< ---------------------------- Microsoft Remote Assistance ------------------------------------ > If you have computer-savvy friends, use Windows Remote Assistance to let a friend access your computer over the Internet and help you fix a problem. You can watch what they're doing and interact with them while they're helping you. msra.exe < ---------------------------- Microsoft Remote Assistance ------------------------------------ > < ---------------------------- Microsoft Office 2013 Autocomplete ------------------------------------ > %localappdata%\Microsoft\Outlook\RoamCache\Stream_Autocomplete* < ---------------------------- Microsoft Office 2013 Autocomplete ------------------------------------ > winrm invoke Create wmicimv2/Win32_Process @{CommandLine="notepad.exe";CurrentDirectory="C:\"} powershell [-noexit] -executionpolicy bypass -File %winternals%\psexec \\HOSTNAME -s powershell Enable-PSRemoting -Force psexec64 \\HOSTNAME -s powershell Enable-PSRemoting -Force wmic systemenclosure get ChassisTypes,LockPresent,Manufacturer,Name,SecurityStatus,SerialNumber,SMBIOSAssetTag,Tag /format:list wmic printer get Caption,Comment,Default,Description,Location,Name,PortName,ServerName,SystemName /format:csv > printers.csv WMIC PRINTER GET CAPTION,COMMENT,DEFAULT,DEFAULTPRIORITY,DESCRIPTION,DRIVERNAME,INSTALLDATE,NAME,PORTNAME,PRINTERSTATE,PRINTERSTATUS,SHARENAME,SPOOLENABLED,STATUS,SYSTEMNAME /FORMAT:LIST "c:\PSTools\PsExec.exe" -accepteula \\KACE_HOST_NAME cmd /c IF EXIST "C:\program files (x86)" ("C:\program files (x86)\dell\kace\runkbot.exe" 4 0) ELSE ("C:\program files\dell\kace\runkbot.exe" 4 0) netsh int ip set address name = "LAN" source = dhcp netsh advfirewall show privateprofile settings netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain NETSH -R HOSTNAME ADVFIREWALL FIREWALL ADD RULE NAME="VHN 11.4 - 25017" DIR=IN ACTION=ALLOW PROGRAM="C:\program files\FourJs\gdc25017\bin\gdc.exe" ENABLE=YES NETSH -R HOSTNAME ADVFIREWALL FIREWALL ADD RULE NAME="VHN 11.4 - 25017" DIR=IN ACTION=ALLOW PROGRAM="C:\program files\FourJs\gdc25017\bin\gdc.exe" ENABLE=YES PROFILE=DOMAIN netsh advfirewall firewall show rule dir=in name=all netsh advfirewall firewall show rule status=enabled name=all < ---------------------------------------------------------------- Powershell Firewall Command ---------------------------------------------------------------- > (New-object -comObject HNetCfg.FwPolicy2).rules | where {$_.Name -like '*remote*'} | select Name < ---------------------------------------------------------------- Powershell Firewall Command ---------------------------------------------------------------- > <# ---------------------------------------------------------------- [Built In Packet Capture on Win Srv 2008 and above] ---------------------------------------------------------------- #> Netsh trace start scenario=NetConnection capture=yes report=yes persistent=no maxsize=1024 correlation=yes traceFile=C:\Logs\NetTrace.etl Netsh trace start scenario=NetConnection capture=yes report=yes persistent=no maxsize=4096 filemode=single correlation=yes traceFile=E:\trace\NetTrace_10-12-2018_1.etl netsh trace stop <# ---------------------------------------------------------------- [Built In Packet Capture on Win Srv 2008 and above] ---------------------------------------------------------------- #> [ Netsh ICMP enable IPV4 & 6 ] netsh -r HOSTNAME advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow netsh -r HOSTNAME advfirewall firewall add rule name="ICMP Allow incoming V6 echo request" protocol=icmpv6:8,any dir=in action=allow [ Netsh ICMP enable IPV4 & 6 ] Command Substitute for Get-NetFirewallRule in Windows 7: $(New-object -comObject HNetCfg.FwPolicy2).rules | Format-Table -Property name, protocol, localports NETSH INTERFACE IP DELETE ARPCACHE ARP -D * IPCONFIG /FLUSHDNS NBTSTAT -R NBTSTAT -RR defrag c: & sleep 300 & defrag c: /X & sleep 300 & shutdown /s /f /c "After Defrag" %winternals%\psexec \\"HostName_IP" -u "DOMAIN\administrator" -p "Administrator_Password" -s -i wusa "c:\tech\Windows6.1-KB2819745-x64-MultiPkg.msu" /quiet /norestart dnscmd 10.10.x.x /RecordAdd ZONE.local HOSTNAME /Aging /OpenAcl A 10.0.x.x wmic datafile where name='C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe' get /format:list ## File HASH - certutil -hashfile FILENAME.EXT MD5 {MD2 MD4 MD5 SHA1 SHA256 SHA384 SHA512] MSG USERNAME/* /SERVER:HOSTNAME "HELLO" ## icacls c:\ /reset /t /c Timout /T 300 /nobreak < ------------------------------------------ > gpresult /Scope User /v gpresult /Scope computer /v < ------------------------------------------ > wmic diskdrive get PNPDeviceID wmic path CIM_LogicalDevice where "Description like 'USB%'" get /value PowerShell EQ gwmi Win32_USBControllerDevice |fl Antecedent,Dependent gwmi Win32_USBControllerDevice |%{[wmi]($_.Dependent)} | Sort Description,DeviceID | ft Description,DeviceID -auto < ------------------ Windows 10 - Remote Registry Disabled by default ------------------ > sc \\HOSTNAME config remoteregistry start= demand sc \\HOSTNAME start remoteregistry reg query "\\HOSTNAME\HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" sc \\HOSTNAME stop remoteregistry sc \\HOSTNAME config remoteregistry start= disabled < ------------------ Windows 10 - Remote Registry Disabled by default ------------------ > ---=== Change Computer Description Remotely ===--- sc \\HOSTNAME query remoteregistry sc \\HOSTNAME start remoteregistry reg query "\\HOSTNAME\HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" reg add "\\HOSTNAME\HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v srvcomment /t REG_SZ /d "Computer Description Text" /f sc \\HOSTNAME stop remoteregistry < -------------------------------------------------------------------------- [Change Description of Remote Machine] -------------------------------------------------------------------------- > Invoke-Command -ComputerName HOSTNAME -ScriptBlock {$OSWMI=Get-WmiObject -class Win32_OperatingSystem;$OSWMI.Description=$args[0];$OSWMI.put() } -ArgumentList("DESCRIPTION") Set-WmiInstance -Path "\\HOSTNAME\root\cimv2:Win32_OperatingSystem=@" -Arguments @{description="Description Here"} < -------------------------------------------------------------------------- [Change Description of Remote Machine] -------------------------------------------------------------------------- > < -------------------------------------------------------------------------- [Original Script] -------------------------------------------------------------------------- > ######################################################################################## ## ## https://www.alexandreviot.net/2015/05/03/powershell-change-computer-description/ ## ######################################################################################## $myDescription="My Server" Invoke-Command -ComputerName $lServerName -ScriptBlock {$OSWMI=Get-WmiObject -class Win32_OperatingSystem;$OSWMI.Description=$args[0];$OSWMI.put() } -ArgumentList($myDescription) < -------------------------------------------------------------------------- [Original Script] -------------------------------------------------------------------------- > ---=== Change Computer Description Remotely ===--- reg query \\HOSTNAME\HKLM\software\wow6432node\Microsoft\Windows\currentversion\Uninstall /f "gdc*" /s reg query \\HOSTNAME\HKLM\software\Microsoft\Windows\currentversion\Uninstall /f "gdc*" /s < ----------------------------------- [ Computer Description ] ------------------------------------------------------------------------------------ > reg query \\[HOSTNAME/IP]\HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\lanmanserver\parameters /f srvcomment wmic /node:[HOSTNAME/IP] os set Description="Descriptive Text Here" REG ADD "\\[HOSTNAME/IP]\HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters /v srvcomment /t REG_SZ /d "your description here" /f < ----------------------------------- [ Computer Description ] ------------------------------------------------------------------------------------ > ########################### UltraVNC Install & Start Service ######################################################################### sc \\REMOTE_HOST query uvnc_service sc \\REMOTE_HOST start uvnc_service sc \\REMOTE_HOST query state= all | find /I "vnc" sc \\REMOTE_HOST start remoteregistry %winternals%\psexec \\REMOTE_HOST "c:\Program Files\UltraVNC\winvnc.exe" -install %winternals%\psexec \\REMOTE_HOST "c:\Program Files\UltraVNC\winvnc.exe" -startservice Invoke-Command -ComputerName REMOTE_HOST -ScriptBlock {& cmd /c "c:\Program files\ultravnc\winvnc.exe" -install} Invoke-Command -ComputerName REMOTE_HOST -ScriptBlock {& cmd /c "c:\Program files\ultravnc\winvnc.exe" -startservice} sc \\REMOTE_HOST query uvnc_service ########################### UltraVNC Install & Start Service ######################################################################### "Set-NetFirewallRule -DisplayName “File and Printer Sharing (Echo Request – ICMPv4-In)” -enabled True" < ---------------------------------------------- External/Public IP Address ---------------------------------------------- > Invoke-RestMethod http://ipinfo.io/json | Select -exp ip (Invoke-RestMethod http://ipinfo.io/json).ip (Invoke-RestMethod http://ipinfo.io/json).hostname (Invoke-RestMethod http://ipinfo.io/json).city (Invoke-RestMethod http://ipinfo.io/json).region (Invoke-RestMethod http://ipinfo.io/json).country (Invoke-RestMethod http://ipinfo.io/json).loc (Invoke-RestMethod http://ipinfo.io/json).org (Invoke-WebRequest http://ipinfo.io/ip).Content.Trim() Invoke-RestMethod ipecho.net/plain Invoke-WebRequest http://ifconfig.me/ip invoke-restmethod https://api.ipify.org?format=json | select -exp ip (Invoke-WebRequest IPv4.Icanhazip.com).Content (Invoke-WebRequest "http://checkip.dyndns.com").ParsedHTML.body.innerHtml icm -ComputerName HOSTNAME -ScriptBlock {Invoke-RestMethod http://ipinfo.io/json | Select -exp ip} Invoke-Command -ComputerName HOSTNAME -ScriptBlock {Invoke-RestMethod http://ipinfo.io/json | Select -exp ip} (new-object System.Net.WebClient).DownloadString("http://myexternalip.com/raw") (Invoke-WebRequest -URI http://myexternalip.com/raw).content (Invoke-WebRequest -URI http://myip.dnsomatic.com/).content curl ifcfg.me nslookup . ifcfg.me telnet ifcfg.me ftp ifcfg.me finger @ifcfg.me Invoke-WebRequest -Uri https://www.hackthebox.eu/api/invite/generate -Method POST %winternals%\psexec \\HOSTNAME nslookup myip.opendns.com. resolver1.opendns.com dig +short myip.opendns.com @resolver1.opendns.com < ---------------------------------------------- External/Public IP Address ---------------------------------------------- > Get-WmiObject -Class "Win32_NetworkAdapterConfiguration" -ComputerName 127.0.0.1 -Filter "IpEnabled = TRUE" | foreach { write-host $_.IpAddress[0]} (Get-WmiObject Win32_NetworkAdapterConfiguration | where { (($_.IPEnabled -ne $null) -and ($_.DefaultIPGateway -ne $null)) } | select IPAddress -First 1).IPAddress[0] Get-WmiObject Win32_NetworkAdapterConfiguration (Get-WmiObject Win32_NetworkAdapterConfiguration -EA).IpAddress[0] (Get-WmiObject Win32_NetworkAdapterConfiguration).IpAddress[0] (Get-WmiObject Win32_NetworkAdapterConfiguration).IpAddress[0] (Get-WmiObject Win32_NetworkAdapterConfiguration).IpAddress (Get-WmiObject Win32_NetworkAdapterConfiguration).IpAddress[1] (Get-WmiObject Win32_NetworkAdapterConfiguration).IpAddress[0] (Get-WmiObject Win32_NetworkAdapterConfiguration).IPSubnet (Get-WmiObject Win32_NetworkAdapterConfiguration).DefaultIPGateway (Get-WmiObject Win32_NetworkAdapterConfiguration).DNSServerSearchOrder (Get-WmiObject Win32_NetworkAdapterConfiguration).DHCPEnables (Get-WmiObject Win32_NetworkAdapterConfiguration).DHCPEnabled (Get-WmiObject Win32_NetworkAdapterConfiguration).DHCPEnabled[0] Get-WmiObject -Class Win32_Networkadapterconfiguration | ? {$_.IPEnabled -eq $true } Get-WmiObject -Class Win32_Networkadapterconfiguration | ? {$_.DHCPEnabled -eq $true } Get-WmiObject -Class Win32_Networkadapterconfiguration | ? {$_.IPEnabled -eq $true } ? {$_.DHCPEnabled -eq $true } Get-WmiObject -Class Win32_Networkadapterconfiguration | ? {$_.IPEnabled -eq $true } | ? {$_.DHCPEnabled -eq $true } Get-WmiObject -Class Win32_IP4RouteTable -ComputerName HOSTNAME | select destination,mask,nexthop, metric1 Get-WmiObject -namespace root\wmi –class MSStorageDriver_FailurePredictStatus -ErrorAction Silentlycontinue | Select InstanceName, PredictFailure, Reason | Format-Table –Autosize < ############################################################################## Powershell Basic Commands ############################################################################## > < ########################################################################################### > < ############################## ############################## > < ############################## Set IP Address, Gateway, DNS ############################## > < ############################## ############################## > < ########################################################################################### > New-NetIPAddress -InterfaceAlias Ethernet -IPAddress 172.16.0.20 -PrefixLength 24 -DefaultGateway 172.16.0.1 Set-DNSClientServerAddress -InterfaceAlias "Ethernet" -ServerAddress 172.16.0.10 Test-NetConnection 8.8.8.8 Test-NetConnection www.bing.com -traceroute Test-NetConnection smtp.com -Port 25 Test-NetConnection www.bing.com -Port 80 Restart-Service Get-service | Out-GridService Rename-Computer COMPUTERNAME01 Restart-Computer Shutdown-Computer Add-Computer -DomainName Domain.Name Install-WindowsFeature -IncludeAllSubFeatures -INcludeManagementTools File-Services Install-WindowsFeature Net-Framework-Core -source d:\sources\sxs Test-ComputerSecureChannel -Credential Domain\Admin -Repair Set-NetFirewallProfile -Profile domain,public,private -Enabled {False | True} < ############################################################################## Powershell Basic Commands ############################################################################## > < -------------------------------------------------------------------------- Simple List of Shared Folders -------------------------------------------------------------------------- > < ## < ## https://superuser.com/questions/769679/powershell-get-list-of-folders-shared < ## < ## ---------------------------------------------------------------------------- > (net view \\HOSTNAME) | % { if($_.IndexOf(' Disk ') -gt 0){ $_.Split(' ')[0] } } $Servers = ( Get-ADComputer -Filter { DNSHostName -Like '*' } | Select -Expand Name ) foreach ($Server in $Servers) { (net view $Server) | % { if($_.IndexOf(' Disk ') -gt 0){ $_.Split(' ')[0] } } | out-file C:\file_shares\$Server.txt } < -------------------------------------------------------------------------- Simple List of Shared Folders -------------------------------------------------------------------------- > ([WMI]'').ConvertToDateTime((Get-WmiObject Win32_OperatingSystem).InstallDate) ([WMI]'').ConvertToDateTime((Get-WmiObject Win32_OperatingSystem -ComputerName HOSTNAME).InstallDate) [timezone]::CurrentTimeZone.ToLocalTime(([datetime]'1/1/1970').AddSeconds($(get-itemproperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion').InstallDate)) < ----------------------------------------- [AD Computer LastLogon Conversion] ----------------------------------------- > w32tm /ntte 131625959999922000 [Excel] =IF(P15>0,P15/(8.64*10^11) - 109205,"") =((P15/10000000/3600/24)-109205)-0.166673 [Excel] < ----------------------------------------- [AD Computer LastLogon Conversion] ----------------------------------------- > gwmi win32_systemenclosure | select PSComputerName,ChassisTypes,LockPresent,Manufacturer,Name,SecurityStatus,SerialNumber,SMBIOSAssetTag,Tag GWMI WIN32_NETWORKADAPTERCONFIGURATION -COMPUTER HOSTNAME | SELECT Description,MACAddress,IPAddress gwmi win32_physicalmemoryarray | select PSComputerName,Caption,MaxCapacity,Tag gwmi win32_physicalmemory | select PSComputerName,Capacity,Caption,Description,DeviceLocator,FormFactor,Manufacturer,Name,OtherIdentifyingInfo,PartNumber,PositionInRow,SerialNumber,SKU,Speed,Tag,TotalWidth,TypeDetail gwmi win32_networkadapterconfiguration -ComputerName HOSTNAME | select PSComputername,Index,Description,DHCPEnabled,DNSDomain,DNSDomainSuffixSearchOrder,DNSHostName,DNSServerSearchOrder,FullDNSRegistrationEnabled,IPAddress,IPEnabled,Caption,DefaultIPGateway,IPSubnet,MACAddress,ServiceName | where {$_.Index -eq '1'} gwmi win32_networkadapterconfiguration -ComputerName HOSTNAME | select * | where {$_.Index -eq '1'} (Get-WMIObject -class Win32_PhysicalMemory -ComputerName SERVER | Measure-Object -Property capacity -Sum | % {[Math]::Round(($_.sum / 1GB),2)}) Get-ADComputer -filter {Name -like '*08'} | Foreach-Object {[math]::Round((Get-WmiObject -Class Win32_ComputerSystem).TotalPhysicalMemory/1GB)} | Format-Table -property * -AutoSize Get-ADComputer -filter {Name -like '*08'} | Foreach-Object {Get-WmiObject -Class Win32_ComputerSystem -ErrorAction SilentlyContinue -ComputerName $_.Name | Select-Object PSComputerName, @{Name="Memory"; Expression={[math]::Round($_.TotalPhysicalMemory/1GB)}}} Get-ADComputer -filter {Name -like '*08'} | Foreach-Object {Get-WmiObject -Class Win32_ComputerSystem -ErrorAction SilentlyContinue -ComputerName $_.Name | Select-Object PSComputerName,Manufacturer,Model, @{Name="Memory"; Expression={[math]::Round($_.TotalPhysicalMemory/1GB)}}} Get-ADComputer -filter {Name -like '*ComputerName*'} | Foreach-Object {Get-WmiObject -ErrorAction SilentlyContinue -Class Win32_ComputerSystem -ComputerName $_.Name} Get-ADComputer -filter {Name -like '*ComputerName*'} | Foreach-Object {Get-WmiObject -ErrorAction SilentlyContinue -Class Win32_ComputerSystem -ComputerName $_.Name | Select-Object *} | Format-Table -Property * -AutoSize | Out-String -Width 4096 Get-ADComputer -filter {Name -like '*ComputerName*'} | Foreach-Object {Get-WmiObject -ErrorAction SilentlyContinue -Class Win32_ComputerSystem -ComputerName $_.Name | Select-Object PSComputerName,Status,Name,BootROMSupported,BootStatus,Caption,CurrentTimeZone,DaylightInEffect,mDNSHostNamem,Domain,DomainRole,EnableDaylightSavingsTime,HypervisorPresent,InstallDate,LastLoadInfo,Manufacturer,Model,NumberOfLogicalProcessors,NumberOfProcessors,PartOfDomain,PauseAfterReset,PrimaryOwnerContact,PrimaryOwnerName,Roles,SystemFamily,SystemSKUNumber,SystemType,TotalPhysicalMemory,UserName} | Format-List -Property * | Out-String -Width 4096 Get-ADComputer -filter {Name -like '*ComputerName*'} | Foreach-Object {Get-WmiObject -ErrorAction SilentlyContinue -Class Win32_ComputerSystem -ComputerName $_.Name | Select-Object PSComputerName,Status,Name,BootROMSupported,BootStatus,Caption,CurrentTimeZone,DaylightInEffect,mDNSHostNamem,Domain,DomainRole,EnableDaylightSavingsTime,HypervisorPresent,InstallDate,LastLoadInfo,Manufacturer,Model,NumberOfLogicalProcessors,NumberOfProcessors,PartOfDomain,PauseAfterReset,PrimaryOwnerContact,PrimaryOwnerName,Roles,SystemFamily,SystemSKUNumber,SystemType,TotalPhysicalMemory,UserName} | ConvertTo-Csv -UseCulture Get-ADComputer -filter * -SearchBase "OU=ORG_UNIT_1,DC=DOMAIN,DC=local" | Foreach-Object {Test-Connection -ErrorAction SilentlyContinue -ComputerName $_.Name} gwmi win32_diskdrive | select PSComputerName,Status,DeviceID,Partitions,BytesPerSector,InstallDate,InterfaceType,SectorsPerTrack,Size,TotalCylinders,TotalHeads,TotalSectors,TotalTracks,TracksPerCylinder,Capabilities,CapabilityDescriptions,Caption,Description,FirmwareRevision,Manufacturer,MediaLoaded,MediaType,Model,Name,PNPDeviceID,SerialNumber,Signature,SystemName gwmi -ComputerName HOSTNAME WIN32_COMPUTERSYSTEM | SELECT PSComputerName,PowerSupplyState,PowerState,Name,BootROMSupported,Caption,DaylightInEffect,DNSHostName,Domain,HypervisorPresent,InstallDate,Manufacturer,Model,SystemType,TotalPhysicalMemory,Username Get-ADComputer -filter * | Foreach-Object {Get-WmiObject -Class Win32_BIOS -ComputerName $_.Name -erroraction silentlycontinue | Select-Object PSComputerName, Serialnumber | FT * -AutoSize} cat "C:\Test\Filename.txt" | where {$_.Contains("Error")} | Write-Host -ForegroundColor Red cat "C:\Test\Filename.txt" | where {$_.Contains("Information")} | Write-Host -ForegroundColor Yellow Get-Content 'C:\Test\Filename.txt' | ? { $_ -match "Error" -and $_ -match "PM"} | Write-Host -ForegroundColor Yellow (Get-ADDomain).PDCEmulator Get-ADUser -filter * -SearchBase "OU=ORG_UNIT_1,DC=DOMAIN,DC=local" -Properties MemberOf (Get-ADUser -filter * -SearchBase "OU=ORG_UNIT_1,DC=DOMAIN,DC=local" -Properties MemberOf).memberof Get-ADUser -filter * -SearchBase "OU=ORG_UNIT_1,DC=DOMAIN,DC=local" -Properties MemberOf Get-ADUser -filter * -SearchBase "OU=ORG_UNIT_1,DC=DOMAIN,DC=local" -Properties * Get-ADUser -filter * -SearchBase "OU=CONTOSO,DC=DOMAIN,DC=local" -Properties DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion Get-ADUser -filter * -SearchBase "OU=ORG_UNIT_1,DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like 'Connie*'} | Format-Table -AutoSize * Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like '*WIC*'} | Format-Table -AutoSize * Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like '*WIC'} | Format-Table -AutoSize * Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like 'Scott'} | Format-Table -AutoSize * Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like 'Scott*'} | Format-Table -AutoSize * Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like '*Bo*'} | Format-Table -AutoSize * Get-ADUser -filter * -SearchBase "DC=DOMAIN,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,PasswordExpired,ProtectedFromAccidentalDeletion | where { $_.SamAccountName -like 'Username'} Get-ADUser -filter * -SearchBase "DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.DisplayName -like 'Name*'} Get-ADUser -filter * -SearchBase "DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion | where { $_.SamAccountName -eq 'Username'} Get-ADUser -filter * -SearchBase "DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,PasswordExpired,ProtectedFromAccidentalDeletion | where { $_.SamAccountName -like 'Username'} Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion,Company,Department,Name,Title Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion,Company,Department,Name Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion,Company,Department,Name | where {$_.Enabled -eq 'True'} Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion,Company,Department,Name | where {$_.Enabled -eq 'True'} Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion,Company,Department,Name,OfficePhone | where {$_.Enabled -eq 'True'} Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | select DisplayName,SamAccountName,Title,Enabled,Lockedout,ProtectedFromAccidentalDeletion,Company,Department,Name,OfficePhone | where {$_.Enabled -eq 'True'} | where {$_.SamAccountName -eq 'Username'} Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | where {$_.Enabled -eq 'True'} | where {$_.SamAccountName -eq 'Username'} Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | where {$_.Enabled -eq 'True'} | where {$_.SamAccountName -eq 'Username'} | Set-ADUser -PasswordNeverExpires:$True Get-ADUser -Filter {(ObjectClass -eq "user")} -SearchBase "OU=Offices,DC=Contoso,DC=com" | Set-ADUser -PasswordNeverExpires:$FALSE Get-ADUser -filter * -SearchBase "OU=ITDept,OU=DO/DEPARTMENT,DC=CONTOSO,DC=local" -Properties * | where {$_.Enabled -eq 'True'} | where {$_.SamAccountName -eq 'Username'} Get-ADUser -filter * -SearchBase "DC=CONTOSO,DC=local" -Properties * | where {$_.Enabled -eq 'True'} | where {$_.SamAccountName -eq 'Username'} Get-ADUser -filter * -SearchBase "DC=CONTOSO,DC=local" -Properties * | where {$_.SamAccountName -eq 'Username'} Get-ADUser -filter * -SearchBase "DC=CONTOSO,DC=local" -Properties * | where {($_.PasswordNeverExpires -eq 'True') -or ($_.CannotChangePassword -eq 'True') -and ($_.DisplayName -notlike '*Terminated*') -and ($_.Description -notlike '*terminated*')} | select DisplayName,SamAccountName,Title,Description,Enabled,Lockedout,PasswordNeverExpires,CannotChangePassword | ConvertTo-Csv | Filename.csv Get-AdUser -Filter 'PasswordNeverExpires -eq $false' -SearchBase "OU=users,DC=domain,DC=com" -Properties Name, Manager, Title, AccountExpirationDate, LastLogonDate | Select-Object Name, SamAccountName, Manager, Title, AccountExpirationDate, LastLogonDate | Export-CSV c:\Test\Testusers_expirationdate.csv -NoTypeInformation Get-ADUser -filter * -properties passwordlastset, passwordneverexpires | sort-object name | select-object Name, passwordlastset, passwordneverexpire Get-ADUser -filter {name -like 'Administrator'} -properties passwordlastset, passwordneverexpires | sort-object name | select-object Name, passwordlastset, passwordneverexpire Get-ADUser -filter * -properties passwordlastset, passwordneverexpires | sort-object name | select-object Name, passwordlastset, passwordneverexpires | Export-csv -path c:\yaniv.csv Get-ADUser -Filter * -SearchBase "DC=CONTOSO,DC=local" -ResultPageSize 0 -Property CN, Description, LastLogonTimestamp | Select-Object -Property CN, Description, @{ n = "LastLogonDate"; e = { [datetime]::FromFileTime( $_.lastLogonTimestamp ) } } | Sort-Object -Property CN, Description, LastLogonDate | Export-CSV -NoTypeInformation "C:\test\lastlogon.csv" Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False} –Properties "DisplayName", "msDS-UserPasswordExpiryTimeComputed" |Select-Object -Property "Displayname",@{Name="ExpiryDate";Expression={[datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")}} | out-gridview Get-ADUser Username -Properties * | Select Name,Enabled,PasswordExpired,PasswordNeverExpires,SamAccountName,Title,Description,EmailAddress,OfficePhpone,TelephoneNumber,Department,Company,City,State get-adcomputer -filter {operatingsystem -like "*2008*" -or operatingsystem -like "*2012*"} -Properties operatingsystem | Select Name,OperatingSystem get-adcomputer -filter {operatingsystem -like "*2003*"} -Properties operatingsystem | Select Name,OperatingSystem get-adcomputer -filter {operatingsystem -like "*server*"} -Properties operatingsystem | Select Name,OperatingSystem get-adcomputer -filter {operatingsystem -like "*2003*"} -Properties operatingsystem | Select Name,OperatingSystem get-adcomputer -filter {operatingsystem -like "*2008*"} -Properties operatingsystem | Select Name,OperatingSystem get-adcomputer -filter {operatingsystem -like "*2012*"} -Properties operatingsystem | Select Name,OperatingSystem get-adcomputer -filter {operatingsystem -ne "*Windows Server*"} -Properties operatingsystem | Select Name,OperatingSystem get-adcomputer -filter {operatingsystem -ne "*Windows Server*"} -Properties Description | Select Description,Enabled,Name,ObjectClass get-adcomputer -filter {operatingsystem -ne "*Windows Server*" -and Enabled -eq "False"} -Properties Description | Select Description,Enabled,Name,ObjectClass get-adcomputer -filter {operatingsystem -ne "*Windows*"} -Properties operatingsystem | Select Name,OperatingSystem get-adcomputer -filter {operatingsystem -like "*Windows XP*"} -Properties operatingsystem | Select Name,OperatingSystem get-adcomputer -filter {operatingsystem -like "*2008*" -or operatingsystem -like "*2012*"} -Properties BadLogonCount,badPwdCount,CanonicalName,Created,Description,DNSHostName,Enabled,IPv4Address,isDeleted,LastBadPasswordAttempt,LastLogonDate,LockedOut,LogonCount,Name,ObjectClass,OperatingSystem,OperatingSystemHotFix,OperatingSystemServicePack,OperatingSystemVersion,ProtectedFromAccidentalDeletion get-adcomputer -filter {operatingsystem -like "*2008*" -or operatingsystem -like "*2012*"} -Properties BadLogonCount,badPwdCount,CanonicalName,Created,Description,DNSHostName,Enabled,IPv4Address,isDeleted,LastBadPasswordAttempt,LastLogonDate,LockedOut,LogonCount,Name,ObjectClass,OperatingSystem,OperatingSystemHotFix,OperatingSystemServicePack,OperatingSystemVersion,ProtectedFromAccidentalDeletion | ConvertTo-Csv > FileName.csv Get-ADComputer -Filter 'Name -like "HOSTNAME"' -Properties * | Select CannotChangePassword,BadPwdCount,CanonicalName,CN,Created,Deleted,Description,DisplayName,DistinguishedName,DNSHostName,Enabled,IPv4Address,IPv6Address,isCriticalSystemObject,isDeleted,lastLogoff,lastLogon,LockedOut,logonCount,Name,OperatingSystem,OperatingSystemHotfix,OperatingSystemServicePack,OperatingSystemVersion,ProtectedFromAccidentalDeletion | ConvertTo-Csv Get-ADComputer -Filter {Name -like "HOSTNAME" -or Name -like "HOSTNAME2"} -Properties * | Select Name,DNSHostName,CanonicalName,DistinguishedName,CannotChangePassword,BadPwdCount,CN,Created,Deleted,Description,DisplayName,Enabled,IPv4Address,IPv6Address,isCriticalSystemObject,isDeleted,lastLogoff,lastLogon,LockedOut,logonCount,OperatingSystem,OperatingSystemHotfix,OperatingSystemServicePack,OperatingSystemVersion,ProtectedFromAccidentalDeletion | ConvertTo-Csv get-adcomputer -filter {Description -like "*ENTRY*"} -Properties * | Select Name,Description,OperatingSystem,OperatingSystemVersion,Created,LastLogonDate,Modified,whenChanged | FL Get-ADComputer -Filter * -Properties Name,OperatingSystem ,lastlogontimestamp | Select Name,OperatingSystem ,@{N='lastlogontimestamp'; E={[DateTime]::FromFileTime($_.lastlogontimestamp)}} Get-ADComputer -Filter {operatingsystem -like "*windows 7*"} -Properties * | Select CanonicalName,CN,Created,Deleted,Description,DisplayName,DNSHostName,Enabled,IPv4Address,isDeleted,LockedOut,Name,OperatingSystem,OperatingSystemServicePack,OperatingSystemVersion,ProtectedFromAccidentalDeletion | ConvertTo-Csv -UseCulture > WIn-7_AD_PCs_6-28-2017_1.csv