< ---------------------------- Microsoft Remote Assistance ------------------------------------ >
If you have computer-savvy friends, use <a class="shellExecuteLink" href="shortcut:%25systemroot%25\system32\msra.exe" title="Click to open Windows Remote Assistance"><img src="mshelp://help/?id=Microsoft.Windows.Resources.ShellExecuteTopicIcon" helpImage="ShellExecute"><span class="notLocalizable">Windows</span> Remote Assistance</a>
to let a friend access your computer over the Internet and help you fix a problem. You can watch what they're doing and interact with them while they're helping you.
msra.exe
< ---------------------------- Microsoft Remote Assistance ------------------------------------ >
< ---------------------------- Microsoft Office 2013 Autocomplete ------------------------------------ >
%localappdata%\Microsoft\Outlook\RoamCache\Stream_Autocomplete*
< ---------------------------- Microsoft Office 2013 Autocomplete ------------------------------------ >
winrm invoke Create wmicimv2/Win32_Process @{CommandLine="notepad.exe";CurrentDirectory="C:\"}
powershell [-noexit] -executionpolicy bypass -File <Filename>
%winternals%\psexec \\HOSTNAME -s powershell Enable-PSRemoting -Force
psexec64 \\HOSTNAME -s powershell Enable-PSRemoting -Force
wmic systemenclosure get ChassisTypes,LockPresent,Manufacturer,Name,SecurityStatus,SerialNumber,SMBIOSAssetTag,Tag /format:list
wmic printer get Caption,Comment,Default,Description,Location,Name,PortName,ServerName,SystemName /format:csv > printers.csv
WMIC PRINTER GET CAPTION,COMMENT,DEFAULT,DEFAULTPRIORITY,DESCRIPTION,DRIVERNAME,INSTALLDATE,NAME,PORTNAME,PRINTERSTATE,PRINTERSTATUS,SHARENAME,SPOOLENABLED,STATUS,SYSTEMNAME /FORMAT:LIST
"c:\PSTools\PsExec.exe" -accepteula \\KACE_HOST_NAME cmd /c IF EXIST "C:\program files (x86)" ("C:\program files (x86)\dell\kace\runkbot.exe" 4 0) ELSE ("C:\program files\dell\kace\runkbot.exe" 4 0)
netsh int ip set address name = "LAN" source = dhcp
netsh advfirewall show privateprofile settings
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain
NETSH -R HOSTNAME ADVFIREWALL FIREWALL ADD RULE NAME="VHN 11.4 - 25017" DIR=IN ACTION=ALLOW PROGRAM="C:\program files\FourJs\gdc25017\bin\gdc.exe" ENABLE=YES
NETSH -R HOSTNAME ADVFIREWALL FIREWALL ADD RULE NAME="VHN 11.4 - 25017" DIR=IN ACTION=ALLOW PROGRAM="C:\program files\FourJs\gdc25017\bin\gdc.exe" ENABLE=YES PROFILE=DOMAIN
netsh advfirewall firewall show rule dir=in name=all
netsh advfirewall firewall show rule status=enabled name=all
< ---------------------------------------------------------------- Powershell Firewall Command ---------------------------------------------------------------- >
(New-object -comObject HNetCfg.FwPolicy2).rules | where {$_.Name -like '*remote*'} | select Name
< ---------------------------------------------------------------- Powershell Firewall Command ---------------------------------------------------------------- >
<# ---------------------------------------------------------------- [Built In Packet Capture on Win Srv 2008 and above] ---------------------------------------------------------------- #>
Netsh trace start scenario=NetConnection capture=yes report=yes persistent=no maxsize=1024 correlation=yes traceFile=C:\Logs\NetTrace.etl
Netsh trace start scenario=NetConnection capture=yes report=yes persistent=no maxsize=4096 filemode=single correlation=yes traceFile=E:\trace\NetTrace_10-12-2018_1.etl
netsh trace stop
<# ---------------------------------------------------------------- [Built In Packet Capture on Win Srv 2008 and above] ---------------------------------------------------------------- #>
[ Netsh ICMP enable IPV4 & 6 ]
netsh -r HOSTNAME advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow
netsh -r HOSTNAME advfirewall firewall add rule name="ICMP Allow incoming V6 echo request" protocol=icmpv6:8,any dir=in action=allow
[ Netsh ICMP enable IPV4 & 6 ]
Command Substitute for Get-NetFirewallRule in Windows 7:
$(New-object -comObject HNetCfg.FwPolicy2).rules | Format-Table -Property name, protocol, localports
NETSH INTERFACE IP DELETE ARPCACHE
ARP -D *
IPCONFIG /FLUSHDNS
NBTSTAT -R
NBTSTAT -RR
defrag c: & sleep 300 & defrag c: /X & sleep 300 & shutdown /s /f /c "After Defrag"
%winternals%\psexec \\"HostName_IP" -u "DOMAIN\administrator" -p "Administrator_Password" -s -i wusa "c:\tech\Windows6.1-KB2819745-x64-MultiPkg.msu" /quiet /norestart
dnscmd 10.10.x.x /RecordAdd ZONE.local HOSTNAME /Aging /OpenAcl A 10.0.x.x
wmic datafile where name='C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe' get /format:list
## File HASH - certutil -hashfile FILENAME.EXT MD5 {MD2 MD4 MD5 SHA1 SHA256 SHA384 SHA512]
MSG USERNAME/* /SERVER:HOSTNAME "HELLO"
## icacls c:\ /reset /t /c
Timout /T 300 /nobreak
< ------------------------------------------ >
gpresult /Scope User /v
gpresult /Scope computer /v
< ------------------------------------------ >
wmic diskdrive get PNPDeviceID
wmic path CIM_LogicalDevice where "Description like 'USB%'" get /value
PowerShell EQ gwmi Win32_USBControllerDevice |fl Antecedent,Dependent
gwmi Win32_USBControllerDevice |%{[wmi]($_.Dependent)} | Sort Description,DeviceID | ft Description,DeviceID -auto
< ------------------ Windows 10 - Remote Registry Disabled by default ------------------ >
sc \\HOSTNAME config remoteregistry start= demand
sc \\HOSTNAME start remoteregistry
reg query "\\HOSTNAME\HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection"
sc \\HOSTNAME stop remoteregistry
sc \\HOSTNAME config remoteregistry start= disabled
< ------------------ Windows 10 - Remote Registry Disabled by default ------------------ >
---=== Change Computer Description Remotely ===---
sc \\HOSTNAME query remoteregistry
sc \\HOSTNAME start remoteregistry
reg query "\\HOSTNAME\HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
reg add "\\HOSTNAME\HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v srvcomment /t REG_SZ /d "Computer Description Text" /f
sc \\HOSTNAME stop remoteregistry
< -------------------------------------------------------------------------- [Change Description of Remote Machine] -------------------------------------------------------------------------- >
Invoke-Command -ComputerName HOSTNAME -ScriptBlock {$OSWMI=Get-WmiObject -class Win32_OperatingSystem;$OSWMI.Description=$args[0];$OSWMI.put() } -ArgumentList("DESCRIPTION")
Set-WmiInstance -Path "\\HOSTNAME\root\cimv2:Win32_OperatingSystem=@" -Arguments @{description="Description Here"}
< -------------------------------------------------------------------------- [Change Description of Remote Machine] -------------------------------------------------------------------------- >
< -------------------------------------------------------------------------- [Original Script] -------------------------------------------------------------------------- >
########################################################################################
##
## https://www.alexandreviot.net/2015/05/03/powershell-change-computer-description/
##
########################################################################################
$myDescription="My Server"
Invoke-Command -ComputerName $lServerName -ScriptBlock {$OSWMI=Get-WmiObject -class Win32_OperatingSystem;$OSWMI.Description=$args[0];$OSWMI.put() } -ArgumentList($myDescription)
< -------------------------------------------------------------------------- [Original Script] -------------------------------------------------------------------------- >
---=== Change Computer Description Remotely ===---
reg query \\HOSTNAME\HKLM\software\wow6432node\Microsoft\Windows\currentversion\Uninstall /f "gdc*" /s
reg query \\HOSTNAME\HKLM\software\Microsoft\Windows\currentversion\Uninstall /f "gdc*" /s
< ----------------------------------- [ Computer Description ] ------------------------------------------------------------------------------------ >
reg query \\[HOSTNAME/IP]\HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\lanmanserver\parameters /f srvcomment
wmic /node:[HOSTNAME/IP] os set Description="Descriptive Text Here"
REG ADD "\\[HOSTNAME/IP]\HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters /v srvcomment /t REG_SZ /d "your description here" /f
< ----------------------------------- [ Computer Description ] ------------------------------------------------------------------------------------ >
########################### UltraVNC Install & Start Service #########################################################################
sc \\REMOTE_HOST query uvnc_service
sc \\REMOTE_HOST start uvnc_service
sc \\REMOTE_HOST query state= all | find /I "vnc"
sc \\REMOTE_HOST start remoteregistry
%winternals%\psexec \\REMOTE_HOST "c:\Program Files\UltraVNC\winvnc.exe" -install
%winternals%\psexec \\REMOTE_HOST "c:\Program Files\UltraVNC\winvnc.exe" -startservice
Invoke-Command -ComputerName REMOTE_HOST -ScriptBlock {& cmd /c "c:\Program files\ultravnc\winvnc.exe" -install}
Invoke-Command -ComputerName REMOTE_HOST -ScriptBlock {& cmd /c "c:\Program files\ultravnc\winvnc.exe" -startservice}
sc \\REMOTE_HOST query uvnc_service
########################### UltraVNC Install & Start Service #########################################################################
"Set-NetFirewallRule -DisplayName “File and Printer Sharing (Echo Request – ICMPv4-In)” -enabled True"
< ---------------------------------------------- External/Public IP Address ---------------------------------------------- >
Invoke-RestMethod http://ipinfo.io/json | Select -exp ip
(Invoke-RestMethod http://ipinfo.io/json).ip
(Invoke-RestMethod http://ipinfo.io/json).hostname
(Invoke-RestMethod http://ipinfo.io/json).city
(Invoke-RestMethod http://ipinfo.io/json).region
(Invoke-RestMethod http://ipinfo.io/json).country
(Invoke-RestMethod http://ipinfo.io/json).loc
(Invoke-RestMethod http://ipinfo.io/json).org
