Lo script per rilevare e analizzare le BSOD<\/h2>\n#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n Conditional script for detecting BSOD's. Uses BlueScreenView from Nirsoft.\r\n.DESCRIPTION\r\n Conditional script for detecting BSOD's. Uses BlueScreenView from Nirsoft.\r\n Will always show the number of Unexpected shutdowns if system is setup to log those events.\r\n This doesn't always mean that there was a BSOD as this includes things like holding the power button or pressing the rest button.\r\n When a mini dump is detected in C:WindowsMinidump then this will output the results and exit with an exit code of 1.\r\n When none have been found then this will exit with an exit code of 0.\r\n When it couldn't download or extract BlueScreenView then this will exit with an exit code of 2.\r\n.OUTPUTS\r\n None\r\n.NOTES\r\n This should be the default, but in case this was modified instructions below.\r\n Minimal Setup:\r\n Open System Properties.\r\n Click on Settings under Startup and Recovery.\r\n Make sure that \"Write an event to the system log\" is checked.\r\n Under System failure change to \"Write debugging information\" to Automatic memory dump.\r\n Minimum OS Architecture Supported: Windows 10, Windows Server 2016\r\n Release Notes:\r\n Initial Release\r\n (c) 2023 NinjaOne\r\n By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam ()\r\n\r\nprocess {\r\n if (-not (Test-IsElevated)) {\r\n Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n exit 1\r\n }\r\n\r\n # Get unexpected shutdown events from System log\r\n $UnexpectedShutdownEvents = Get-WinEvent -FilterHashtable @{LogName = 'System'; ID = 6008 }\r\n if ($UnexpectedShutdownEvents) {\r\n Write-Host \"Unexpected shutdowns found: $($UnexpectedShutdownEvents.Count)\"\r\n Write-Host \"\"\r\n }\r\n\r\n # Check if any minidumps exist and exit if none are found\r\n if (-not $(Get-ChildItem -Path \"C:WindowsMinidump\" -ErrorAction SilentlyContinue)) {\r\n Write-Host \"No mini dumps found.\"\r\n exit 0\r\n }\r\n \r\n # Download Blue Screen View, run, and export results to a csv file\r\n try {\r\n Invoke-WebRequest -Uri $BlueScreenViewUrl -OutFile $ZipPath -ErrorAction Stop\r\n Expand-Archive -Path $ZipPath -DestinationPath $ENV:Temp -Force -ErrorAction Stop\r\n Start-Process -FilePath $ExePath -ArgumentList \"\/scomma \"\"$CsvPath\"\"\" -Wait -ErrorAction Stop\r\n }\r\n catch {\r\n Write-Host \"Blue Screen View Command has Failed: $($_.Exception.Message)\"\r\n # Clean Up\r\n Remove-DownloadedFiles -Path $CsvPath, $ZipPath, $ExePath, \"$($ENV:Temp)BlueScreenView.chm\", \"$($ENV:Temp)readme.txt\"\r\n exit 2\r\n }\r\n\r\n # Convert the CSV to an array of objects\r\n $MiniDumps = Get-Content -Path $CsvPath |\r\n ConvertFrom-Csv -Delimiter ',' -Header $Header |\r\n Select-Object -Property @{\r\n 'n' = \"Timestamp\";\r\n 'e' = { [DateTime]::Parse($_.timestamp, [System.Globalization.CultureInfo]::CurrentCulture) }\r\n }, Dumpfile, Reason, Errorcode, CausedByDriver\r\n\r\n # Clean Up\r\n Remove-DownloadedFiles -Path $CsvPath, $ZipPath, $ExePath, \"$($ENV:Temp)BlueScreenView.chm\", \"$($ENV:Temp)readme.txt\"\r\n\r\n # Output the results\r\n $MiniDumps | Out-String | Write-Host\r\n\r\n if ($MiniDumps) {\r\n exit 1\r\n }\r\n exit 0\r\n}\r\nbegin {\r\n function Test-IsElevated {\r\n $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n }\r\n function Remove-DownloadedFiles {\r\n param([string[]]$Path)\r\n process { Remove-Item -Path $Path -Force -ErrorAction SilentlyContinue }\r\n }\r\n\r\n # CSV Headers\r\n $Header = @(\r\n \"Dumpfile\"\r\n \"Timestamp\"\r\n \"Reason\"\r\n \"Errorcode\"\r\n \"Parameter1\"\r\n \"Parameter2\"\r\n \"Parameter3\"\r\n \"Parameter4\"\r\n \"CausedByDriver\"\r\n )\r\n\r\n # Build path variables\r\n $CsvFileName = \"bluescreenview-export.csv\"\r\n $BlueScreenViewZip = \"bluescreenview.zip\"\r\n $BlueScreenViewExe = \"BlueScreenView.exe\"\r\n $BlueScreenViewUrl = \"https:\/\/www.nirsoft.net\/utils\/$BlueScreenViewZip\"\r\n $ZipPath = Join-Path -Path $ENV:Temp -ChildPath $BlueScreenViewZip\r\n $ExePath = Join-Path -Path $ENV:Temp -ChildPath $BlueScreenViewExe\r\n $CsvPath = Join-Path -Path $ENV:Temp -ChildPath $CsvFileName\r\n}\r\nend {}<\/pre>\n <\/p>\n\n\n
Analisi dettagliata<\/span><\/b>\u00a0<\/span><\/h2>\n\n- Prerequisiti:<\/span><\/b> Lo script per rilevare e analizzare le BSOD richiede la versione 5.1 di PowerShell ed \u00e8 progettato per Windows 10 e Windows Server 2016.<\/span>\u00a0<\/span><\/li>\n
- Condizioni iniziali:<\/span><\/b> Si comincia assicurandosi di avere i privilegi di amministratore, essenziali per accedere ai registri di sistema e ai file minidump.<\/span>\u00a0<\/span><\/li>\n
- Arresti imprevisti:<\/span><\/b> Lo script per rilevare e analizzare le BSOD controlla quindi la presenza di eventi di spegnimento inattesi nel registro di sistema.<\/span>\u00a0<\/span><\/li>\n
- Controllo minidump:<\/span><\/b> Cerca i file minidump nella directory designata.<\/span>\u00a0<\/span><\/li>\n
- Integrazione di BlueScreenView:<\/span><\/b> Se vengono rilevati file minidump, lo script scarica ed esegue BlueScreenView, esportando i risultati in un file CSV.<\/span>\u00a0<\/span><\/li>\n
- Analizzi dei dati:<\/span><\/b> I dati CSV vengono convertiti in un array di oggetti per la visualizzazione da parte dell’utente.<\/span>\u00a0<\/span><\/li>\n
- Pulizia:<\/span><\/b> Dopo l’analisi, i file scaricati o estratti vengono rimossi.<\/span><\/li>\n<\/ol>\n
Casi d’uso potenziali<\/h2>\n
Consideriamo un professionista dell’IT, Alex,<\/span> che<\/span> \u00e8 stato avvisato di BSOD ricorrenti nel reparto di progettazione di un’azienda. Invece di verificare manualmente ogni sistema, Alex distribuisce lo script per rilevare e analizzare le BSOD. In pochi istanti,<\/span> identifica<\/span> un driver specifico che causa i BSOD, consentendo una soluzione mirata. Lo script per rilevare e analizzare le BSOD diventa quindi un potente strumento nel suo arsenale di risoluzione dei problemi.<\/span><\/p>\nConfronti<\/h2>\n
Sebbene il Visualizzatore eventi di Windows offra spunti di riflessione, non dispone dell’analisi dettagliata dei minidump che<\/span> BlueScreenView<\/span> fornisce. Lo script per rilevare e analizzare le BSOD colma efficacemente questa lacuna, offrendo un approccio pi\u00f9 completo rispetto ai metodi manuali.<\/span><\/p>\nDomande frequenti<\/h2>\n\n- D:<\/span><\/b> Questo script pu\u00f2 essere eseguito su versioni precedenti di Windows?<\/span>
\nR: \u00c8 ottimizzato per Windows 10 e Windows Server 2016. Le versioni precedenti potrebbero non supportare tutte le funzioni.<\/span>\u00a0<\/span><\/li>\n- D:<\/span><\/b> Cosa succede se BlueScreenView non riesce ad essere scaricato o estratto?<\/span>