Get-ADComputer -Filter * -Properties ipv4Address, OperatingSystem | Format-List Name, ipv4*, oper* > c:\users\username\desktop\computers.txt Found on Spiceworks: https://community.spiceworks.com/topic/2081162-powershell-script-to-get-computer-name-ip-last-logon-and-name-of-last-logon?utm_source=copy_paste&utm_campaign=growth Search-ADAccount -Accountinactive -TimeSpan 60 -Usersonly | Select name,lastlogondate <# ---------------------------------------------------------------------------- Ping color coded UP/Down for IPs pulled from GET-ADComputer ------------------------------------------- #> Get-ADComputer -Filter {Name -like '*HOSTNAMES*'} | ForEach { If (Test-Connection -ComputerName $_.Name -Count 1 -Quiet) { Write-Host "$($_.Name) is up" -ForegroundColor Green } Else { Write-Host "$($_.Name) is down" -ForegroundColor Red } } <# ---------------------------------------------------------------------------- Ping color coded UP/Down for IPs pulled from GET-ADComputer ------------------------------------------- #> ## ## https://social.technet.microsoft.com/Forums/lync/en-US/737b2322-e51c-48a4-9cfe-63ebef9d120a/getadcomputer-to-query-organizational-unit-for-active-computers?forum=winserverpowershell ## <# ---------------------------------------------------------------------------- CSV Export of IPs pulled from GET-ADComputer to Test-Connection ------------------------------------------- #> Get-ADComputer -Filter {Name -like '154*'} | ForEach { $computerName = $_.Name $props = @{ ComputerName = $computerName Status = '' } If (Test-Connection -ComputerName $computerName -Count 1 -Quiet) { $props.Status = 'UP' } Else { $props.Status = 'DOWN' } New-Object PsObject -Property $props } | Select ComputerName,Status | Export-Csv .\pingResults.csv -NoTypeInformation <# ---------------------------------------------------------------------------- CSV Export of IPs pulled from GET-ADComputer to Test-Connection ------------------------------------------- #> Get-GPO -All | Sort-Object displayname | Where-Object { If ( $_ | Get-GPOReport -ReportType XML | Select-String -NotMatch "" ) {$_.DisplayName } } < --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- > ## https://social.technet.microsoft.com/Forums/en-US/ff2f5ca5-91d7-43d7-9f45-e9d758dc1257/how-to-filter-multiple-conditions-with-getadcomputer?forum=winserverpowershell ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ $DaysInactive = 30 $time = (Get-Date).Adddays(-($DaysInactive)) Get-ADComputer -Filter {(Enabled -eq $TRUE -and LastLogonTimeStamp -gt $time)} -Property * | ? OperatingSystem -NotLike "*Server*" | < --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- > Invoke-CimMethod -InputObject (Get-CimInstance Win32_Process -Filter "name = 'notepad.exe'") -MethodName GetOwner Get-WmiObject win32_process -Filter "Name='PowerShell.exe'" | fl Caption,Name,ProcessName,Handles,CommandLine,CSName,Description,OSName,WindowsVersion,Priority,ProcessID,ThreadCount Get-WmiObject Win32_UserProfile | select LocalPath, SID,@{LABEL="last used";EXPRESSION={$_.ConvertToDateTime($_.lastusetime)}}| ft get-ciminstance win32_userprofile | ? lastusetime | select lastusetime, localpath,@{LABEL='user';EXPRESSION={(gwmi win32_useraccount -filter "SID = '$($_.sid)'").caption}} gwmi -NS root\cimv2\power -Class win32_PowerPlan | select ElementName, IsActive | ft -a ------------------------------------------------------------------------------------------------- $ServicePID = (get-wmiobject win32_service | where { $_.name -eq 'service name'}).processID Stop-Process $ServicePID -Force < ----------------------------------------------------------------------------- > gci | % name But it's important to remember that PS isn't all about speed, but functionality. Powershell gci | ? LastWriteTime -lt (Get-Date).AddDays(-15) | % Name ------------------------------------------------------------------------------------------------- [ Rename Files ] Get-ChildItem -Filter "*.wav" -Recurse | Rename-Item -NewName {$_.name -replace 'wav','flac' } -whatif get-childitem -path "hklm:\software\microsoft\windows\currentversion\uninstall" | Get-ItemProperty | ? {$_.DisplayName -like "paint.net"} gci -path "hklm:\software\microsoft\windows\currentversion\uninstall" | Get-ItemProperty | ? {$_.DisplayName -like "paint.net"} get-childitem -path "hklm:\software\microsoft\windows\currentversion\uninstall" | Get-ItemProperty | Where-Objectd {$_.DisplayName -like "paint.net"} Get-ChildItem "hklm:\software\microsoft\windows\currentversion\uninstall" | ForEach-Object {Get-ItemProperty $_.pspath} | where-object {$_.DisplayName} | Foreach-Object {$_.DisplayName} Get-ChildItem "hklm:\software\microsoft\windows\currentversion\uninstall" | ForEach-Object {Get-ItemProperty $_.pspath} | Foreach-Object {$_.DisplayName} $files = Get-ChildItem -Path C:\Temp foreach ($file in $files) { $newFileName=$file.Name.Replace("c11","c12") Rename-Item $file $newFileName } [ Rename Files ] Get-WmiObject Win32_MappedLogicalDisk -computer | select name, providername (Mapped Drive) Test-Connection -count 1 -computer (Get-Content names.txt) | ForEach { # do something with $_.Address }_ 1..254 | ForEach-Object {Test-Connection -ComputerName "192.168.0.