(Invoke-WebRequest http://ipinfo.io/ip).Content.Trim()
Invoke-RestMethod ipecho.net/plain
Invoke-WebRequest http://ifconfig.me/ip
invoke-restmethod https://api.ipify.org?format=json | select -exp ip
(Invoke-WebRequest IPv4.Icanhazip.com).Content
(Invoke-WebRequest "http://checkip.dyndns.com").ParsedHTML.body.innerHtml
icm -ComputerName HOSTNAME -ScriptBlock {Invoke-RestMethod http://ipinfo.io/json | Select -exp ip}
Invoke-Command -ComputerName HOSTNAME -ScriptBlock {Invoke-RestMethod http://ipinfo.io/json | Select -exp ip}
(new-object System.Net.WebClient).DownloadString("http://myexternalip.com/raw")
(Invoke-WebRequest -URI http://myexternalip.com/raw).content
(Invoke-WebRequest -URI http://myip.dnsomatic.com/).content
curl ifcfg.me
nslookup . ifcfg.me
telnet ifcfg.me
ftp ifcfg.me
finger @ifcfg.me
Invoke-WebRequest -Uri https://www.hackthebox.eu/api/invite/generate -Method POST
%winternals%\psexec \\HOSTNAME nslookup myip.opendns.com. resolver1.opendns.com
dig +short myip.opendns.com @resolver1.opendns.com
< ---------------------------------------------- External/Public IP Address ---------------------------------------------- >
Get-WmiObject -Class "Win32_NetworkAdapterConfiguration" -ComputerName 127.0.0.1 -Filter "IpEnabled = TRUE" | foreach { write-host $_.IpAddress[0]}
(Get-WmiObject Win32_NetworkAdapterConfiguration | where { (($_.IPEnabled -ne $null) -and ($_.DefaultIPGateway -ne $null)) } | select IPAddress -First 1).IPAddress[0]
Get-WmiObject Win32_NetworkAdapterConfiguration
(Get-WmiObject Win32_NetworkAdapterConfiguration -EA).IpAddress[0]
(Get-WmiObject Win32_NetworkAdapterConfiguration).IpAddress[0]
(Get-WmiObject Win32_NetworkAdapterConfiguration).IpAddress[0]
(Get-WmiObject Win32_NetworkAdapterConfiguration).IpAddress
(Get-WmiObject Win32_NetworkAdapterConfiguration).IpAddress[1]
(Get-WmiObject Win32_NetworkAdapterConfiguration).IpAddress[0]
(Get-WmiObject Win32_NetworkAdapterConfiguration).IPSubnet
(Get-WmiObject Win32_NetworkAdapterConfiguration).DefaultIPGateway
(Get-WmiObject Win32_NetworkAdapterConfiguration).DNSServerSearchOrder
(Get-WmiObject Win32_NetworkAdapterConfiguration).DHCPEnables
(Get-WmiObject Win32_NetworkAdapterConfiguration).DHCPEnabled
(Get-WmiObject Win32_NetworkAdapterConfiguration).DHCPEnabled[0]
Get-WmiObject -Class Win32_Networkadapterconfiguration | ? {$_.IPEnabled -eq $true }
Get-WmiObject -Class Win32_Networkadapterconfiguration | ? {$_.DHCPEnabled -eq $true }
Get-WmiObject -Class Win32_Networkadapterconfiguration | ? {$_.IPEnabled -eq $true } ? {$_.DHCPEnabled -eq $true }
Get-WmiObject -Class Win32_Networkadapterconfiguration | ? {$_.IPEnabled -eq $true } | ? {$_.DHCPEnabled -eq $true }
Get-WmiObject -Class Win32_IP4RouteTable -ComputerName HOSTNAME | select destination,mask,nexthop, metric1
Get-WmiObject -namespace root\wmi –class MSStorageDriver_FailurePredictStatus -ErrorAction Silentlycontinue | Select InstanceName, PredictFailure, Reason | Format-Table –Autosize
< ############################################################################## Powershell Basic Commands ############################################################################## >
< ########################################################################################### >
< ############################## ############################## >
< ############################## Set IP Address, Gateway, DNS ############################## >
< ############################## ############################## >
< ########################################################################################### >
New-NetIPAddress -InterfaceAlias Ethernet -IPAddress 172.16.0.20 -PrefixLength 24 -DefaultGateway 172.16.0.1
Set-DNSClientServerAddress -InterfaceAlias "Ethernet" -ServerAddress 172.16.0.10
Test-NetConnection 8.8.8.8
Test-NetConnection www.bing.com -traceroute
Test-NetConnection smtp.com -Port 25
Test-NetConnection www.bing.com -Port 80
Restart-Service
Get-service | Out-GridService
Rename-Computer COMPUTERNAME01
Restart-Computer
Shutdown-Computer
Add-Computer -DomainName Domain.Name
Install-WindowsFeature -IncludeAllSubFeatures -INcludeManagementTools File-Services
Install-WindowsFeature Net-Framework-Core -source d:\sources\sxs
Test-ComputerSecureChannel -Credential Domain\Admin -Repair
Set-NetFirewallProfile -Profile domain,public,private -Enabled {False | True}
< ############################################################################## Powershell Basic Commands ############################################################################## >
< -------------------------------------------------------------------------- Simple List of Shared Folders -------------------------------------------------------------------------- >
< ##
< ## https://superuser.com/questions/769679/powershell-get-list-of-folders-shared
< ##
< ## ---------------------------------------------------------------------------- >
(net view \\HOSTNAME) | % { if($_.IndexOf(' Disk ') -gt 0){ $_.Split(' ')[0] } }
$Servers = ( Get-ADComputer -Filter { DNSHostName -Like '*' } | Select -Expand Name )
foreach ($Server in $Servers)
{
(net view $Server) | % { if($_.IndexOf(' Disk ') -gt 0){ $_.Split(' ')[0] } } | out-file C:\file_shares\$Server.txt
}
< -------------------------------------------------------------------------- Simple List of Shared Folders -------------------------------------------------------------------------- >
([WMI]'').ConvertToDateTime((Get-WmiObject Win32_OperatingSystem).InstallDate)
([WMI]'').ConvertToDateTime((Get-WmiObject Win32_OperatingSystem -ComputerName HOSTNAME).InstallDate)
[timezone]::CurrentTimeZone.ToLocalTime(([datetime]'1/1/1970').AddSeconds($(get-itemproperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion').InstallDate))
< ----------------------------------------- [AD Computer LastLogon Conversion] ----------------------------------------- >
w32tm /ntte 131625959999922000
[Excel]
=IF(P15>0,P15/(8.64*10^11) - 109205,"")
=((P15/10000000/3600/24)-109205)-0.166673
[Excel]
< ----------------------------------------- [AD Computer LastLogon Conversion] ----------------------------------------- >
gwmi win32_systemenclosure | select PSComputerName,ChassisTypes,LockPresent,Manufacturer,Name,SecurityStatus,SerialNumber,SMBIOSAssetTag,Tag
GWMI WIN32_NETWORKADAPTERCONFIGURATION -COMPUTER HOSTNAME | SELECT Description,MACAddress,IPAddress
gwmi win32_physicalmemoryarray | select PSComputerName,Caption,MaxCapacity,Tag
gwmi win32_physicalmemory | select PSComputerName,Capacity,Caption,Description,DeviceLocator,FormFactor,Manufacturer,Name,OtherIdentifyingInfo,PartNumber,PositionInRow,SerialNumber,SKU,Speed,Tag,TotalWidth,TypeDetail
gwmi win32_networkadapterconfiguration -ComputerName HOSTNAME | select PSComputername,Index,Description,DHCPEnabled,DNSDomain,DNSDomainSuffixSearchOrder,DNSHostName,DNSServerSearchOrder,FullDNSRegistrationEnabled,IPAddress,IPEnabled,Caption,DefaultIPGateway,IPSubnet,MACAddress,ServiceName | where {$_.Index -eq '1'}
gwmi win32_networkadapterconfiguration -ComputerName HOSTNAME | select * | where {$_.Index -eq '1'}
(Get-WMIObject -class Win32_PhysicalMemory -ComputerName SERVER | Measure-Object -Property capacity -Sum | % {[Math]::Round(($_.sum / 1GB),2)})
Get-ADComputer -filter {Name -like '*08'} | Foreach-Object {[math]::Round((Get-WmiObject -Class Win32_ComputerSystem).TotalPhysicalMemory/1GB)} | Format-Table -property * -AutoSize
Get-ADComputer -filter {Name -like '*08'} | Foreach-Object {Get-WmiObject -Class Win32_ComputerSystem -ErrorAction SilentlyContinue -ComputerName $_.Name | Select-Object PSComputerName, @{Name="Memory"; Expression={[math]::Round($_.TotalPhysicalMemory/1GB)}}}
Get-ADComputer -filter {Name -like '*08'} | Foreach-Object {Get-WmiObject -Class Win32_ComputerSystem -ErrorAction SilentlyContinue -ComputerName $_.Name | Select-Object PSComputerName,Manufacturer,Model, @{Name="Memory"; Expression={[math]::Round($_.TotalPhysicalMemory/1GB)}}}
Get-ADComputer -filter {Name -like '*ComputerName*'} | Foreach-Object {Get-WmiObject -ErrorAction SilentlyContinue -Class Win32_ComputerSystem -ComputerName $_.Name}
Get-ADComputer -filter {Name -like '*ComputerName*'} | Foreach-Object {Get-WmiObject -ErrorAction SilentlyContinue -Class Win32_ComputerSystem -ComputerName $_.Name | Select-Object *} | Format-Table -Property * -AutoSize | Out-String -Width 4096
Get-ADComputer -filter {Name -like '*ComputerName*'} | Foreach-Object {Get-WmiObject -ErrorAction SilentlyContinue -Class Win32_ComputerSystem -ComputerName $_.Name | Select-Object PSComputerName,Status,Name,BootROMSupported,BootStatus,Caption,CurrentTimeZone,DaylightInEffect,mDNSHostNamem,Domain,DomainRole,EnableDaylightSavingsTime,HypervisorPresent,InstallDate,LastLoadInfo,Manufacturer,Model,NumberOfLogicalProcessors,NumberOfProcessors,PartOfDomain,PauseAfterReset,PrimaryOwnerContact,PrimaryOwnerName,Roles,SystemFamily,SystemSKUNumber,SystemType,TotalPhysicalMemory,UserName} | Format-List -Property * | Out-String -Width 4096
Get-ADComputer -filter {Name -like '*ComputerName*'} | Foreach-Object {Get-WmiObject -ErrorAction SilentlyContinue -Class Win32_ComputerSystem -ComputerName $_.Name | Select-Object PSComputerName,Status,Name,BootROMSupported,BootStatus,Caption,CurrentTimeZone,DaylightInEffect,mDNSHostNamem,Domain,DomainRole,EnableDaylightSavingsTime,HypervisorPresent,InstallDate,LastLoadInfo,Manufacturer,Model,NumberOfLogicalProcessors,NumberOfProcessors,PartOfDomain,PauseAfterReset,PrimaryOwnerContact,PrimaryOwnerName,Roles,SystemFamily,SystemSKUNumber,SystemType,TotalPhysicalMemory,UserName} | ConvertTo-Csv -UseCulture
Get-ADComputer -filter * -SearchBase "OU=ORG_UNIT_1,DC=DOMAIN,DC=local" | Foreach-Object {Test-Connection -ErrorAction SilentlyContinue -ComputerName $_.Name}
