Hey, Scripting Guy! How Do I Check Host Name Records?

ScriptingGuy1

Hey, Scripting Guy! We are having name resolution issues at work. It is so bad that when my wife calls me, the guy in the other cube gets the call. This manifests itself in concrete ways as well. Opening Office Outlook seems to take forever; going to internal Web sites takes a long time; trying to connect to an Office SharePoint site is about impossible. To make matters worse, the pointy headed boss (PHB) just spent a small fortune on buying new switches. The project was supposed to “make the network fast,” but he never bothered to talk to us first. After five minutes with Netmon, it was obvious what was happening. Well, the good news is after we get DNS fixed, we really will have a fast network. The first thing I want to check are the A (host name) records. You got a script to do that?

– JE

Hi JE,

A person after my own heart! I wrote the book on Netmon. Literally. Before I got into scripting, I used to do lots of network stuff. By the way, did you know we released Network Monitor (Netmon) 3.2 not too long ago? DNS problems often masquerade as network problems because we often need to find the host providing the information. If we only have a name, we need to translate the name into an IP address, but if it takes a long time to make that translation, even the fastest network in the world will seem like an old fashioned dial-up modem.

Because you want to check out A records, take a look at the GetDnsARecords.ps1 script. There is a VBScript version of this script in the Script Center Script Repository.

GetDnsARecords.ps1

Function Get-DnsServer
{
 Begin {Write-Host -ForeGroundColor Cyan "Obtaining local DNS Server information..."}
 Process {
  (Get-WmiObject -Class `
win32_networkadapterconfiguration -filter "ipenabled =   $true").DnsServerSearchOrder[0]
 } #end Process
} #end Get-DnsServer
Function Get-DomainName
{
 Begin {Write-Host -ForeGroundColor DarkCyan "Obtaining local DNS Domain information..."}
 Process {
  (Get-WmiObject -Class win32_networkadapterconfiguration -filter "ipenabled =   $true").DnsDomain
 } #end Process
} #end Get-DnsServer
Function Get-ARecords($DnsServer)
{
 Begin { Write-Host -ForeGroundColor Yellow "Connecting to $DnsServer ..." }
 Process { Write-Host -ForeGroundColor Green "Retrieving A records ..."
  Get-WmiObject -Class MicrosoftDNS_AType -NameSpace Root\MicrosoftDNS
  -ComputerName $DnsServer  -Filter "DomainName = 'nwtraders.com'" |
  Select-Object -property Ownername, ipaddress
 } #end process
} #end Get-ARecords
# *** Entry Point to Script ***
$DnsServer = Get-DnsServer
$DnsDomain = Get-DomainName
Get-ARecords -DnsDomain $DnsDomain -DnsServer $DnsServer

The first thing we need to do is to create a function that will obtain the address of the DNS server. A good name for such a function is Get-DnsServer. To create a function, we use the function keyword and give it a name. There are no inputs required for the function because it will simply query the TCP/IP configuration information on the local computer.

Function Get-DnsServer
{

We are going to now use a feature of a function that we have not previously written about—the Begin parameter for a function. The Begin parameter runs once for items on the pipeline. Most of the time, we are using the process parameter for a function. It is, in fact, the default parameter for a function and as a result is normally left off.

We normally do not like relying on default parameters. There are several reasons for this, but the biggest reason is that we like to know what a script is doing. If we do not know that we are using a default parameter, we may not understand when the script fails when we attempt a different parameter. One other reason is that if we do not know we are using a default parameter, we may be similarly unaware of the presence of other parameters.

