Collecting enough logs and information from a system with networking issues can be difficult. You always need just one more to troubleshoot the problem. 😉 In this blog post, I will show you how the built-in Get-NetView module can help you collect all the necessary logs and information.
What is the Get-NetView Module?
“Get-NetView is a tool that collects local system and network configuration data, to streamline diagnosis of Windows networking issues.”
Source: https://github.com/microsoft/Get-NetView?tab=readme-ov-file
How to install
There are different ways to install the module from Microsoft, but it might already be on your system. I checked Windows 10, 11, and Windows Server 2022, for example, and some did have it, not at all, or an older version. In the chapters below, I will show you different scenarios and how to install or update it depending on the case.
How to check if it’s already installed
By running the command below, you can check if it’s already on your system:
Get-Module Get-NetView -ListAvailable
If it’s already there, it will return it with the version: (In the example below, it’s an older version from 2023.)
If not, it will return nothing, and you can continue with the different installation options below.
Updating an existing older version
Suppose an older version is already on the system, like the one in the screenshot above from 2023. In that case, you can update it by running the following command: (The SkipPublisherCheck Parameter is needed. Otherwise, you will get this error message)
Install-Module Get-NetView -Force -SkipPublisherCheck
When checking the version of the installed module, you will see both the old and the newer one. After starting a new PowerShell session, it will use the latest version.
Installing if not already present
You can install the module on a system that does not have the Get-NetView module present by running one of these commands in the chapters below:
Install-Module
Use the following command to install the module using Install-Module:
Install-Module Get-NetView -SkipPublisherCheck -Force
Direct execution
You can also install it by downloading and saving the Get-NetView.ps1 script to your current folder by running the following:
Invoke-WebRequest "aka.ms/Get-NetView" -OutFile "Get-NetView.ps1"
Disconnected or air-gapped systems
To install it on a system that is disconnected from the network, or air-gapped, you can use this command to save the module on a system that has it installed to a folder called c:\SomeFolderPath:
Save-Module Get-NetView -Path C:\SomeFolderPath -Force
Then move the Get-NetView folder (from C:\SomeFolderPath) to C:\Program Files\WindowsPowerShell\Modules on your target system.
Using the Get-NetView Module
When the installation is done, the Function Get-NetView is available, and you can start it by running it from an Administrator PowerShell prompt:
This will start gathering information from your system and might take a while, depending on the number of network adapters, CPUs, etc.
When it’s done, it will show you the location of the zipped logs and how long the process took:
In the default location, the Desktop folder, it will show the folder containing all the logs together with a zipped version of those logs for easy transportation to your system for further analysis:
Viewing the gathered logs
You can browse the folder and open the different text, zip, event log files, Registry Files, etc. for investigation: (These might contain sensitive information, be aware of that)
The logs contain everything from firewall rules to IP configuration, Windows services, drivers, version information, ARP, IP routes, and SMB settings. This should be enough for your network team.
Help and Parameters for Get-NetView
The Function has a lot of Parameters which you can use to limit the amount of information gathered (-SkipXYZ) or to run an additional ScriptBlock (-ExtraCommands )
NAME
Get-NetView
SYNOPSIS
Collects data on system and network configuration for diagnosing Microsoft Networking.
SYNTAX
Get-NetView [-OutputDirectory ] [-ExtraCommands ] [-BackgroundThreads ] [-Timeout ] [-ExecutionRate ] [-SkipAdminCheck] [-SkipLogs] [-SkipNetsh]
[-SkipNetshTrace] [-SkipCounters] [-SkipWindowsRegistry] [-SkipSMBEvents] [-SkipOnline] [-SkipVm] [-SkipPktMon] [-SkipNvspInfo] []
DESCRIPTION
Collects comprehensive configuration data to aid in troubleshooting Microsoft Network issues.
Data is collected from the following sources:
– Get-NetView metadata (path, args, etc.)
– Environment (OS, hardware, domain, hostname, etc.)