gwmi win32_diskdrive | select PSComputerName,Status,DeviceID,Partitions,BytesPerSector,InstallDate,InterfaceType,SectorsPerTrack,Size,TotalCylinders,TotalHeads,TotalSectors,TotalTracks,TracksPerCylinder,Capabilities,CapabilityDescriptions,Caption,Description,FirmwareRevision,Manufacturer,MediaLoaded,MediaType,Model,Name,PNPDeviceID,SerialNumber,Signature,SystemName
gwmi -ComputerName HOSTNAME WIN32_COMPUTERSYSTEM | SELECT PSComputerName,PowerSupplyState,PowerState,Name,BootROMSupported,Caption,DaylightInEffect,DNSHostName,Domain,HypervisorPresent,InstallDate,Manufacturer,Model,SystemType,TotalPhysicalMemory,Username
Get-ADComputer -filter * | Foreach-Object {Get-WmiObject -Class Win32_BIOS -ComputerName $_.Name -erroraction silentlycontinue | Select-Object PSComputerName, Serialnumber | FT * -AutoSize}
cat "C:\Test\Filename.txt" | where {$_.Contains("Error")} | Write-Host -ForegroundColor Red
cat "C:\Test\Filename.txt" | where {$_.Contains("Information")} | Write-Host -ForegroundColor Yellow
Get-Content 'C:\Test\Filename.txt' | ? { $_ -match "Error" -and $_ -match "PM"} | Write-Host -ForegroundColor Yellow
(Get-ADDomain).PDCEmulator
Get-ADUser -filter * -SearchBase "OU=ORG_UNIT_1,DC=DOMAIN,DC=local" -Properties MemberOf
(Get-ADUser -filter * -SearchBase "OU=ORG_UNIT_1,DC=DOMAIN,DC=local" -Properties MemberOf).memberof
Get-ADUser -filter * -SearchBase "OU=ORG_UNIT_1,DC=DOMAIN,DC=local" -Properties MemberOf
Get-ADUser -filter * -SearchBase "OU=ORG_UNIT_1,DC=DOMAIN,DC=local" -Properties *
Get-ADUser -filter * -SearchBase "OU=CONTOSO,DC=DOMAIN,DC=local" -Properties DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion
Get-ADUser -filter * -SearchBase "OU=ORG_UNIT_1,DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion
Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion
Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like 'Connie*'} | Format-Table -AutoSize *
Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like '*WIC*'} | Format-Table -AutoSize *
Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like '*WIC'} | Format-Table -AutoSize *
Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like 'Scott'} | Format-Table -AutoSize *
Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like 'Scott*'} | Format-Table -AutoSize *
Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like '*Bo*'} | Format-Table -AutoSize *
Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,PasswordExpired,ProtectedFromAccidentalDeletion | where { $_.SamAccountName -like 'Username'}
Get-ADUser -filter * -SearchBase "DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like 'Name*'}
Get-ADUser -filter * -SearchBase "DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.SamAccountName -eq 'Username'}
Get-ADUser -filter * -SearchBase "DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,PasswordExpired,ProtectedFromAccidentalDeletion | where { $_.SamAccountName -like 'Username'}
Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion
Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion,Company,Department,Name,Title
Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion,Company,Department,Name
Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion,Company,Department,Name | where {$_.Enabled -eq 'True'}
Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion,Company,Department,Name | where {$_.Enabled -eq 'True'}
Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion,Company,Department,Name,OfficePhone | where {$_.Enabled -eq 'True'}
Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion,Company,Department,Name,OfficePhone | where {$_.Enabled -eq 'True'} | where {$_.SamAccountName -eq 'Username'}
Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | where {$_.Enabled -eq 'True'} | where {$_.SamAccountName -eq 'Username'}
Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | where {$_.Enabled -eq 'True'} | where {$_.SamAccountName -eq 'Username'} | Set-ADUser -PasswordNeverExpires:$True
Get-ADUser -Filter {(ObjectClass -eq "user")} -SearchBase "OU=Offices,DC=Contoso,DC=com" | Set-ADUser -PasswordNeverExpires:$FALSE
Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | where {$_.Enabled -eq 'True'} | where {$_.SamAccountName -eq 'Username'}
Get-ADUser -filter * -SearchBase "DC=CONTOSO,DC=local" -Properties * | where {$_.Enabled -eq 'True'} | where {$_.SamAccountName -eq 'Username'}
Get-ADUser -filter * -SearchBase "DC=CONTOSO,DC=local" -Properties * | where {$_.SamAccountName -eq 'Username'}
Get-ADUser -filter * -SearchBase "DC=CONTOSO,DC=local" -Properties * | where {($_.PasswordNeverExpires -eq 'True') -or ($_.CannotChangePassword -eq 'True') -and ($_.DisplayName -notlike '*Terminated*') -and ($_.Description -notlike '*terminated*')} | select DisplayName,SamAccountName,Title,Description,Enabled,Lockedout,PasswordNeverExpires,CannotChangePassword | ConvertTo-Csv | Filename.csv
Get-AdUser -Filter 'PasswordNeverExpires -eq $false' -SearchBase "OU=users,DC=domain,DC=com" -Properties Name, Manager, Title, AccountExpirationDate, LastLogonDate | Select-Object Name, SamAccountName, Manager, Title, AccountExpirationDate, LastLogonDate | Export-CSV c:\Test\Testusers_expirationdate.csv -NoTypeInformation
Get-ADUser -filter * -properties passwordlastset, passwordneverexpires | sort-object name | select-object Name, passwordlastset, passwordneverexpire
Get-ADUser -filter {name -like 'Administrator'} -properties passwordlastset, passwordneverexpires | sort-object name | select-object Name, passwordlastset, passwordneverexpire
Get-ADUser -filter * -properties passwordlastset, passwordneverexpires | sort-object name | select-object Name, passwordlastset, passwordneverexpires | Export-csv -path c:\yaniv.csv
Get-ADUser -Filter * -SearchBase "DC=CONTOSO,DC=local" -ResultPageSize 0 -Property CN, Description, LastLogonTimestamp | Select-Object -Property CN, Description, @{ n = "LastLogonDate"; e = { [datetime]::FromFileTime( $_.lastLogonTimestamp ) } } | Sort-Object -Property CN, Description, LastLogonDate | Export-CSV -NoTypeInformation "C:\test\lastlogon.csv"
Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False} –Properties "DisplayName", "msDS-UserPasswordExpiryTimeComputed" |Select-Object -Property "Displayname",@{Name="ExpiryDate";Expression={[datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")}} | out-gridview
Get-ADUser Username -Properties * | Select Name,Enabled,PasswordExpired,PasswordNeverExpires,SamAccountName,Title,Description,EmailAddress,OfficePhpone,TelephoneNumber,Department,Company,City,State
get-adcomputer -filter {operatingsystem -like "*2008*" -or operatingsystem -like "*2012*"} -Properties operatingsystem | Select Name,OperatingSystem
get-adcomputer -filter {operatingsystem -like "*2003*"} -Properties operatingsystem | Select Name,OperatingSystem
get-adcomputer -filter {operatingsystem -like "*server*"} -Properties operatingsystem | Select Name,OperatingSystem
get-adcomputer -filter {operatingsystem -like "*2003*"} -Properties operatingsystem | Select Name,OperatingSystem
get-adcomputer -filter {operatingsystem -like "*2008*"} -Properties operatingsystem | Select Name,OperatingSystem
get-adcomputer -filter {operatingsystem -like "*2012*"} -Properties operatingsystem | Select Name,OperatingSystem
get-adcomputer -filter {operatingsystem -ne "*Windows Server*"} -Properties operatingsystem | Select Name,OperatingSystem
get-adcomputer -filter {operatingsystem -ne "*Windows Server*"} -Properties Description | Select Description,Enabled,Name,ObjectClass
get-adcomputer -filter {operatingsystem -ne "*Windows Server*" -and Enabled -eq "False"} -Properties Description | Select Description,Enabled,Name,ObjectClass
get-adcomputer -filter {operatingsystem -ne "*Windows*"} -Properties operatingsystem | Select Name,OperatingSystem
get-adcomputer -filter {operatingsystem -like "*Windows XP*"} -Properties operatingsystem | Select Name,OperatingSystem
get-adcomputer -filter {operatingsystem -like "*2008*" -or operatingsystem -like "*2012*"} -Properties BadLogonCount,badPwdCount,CanonicalName,Created,Description,DNSHostName,Enabled,IPv4Address,isDeleted,LastBadPasswordAttempt,LastLogonDate,LockedOut,LogonCount,Name,ObjectClass,OperatingSystem,OperatingSystemHotFix,OperatingSystemServicePack,OperatingSystemVersion,ProtectedFromAccidentalDeletion
get-adcomputer -filter {operatingsystem -like "*2008*" -or operatingsystem -like "*2012*"} -Properties BadLogonCount,badPwdCount,CanonicalName,Created,Description,DNSHostName,Enabled,IPv4Address,isDeleted,LastBadPasswordAttempt,LastLogonDate,LockedOut,LogonCount,Name,ObjectClass,OperatingSystem,OperatingSystemHotFix,OperatingSystemServicePack,OperatingSystemVersion,ProtectedFromAccidentalDeletion | ConvertTo-Csv > FileName.csv
Get-ADComputer -Filter 'Name -like "HOSTNAME"' -Properties * | Select CannotChangePassword,BadPwdCount,CanonicalName,CN,Created,Deleted,Description,DisplayName,DistinguishedName,DNSHostName,Enabled,IPv4Address,IPv6Address,isCriticalSystemObject,isDeleted,lastLogoff,lastLogon,LockedOut,logonCount,Name,OperatingSystem,OperatingSystemHotfix,OperatingSystemServicePack,OperatingSystemVersion,ProtectedFromAccidentalDeletion | ConvertTo-Csv
Get-ADComputer -Filter {Name -like "HOSTNAME" -or Name -like "HOSTNAME2"} -Properties * | Select Name,DNSHostName,CanonicalName,DistinguishedName,CannotChangePassword,BadPwdCount,CN,Created,Deleted,Description,DisplayName,Enabled,IPv4Address,IPv6Address,isCriticalSystemObject,isDeleted,lastLogoff,lastLogon,LockedOut,logonCount,OperatingSystem,OperatingSystemHotfix,OperatingSystemServicePack,OperatingSystemVersion,ProtectedFromAccidentalDeletion | ConvertTo-Csv
get-adcomputer -filter {Description -like "*ENTRY*"} -Properties * | Select Name,Description,OperatingSystem,OperatingSystemVersion,Created,LastLogonDate,Modified,whenChanged | FL