$_" -Count 1 -ErrorAction SilentlyContinue} Test-Connection -Count ([Int32]::MaxValue) outlook.office365.com Test-Connection -ErrorAction Silentlycontinue -Count ([Int32]::MaxValue) outlook.office365.com < ---###########################################################################################################--- > while ($true) { "$(Get-Date);$(Test-Connection -ComputerName outlook.office365.com -Quiet)" } while ($true) { "$(Get-Date);$(Test-Connection -ComputerName outlook.office365.com)" } while ($true){"$(Get-Date);$(Test-Connection -ComputerName outlook.office365.com)"} < ---###########################################################################################################--- > < ################################### Compare Folder Hashes ################################### > $LeftFolder = "C:\Users\Username\Downloads\Dell\Skylake\Win7_x64_Dell_OEM" $RightFolder = "E:\Scott\ISO\Win7_x64_Dell_OEM" $LeftSideHash = Get-ChildItem $LeftFolder -Recurse | Get-FileHash | select @{Label="Path";Expression={$_.Path.Replace($LeftFolder,"")}},Hash $RightSideHash = Get-ChildItem $RightFolder -Recurse | Get-FileHash | select @{Label="Path";Expression={$_.Path.Replace($RightFolder,"")}},Hash Compare-Object $LeftSideHash $RightSideHash -Property Path,Hash < ################################### Compare Folder Hashes ################################### > Get-Service | select * Get-Service -Name 'PRTG*' | select * Get-Service | select Name,Status,RequiredServices,StartType Get-Service -Name 'PRTG*' | select Name,Status,RequiredServices,StartType get-service -ComputerName HOSTNAME winrm -requiredServices get-service -name winrm -computername localhost, Server01, Server02 | format-table -property MachineName, Status, Name, DisplayName -auto get-service s* | sort-object status -descending get-service | where-object {$_.DependentServices} | format-list -property Name, DependentServices, @{Label="NoOfDependentServices"; Expression={$_.dependentservices.count}} get-service -ComputerName HOSTNAME | where-object {$_.Status -eq "Running"} get-service -ComputerName HOSTNAME | where {$_.Name -like "Mps*"} get-Service -Name mpssvc -ComputerName HOSTNAME | start-service set-service -name lanmanworkstation -DisplayName "LanMan Workstation" Get-Service New-Service Restart-Service Get-Service -Name "net*" | Where-Object {$_.Status -eq "Stopped"} | Restart-Service Resume-Service Start-Service Stop-Service Suspend-Service (Get-WmiObject -Class Win32_Service -Filter "name='WinRM'" -ComputerName Server01) (get-wmiobject win32_process -filter "name='ampagent.exe'" -computername hart08) Get-CimInstance Win32_Service -Filter "name = 'AMPWatchDog'" -ComputerName HOSTNAME | ConvertTo-Csv Get-CimInstance Win32_Service -Filter "name = 'AMPWatchDog'" | ConvertTo-Csv Get-Service -name "adws","dns","kdc","netlogon" -ComputerName (Get-ADDomain).ReplicaDirectoryServers | Sort Machinename | Format-Table -group @{Name="Computername";Expression={$_.Machinename.toUpper()}} -Property Name,Displayname,Status Add-Computer –DomainName mylab.local –Credential (Get-Credential) Get-ADComputer -filter * -SearchBase "OU=ORG_UNIT_2,OU=ORG_UNIT_1,DC=DOMAIN,DC=local" | Select-Object -expand name Get-ADGroup -Filter * | Select-Object Name,GroupCategory,GroupScope,DistinguishedName Get-ADGroup -Filter * | Select-Object Name,DistinguishedName powershell.exe -executionpolicy bypass -command "C:\Users\gas\Desktop\Update-Sysinternals.ps1" dism.exe /online /enable-feature /featurename:NetFX3 /Source:D:\sources\sxs /all dism /online /enable-feature /featurename:netfx3 /all /LimitAccess /source:\\share_name\sources\sxs <# ------------------------- [Add Telnet CMD Line / PowerShell] ------------------------- #> Import-Module servermanager Add-WindowsFeature telnet-client dism /online /Enable-Feature /FeatureName:TelnetClient <# ------------------------- [Add Telnet CMD Line / PowerShell] ------------------------- #> ## PowerShell History - get-history | Format-Table -Property < *|CommandLine > -AutoSize | Out-String -Width 4096 | clip < ------------------------------------------- Windows / PowerShell Version ------------------------------------------- > get-item "C:\Windows\System32\qmgr.dll" | Select-Object -ExpandProperty VersionInfo [System.Environment]::OSVersion.Version (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -Name ReleaseId).ReleaseId [Environment]::OSVersion.Version -ge (new-object 'Version' 6,1) < ------------------------------------------- Windows / PowerShell Version ------------------------------------------- > ## GET DOT NET VERSION - Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -Recurse | Get-ItemProperty -Name Version -EA 0 | Where { $_.PSChildName -Match '^(?!S)\p{L}'} | Format-Table PSChildName, Version -AutoSize [System.Diagnostics.FileVersionInfo]::GetVersionInfo("C:\Windows\system32\notepad.exe").FileVersion Invoke-Command -ComputerName COMPUTERNAME -ScriptBlock {& cmd /c "c:\Program Files (x86)\Symantec\Symantec Endpoint Protection\smc.exe" -p gooberpea -stop} Invoke-Command -ComputerName HOSTNAME -ScriptBlock {(Get-ItemProperty 'hklm:software\symantec\Symantec Endpoint Protection\CurrentVersion').ProductVersion} Invoke-Command -ComputerName HOSTNAME -ScriptBlock {(Get-ItemProperty 'hklm:software\symantec\Symantec Endpoint Protection\CurrentVersion').ProductName} Invoke-Command -ComputerName HOSTNAME {Get-PSDrive D} | Select-Object PSComputerName,Used,Free | ForEach-Object {$_.free / 1GB} Invoke-Command -ComputerName HOSTNAME {Get-PSDrive D} | Select-Object PSComputerName,Used,Free | ForEach-Object {$_.used / 1GB} powershell.exe -nologo -executionpolicy bypass -WindowStyle hidden -noprofile -file "uninstallScript.ps1" "Java" gwmi win32_product | where-object { $_.name -match "" } &START /WAIT msiexec `/qn `/x `{$stringer`} (Get-WmiObject Win32_Process | ?