Windows 2012 Server Manager, behind the scene

When I first saw the server manager, I didn’t realize how different it’s from its predecessors. Of course, I’ve heard the motto ‘the power of many, the simplicity of one’ and that it’s using Powershell to achieve what it does and display. Being curious, I wondered how but didn’t find any technical article or any specific documentation explaining how it really works behind the scene.

I’ll try to uncover some of its hidden or let’s say not well known aspects. Of course, what I’ll present below is limited, incomplete, etc.
Even if the title of the blog post might look too much promising, I hope that you’ll find interesting what I’ve to share.

First, the visible part of the iceberg is located in the EventLog and is full of relevant information.


As you can see in the above image, there are logs related to the Server Manager activities.
This information isn’t really hidden and it’s actually mentioned in the Quick_Reference_SM_WS12.pdf

From the above images, we may also notice that:

  • it seems to use the configure-smremoting.exe excutable is used to get, enable and disable the ‘remote management’.

    On Windows 2008 R2, it used to be a powershell script that had the following arguments:
  • it uses the DCOM protocol to accesss locally the WMI repository. Why? Without overthinking it, I guess that this will ensure that the server manager still works event if you’ve disabled the remote management.
  • it seems to use Powershell workflows to manage multiple machine over remoting as the server manager has a dedicated powershell session:
  • it invokes methods on classes located in the WMI namespace root\microsoft\windows\servermanager
  • Let’s enumerate all the methods that can be invoked on this class:

    Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks |            
    Select -ExpandProperty CimClassMethods

    Let’s try to see how the GetServerFeature method should be invoked:

    (Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks).CimClassMethods  |             
    ? Name -eq "GetServerFeature" | fl *

    Let’s attempt to invoke the method without arguments and see what happens:

    Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks |            
    Invoke-CimMethod -MethodName GetServerFeature            
    

    I’ve received two Instances that holds features as the Batch size default was too small.

    If I double the batch size, I’ll only receive a single instance.

    Now to see the content of the objects in this instance, I just need to set the results in an array and show their ItemValue property like this:

    (Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks |  Invoke-CimMethod -MethodName GetServerFeature -Arguments @{BatchSize=512}).ItemValue

    The above image tells use that the instance array holds server features objects:

    But these objects are different from those that we can get using

    (Get-WindowsFeature)[0] | gm


    Or using:

    (Get-WmiObject win32_serverfeature)[0] | fl *

    What we actually found at this point is how the server manager retrieves the following data 😀

    # Role            
    (Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks |              
    Invoke-CimMethod -MethodName GetServerFeature -Arguments @{BatchSize=512}).ItemValue |             
    ? { $_.State -eq 1 -and $_.Type -eq 0 } |             
    Select DisplayName            
                
    # Role Service            
    (Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks |             
    Invoke-CimMethod -MethodName GetServerFeature -Arguments @{BatchSize=512}).ItemValue |             
    ? { $_.State -eq 1 -and $_.Type -eq 1 } |            
    Select DisplayName            
                
    # Feature            
    (Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks |            
    Invoke-CimMethod -MethodName GetServerFeature -Arguments @{BatchSize=512}).ItemValue |             
    ? { $_.State -eq 1 -and $_.Type -eq 2 } |             
    Select DisplayName            
                
                
    (Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks |             
    Invoke-CimMethod -MethodName GetServerFeature -Arguments @{BatchSize=512}).ItemValue |             
    ? { $_.State -eq 1 } |              
    Measure            
    

    This one was easy. Let’s try to get services using the same approach:

    (Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks).CimClassMethods |            
    ? Name -match GetServerServiceDetail |            
    Select -ExpandProperty Parameters            
    

    Let’s provide the two arguments and the services as an array of strings:

    (Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks |              
    Invoke-CimMethod -MethodName GetServerServiceDetail -Arguments @{            
    BatchSize = 512;services="wudfsvc","WSusCertServer"            
    }).ItemValue

    To figure out how to pass a wildcard it’s more difficult:

    (Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks |            
    Invoke-CimMethod -MethodName GetServerServiceDetail -Arguments @{            
    BatchSize = 512;services=@("*")            
    }).ItemValue            
    

    Now, let’s try to figure out where the data on the main page come from.

    (Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks).CimClassMethods |            
    ? Name -eq "GetServerInventory" |             
    select -ExpandProperty Parameters            
    

    To retrieve the IP Address of the network card, I can do:

    ((Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks |              
    Invoke-CimMethod -MethodName GetServerInventory -Arguments @{            
    SMServerId="$env:COMPUTERNAME"            
    } -Verbose) | ? ParameterName -eq NetworkAdapters            
    ).ItemValue | ? ConnectionStatus            
    


    For the Operating system,

    (Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks |            
    Invoke-CimMethod -MethodName GetServerInventory -Arguments @{            
    SMServerId="$env:COMPUTERNAME"            
    }).OperatingSystem


    For the server inventory,

    (Get-CimClass -Namespace root\microsoft\windows\servermanager -Class MSFT_ServerManagerTasks |             
    Invoke-CimMethod -MethodName GetServerInventory -Arguments @{            
    SMServerId="$env:COMPUTERNAME"            
    }).ServerInventory            
    

    What information is missing? The NiC teaming status, the firewall state, the Remote Desktop, the time zone, the IE enhanced security configuration state and the total disk space? I’d like to know how the server manager gathers the rest of the information. Currently I don’t know and I can unfortunately only make assumptions 😦

    That’s the end for this post but there are still many many things to explore 🙂 …

    … as well as other information already published by Microsoft:

    Advertisements

    3 thoughts on “Windows 2012 Server Manager, behind the scene

    1. Hi Emin,

      I have an Issue while using the ServerManager of a Windows Server 2012 R2. Everything works fine, but when i am starting the ServerManager in the Overview i can see a Failure at the Managebility of the Local Server. The ServerManager isn’t able to get Information of Roles and Feature Installation. And further more i am not able to install more Roles and Features or deinstall them. It gives me an Error “Invalid Class”. The Powershell Command “Get-WindowsFeatures” doesn’t work anymore and give the same Issue as the Result. In the EventManager i can find the Event-ID 49.

      Could you help me about that, please?

      Thanks in Advance..

      Regards,

      Daniel

      • Hi Daniel,
        Yes, I may help. I can tell what I’d look for.
        I’d check that there isn’t any problem with the NTFS filesystem and that the harddrive isn’t faulty (have badblocks,…) and about to die. There are usually events in the eventlogs.
        I’d check the Dism.exe command to list features/roles, is it working?
        I’d check that the WMI repository isn’t corrupted and that wrong permissions haven’t been set on the repository.
        I’d check PowerShell remoting settings applied on the server and firewall rules as well.
        I’d check that the servermanager endpoint is still there and configured properly.
        I’d check what patches/hotfixes have been installed recently and if that matches the same timeframe where your problem appeared.
        To figure out more quickly what’s wrong, I’d also compare what I find on a working server and the one where you’ve the problem.
        /Emin

        • If you figure out what’s wrong and get your server back to normal, please share what you find. What was the symtom(s), the error message(s) (make some screenshots) and what was the root cause and how you fixed it. You can write your own blog post and link it here 😀

    Leave a Reply

    Fill in your details below or click an icon to log in:

    WordPress.com Logo

    You are commenting using your WordPress.com account. Log Out / Change )

    Twitter picture

    You are commenting using your Twitter account. Log Out / Change )

    Facebook photo

    You are commenting using your Facebook account. Log Out / Change )

    Google+ photo

    You are commenting using your Google+ account. Log Out / Change )

    Connecting to %s