Get-ADComputer -Filter * -Properties Name,OperatingSystem ,lastlogontimestamp | Select Name,OperatingSystem ,@{N='lastlogontimestamp'; E={[DateTime]::FromFileTime($_.lastlogontimestamp)}}
Get-ADComputer -Filter {operatingsystem -like "*windows 7*"} -Properties * | Select CanonicalName,CN,Created,Deleted,Description,DisplayName,DNSHostName,Enabled,IPv4Address,isDeleted,LockedOut,Name,OperatingSystem,OperatingSystemServicePack,OperatingSystemVersion,ProtectedFromAccidentalDeletion | ConvertTo-Csv -UseCulture > WIn-7_AD_PCs_6-28-2017_1.csv
Get-ADComputer -Filter * -Properties ipv4Address, OperatingSystem | Format-List Name, ipv4*, oper* > c:\users\username\desktop\computers.txt
Found on Spiceworks: https://community.spiceworks.com/topic/2081162-powershell-script-to-get-computer-name-ip-last-logon-and-name-of-last-logon?utm_source=copy_paste&utm_campaign=growth
Search-ADAccount -Accountinactive -TimeSpan 60 -Usersonly | Select name,lastlogondate
<# ---------------------------------------------------------------------------- Ping color coded UP/Down for IPs pulled from GET-ADComputer ------------------------------------------- #>
Get-ADComputer -Filter {Name -like '*HOSTNAMES*'} | ForEach {
If (Test-Connection -ComputerName $_.Name -Count 1 -Quiet) {
Write-Host "$($_.Name) is up" -ForegroundColor Green
} Else {
Write-Host "$($_.Name) is down" -ForegroundColor Red
}
}
<# ---------------------------------------------------------------------------- Ping color coded UP/Down for IPs pulled from GET-ADComputer ------------------------------------------- #>
##
## https://social.technet.microsoft.com/Forums/lync/en-US/737b2322-e51c-48a4-9cfe-63ebef9d120a/getadcomputer-to-query-organizational-unit-for-active-computers?forum=winserverpowershell
##
<# ---------------------------------------------------------------------------- CSV Export of IPs pulled from GET-ADComputer to Test-Connection ------------------------------------------- #>
Get-ADComputer -Filter {Name -like '154*'} | ForEach {
$computerName = $_.Name
$props = @{
ComputerName = $computerName
Status = ''
}
If (Test-Connection -ComputerName $computerName -Count 1 -Quiet) {
$props.Status = 'UP'
} Else {
$props.Status = 'DOWN'
}
New-Object PsObject -Property $props
} | Select ComputerName,Status | Export-Csv .\pingResults.csv -NoTypeInformation
<# ---------------------------------------------------------------------------- CSV Export of IPs pulled from GET-ADComputer to Test-Connection ------------------------------------------- #>
Get-GPO -All | Sort-Object displayname | Where-Object { If ( $_ | Get-GPOReport -ReportType XML | Select-String -NotMatch "<LinksTo>" ) {$_.DisplayName } }
< --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- >
## https://social.technet.microsoft.com/Forums/en-US/ff2f5ca5-91d7-43d7-9f45-e9d758dc1257/how-to-filter-multiple-conditions-with-getadcomputer?forum=winserverpowershell
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
$DaysInactive = 30
$time = (Get-Date).Adddays(-($DaysInactive))
Get-ADComputer
-Filter {(Enabled -eq $TRUE -and LastLogonTimeStamp -gt $time)}
-Property *
| ? OperatingSystem -NotLike "*Server*"
|
< --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- >
Invoke-CimMethod -InputObject (Get-CimInstance Win32_Process -Filter "name = 'notepad.exe'") -MethodName GetOwner
Get-WmiObject win32_process -Filter "Name='PowerShell.exe'" | fl Caption,Name,ProcessName,Handles,CommandLine,CSName,Description,OSName,WindowsVersion,Priority,ProcessID,ThreadCount
Get-WmiObject Win32_UserProfile | select LocalPath, SID,@{LABEL="last used";EXPRESSION={$_.ConvertToDateTime($_.lastusetime)}}| ft
get-ciminstance win32_userprofile | ? lastusetime | select lastusetime, localpath,@{LABEL='user';EXPRESSION={(gwmi win32_useraccount -filter "SID = '$($_.sid)'").caption}}
gwmi -NS root\cimv2\power -Class win32_PowerPlan | select ElementName, IsActive | ft -a
-------------------------------------------------------------------------------------------------
$ServicePID = (get-wmiobject win32_service | where { $_.name -eq 'service name'}).processID
Stop-Process $ServicePID -Force
< ----------------------------------------------------------------------------- >
gci | % name
But it's important to remember that PS isn't all about speed, but functionality.
Powershell
gci | ? LastWriteTime -lt (Get-Date).AddDays(-15) | % Name
-------------------------------------------------------------------------------------------------
[ Rename Files ]
Get-ChildItem -Filter "*.wav" -Recurse | Rename-Item -NewName {$_.name -replace 'wav','flac' } -whatif
get-childitem -path "hklm:\software\microsoft\windows\currentversion\uninstall" | Get-ItemProperty | ? {$_.DisplayName -like "paint.net"}
gci -path "hklm:\software\microsoft\windows\currentversion\uninstall" | Get-ItemProperty | ? {$_.DisplayName -like "paint.net"}
get-childitem -path "hklm:\software\microsoft\windows\currentversion\uninstall" | Get-ItemProperty | Where-Objectd {$_.DisplayName -like "paint.net"}
Get-ChildItem "hklm:\software\microsoft\windows\currentversion\uninstall" | ForEach-Object {Get-ItemProperty $_.pspath} | where-object {$_.DisplayName} | Foreach-Object {$_.DisplayName}
Get-ChildItem "hklm:\software\microsoft\windows\currentversion\uninstall" | ForEach-Object {Get-ItemProperty $_.pspath} | Foreach-Object {$_.DisplayName}
$files = Get-ChildItem -Path C:\Temp
foreach ($file in $files)
{
$newFileName=$file.Name.Replace("c11","c12")
Rename-Item $file $newFileName
}
[ Rename Files ]
Get-WmiObject Win32_MappedLogicalDisk -computer <computername> | select name, providername (Mapped Drive)
Test-Connection -count 1 -computer (Get-Content names.txt) | ForEach { # do something with $_.Address }_
1..254 | ForEach-Object {Test-Connection -ComputerName "192.168.0.$_" -Count 1 -ErrorAction SilentlyContinue}
Test-Connection -Count ([Int32]::MaxValue) outlook.office365.com
Test-Connection -ErrorAction Silentlycontinue -Count ([Int32]::MaxValue) outlook.office365.com
< ---###########################################################################################################--- >
while ($true)
{
"$(Get-Date);$(Test-Connection -ComputerName outlook.office365.com -Quiet)"
}
while ($true)
{
"$(Get-Date);$(Test-Connection -ComputerName outlook.office365.com)"
}
while ($true){"$(Get-Date);$(Test-Connection -ComputerName outlook.office365.com)"}
< ---###########################################################################################################--- >
< ################################### Compare Folder Hashes ################################### >
$LeftFolder = "C:\Users\Username\Downloads\Dell\Skylake\Win7_x64_Dell_OEM"
$RightFolder = "E:\Scott\ISO\Win7_x64_Dell_OEM"
$LeftSideHash = Get-ChildItem $LeftFolder -Recurse | Get-FileHash | select @{Label="Path";Expression={$_.Path.Replace($LeftFolder,"")}},Hash
$RightSideHash = Get-ChildItem $RightFolder -Recurse | Get-FileHash | select @{Label="Path";Expression={$_.Path.Replace($RightFolder,"")}},Hash
Compare-Object $LeftSideHash $RightSideHash -Property Path,Hash
< ################################### Compare Folder Hashes ################################### >
Get-Service | select *
Get-Service -Name 'PRTG*' | select *
Get-Service | select Name,Status,RequiredServices,StartType
Get-Service -Name 'PRTG*' | select Name,Status,RequiredServices,StartType
get-service -ComputerName HOSTNAME winrm -requiredServices
get-service -name winrm -computername localhost, Server01, Server02 | format-table -property MachineName, Status, Name, DisplayName -auto
get-service s* | sort-object status -descending
get-service | where-object {$_.DependentServices} | format-list -property Name, DependentServices, @{Label="NoOfDependentServices"; Expression={$_.dependentservices.count}}
get-service -ComputerName HOSTNAME | where-object {$_.Status -eq "Running"}
get-service -ComputerName HOSTNAME | where {$_.Name -like "Mps*"}
get-Service -Name mpssvc -ComputerName HOSTNAME | start-service
set-service -name lanmanworkstation -DisplayName "LanMan Workstation"
Get-Service
New-Service
Restart-Service
Get-Service -Name "net*" | Where-Object {$_.Status -eq "Stopped"} | Restart-Service
Resume-Service
Start-Service
Stop-Service
Suspend-Service
(Get-WmiObject -Class Win32_Service -Filter "name='WinRM'" -ComputerName Server01)
(get-wmiobject win32_process -filter "name='ampagent.exe'" -computername hart08)
Get-CimInstance Win32_Service -Filter "name = 'AMPWatchDog'" -ComputerName HOSTNAME | ConvertTo-Csv
Get-CimInstance Win32_Service -Filter "name = 'AMPWatchDog'" | ConvertTo-Csv
Get-Service -name "adws","dns","kdc","netlogon" -ComputerName (Get-ADDomain).ReplicaDirectoryServers | Sort Machinename | Format-Table -group @{Name="Computername";Expression={$_.Machinename.toUpper()}} -Property Name,Displayname,Status
Add-Computer –DomainName mylab.local –Credential (Get-Credential)
Get-ADComputer -filter * -SearchBase "OU=ORG_UNIT_2,OU=ORG_UNIT_1,DC=DOMAIN,DC=local" | Select-Object -expand name
Get-ADGroup -Filter * | Select-Object Name,GroupCategory,GroupScope,DistinguishedName
Get-ADGroup -Filter * | Select-Object Name,DistinguishedName
powershell.exe -executionpolicy bypass -command "C:\Users\gas\Desktop\Update-Sysinternals.ps1"
dism.exe /online /enable-feature /featurename:NetFX3 /Source:D:\sources\sxs /all
dism /online /enable-feature /featurename:netfx3 /all /LimitAccess /source:\\share_name\sources\sxs
<# ------------------------- [Add Telnet CMD Line / PowerShell] ------------------------- #>
Import-Module servermanager
Add-WindowsFeature telnet-client
dism /online /Enable-Feature /FeatureName:TelnetClient
<# ------------------------- [Add Telnet CMD Line / PowerShell] ------------------------- #>
## PowerShell History - get-history | Format-Table -Property < *|CommandLine > -AutoSize | Out-String -Width 4096 | clip
< ------------------------------------------- Windows / PowerShell Version ------------------------------------------- >
