command {
    foreach ($item in $data) { Process-Item $item }
}

PERF-02 Equilibra rendimiento y legibilidad

Para pequeños conjuntos de datos, prioriza la legibilidad.
Para grandes volúmenes, considera streaming o técnicas con .NET.

Legible pero menos eficiente:

$content = Get-Content -Path file.txt
foreach ($line in $content) {
    Do-Something -Input $line
}

Optimizado para rendimiento:

Get-Content -Path file.txt | ForEach-Object {
    Do-Something -Input $_
}

Alto rendimiento con .NET:

$sr = New-Object System.IO.StreamReader "file.txt"
while ($sr.Peek() -ge 0) {
    $line = $sr.ReadLine()
    Do-Something -Input $line
}

PERF-03 Prefiere características del lenguaje sobre cmdlets

Construcciones del lenguaje (foreach) > Métodos .NET > Scripts > Cmdlets/Pipeline.
Mide siempre antes de optimizar.

Mejores Prácticas de Seguridad

Usa siempre `PSCredential` para credenciales

Evita contraseñas en texto plano. Utiliza parámetros [Credential()].

param (
    [System.Management.Automation.PSCredential]
    [System.Management.Automation.Credential()]
    $Credential
)

Al pasar a APIs:

$Insecure.SetPassword($Credential.GetNetworkCredential().Password)

Usa `SecureString` para datos sensibles

Solicita datos de forma segura y almacénalos cifrados.

$Secure = Read-Host -Prompt "Introduce datos seguros" -AsSecureString

Conversión segura a texto plano:

$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Secure)
$PlainText = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)
[System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($BSTR)

Guarda credenciales de forma segura

Utiliza Export-CliXml.

Get-Credential | Export-CliXml -Path C:\secure\cred.xml
$Credential = Import-CliXml -Path C:\secure\cred.xml

Guarda cadenas cifradas

ConvertFrom-SecureString -SecureString $Secure | Out-File -Path "${Env:AppData}\secure.bin"
$Secure = Get-Content -Path "${Env:AppData}\secure.bin" | ConvertTo-SecureString

Conclusión

Aplicando estas mejores prácticas en diseño, documentación, manejo de salida, errores, rendimiento y seguridad, podrás crear scripts de PowerShell robustos, eficientes y fáciles de mantener. Busca siempre el equilibrio entre legibilidad, rendimiento y seguridad para entregar soluciones de automatización de alta calidad.

Configuración del cliente para autenticación SSH con clave pública (Windows/Linux)

Fri, 20 Feb 2026 20:14:11 GMT

Descripción general

Este artículo explica los pasos de configuración del cliente para conectarse de forma segura a un servidor mediante autenticación SSH con clave pública. Está dirigido a entornos Windows y Linux.

Requisitos previos

El cliente SSH ya está instalado (Windows 10 o posterior, Linux estándar)
El servidor SSH permite la autenticación por clave pública
Existe una cuenta de usuario en el servidor

Tipos de claves y métodos de cifrado

Los tipos de claves más comunes usados en SSH son RSA, ECDSA y Ed25519. La siguiente tabla compara sus características, usos recomendados y compatibilidad.

Tipo de clave	Características	Uso recomendado	Compatibilidad
RSA	Muy usada y ampliamente compatible; longitud de clave ajustable	Entornos con sistemas antiguos	Muy alta
ECDSA	Usa criptografía de curva elíptica, más rápida con claves más cortas	Entornos con énfasis en rendimiento	Media
Ed25519	Nuevo estándar, rápido y muy seguro, tamaño pequeño	Nuevas implementaciones y alta seguridad	Alta (OpenSSH ≥ 6.5)

Ed25519 es el estándar moderno recomendado. RSA sigue siendo útil por compatibilidad; ECDSA es un punto intermedio.

Convenciones de variables

Variable	Ejemplo	Descripción
`<<USERNAME>>`	`exampleuser`	Nombre del usuario local
`<<SERVER>>`	`192.168.1.10`	Dirección o IP del servidor
`<<USER>>`	`ubuntu` o `ec2-user`	Usuario SSH en el servidor
`<<EMAIL_ADDRESS>>`	`user@example.com`	Comentario opcional para la clave

Nota sobre Windows

Los comandos para Windows están pensados para PowerShell.
Si se usa cmd.exe, reemplace $env:USERPROFILE por %USERPROFILE%.

Cliente Windows

Paso 1: Generar claves

Ejecutar PowerShell como administrador:

ssh-keygen -t ed25519 -C "<<EMAIL_ADDRESS>>"

Ejemplo de salida:

Generating public/private ed25519 key pair.
Your identification has been saved in /C:/Users/<<USERNAME>>/.ssh/id_ed25519
Your public key has been saved in /C:/Users/<<USERNAME>>/.ssh/id_ed25519.pub

Clave pública: $env:USERPROFILE\.ssh\id_ed25519.pub
Clave privada: $env:USERPROFILE\.ssh\id_ed25519

Paso 2: Copiar clave al servidor

cat $env:USERPROFILE\.ssh\id_ed25519.pub | ssh <<USER>>@<<SERVER>> "mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys; chmod 600 ~/.ssh/authorized_keys"

O copiar manualmente el contenido en ~/.ssh/authorized_keys en el servidor.

Paso 3: Verificar conexión

ssh -i $env:USERPROFILE\.ssh\id_ed25519 <<USER>>@<<SERVER>>

Cliente Linux

Paso 1: Generar claves

ssh-keygen -t ed25519 -C "<<EMAIL_ADDRESS>>"

Salida esperada:

Enter file in which to save the key (/home/<<USERNAME>>/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):

Clave pública: ~/.ssh/id_ed25519.pub
Clave privada: ~/.ssh/id_ed25519

Paso 2: Registrar clave en el servidor

ssh-copy-id -i ~/.ssh/id_ed25519.pub <<USER>>@<<SERVER>>

O editar manualmente ~/.ssh/authorized_keys.