The parts of a function are seen in DemoFunctionParameters.ps1. An array of numbers is created by using the 1..4 notation. This creates an array of 4 numbers: 1,2,3,4. This array is pipelined to the test function. The first thing that happens is the display of the message, “Beginning test”. Then each number that comes across the pipeline is added to the number 1, and the results are displayed. When the process block is completed, the last thing that happens is the display of the message, “Completed test”. The result of running the DemoFunctionParameters.ps1 script is seen here:

Beginning test
2
3
4
5
Completed test

The complete DemoFunctionParameters.ps1 script is seen here:

Function test
{
 Begin {"Beginning test" }
 Process {$_ + 1 }
 End { "Completed test" }
} #end test
1..4 | test

Back to our real script. The first thing we do is use the Begin statement list to print out a message in Cyan that informs the user that we are obtaining local DNS server information. This is done by using the Write-Host cmdlet with the ForegroundColor parameter. The Begin statement list is seen here:

Begin {Write-Host -ForeGroundColor Cyan "Obtaining local DNS Server information..."}

When we have produced the first status message, it is time to obtain the DNS server information. We can get this information from the Win32_NetworkAdapterConfiguration WMI class. (Here’s a good series of articles on scripting networking. They are all VBScript examples, but the techniques remain the same.) For additional information about working with network adapters using Windows PowerShell, you can see this article.

With Windows PowerShell, the primary tool to use when working with WMI is the Get-WmiObject cmdlet. There are a number of parameters for this cmdlet, but the primary ones are seen in Table 1.

When the Get-WmiObject cmdlet is run, a management object is returned. If there is only one instance of that object, we can directly access properties of the object by using a dotted notation. In our script, we are querying the Win32_NetworkAdapterConfiguration WMI class. On most modern computers, there are nearly a dozen “things” that get reported as network adapters. Most computers only have one or two “real” network adapters, but everything from VPN connections to Bluetooth devices end up in the list. To return a single instance of a network adapter can often be a problem. One way that often works is to see if the adapter is IP enabled. That is, does it have an Internet Protocol stack enabled on it? This will filter out many of the bogus adapters.

I am deliberately being obtuse here because if you have multiple network cards enabled on your computer, this function could very well fail because of the way it is written. Because there are so many different network configurations available among our readers, I want you to be aware of the potential limitation here.

After we have the network adapter, we retrieve the IP address for the first DNS server. The DnsServerSearchOrder property is stored as an array. We are selecting the first one to query. The process section of the function is seen here (note that the second line should be one line of code; using the backtick character, we have broken it into two lines of code so that this page will not scroll horizontally in your browser):

Process {
(Get-WmiObject -Class `
win32_networkadapterconfiguration -filter "ipenabled =   $true").DnsServerSearchOrder[0]
 } #end Process
} #end Get-DnsServer

Next we want to retrieve the domain name for the local computer. To do this, we will once again query the Win32_NetworkAdapterConfiguration WMI class. Once again we use the Begin statement list to print out a status message to indicate that we are obtaining local DNS domain information. This time, we print out the message in DarkCyan. By the way, if you are curious about which colors are available, you can use the GetNames static method from the System.Enum .NET Framework class, as seen here:

PS C:\> [enum]::GetNames("System.ConsoleColor")
Black
DarkBlue
DarkGreen
DarkCyan
DarkRed
DarkMagenta
DarkYellow
Gray
DarkGray
Blue
Green
Cyan
Red
Magenta
Yellow
White

The Get Begin statement list is seen here:

Function Get-DomainName
{
 Begin {Write-Host -ForeGroundColor DarkCyan "Obtaining local DNS Domain information..."}

It is time to create our Process block. The code is exactly the same as the previous Process block, except that this time we return the DnsDomain property. This will give us the domain name to use when we need to filter the results later on in the next function:

Process {
  (Get-WmiObject -Class win32_networkadapterconfiguration -filter "ipenabled =   $true").DnsDomain
 } #end Process
} #end Get-DnsServer

Now we come to the Get-ARecords function. This function is used to retrieve A records from the DNS server. We once again use Begin to print out a status message. This is seen here:

Function Get-ARecords($DnsServer)
{
 Begin { Write-Host -ForeGroundColor Yellow "Connecting to $DnsServer ..." }

Then in the Process block, we write another status message (this time in green) that we are retrieving the A records, and we get to the WMI query. The WMI DNS provider resides in the Root\MicrosoftDNS WMI namespace. To work with DNS, we need to specify that WMI namespace. The default WMI namespace is Root\CimV2.