get-item "C:\Windows\System32\qmgr.dll" | Select-Object -ExpandProperty VersionInfo
[System.Environment]::OSVersion.Version
(Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -Name ReleaseId).ReleaseId
[Environment]::OSVersion.Version -ge (new-object 'Version' 6,1)
< ------------------------------------------- Windows / PowerShell Version ------------------------------------------- >
## GET DOT NET VERSION - Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -Recurse | Get-ItemProperty -Name Version -EA 0 | Where { $_.PSChildName -Match '^(?!S)\p{L}'} | Format-Table PSChildName, Version -AutoSize
[System.Diagnostics.FileVersionInfo]::GetVersionInfo("C:\Windows\system32\notepad.exe").FileVersion
Invoke-Command -ComputerName COMPUTERNAME -ScriptBlock {& cmd /c "c:\Program Files (x86)\Symantec\Symantec Endpoint Protection\smc.exe" -p gooberpea -stop}
Invoke-Command -ComputerName HOSTNAME -ScriptBlock {(Get-ItemProperty 'hklm:software\symantec\Symantec Endpoint Protection\CurrentVersion').ProductVersion}
Invoke-Command -ComputerName HOSTNAME -ScriptBlock {(Get-ItemProperty 'hklm:software\symantec\Symantec Endpoint Protection\CurrentVersion').ProductName}
Invoke-Command -ComputerName HOSTNAME {Get-PSDrive D} | Select-Object PSComputerName,Used,Free | ForEach-Object {$_.free / 1GB}
Invoke-Command -ComputerName HOSTNAME {Get-PSDrive D} | Select-Object PSComputerName,Used,Free | ForEach-Object {$_.used / 1GB}
powershell.exe -nologo -executionpolicy bypass -WindowStyle hidden -noprofile -file "uninstallScript.ps1" "Java"
gwmi win32_product | where-object { $_.name -match "" }
&START /WAIT msiexec `/qn `/x `{$stringer`}
(Get-WmiObject Win32_Process | ?{ $_.ProcessName -match "paintdotnet" }).Terminate()
Get-WmiObject Win32_Service | Where {$_.name -eq "uvnc_serivce"}
Get-WmiObject Win32_Service | Where {$_.name -eq "spooler"}
Get-WmiObject Win32_Service | Where {$_.name -like "*vnc*"}
gwmi win32_service | where {$_.StartMode -ne “Disabled”} | select name,startname | format-list
gwmi win32_service | where {$_.StartMode -ne “Disabled”} | select name,startname | format-Wide
gwmi win32_service | where {$_.StartMode -ne “Disabled”} | select name,startname | format-Table
gwmi win32_service | where {$_.StartMode -ne “Disabled”} | select name,startname | export-csv c:\services.csv
gwmi win32_service | where {$_.StartMode -ne “Disabled”} | select name,startname | convertto-html
gwmi win32_service | where {$_.StartMode -ne “Disabled”} | select name,startname | convertto-html | out-file c:\services.html
(Get-WmiObject Win32_OperatingSystem -ComputerName ).OSArchitecture
(Get-WmiObject Win32_OperatingSystem -ComputerName ).Description
gwmi -ComputerName HOSTNAME Win32_OperatingSystem | Select-Object PSComputerName,CSName,Caption,CSDVersion,Version,ServicePackMajorVersion,ServicePackMinorVersion,OSType,LastBootUpTime,ProductType,Organization,OSArchitecture,EncryptionLevel,BuildNumber,BuildType,Description,InstallDate,RegisteredUser,SerialNumber
(gwmi -ComputerName HOSTNAME Win32_OperatingSystem).caption
gwmi win32_operatingsystem -ComputerName HOSTNAME | select PSComputerName,BuildNumber,Caption,Description,EncryptionLevel,InstallDate,LastBootUpTime,LocalDateTime,OperatingSystemSKU,Organization,OSArchitecture,Version | Export-Csv -Path c:\test\WMI_OS_Property.csv
Get-WmiObject win32_operatingsystem | select csname, @{LABEL='LastBootUpTime';EXPRESSION={$_.ConverttoDateTime($_.lastbootuptime)}}
Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
Get-ItemProperty -path "hkcu:\Software\Microsoft\Office\15.0\Outlook\Security"
Get-ItemProperty -path "hkcu:\Software\Microsoft\Office\16.0\Outlook\Security"
(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").ReleaseId
Reg Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ReleaseId
(gwmi -ComputerName HOSTNAME Win32_OperatingSystem).caption
Get-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName
Get-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName,HardwareID
Get-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName,MFG,Service
ICM -ComputerName HOSTNAME -ScriptBlock {Get-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName}
ICM -ComputerName HOSTNAME -ScriptBlock {Get-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName,Service}
(invoke-command -ComputerName mymachine -ScriptBlock {Get-ItemProperty HKLM:\SOFTWARE\VanDyke\VShell\License -Name Version }).version
Get-WmiObject -class Win32_OperatingSystem | Select-Object __SERVER,@{label='Install Date';expression={$_.ConvertToDateTime($_.InstallDate)}}
Get-WmiObject -class Win32_OperatingSystem | Select-Object __SERVER,@{label='Last Restart';expression={$_.ConvertToDateTime($_.LastBootUpTime)}}
Get-WmiObject -class Win32_OperatingSystem | Select-Object __SERVER,@{label='Local Date Time';expression={$_.ConvertToDateTime($_.LocalDateTime)}}
gwmi win32_computersystem -ComputerName HOSTNAME | select PSComputerName,Name,Caption,ChassisSkuNumber,DaylightInEffect,DNSHostName,Domain,DomainRole,HypervisorPresent,Manufacturer,Model,NetworkServerModeEnabled,NumberOfLogicalProcessors,NumberOfProcessors,PartOfDomain,PrimaryOwnerContact,PrimaryOwnerName,SystemFamily,SystemSKUNumber,SystemType,TotalPhysicalMemory,Username
gwmi win32_volume | select PSComputerName,AutoMount,BlockSize,Capacity,Caption,Compressed,DirtyBitSet,FileSystem,FreeSpace,IndexingEnabled,Label,PageFilePresent,QuotasEnabled,SerialNumber,SystemVolume,DriveLetter,DriveType,Name
gwmi win32_volume | select PSComputer,Name,DriveLetter,DriveType,AutoMount,Caption,Index,FreeSpace,PageFilePresent,IndexingEnabled,DirtyBitSet,FileSystem,Compressed,Capacity,BlockSize,BootVolume
gwmi win32_volume -ComputerName HOSTNAME | select DriveLetter,Compressed,FileSystem,SerialNumber,SystemVolume, @{Name="Capacity"; Expression={[math]::Round($_.Capacity/1GB)}},@{Name="FreeSpace"; Expression={[math]::Round($_.FreeSpace/1GB)}} | sort -Property DriveLetter | FT
Get-CimInstance Win32_DiskDrive | Select-Object Model,SerialNumber
< ----------------------- Win 8 + ------------------------ >
Get-PhysicalDisk | Select-Object FriendlyName,SerialNumber
< ----------------------- Win 8 + ------------------------ >
(Get-WmiObject Win32_LogicalDisk -ComputerName HOSTNAME -Filter "DeviceID='C:'" | Select-Object Size,FreeSpace).size/1GB
(Get-WmiObject Win32_LogicalDisk -ComputerName HOSTNAME -Filter "DeviceID='C:'" | Select-Object Size,FreeSpace).freespace/1GB
Get-WMIObject Win32_Logicaldisk -filter "deviceid='C:'" -ComputerName HOSTNAME | Select PSComputername,DeviceID,@{Name="SizeGB";Expression={$_.Size/1GB -as [int]}},@{Name="FreeGB";Expression={[math]::Round($_.Freespace/1GB,2)}}
$OS = Get-WMiobject -Class Win32_operatingsystem -ComputerName chi-core01
$OS.SystemDrive
Get-WMIObject Win32_Logicaldisk -filter "deviceid='$($os.systemdrive)'" -ComputerName HOSTNAME | Select PSComputername,DeviceID,@{Name="SizeGB";Expression={$_.Size/1GB -as [int]}},@{Name="FreeGB";Expression={[math]::Round($_.Freespace/1GB,2)}}
Get-WMIObject Win32_Logicaldisk -filter "deviceid='$((Get-WMiobject -Class Win32_operatingsystem).systemdrive)'" -ComputerName HOSTNAME | Select PSComputername,DeviceID,@{Name="SizeGB";Expression={$_.Size/1GB -as [int]}},@{Name="FreeGB";Expression={[math]::Round($_.Freespace/1GB,2)}}
< --------------------------------------------------------- Last Boot Up Time --------------------------------------------------------- >
GWMI -class Win32_Share -computer HOSTNAME
(net view \\enetsqnap01) | % { if($_.IndexOf(' Disk ') -gt 0){ $_.Split(' ')[0] } }
Get-WmiObject -class Win32_OperatingSystem | Select-Object __SERVER,@{label='LastRestart';expression={$_.ConvertToDateTime($_.LastBootUpTime)}}
Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime
Get-WmiObject win32_operatingsystem | select csname, @{LABEL='LastBootUpTime';EXPRESSION={$_.ConverttoDateTime($_.lastbootuptime)}}
systeminfo /FO CSV | ConvertFrom-CSV
net statistics workstation
< --------------------------------------------------------- Last Boot Up Time --------------------------------------------------------- >
< --------------------------------------------------------- IMPORT PCS FROM AD INTO COMMAND --------------------------------------------------------- >
Get-WmiObject -class Win32_BIOS -comp (
Get-ADComputer -filter * -SearchBase "OU=ORG_UNIT2, OU=ORG_UNIT1, DC=DOMAIN, DC=local" | Select-Object -expand name
) | SELECT SERIALNUMBER,PSComputername
Get-WmiObject -class Win32_computersystem -comp (
Get-ADComputer -filter * -SearchBase "OU=ORG_UNIT2, OU=ORG_UNIT1, DC=DOMAIN, DC=local" | Select-Object -expand name
) | SELECT PSComputerName,Username,Manufacturer,Model,Domain,SystemType
Get-WmiObject -class Win32_networkadapterconfiguration -comp (
Get-ADComputer -filter * -SearchBase "OU=ORG_UNIT2, OU=ORG_UNIT1, DC=DOMAIN, DC=local" | Select-Object -expand name
) | SELECT PSComputerName,ipaddress,macaddress,description
Invoke-command -comp (
Get-ADComputer -filter * -SearchBase "OU=ORG_UNIT2, OU=ORG_UNIT1, DC=DOMAIN, DC=local" | Select-Object -expand name
) {Get-PSDrive C} | Select-Object PSComputerName,Used,Free | ForEach-Object {$_.used / 1GB}
< --------------------------------------------------------- IMPORT PCS FROM AD INTO COMMAND --------------------------------------------------------- >
Get-HotFix | where InstalledOn -ge ([datetime]”11/1/2013″)
get-hotfix -id KB974332
get-hotfix -id KB974332 -computername HOSTNAME
if (!(get-hotfix -id KB974332 -computername HOSTNAME)) \{ add-content $_ -path Missing-KB974332.txt \}
get-content computers.txt | foreach \{ if (!(get-hotfix -id KB974332 -computername $_)) \{ add-content $_ -path Missing-KB974332.txt \}\}