\nR: Se c’\u00e8 un problema, lo script per rilevare e analizzare le BSOD uscir\u00e0 con un codice di errore 2. Assicurati di disporre di una connessione Internet stabile e di autorizzazioni sufficienti.<\/span>\u00a0<\/span><\/li>\n- D:<\/span><\/b> Come posso utilizzare lo script su versioni precedenti di Windows?<\/span>
\nR: Sebbene lo script per rilevare e analizzare le BSOD sia stato progettato per le versioni pi\u00f9 recenti, potrebbe essere necessario modificare alcuni parametri o integrare le vecchie utilit\u00e0 per garantire la compatibilit\u00e0 con le vecchie versioni di Windows.<\/span><\/li>\n<\/ul>\nImplicazioni per la sicurezza<\/h2>\n
I BSOD<\/span> non<\/span> sono solo fastidiosi, ma possono essere un problema di sicurezza. Un BSOD ricorrente potrebbe essere il segno di un’entit\u00e0 dannosa<\/span> che tenta<\/span> di compromettere il sistema. Registrando e analizzando questi eventi, i professionisti IT possono<\/span> identificare<\/span> potenziali minacce e garantire la sicurezza del sistema.<\/span><\/p>\nRaccomandazioni<\/h2>\n\n- Esegui sempre lo script per rilevare e analizzare le BSOD con privilegi di amministratore per garantire la piena funzionalit\u00e0.<\/span>\u00a0<\/span><\/li>\n
- Aggiorna regolarmente lo strumento BlueScreenView per sfruttare le sue ultime funzionalit\u00e0 e garantire la compatibilit\u00e0.<\/span>\u00a0<\/span><\/li>\n
- Monitora i sistemi alla ricerca di BSOD ricorrenti, che potrebbero indicare problemi di sicurezza pi\u00f9 profondi.<\/span><\/li>\n<\/ul>\n
Considerazioni finali<\/h2>\n
Nel mondo dinamico dell’IT, strumenti come<\/span> NinjaOne<\/span>, se combinati con lo script rilevare e analizzare le BSOD, consentono ai professionisti di<\/span> mantenere la<\/span> salute e la sicurezza del sistema. Il rilevamento e l’analisi dei registri BSOD e degli arresti imprevisti diventano un processo semplificato, che garantisce operazioni efficienti e sicure.<\/span><\/p>\n","protected":false},"author":35,"featured_media":207072,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","_lmt_disableupdate":"no","_lmt_disable":""},"operating_system":[4212],"use_cases":[4272],"class_list":["post-208127","script_hub","type-script_hub","status-publish","has-post-thumbnail","hentry","script_hub_category-windows","use_cases-manutenzione"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ninjaone.com\/it\/wp-json\/wp\/v2\/script_hub\/208127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ninjaone.com\/it\/wp-json\/wp\/v2\/script_hub"}],"about":[{"href":"https:\/\/www.ninjaone.com\/it\/wp-json\/wp\/v2\/types\/script_hub"}],"author":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/it\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/it\/wp-json\/wp\/v2\/comments?post=208127"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/it\/wp-json\/wp\/v2\/media\/207072"}],"wp:attachment":[{"href":"https:\/\/www.ninjaone.com\/it\/wp-json\/wp\/v2\/media?parent=208127"}],"wp:term":[{"taxonomy":"script_hub_category","embeddable":true,"href":"https:\/\/www.ninjaone.com\/it\/wp-json\/wp\/v2\/operating_system?post=208127"},{"taxonomy":"use_cases","embeddable":true,"href":"https:\/\/www.ninjaone.com\/it\/wp-json\/wp\/v2\/use_cases?post=208127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}