Solved Need help from PowerShell expert

[dsperber]

I'm having trouble using the now well-publicized Microsoft-provided PowerShell technique for determining if the hardware BIOS and Windows OS has been properly updated to mitigate Spectre and Meltdown.

I had no problem running the recipe on my Win10 system, and getting the predicted results displayed back. However when trying the identical steps on my Win7 system it appeared that PowerShell was simply not recognizing anything. Everything got rejected with "... is not recognized as the name of a cmdlet".

I finally concluded that the version of PowerShell (i.e. Windows Management Framework) provided with Win7 SP1 is only 2.0, whereas the version of WMF with Win10 is 5.1. And surely this must be why the PowerShell commands specified in the current story are just flat not working.

So I did some online hunting and discovered Microsoft's instructions on how to install WMF 5.1 on a Win7 SP1 system. And it seemed to install perfectly. The use of the $PSVersionTable command now displays the same values as is shown in my Win10 system:

I next performed the few steps that had worked without incident in Win10, and all seemed to be going fine... until the final command which is the crucial command that displays the results of the hardware and software inquiry, in order to determine if my system's vulnerability has been mitigated correctly.

So my question of a PowerShell expert is what is the problem with my Win7 environment, which is responsible for the error message: The term 'Get-SpeculationControlSettings' is not recognized as the name of a cmdlet.

This is how the same steps produced the correct results in Win10, because Get-SpeculationControlSettings worked fine in Win10. So why didn't that command work in Win7?

 

[torchwood]

Hi Despber,

No expert but did as you, upgraded PS,
MY commands are different to yours tho
see my screenshots here

Windows Client Guidance against speculative execution vulnerabilities - Windows 7 Help Forums

Roy

 

[dsperber]

I hadn't seen Brink's guidance on this topic. I had found my steps on the Lenovo Thinkpad Forum, where the MS script to verify the status of things was also being discussed.

I had already previously installed the NuGet piece, as Brink refers to. That had come up early in my environmental setup.

Also, I had already set "trusted" for the PSGallery as prompted, since prior to that I kept getting warning messages about "installing from untrusted..." and I had to keep replying Y to proceed with the install. Once I established that PSGallery was "trusted" I never saw that warning again.

Nevertheless, no matter how I arrive at the Get-SpeculationControlSettings step, either using the Brink approach or my previously shown approach, this command is still being rejected. So there's still got to be something else I'm missing which is responsible for this problem. The command is simply not being understood and parsed properly as all the previous PS commands are.

 

[torchwood]

Hi Desperber,

It appears your not getting the NUGET prompt

silly question since youve install PS 5 have you rebooted, got something simular running V1, screenshot also in that thread.


Roy

 

[dsperber]

I wonder if the Install-Module SpeculationControl is actually working? You'd think if it wasn't working or experienced an error, that there would be some red error message.

When I enter this command, there is a brief "thinking" pause, and then there is a brief green flash at the top of the window as something presumably takes place and displays some output (but very quickly), and then it goes away, and I'm back at the command prompt... with no red error message.

Sure seems like the Install-Module went fine. But if this somehow didn't actually succeed, that seems like the most likely reason for the Get-SpeculationControlSettings to then be rejected.

Is there some type of "trace/debug" output I can request (or maybe just "pause" so that I can see what's in that green area when Install-Module is performed, before it disappearing), in order to ensure that Install-Module installed successfully? Is there some additional command that displays a list of installed modules, so that I can see the name "SpeculationControl"?

Still looking for guidance from a PowerShell expert.

 

[dsperber]

It appears your not getting the NUGET prompt

That's already been done. Look in my second screenshot in my original post. The Get-PackageProvider shows that NuGet has already been installed, and once that's done it's done.

silly question since youve install PS 5 have you rebooted, got something simular running V1, screenshot also in that thread.

I don't quite follow what you're suggesting, but yes... you have to re-boot after the process of installing PS 5.1. It triggers another Windows Update to install a required KB fix, and demands a re-boot.

 

[Brink]

Hello dsperber,

If you haven't already, you might see if using the downloadable PowerShell Module from Technet may work for you.

PowerShell Verification using a download from Technet (earlier operating system versions and earlier WMF versions)

Install the PowerShell Module from Technet ScriptCenter.

Go to Speculation Control Validation PowerShell Script

Download SpeculationControl.zip to a local folder.

Extract the contents to a local folder, for example C:\ADV180002

Run the PowerShell module to validate the protections are enabled

Start PowerShell, then (using the example above) copy and run the following commands:

PS> # Save the current execution policy so it can be reset

PS> $SaveExecutionPolicy = Get-ExecutionPolicy

PS> Set-ExecutionPolicy RemoteSigned -Scope Currentuser

PS> CD C:\ADV180002\SpeculationControl

PS> Import-Module .\SpeculationControl.psd1

PS> Get-SpeculationControlSettings

PS> # Reset the execution policy to the original state

PS> Set-ExecutionPolicy $SaveExecutionPolicy -Scope Currentuser

 

[dsperber]

Nope, still no cigar. Somehow, although it seems as if I now have WMF 5.1 installed, something's not working properly when it comes to handling that Get-SpeculationControlSettings command... whatever special is needed to parse and handle it properly.

 

[torchwood]

Hmmmmm

ODD i installed PS5 directly from the KB3191566, now my Updates option is set to never, so i have not seen or updated it with another fix -- just checked no fix offered
Where did you download it from
you could allways uninstall/reinstall it.

Roy

 

[dsperber]

Hmmmmm

ODD i installed PS5 directly from the KB3191566, now my Updates option is set to never, so i have not seen or updated it with another fix -- just checked no fix offered
Where did you download it from
you could allways uninstall/reinstall it.

Roy

I followed the instructions from MS, "Install and Configure WMF 5.1". This included download a zip of an MSU and then running it. After checking my environment to ensure all prereqs were present, it triggered the install of KB3191566. So I'm sure that's how it got installed (and it does show up in my installed Windows Updates history from today).

Note that I didn't quite understand this particular comment in the installation instructions from MS, regarding WinRM (and the related service, which is not automatically activated with Win7):

WinRM Dependency
Windows PowerShell Desired State Configuration (DSC) depends on WinRM. WinRM is not enabled by default on Windows Server 2008 R2 and Windows 7. Run Set-WSManQuickConfig, in a Windows PowerShell elevated session, to enable WinRM.

It wasn't clear to me if this had to be done by me or what? I hadn't done it so maybe that was needed, and that was why I was having trouble. So I then did what it said, but it made no difference. I've now stopped and disabled the WinRM service, as it seems unneeded (or at least irrelevant).

 

[dsperber]

FOUND IT!!!!!!!!!!!!!!!!!!!!!!!!

Looking at the error messages in my most recent test (using the Technet script method that Brink had suggested I try), there was something interesting:

"Invalid search path C:\OTSORTW in the LIB environment variable; cannot find the path specified"

Well, turns out C:\OTSORTW actually is a folder that is supposed to be present, and I truly have customized my LIB environment variable to contain it (among others I've also added). But obviously I had unwittingly neglected to actually create that folder on the Lenovo P70 laptop I'm working on. Pure oversight, but it has never caused any problem until now.

Apparently PowerShell utilizes the LIB environment variable.

So, I simply copied the C:\OTSORTW folder from another machine on which it existed onto this laptop, and then re-tried my original command sequence (again, running with WMF 5.1 exactly as it got installed earlier this morning).

AND SURE ENOUGH... IT NOW WORKS!! Obviously WinRM is totally irrelevant, and it's not necessary to activate it.