Get-HotFix : This command cannot find hot-fix on the machine 'savdaldc11'. Verify the input and Run your command again. At line:1 char:55 + get-content computers.txt | foreach \{ if (!(get-hotfix <<<< -id KB974332 -computername $_)) \{ add-content $_ -path Missing-KB974332.txt \}\}
get-hotfix | Where-Object {$_.installedon -gt (get-date).addmonths(-6)} | Sort-Object -property installedOn -Descending
Get-Hotfix | where {$_.HotFixId -like "KB000000"}
Get-CimInstance Win32_StartupCommand | Select-Object Name, command, Location, User | Format-List
($result.IPV6Address).IPAddressToString
< ---------- Clean Shutdown ------------------------------------------------------------------------------------------------------------------------------ >
Get-Process | Where-Object MainWindowTitle | Out-GridView -Title 'Select Program To Kill' -PassThru | ForEach-Object { $_.CloseMainWindow() }
Get-Process | Where-Object MainWindowTitle | Out-GridView -Title 'Select Program To Kill' -PassThru | Stop-Process
< ---------- Foreced Shutdown ---------------------------------------------------------------------------------------------------------------------------- >
Get-Process | Where-Object { $_.MainWindowTitle } | Select-Object -Property Name, Company, Description, CPU | Out-Excel
Get-Process | Where-Object { $_.MainWindowTitle } | Select-Object -Property Name, Company, Description, CPU
Get-Process | Where-Object { $_.MainWindowTitle } | Select-Object -Property Name,Company,Description,CPU,ID,FileVersion,ProductVersion,StartTime,Path
Get-Process -ComputerName HOSTNAME | Select-Object name,fileversion,productversion,company
Get-Process -id (get-process ProtectionUtilSurrogate*).id -FileVersionInfo
(Get-Process -id (get-process PfuSsMon*).id -module).count
(get-process explorer).id
Get-Process -Name prt* | select Name,ID,PriorityClass,FileVersion,HandleCount,TotalProcessorTime,Handles,Company,CPU,ProductVersion,Description,Product,ExitCode,HasExited,ExitTime,Handle,PriorityBoostEnabled,ProcessName,ProcessorAffinity,Responding,SessionID,StartTime,EnableRaisingEvents,Site,Container
get-process | select -Property Name,ID,handlecount,PagedMemorySize,Handles,Path,Company,CPU,ProductVersion,Description,Product | Out-GridView
Get-FileHash "C:\Users\Username\Downloads\ImgBurn\SetupImgBurn_2.5.8.0.exe" -Algorithm md5
-Algorithm <String> {SHA1 | SHA256 | SHA384 | SHA512 | MACTripleDES | MD5 | RIPEMD160}
dir "DIRECOTRY PATH" -Recurse | Where-Object {!$_.psiscontainer } | get-filehash | ? {$_.hashstring -match ‘f64a28eaa82a657e16044ca85b5f0571’}
dir "DIRECTORY PATH" -Recurse | Where-Object {!$_.psiscontainer } | get-filehash | ? {$_.hashstring -match ‘6798240DCFECA09BCD6AE21AC7F5E573’}
if ( $($(CertUtil -hashfile C:\TEMP\MyDataFile.img MD5)[1] -replace " ","") -eq "your_hash" ) { echo "ok" }
ipconfig | Where-Object { $_ -like "*Address*"}
ipconfig | Where-Object { $_ -like "*IPv4 Address*"}
dir -Recurse | Where-Object { $_ -like "*Google*"}
gwmi -Class win32_process -computername HOSTNAME | select name, kernelmodetime, usermodetime
Get-WmiObject Win32_Process | select Name, @{Name="CPU_Time";Expression={$_.kernelmodetime + $_.usermodetime}} | sort CPU_Time -Descending
ps -ComputerName HOSTNAME | sort cpu -Descending
Invoke-Command -ScriptBlock {get-process} -ComputerName HOSTNAME
get-WmiObject -list | where {$_.name -match “Printer”}
GWMI WIN32_PRINTER | SELECT CAPTION,COMMENT,DEFAULT,DEFAULTPRIORITY,DESCRIPTION,DRIVERNAME,INSTALLDATE,NAME,PORTNAME,PRINTERSTATE,PRINTERSTATUS,SHARENAME,SPOOLENABLED,STATUS,SYSTEMNAME | ConvertTo-Csv -UseCulture > $env:computername"_PRINTERS.CSV"
GWMI WIN32_PRINTER | SELECT CAPTION,COMMENT,DEFAULT,DEFAULTPRIORITY,DESCRIPTION,DRIVERNAME,INSTALLDATE,NAME,PORTNAME,PRINTERSTATE,PRINTERSTATUS,SHARENAME,SPOOLENABLED,STATUS,SYSTEMNAME | ConvertTo-Csv -UseCulture > $env:computername"_$(get-date -f MM-dd-yyyy-HH-mm)".csv
Get-WMiObject Win32_USBControllerDevice -computername HOSTNAME | fl Antecedent,Dependent
gwmi Win32_USBControllerDevice |%{[wmi]($_.Dependent)} | Sort Description,DeviceID | ft Description,DeviceID -auto
Get-WMIObject -class Win32_ComputerSystem | select username
Get-WmiObject -Class __Namespace -Namespace root ` -Filter "name='WMI'"
(Get-WSManInstance -Enumerate wmicimv2/* -filter "select * from win32_computersystemproduct").uuid
Get-WmiObject Win32_NetworkAdapter -Filter "netenabled = true" | Select Guid
Get-WmiObject Win32_NetworkAdapter -Filter "netenabled = true" | Select Guid,macaddress,description
wmic csproduct get uuid
get-history | Format-Table -Property * -AutoSize | Out-String -Width 4096 | clip
get-history | Format-Table -Property CommandLine -AutoSize | Out-String -Width 4096 | clip
Test-Connection IPADDRESS | Format-list -Property PSComputerName,IPV4Address,ResponseTimeToLive,ReplySize
Test-Connection IPADDRESS | Out-GridView -Title 'PING Reply Table'
Test-Connection IPADDRESS | Out-GridView -PassThru | Export-Csv -Path .\IPScan.csv
Invoke-Command -ComputerName S1, S2 -ScriptBlock {Get-Process PowerShell} -HideComputerName
Invoke-Command -ComputerName HOSTNAME -ScriptBlock {Get-Process vm*}
Invoke-Command -ComputerName HOSTNAME -ScriptBlock {Get-Process win*}
Get-CimClass Win32*Disk*
Get-CimInstance -ClassName Win32_DiskDrive | Select Status,InterfaceType,Size,Caption,Description,Name,SystemName,FirmwareRevision,Manufacturer,Model,SerialNumber,Signature
Get-CimInstance -ClassName Win32_DiskDrive -Property Status, InterfaceType, Size, Caption, Description, Name, SystemName, FirmwareRevision, Manufacturer, Model, SerialNumber, Signature
Get-ChildItem -Path C:\TECH -Recurse -Directory -Force -ErrorAction SilentlyContinue | Select-Object FullName
Get-Childitem -Path C:\Users -Include *HSG* -Exclude *.JPG,*.MP3,*.TMP -File -Recurse -ErrorAction SilentlyContinue
[ Look for String in files ]
ls -r c:\ -file | % {select-string -path $_ -pattern mypassword}
[ Look for file name ]
ls -r -file -filter *secret*
< ------ [ GWMI is alias for Get-WMIObject ] ------ >
(Get-WmiObject win32_bios).serialnumber
Gwmi Win32_SystemEnclosure | Select Serialnumber
Get-WMIObject Win32_SystemEnclosure | Select Serialnumber
Gwmi Win32_BIOS | Select Serialnumber
Get-WMIObject Win32_BIOS | Select Serialnumber
((Get-CimInstance win32_processor).Name | select -First 1)
(Get-CimInstance win32_processor).Name
(Get-CimInstance win32_processor)
(Get-CimInstance win32_processor).Caption
(Get-CimInstance win32_processor).DeviceID
(Get-CimInstance win32_processor).MaxClockSpeed
(Get-CimInstance win32_processor).SocketDesignation
(Get-ADComputer -Filter {OperatingSystem -Like "*Server*"} -Properties OperatingSystem)
(Get-WmiObject Win32_OperatingSystem).Version
(Get-WmiObject Win32_OperatingSystem)
(Get-WmiObject Win32_OperatingSystem) | select *
(Get-WmiObject Win32_OperatingSystem).Caption
(Get-WmiObject Win32_OperatingSystem).RegisteredUser
(Get-WmiObject Win32_OperatingSystem).RegisteredUser.OSArchitecture
(Get-WmiObject Win32_OperatingSystem).OSArchitecture
(Get-WmiObject Win32_OperatingSystem).Description
< ------ [ GWMI is alias for Get-WMIObject ] ------ >
Get-CimInstance -ClassName win32_bios | Select SMBIOSBIOSVersion, Manufacturer, Name, SerialNumber, Version
Get-CimInstance -ClassName CIM_ComputerSystem | select Name,Caption,PrimaryOwnerName,DayLightInEffectd,DNSHostName,Domain,DomainRole,EnableDayLightSavingsTime,HypervisorPresent,Manufacturer,Model,NumberOfLogicalProcessors,NumberOfProcessors,PartOfDomain,SystemSKUNumber,SystemType,TotalPhysicalMemeory,UserName,WorkGroup
Get-CimInstance -ClassName CIM_DiskDrive | select *
Get-CimInstance -ClassName CIM_Chip | select *
Get-CimInstance -ClassName CIM_PhysicalMemory
Get-CimInstance -ClassName CIM_Printer | select Name,Status,Caption,Description,DeviceID,SystemName,Comment,Default,Direct,DriverName,Local,Network,PortName,ServerName,ShareName
Get-CimInstance -ClassName CIM_Process
Get-CimInstance -ClassName CIM_Processor
Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -Property BuildNumber,BuildType,OSType,ServicePackMajorVersion,ServicePackMinorVersion
Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -Property NumberOfLicensedUsers,NumberOfUsers,RegisteredUser
Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DriveType=3"
Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DriveType=3" | Measure-Object -Property FreeSpace,Size -Sum | Select-Object -Property Property,Sum
Get-CimInstance -ClassName Win32_LogonSession
< ------------------------------------------------------------------ Invoke-RestMethod ------------------------------------------------------------------ >
$Data = Invoke-RestMethod -Uri 'https://gis.iowadot.gov/public/rest/services/Traffic_Safety/Crash_Data/MapServer/0?f=pjson'
$Data.fields|Select-Object -Property Name, alias, Domain
(Invoke-RestMethod -Uri 'https://gis.iowadot.gov/public/rest/services/Traffic_Safety/Crash_Data/MapServer/0?f=pjson').fields | Select Name,Alias,Domain
((Invoke-RestMethod -Uri 'https://gis.iowadot.gov/public/rest/services/Traffic_Safety/Crash_Data/MapServer/0?f=pjson').fields | Where-Object {$_.name -eq 'weather'}).Domain.CodedValues
Invoke-RestMethod -Uri 'https://gis.iowadot.gov/public/rest/services/Traffic_Safety/Crash_Data/MapServer/0?f=pjson' | select -Property Name,CurrentVersion,supportsStatistics,supportedQueryFormats,ownershipBasedAccessControlForFeatures,useStandardizedQueries
< ------------------------------------------------------------------ Invoke-RestMethod ------------------------------------------------------------------ >
gwmi -ComputerName HOSTNAME -ClassName CIM_Chip
Get-PnpDevice -PresentOnly
(whoami /all | select-string S-1-16-12288) -ne $null
Last Bootup Time - [System.Management.ManagementDateTimeConverter]::ToDateTime((Get-WmiObject Win32_OperatingSystem).LastBootUpTime)
Get-WmiObject win32_processor | Measure-Object -property LoadPercentage -Average | Select Average
Get-WmiObject -Computername HOSTNAME win32_processor | Measure-Object -property LoadPercentage -Average | Select Average