Paso 3: Verificar conexión

ssh -i ~/.ssh/id_ed25519 <<USER>>@<<SERVER>>

Uso de claves con frase de contraseña

Si la clave privada tiene una frase, configure un agente SSH para evitar introducirla cada vez.

Paso 1: Iniciar agente

Windows:

Set-Service -Name ssh-agent -StartupType Manual
Start-Service ssh-agent

Linux:

eval "$(ssh-agent -s)"

Para inicio automático:

Windows:

Set-Service -Name ssh-agent -StartupType Automatic

Linux:
Agregar en ~/.bashrc:

eval "$(ssh-agent -s)" > /dev/null

Paso 2: Registrar clave

Windows:

ssh-add $env:USERPROFILE\.ssh\id_ed25519

Linux:

ssh-add ~/.ssh/id_ed25519

Paso 3: Confirmar registro

ssh-add -l

Configuración del archivo `config` del cliente SSH

Para simplificar conexiones, cree el archivo ~/.ssh/config (en Windows: C:\Users\<<USERNAME>>\.ssh\config):

Host myserver
    HostName <<SERVER>>
    User <<USER>>
    IdentityFile ~/.ssh/id_ed25519
    Port 22

En Windows use $env:USERPROFILE\.ssh\id_ed25519.

Con esto, bastará ejecutar:

ssh myserver

Múltiples servidores

Host web
    HostName 192.168.1.10
    User ubuntu
    IdentityFile ~/.ssh/id_ed25519

Host db
    HostName 192.168.1.11
    User ec2-user
    IdentityFile ~/.ssh/id_ed25519

Se recomienda usar diferentes claves por servidor cuando sea posible.

Verificación

Use salida detallada para depuración:

ssh -vvv -i ~/.ssh/id_ed25519 <<USER>>@<<SERVER>>

Authentication succeeded (publickey) indica éxito.

Solución de problemas

Autenticación por clave deshabilitada en el servidor
Revise PubkeyAuthentication yes en sshd_config.
Clave no registrada o incorrecta
Verifique que la clave pública esté en ~/.ssh/authorized_keys.
Datos de conexión erróneos
Asegúrese de usar el usuario, host y permisos correctos.

Conclusión

La autenticación SSH con clave pública permite conexiones seguras sin contraseñas.
Tanto en Windows como en Linux, ssh-keygen y una configuración correcta de permisos garantizan seguridad y eficiencia.

Techist

Windowsでのプロキシ設定方法

概要

変数表記について

Step 1: プロキシ設定の種類を理解する

Step 2: PowerShellでユーザー単位のプロキシを設定

Step 3: システム全体のプロキシを設定（WinHTTP / BITS 用）

① 旧方式（Windows Server 2019以前）

② 新方式（Windows Server 2022以降 推奨）

Step 4: BITSのプロキシ設定をローカルシステムに反映

Step 5: 設定の確認・トラブルシューティング

プロキシ設定をリセットする場合

ユーザー単位（WinINET）の設定をリセット

システム単位（WinHTTP / advproxy）の設定をリセット

まとめ

LinuxでSquidプロキシサーバーを構築する

概要（What）

利点（Why）

手順（How）

ステップ1：Squidのインストール

RHEL系（AlmaLinux, Rocky, CentOS）の場合：

Debian系（Ubuntu）の場合：

ステップ2：Squidの設定

ステップ3：Squidの有効化と起動

ステップ4：ファイアウォールの設定

firewalld使用時：

UFW使用時：

ステップ5：クライアントの設定

Linux（シェルで一時的に設定）：

Linux（永続設定）：

Windows（PowerShellで現在のユーザーに適用）：

ステップ6：接続確認

結論

How to Configure Proxy Settings on Windows

Overview

Variable Notation

Step 1: Understanding Proxy Types

Step 2: Set User-Level Proxy with PowerShell

Step 3: Configure System-Wide Proxy (WinHTTP / BITS)

(1) Legacy Method (Windows Server 2019 or earlier)

(2) Modern Method (Windows Server 2022 or later - Recommended)

Step 4: Apply Proxy for BITS (LocalSystem Account)

Step 5: Verification and Troubleshooting

Reset Proxy Settings

Reset User-Level (WinINET)

Reset System-Level (WinHTTP / advproxy)

Summary

Windows Network Diagnosis Tools Guide

Overview

Variable Notation

Step 1: ICMP Connectivity Check (ping)

Step 2: Route Verification (tracert)

Step 3: TCP Port Connectivity (Test-NetConnection)

Step 4: Checking TCP Session Status (netstat / Get-NetTCPConnection)

Using netstat

Using PowerShell

Step 5: DNS Resolution Verification (nslookup / Resolve-DnsName)

Step 6: Advanced Troubleshooting

Enable Firewall Logging

Check the ARP Table (Layer 2 Troubles)

Summary

Extracting Log Files with PowerShell

What

Why

How

Step 1: Reading a Log File

Step 2: Filtering by Keyword

Step 3: Searching Multiple Patterns

Step 4: Extracting Logs Within a Date Range

Step 5: Exporting Results to CSV

Step 6: Automating with a Script

Conclusion

Managing Windows Features and Images with DISM and PowerShell

Overview

Variable Conventions

Step 1: Target Selection (/Online vs /Image)

Step 2: List Features (/Get-Features, /Get-FeatureInfo)

Summary

Key Options

Examples

② 新方式（Windows Server 2022以降推奨）

2-4. Set persistent environment variables with `setx`