Most of the WMI classes that are used by IT pros live in that namespace, and as a result many are unaware of the other WMI namespaces that exist.

The following is a listing of DNS classes from my Windows Server 2008 computer:

MicrosoftDNS_AAAAType
MicrosoftDNS_AFSDBType
MicrosoftDNS_ATMAType
MicrosoftDNS_AType
MicrosoftDNS_Cache
MicrosoftDNS_CNAMEType
MicrosoftDNS_Domain
MicrosoftDNS_DomainDomainContainment
MicrosoftDNS_DomainResourceRecordContainment
MicrosoftDNS_HINFOType
MicrosoftDNS_ISDNType
MicrosoftDNS_KEYType
MicrosoftDNS_MBType
MicrosoftDNS_MDType
MicrosoftDNS_MFType
MicrosoftDNS_MGType
MicrosoftDNS_MINFOType
MicrosoftDNS_MRType
MicrosoftDNS_MXType
MicrosoftDNS_NSType
MicrosoftDNS_NXTType
MicrosoftDNS_PTRType
MicrosoftDNS_ResourceRecord
MicrosoftDNS_RootHints
MicrosoftDNS_RPType
MicrosoftDNS_RTType
MicrosoftDNS_Server
MicrosoftDNS_ServerDomainContainment
MicrosoftDNS_SIGType
MicrosoftDNS_SOAType
MicrosoftDNS_SRVType
MicrosoftDNS_Statistic
MicrosoftDNS_TXTType
MicrosoftDNS_WINSRType
MicrosoftDNS_WINSType
MicrosoftDNS_WKSType
MicrosoftDNS_X25Type
MicrosoftDNS_Zone

The WMI class we are going to query to obtain A records is the MicrosoftDNS_AType. These WMI class names are pretty easy to work with because they all begin with MicrosoftDNS and and underscore. If we wanted to list the MX records, the class would be MicrosoftDNS_MXType. In fact, you could easily replace the code we are using here with the DNS record type you were interested in obtaining. After specifying the WMI class name, we specify the namespace, which as you recall for DNS is Root\MicrosoftDNS. Then the computername parameter is supplied. This is why we used the earlier function to obtain the name of the DNS server, because the Root\MicrosoftDNS namespace does not exist unless the server is running DNS. However, using WMI we can connect to a namespace on a remote machine that does not exist on our local machine, and we can query WMI classes on a remote machine that do not exist on the local computer.

On Windows 2000, you need to download Dnsprov.zip and use MOFCOMP to install the DNS provider. On Windows Server 2003 and later, it is installed automatically.

We use the Filter parameter to limit the A records to those in our own domain. We then use the Select-Object cmdlet to retrieve the Ownername and the IP address. This is seen here:

Process { Write-Host -ForeGroundColor Green "Retrieving A records ..."
  Get-WmiObject -Class MicrosoftDNS_AType -NameSpace Root\MicrosoftDNS -ComputerName
$DnsServer  -Filter "DomainName = 'nwtraders.com'" |  Select-Object -property Ownername, ipaddress
 } #end process
} #end Get-ARecords

Next we come to the entry point of the script. We call the Get-DnsServer function and store the DNS server name in the $DnsServer variable. We call the Get-DomainName function and store the domain name in the $DnsDomain variable. We then pass both of these values to the GetARecords function. This is seen here:

$DnsServer = Get-DnsServer
$DnsDomain = Get-DomainName
Get-ARecords -DnsDomain $DnsDomain -DnsServer $DnsServer

The results of running the script are seen here:

Well, JE, that is all there is to using the DNS provider to let us find A records. Join us tomorrow as DNS week continues.

Ed Wilson and Craig Liebendorfer, Scripting Guys

ScriptingGuy1

Follow