Get-WmiObject -Class win32_Volume | select Name,FileSystem,BlockSize,Capacity,Label,PSComputername | Format-Table
Get-WmiObject -Computername HOSTNAME -Class win32_Volume | select Name,FileSystem,BlockSize,Capacity,Label,PSComputername | Format-Table
Get-WMIObject Win32_OperatingSystem | select-object caption
Get-WMIObject Win32_OperatingSystem
Get-WMIObject Win32_OperatingSystem -Computername HOSTNAME | select-object caption
(Get-ADDomain).PDCEmulator
Get-ADUser -Identity Username -Properties memberof | Select-Object -ExpandProperty memberof
(Get-ADUser -Identity Username -Properties memberof).memberof
Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol
Write-Host (2,4,6,8,10,12) -Separator ", -> " -ForegroundColor Green -BackgroundColor RED
Write-Host (2,4,6,8,10,12) -Separator ", -> " -ForegroundColor DarkGreen -BackgroundColor white
CommandLine
-----------
Get-WinEvent -LogName Microsoft-Windows-TaskScheduler/Operational
Get-WinEvent -LogName security
Get-WinEvent -LogName Microsoft-Windows-Security-Audit-Configuration-Client/Operational
Get-WinEvent -LogName Microsoft-Windows-Winlogon/Operational
Get-WinEvent -LogName Microsoft-Windows-Winlogon
Get-WinEvent -LogName Microsoft*
Get-EventLog -list | Where-Object {$_.logdisplayname -eq "Security"}
Get-EventLog "Security" | Where-Object {$_.EventID -eq 4672}
Get-EventLog "Security" -ComputerName HOSTNAME | Where-Object {$_.EventID -eq 428 -or }
Get-Eventlog -logname Security -ComputerName HOSTNAME | Where EventID -EQ “4740” | Format-Table
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672; level=2} -MaxEvents 10
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672; UserID=Username} -MaxEvents 10
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672; UserID=CONTOSO\Username} -MaxEvents 10
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672; UserID=Administratro} -MaxEvents 10
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672; UserID=Administrator} -MaxEvents 10
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} -MaxEvents 10
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} -MaxEvents 10 | Group-Object eventid | Sort-Object Name
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Group-Object eventid | Sort-Object Name -MaxEvents 10
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Group-Object eventid | Sort-Object Name
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Group-Object id | Sort-Object Message
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Group-Object id | Sort-Object Message -MaxEvents 10
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Group-Object id -MaxEvents 10
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Group-Object Id -MaxEvents 10
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Format-Table -Property * -AutoSize | Out-String -Width 4096
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} -MaxEvents 10 | Format-Table -Property * -AutoSize | Out-String -Width 4096
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} -MaxEvents 10 | Format-Table -Property * -AutoSize | Out-String -Width 4096 | clip
Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} -MaxEvents 10 | Format-Table -Property * -AutoSize | clip
Get-EventLog -ComputerName SERVER -LogName Security ?{$_.EventID -eq 538 -or $_.Event -eq 540}
Get-EventLog -LogName Security ?{$_.EventID -eq 4907 -or $_.Event -eq 4672}
Get-EventLog -LogName Security ?{$_.EventID -eq 4907 -or $_.Event -eq 4672}
Get-EventLog -LogName Security ?{$_.EventID -eq 4907 -or $_.Event -eq 4672}
Get-EventLog -LogName Security | ?{$_.EventID -eq 4907 -or $_.Event -eq 4672}
Get-EventLog -ComputerName SERVER -LogName Security | ?{$_.EventID -eq 4907 -or $_.Event -eq 4672}
Get-EventLog -ComputerName SERVER -LogName Security | ?{$_.EventID -eq 538 -or $_.Event -eq 540}
Get-EventLog -ComputerName SERVER -LogName Security | ?{$_.EventID -eq 538 -or $_.Event -eq 540}
Get-EventLog -ComputerName SERVER -LogName Security | ?{$_.EventID -eq 538 -or $_.Event -eq 540} | Format-Table -Property * -AutoSize | Out-String -Width 4096
get-history | Format-Table -Property * -AutoSize | Out-String -Width 4096 | clip
Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*konea*' }
Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*outlook*' }
Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*outlook*' }
Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*outlook*' } | clip
Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*outlook*' } | Format-Table -AutoSize *
Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*outlook*' } | Format-Table -AutoSize
Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*outlook*' } | select message
Get-WinEvent -FilterHashtable @{logname='application'; id=4107; StartTime="1/17/11"}
Invoke-Command -Computername Computer01 -ScirptBlock {Get-Eventlog -Logname Security | Select-Object -First 10}
Invoke-Command -Computername Computer01 -ScirptBlock {Get-Process} | gm
Invoke-Command -Computername Computer01 -ScirptBlock {Get-Process} | where {_.name -eq "notepad"}
Measure-Command {Invoke-Command -Computername Computer01 -ScirptBlock {Get-Process} | where {_.name -eq "notepad"} }
Measure-Command {Invoke-Command -Computername Computer01 -ScirptBlock {Get-Process | where {_.name -eq "notepad"}} }
Invoke-Command -Computername Computer01 -ScirptBlock {Get-Process | where {_.name -eq "notepad"} | Stop-Process}
Event Log Archive - Get-WinEvent -FilterHashtable @{logname='security'; id=1105; StartTime="12/12/17"}
Event Log Pass Change - Get-WinEvent -FilterHashtable @{logname='security'; id=628; StartTime="12/12/17"}
Get-WinEvent -FilterHashtable @{logname='application';id=4107;StartTime="1/15/11";EndTime="1
Get-EventLog "Application" | Where-Object {$_.EventID -eq 1003 -or $_.EventID -eq 62 -or $_.EvendID -eq 902} | select EventID,TimeGenerated,EntryType,Source
Get-EventLog "System" | Where-Object {$_.EventID -eq 7 -or $_.EventID -eq 11 -or $_.EventID -eq 51 -or $_.EvendID -eq 52 -or $_.EventID -eq 13150} | select EventID,TimeGenerated,EntryType,Source,Message
Get-EventLog "System" | Where-Object {$_.EventID -eq 7 -or $_.EventID -eq 11 -or $_.EventID -eq 51 -or $_.EvendID -eq 52 -or $_.EventID -eq 13150} | select * | ConvertTo-Csv > C:\Test\EvntLog_HD_Failure.csv
Get-EventLog "System" | Where-Object {$_.EventID -eq 7 -or $_.EventID -eq 9 -or $_.EventID -eq 11 -or $_.EventID -eq 15 -or $_.EventID -eq 51 -or $_.EvendID -eq 52 -or $_.EventID -eq 13150} | select EventID,TimeGenerated,EntryType,Source,Message
Get-EventLog "System" | Where-Object {$_.EventID -eq 7 -or $_.EventID -eq 9 -or $_.EventID -eq 11 -or $_.EventID -eq 15 -or $_.EventID -eq 51 -or $_.EvendID -eq 52 -or $_.EventID -eq 13150} | select * | ConvertTo-Csv > C:\Test\EvntLog_HD_Failure.csv
Get-EventLog Security -ComputerName Computer -Source Microsoft-Windows-Security-Auditing | Where {$_.InstanceID -like "4624"} | Select $UserProperty | where {$_.Username -Like "username"} | Export-Csv D:\Logon.csv -NoTypeInformation
- Make sure Service "RemoteRegistry" running
Get-EventLog Security -ComputerName Computer -Source Microsoft-Windows-Security-Auditing | Where {$_.InstanceID -like "4624"} | Select $UserProperty | where {$_.Username -Like "*blalock"} | Export-Csv D:\Logon.csv -NoTypeInformation
Get-EventLog "System" | Where-Object {$_.EntryType -eq 'Error'} | select EventID,TimeGenerated,EntryType,Source
Get-EventLog "System" | Where-Object {$_.EntryType -ne "Information"} | select * | more
Get-EventLog "System" | Where-Object {$_.EntryType -eq "Error"} | select * | more
$date = (Get-Date).AddDays(-1)
Get-WinEvent -FilterHashTable @{ LogName = "System"; StartTime = $date; ID = "12" }
$formatEnumerationLimit = -1
$formatenumerationlimit
Get-WinEvent -FilterHashtable @{logname='application'; ProviderName='MSSQLSERVER'} | where-object { $_.Message -like '*error*' }
Get-WinEvent -path "C:\temp\*Security*.evtx" -max 10 -FilterHashtable @{Providername="Microsoft-Windows-Security-Auditing"; id=4740; StartTime='1/7/2013'; EndTime='1/8/2013'}
Get-WinEvent -FilterHashtable @{logname='application'; providername='.Net Runtime' }
Get-WinEvent -FilterHashtable @{logname='system'; providername='Disk' }
Get-WinEvent -FilterHashtable @{logname='system'; level='2'}
Get-EventLog Security -Source Microsoft-Windows-Security-Auditing -After ((Get-Date).Date.AddDays(-30)) | Where ($_.EventID -eq 4624)
Get-WinEvent -FilterHashTable @{LogName="System"; StartTime=(get-date).AddDays(-13); EndTime=(get-date).AddHours(-1): level='2'}
Write-Eventlog -Logname "Operations Manager" -Source 'HealthService' -EventID 100 -EntryType Warning -Message "String `"$string`" has not been found in URL `"$url`" authenticated with username `"$user`" and password `"$password`"."
Get-EventLog System | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap | More
##############################################################################################################################################################
##
## https://4sysops.com/archives/search-the-event-log-with-the-get-winevent-powershell-cmdlet/
##
###############################################################################################
Events with a specific information level
You must provide the information level with Level as the key and a Number as the value. Here is a list of levels associated with their respective numbers:
•LogAlways 0
•Critical 1
•Error 2
•Warning 3
•Informational 4
•Verbose 5
The following command displays all error events from the System log:
Get-WinEvent -FilterHashTable @{LogName='System';Level='2'}
Unfortunately, you can only specify one level at a time through a hash table.
However, we can circumvent this problem by using the Where-Object cmdlet instead of the Level key from the hash table.