– Physical, virtual, Container, NICs
– Network Configuration, IP Addresses, MAC Addresses, Neighbors, Routes
– Physical Switch configuration, QOS polices
– Virtual Machine configuration
– Virtual Switches, Bridges, NATs
– Device Drivers
– Performance Counters
– Logs, Traces, etc.
– System and Application Events
The data is collected in a folder on the Desktop (by default), which is zipped on completion.
Use Feedback hub to submit a new feedback. Select one of these Categories:
Network and Internet -> Virtual Networking
Network and Internet -> Connecting to an Ethernet Network.
Attach the Zip file to the feedback and submit.
Do not share the zip file over email or other file sharing tools. Only submit the file through the feedback hub.
The output is most easily viewed with Visual Studio Code or similar editor with a navigation panel.
PARAMETERS
-OutputDirectory
Optional path to the directory where the output should be saved. Can be either a relative or an absolute path.
If unspecified, the current user’s Desktop will be used by default.
Required? false
Position? named
Default value
Accept pipeline input? false
Accept wildcard characters? false
-ExtraCommands <ScriptBlock[]>
Optional list of additional commands, given as ScriptBlocks. Their output is saved to the CustomModule directory,
which can be accessed by using "$CustomModule" as a placeholder. For example, {Copy-Item .\MyFile.txt $CustomModule}
copies "MyFile.txt" to "CustomModule\MyFile.txt".
Required? false
Position? named
Default value @()
Accept pipeline input? false
Accept wildcard characters? false
-BackgroundThreads <Int32>
Maximum number of background tasks, from 0 - 16. Defaults to 5.
Required? false
Position? named
Default value 5
Accept pipeline input? false
Accept wildcard characters? false
-Timeout <Int32>
Amount of time, in minutes, to wait for all commands to complete. Note that total runtime may be greater due to
post-processing. Defaults to 120 minutes.
Required? false
Position? named
Default value 120
Accept pipeline input? false
Accept wildcard characters? false
-ExecutionRate <Double>
Relative rate at which commands are executed, with 1 being normal speed. Reduce to slow down execution and spread
CPU usage over time. Useful on live or production systems to avoid disruption.
NOTE: This will force BackgroundThreads = 0.
Required? false
Position? named
Default value 1
Accept pipeline input? false
Accept wildcard characters? false
-SkipAdminCheck [<SwitchParameter>]
If present, skip the check for admin privileges before execution. Note that without admin privileges, the scope and
usefulness of the collected data is limited.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-SkipLogs [<SwitchParameter>]
If present, skip the EVT and WER logs gather phases.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-SkipNetsh [<SwitchParameter>]
If present, skip all Netsh commands.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-SkipNetshTrace [<SwitchParameter>]
If present, skip the Netsh Trace data gather phase.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-SkipCounters [<SwitchParameter>]
If present, skip the Windows Performance Counters collection phase.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-SkipWindowsRegistry [<SwitchParameter>]
If present, skip exporting Windows Registry keys.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-SkipSMBEvents [<SwitchParameter>]
If present, skips collecting of SMB Events.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-SkipOnline [<SwitchParameter>]
If present, skip the Online data gather phases.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-SkipVm [<SwitchParameter>]
If present, skip the Virtual Machine (VM) data gather phases.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-SkipPktMon [<SwitchParameter>]
If present, skips collecting PktMon information
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
-SkipNvspInfo [<SwitchParameter>]
If present, skips collecting NvspInfo information.
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
OUTPUTS
-------------------------- EXAMPLE 1 -------------------------- PS C:\>Get-NetView -OutputDirectory ".\" Runs Get-NetView and outputs to the current working directory.
RELATED LINKS
https://github.com/microsoft/Get-NetView
Wrapping up
That’s how you can use the Get-NetView module to gather information from a system for analysis using the powerful PowerShell module provided by Microsoft. 🙂 Have a lovely weekend!