##############################################################################################################################################################
< ************************************* https://social.technet.microsoft.com/Forums/ie/en-US/c8330f58-f2e5-4681-beb2-b2b6a185f818/how-to-geteventlog-for-offline-evtx-files?forum=winserverpowershell ************** >
If you want to export out only some column, then please run below command first to select out one object and get those column:
$EventLogonIDs="4624","4634"
Get-WinEvent -FilterHashtable @{Path="C:\temp\Security*.evtx";id= @($EventLogonIDs);StartTime="1/7/2013";EndTime="1/8/2013"} | select-object -first 2
OR we also could use get-member command to get all properties of the result, and then choose what you want to export:
$EventLogonIDs="4624","4634"
Get-WinEvent -FilterHashtable @{Path="C:\temp\Security*.evtx";id= @($EventLogonIDs);StartTime="1/7/2013";EndTime="1/8/2013"} | select-object -first 1 | get-member
< ************************************* https://social.technet.microsoft.com/Forums/ie/en-US/c8330f58-f2e5-4681-beb2-b2b6a185f818/how-to-geteventlog-for-offline-evtx-files?forum=winserverpowershell **************
< ---------------------------------- https://www.makeuseof.com/tag/15-advanced-tasks-powershell-can-handle-windows-10/
Set-Date -date "12/25/2016 7:30 AM"
Set-Date (Get-Date).AddDays(2)
Test-Path c:\Users\Brad\Documents\PowerShell.xls
Rename-Item c:\Users\Brad\Documents\PowerShellisDifficult.xls PowerShellisEasy.xls
Move-Item c:\Users\Brad\Documents\PowerShellisEasy.xls c:\Users\Brad\Important Documents
Move-Item c:\Users\Brad\Documents\*.xls c:\Users\Brad\Important Documents
Invoke-Item c:\Windows\System32\notepad.exe
Invoke-Item c:\MakeUseOf\Hello.txt
Invoke-Item c:\MakeUseOf\*.txt
Get-Content c:\MakeUseOf\Hello.txt
Get-Content c:\MakeUseOf\Hello.txt -totalcount 5
Add-Content c:\MakeUseOf\Hello.txt "written by Brad Jones"
Add-Content c:\MakeUseOf\Hello.txt "`nwritten by Brad Jones"
Get-Content c:\MakeUseOf\Hello.txt | Measure Object
Get-Service
Get-Service | Where-Object {$_.status -eq "stopped"}
Restart-Service dbupdate
Restart-Service -displayname "Dropbox Update Service"
Set-Service dbupdate -startuptype "manual"
Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}
powershell -NoExit -Command "Set-Location c:\\"
If your path contains spaces, you can wrap it in single-quotes, like so:
powershell -NoExit -Command "Set-Location 'c:\\program files'"
'powershell -NoExit -Command "Set-Location ' + path1 + '"'
'start C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -NoExit -Command '; s2 = '"Select-Location ' + "'" + path1 + "'" + '"', and command = s1 + s2
< ---------------------------------- https://www.makeuseof.com/tag/15-advanced-tasks-powershell-can-handle-windows-10/
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
## Show addins for Outlook
-------------------------------------------------------------
$searchScopes = "HKCU:\SOFTWARE\Microsoft\Office\Outlook\Addins","HKLM:\SOFTWARE\Wow6432Node\Microsoft\Office\Outlook\Addins"
$searchScopes | % {Get-ChildItem -Path $_ | % {Get-ItemProperty -Path $_.PSPath} | Select-Object @{n="Name";e={Split-Path $_.PSPath -leaf}},FriendlyName,Description} | Sort-Object -Unique -Property name
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
if(test-path "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe"){(ls "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe").VersionInfo | Format-List}
if(test-path "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe"){(ls "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe").VersionInfo | select ProductVersion}
$path= "\\remote\C$\windows\System32\WindowsPowerShell\v1.0\powershell.exe"
if(test-path $path){(ls $path).VersionInfo}
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
< ======================================================= Command Used Excel Formulas ======================================================= >
=IF(D1>1024*1024*1024,TRUNC(D1/1024/1024/1024,2)&" GB", IF(D1>1024*1024, ROUND(D1/1024/1024,0)&" MB", ROUND(D1/1024,0)&" KB"))
< ======================================================= Command Used Excel Formulas ======================================================= >
Powershell.exe -ExecutionPolicy Bypass -File "\\sccm\clienthealth$\ConfigMgrClientHealth.ps1" -Config "\\sccm\clienthealth$\config.xml"
< ---------------------------- [ Powershell Versioning ] ---------------------------- >
Get-Host | Select-Object Version
Invoke-Command -Computername HOSTNAME -Scriptblock {$PSVersionTable.psversion}
REG QUERY \\HOSTNAME\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine
REG QUERY \\HOSTNAME\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine /V "PowerShellVersion"
REG QUERY \\HOSTNAME\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine /V "PowerShellVersion"
REG QUERY \\HOSTNAME\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\
REG QUERY \\HOSTNAME\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\3
< ---------------------------- [ Powershell Versioning ] ---------------------------- >
< ---------------------------- [ Check if Server needs rebooting ] ---------------------------- >
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired"
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update"
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /s
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending"
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing"
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending"
< ---------------------------- [ Check if Server needs rebooting ] ---------------------------- >
< ---------------------------- [ Powershell 5.1 Quient Install/Uninstall ] ---------------------------- >
wusa.exe Win7AndW2K8R2-KB3191566x64.msu /quiet /norestart
wusa.exe /KB3191566 /uninstall /quiet /norestart
< ---------------------------- [ Powershell 5.1 Quient Install/Uninstall ] ---------------------------- >
function Get-SystemUptime
{
$operatingSystem = Get-WmiObject Win32_OperatingSystem
[Management.ManagementDateTimeConverter]::ToDateTime($operatingSystem.LastBootUpTime)
}
##########################################################################################################################################
##
## http://windowsitpro.com/blog/four-ways-get-computer-names-computername-parameter
##
##########################################################################################################################################
I'm teaching a class forSAPIEN Technologies in Chicago this week. Actually, everyone's doing a lab on WMI, watching me enter this. Don't you wish you were here? Anyway, we needed to look at various ways to feed computer names to any cmdlet that has a -computerName parameter. Here's what I cam up with:
# get names from a file, one name per line
Get-WmiObject -class Win32_Whatever -computer (Get-Content names.txt)
# get names from Active Directory
Import-Module ActiveDirectory
Get-WmiObject -class Win32_Something -comp (
Get-ADComputer -filter * | Select-Object -expand name
)
# specify one computer
Get-WmiObject -class Win32_This -computer SERVER-R2
# specify many computers
Get-WmiObject -class Win32_That -computer WESTDC4,EASTDC5
# get names from a CSV file that has a "host" column
Get-WmiObject -class Win32_Those -computer (
Import-CSV computerlist.csv | Select-Object -expand host
)
I used Get-WmiObject for all of the examples, but you can obviously use this with any cmdlet that supports -computerName. Enjoy!
##########################################################################################################################################
##############################################################################################################################################################################
##
## WINDOWS 7 AND ABOVE - NIC ADAPTER REPAIR EQUIVALENT
##
## http://windowsitpro.com/windows-xp/what-actions-occur-when-i-click-repair-network-connection-windows-xp-and-later
##
##############################################################################################################################################################################
If you right-click a network connection and select Status, Windows displays information about the connection's speed, duration of connection, and packet activity.
For XP and later, a Repair option appears on the Support tab. When you click Repair, Windows attempts to resolve a range of problems.
Specifically, the OS attempts to renew the DHCP lease, if the connection obtains its IP address through DHCP, using a broadcast message.
•Flushes the Address Resolution Protocol (ARP) cache using the command
arp -d *
•Flushes the NetBIOS cache using the command
nbtstat -R
•Flushes the DNS cache using the command
ipconfig /flushdns
•Reregisters the NetBIOS name and IP address with WINS using the command
nbtstat -RR
•Reregisters the computer name and IP address with DNS using the command
ipconfig /registerdns
arp -d *
nbtstat -R
ipconfig /flushdns
nbtstat -RR
ipconfig /registerdns
##############################################################################################################################################################################
nmap -sV -script=banner IP / HOSTNAME
nmap -p "Port Number" -oA "Base File Name" IP/RANGE - No quotes
##############################################################################################################################################################################
## SERVER ONLY COMMANDS FOR NOW
##############################################################################################################################################################################
Get-DhcpServerv4Lease -ScopeId "NETWORK_ID" | select IPAddress,ClientID,HostName
##############################################################################################################################################################################
icacls "C:\Program Files (x86)\FourJs" /grant "Users":(OI)(CI)F /inheritance:r
icacls DemoOCX.lnk /grant users:F (Topaz signature pad, give full access to local USERS group in %PUBLIC%\DESKTOP\DemoOCX.lnk link file)
invoke-command -ComputerName SERVER -ScriptBlock {Test-Connection -ComputerName 10.0.1.4,10.0.2.4,10.0.3.4,10.0.4.4,10.0.5.4,10.0.6.4,10.0.7.1,10.0.8.4,10.0.9.4,10.0.10.4,10.0.11.4,10.0.12.4,10.0.53.4,10.0.61.1 -Count 2 | format-table -autosize}
< ##################################################### - ESXi CLI -- Command - ######################################################################################### >
ESXi History Log - https://ESXiHostnameOrIP/host/shell.log
https://kb.vmware.com/s/article/2004810
[root]: esxcli network ip connection list
[root]: vim-cmd vmsvc/getallvms
[root]: vim-cmd vmsvc/power.on vcsa
[root]: vim-cmd vmsvc/getallvms
[root]: vim-cmd vmsvc/power.on 47
[root]: vim-cmd vmsvc/getallvms |grep hall
[root]: vim-cmd vmsvc/getallvms |grep HALL
[root]: vim-cmd vmsvc/getallvms |grep vcsa
[root]: vim-cmd vmsvc/power.on 47
[root]: esxcli vm process list
[root]: history
< ##################################################### - ESXi CLI -- Command - ######################################################################################### >
< ##################################################### - PowerShell Sessions - ######################################################################################### >
< ##################################################### >
< #### ####
< #### https://youtu.be/PMRkM9jlMMw ####
< #### ####
< ##################################################### >
$sess = New-PSSession -ComputerName Computer01
Get-PSSession
Process - wsmprovhost.exe - Check username it is running under
Invoke-Command -Session $sess {var=10} (remains due to estabilshed session)
$sess | Remove-PSSession
For domain controllers must be in "Built In" "Administrators"
$sess | Remove-PSSession
$dcs = "DC01", "DC02"
$dcs (should show list of previously added DCs)
Invoke-Command -ComputerName $dcs -ScriptBlock {$env:computername}
$sess = NewPSSession -ComputerName $dcs
Invoke-Command -Session $sess -ScriptBlock {$env:computername}
Enter-PSSession -Session $sess [0]
gps
Get-Service
exit
Remove-PSSession | remove
$sess | Remove
[Implicit Remoting is importing modules from remote session]
$adsess = NewPSSession -ComputerName DC01
Import-Module -Name ActiveDirectory -PSSession $adsess
Get-Module
Get-Command -Module ActiveDirectory
$c = Get-Command Get-ADUser
$c.definition
Get-ADUser -filter * | gm
(Deserialized)
$comm = "Get-Command"
& $comm
Remove-Module ActiveDirectory
Import-Module -Name ActiveDirectory -PSSession $adsess -Prefix OnDC
Get-Module
$sess = New-PSSession -Name DC1Sess -ComputerName DC01
Get-PSSession
Invoke-Command -Session $sess {$var=50}
Disconnect-PSSession -ID 2
Connect-PSSession -ID2
Invoke-Command -Session $sess {$var}
Try telnet "node" 5985
Import-Module PSDiagnostics
Get-Command -Module PSDiagnostics
Enable-PSWSManCombinedTrace
Invoke-Command -ComputerName Computer01 -ScriptBlock {Get-Process}
Disable-PSWSMANCombinedTrace
cd .\\LocalMachine\my
ls
< ##################################################### - PowerShell Sessions - ######################################################################################### >
< ##################################################### - Wireshark Filtering - ######################################################################################### >
http.request.uri matches "^....$"
< ##################################################### - Wireshark Filtering - ######################################################################################### >
< ##################################################### - Powershell JSON to XML Conversion - ##################################################### >
Get-Content -Path "PATH\FILE-NAME.json" | ConvertFrom-Json | ConvertTo-Xml -As Document -Depth 3 | Out-File -FilePath "PATH\FILE-NAME.xml"
< ##################################################### - Powershell JSON to XML Conversion - ##################################################### >
Comments
0 B
|👍
/👎