{ $_.ProcessName -match "paintdotnet" }).Terminate() Get-WmiObject Win32_Service | Where {$_.name -eq "uvnc_serivce"} Get-WmiObject Win32_Service | Where {$_.name -eq "spooler"} Get-WmiObject Win32_Service | Where {$_.name -like "*vnc*"} gwmi win32_service | where {$_.StartMode -ne “Disabled”} | select name,startname | format-list gwmi win32_service | where {$_.StartMode -ne “Disabled”} | select name,startname | format-Wide gwmi win32_service | where {$_.StartMode -ne “Disabled”} | select name,startname | format-Table gwmi win32_service | where {$_.StartMode -ne “Disabled”} | select name,startname | export-csv c:\services.csv gwmi win32_service | where {$_.StartMode -ne “Disabled”} | select name,startname | convertto-html gwmi win32_service | where {$_.StartMode -ne “Disabled”} | select name,startname | convertto-html | out-file c:\services.html (Get-WmiObject Win32_OperatingSystem -ComputerName ).OSArchitecture (Get-WmiObject Win32_OperatingSystem -ComputerName ).Description gwmi -ComputerName HOSTNAME Win32_OperatingSystem | Select-Object PSComputerName,CSName,Caption,CSDVersion,Version,ServicePackMajorVersion,ServicePackMinorVersion,OSType,LastBootUpTime,ProductType,Organization,OSArchitecture,EncryptionLevel,BuildNumber,BuildType,Description,InstallDate,RegisteredUser,SerialNumber (gwmi -ComputerName HOSTNAME Win32_OperatingSystem).caption gwmi win32_operatingsystem -ComputerName HOSTNAME | select PSComputerName,BuildNumber,Caption,Description,EncryptionLevel,InstallDate,LastBootUpTime,LocalDateTime,OperatingSystemSKU,Organization,OSArchitecture,Version | Export-Csv -Path c:\test\WMI_OS_Property.csv Get-WmiObject win32_operatingsystem | select csname, @{LABEL='LastBootUpTime';EXPRESSION={$_.ConverttoDateTime($_.lastbootuptime)}} Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration Get-ItemProperty -path "hkcu:\Software\Microsoft\Office\15.0\Outlook\Security" Get-ItemProperty -path "hkcu:\Software\Microsoft\Office\16.0\Outlook\Security" (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").ReleaseId Reg Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ReleaseId (gwmi -ComputerName HOSTNAME Win32_OperatingSystem).caption Get-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName Get-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName,HardwareID Get-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName,MFG,Service ICM -ComputerName HOSTNAME -ScriptBlock {Get-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName} ICM -ComputerName HOSTNAME -ScriptBlock {Get-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName,Service} (invoke-command -ComputerName mymachine -ScriptBlock {Get-ItemProperty HKLM:\SOFTWARE\VanDyke\VShell\License -Name Version }).version Get-WmiObject -class Win32_OperatingSystem | Select-Object __SERVER,@{label='Install Date';expression={$_.ConvertToDateTime($_.InstallDate)}} Get-WmiObject -class Win32_OperatingSystem | Select-Object __SERVER,@{label='Last Restart';expression={$_.ConvertToDateTime($_.LastBootUpTime)}} Get-WmiObject -class Win32_OperatingSystem | Select-Object __SERVER,@{label='Local Date Time';expression={$_.ConvertToDateTime($_.LocalDateTime)}} gwmi win32_computersystem -ComputerName HOSTNAME | select PSComputerName,Name,Caption,ChassisSkuNumber,DaylightInEffect,DNSHostName,Domain,DomainRole,HypervisorPresent,Manufacturer,Model,NetworkServerModeEnabled,NumberOfLogicalProcessors,NumberOfProcessors,PartOfDomain,PrimaryOwnerContact,PrimaryOwnerName,SystemFamily,SystemSKUNumber,SystemType,TotalPhysicalMemory,Username gwmi win32_volume | select PSComputerName,AutoMount,BlockSize,Capacity,Caption,Compressed,DirtyBitSet,FileSystem,FreeSpace,IndexingEnabled,Label,PageFilePresent,QuotasEnabled,SerialNumber,SystemVolume,DriveLetter,DriveType,Name gwmi win32_volume | select PSComputer,Name,DriveLetter,DriveType,AutoMount,Caption,Index,FreeSpace,PageFilePresent,IndexingEnabled,DirtyBitSet,FileSystem,Compressed,Capacity,BlockSize,BootVolume gwmi win32_volume -ComputerName HOSTNAME | select DriveLetter,Compressed,FileSystem,SerialNumber,SystemVolume, @{Name="Capacity"; Expression={[math]::Round($_.Capacity/1GB)}},@{Name="FreeSpace"; Expression={[math]::Round($_.FreeSpace/1GB)}} | sort -Property DriveLetter | FT Get-CimInstance Win32_DiskDrive | Select-Object Model,SerialNumber < ----------------------- Win 8 + ------------------------ > Get-PhysicalDisk | Select-Object FriendlyName,SerialNumber < ----------------------- Win 8 + ------------------------ > (Get-WmiObject Win32_LogicalDisk -ComputerName HOSTNAME -Filter "DeviceID='C:'" | Select-Object Size,FreeSpace).size/1GB (Get-WmiObject Win32_LogicalDisk -ComputerName HOSTNAME -Filter "DeviceID='C:'" | Select-Object Size,FreeSpace).freespace/1GB Get-WMIObject Win32_Logicaldisk -filter "deviceid='C:'" -ComputerName HOSTNAME | Select PSComputername,DeviceID,@{Name="SizeGB";Expression={$_.Size/1GB -as [int]}},@{Name="FreeGB";Expression={[math]::Round($_.Freespace/1GB,2)}} $OS = Get-WMiobject -Class Win32_operatingsystem -ComputerName chi-core01 $OS.SystemDrive Get-WMIObject Win32_Logicaldisk -filter "deviceid='$($os.systemdrive)'" -ComputerName HOSTNAME | Select PSComputername,DeviceID,@{Name="SizeGB";Expression={$_.Size/1GB -as [int]}},@{Name="FreeGB";Expression={[math]::Round($_.Freespace/1GB,2)}} Get-WMIObject Win32_Logicaldisk -filter "deviceid='$((Get-WMiobject -Class Win32_operatingsystem).systemdrive)'" -ComputerName HOSTNAME | Select PSComputername,DeviceID,@{Name="SizeGB";Expression={$_.Size/1GB -as [int]}},@{Name="FreeGB";Expression={[math]::Round($_.Freespace/1GB,2)}} < --------------------------------------------------------- Last Boot Up Time --------------------------------------------------------- > GWMI -class Win32_Share -computer HOSTNAME (net view \\enetsqnap01) | % { if($_.IndexOf(' Disk ') -gt 0){ $_.Split(' ')[0] } } Get-WmiObject -class Win32_OperatingSystem | Select-Object __SERVER,@{label='LastRestart';expression={$_.ConvertToDateTime($_.LastBootUpTime)}} Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime Get-WmiObject win32_operatingsystem | select csname, @{LABEL='LastBootUpTime';EXPRESSION={$_.ConverttoDateTime($_.lastbootuptime)}} systeminfo /FO CSV | ConvertFrom-CSV net statistics workstation < --------------------------------------------------------- Last Boot Up Time --------------------------------------------------------- > < --------------------------------------------------------- IMPORT PCS FROM AD INTO COMMAND --------------------------------------------------------- > Get-WmiObject -class Win32_BIOS -comp ( Get-ADComputer -filter * -SearchBase "OU=ORG_UNIT2, OU=ORG_UNIT1, DC=DOMAIN, DC=local" | Select-Object -expand name ) | SELECT SERIALNUMBER,PSComputername Get-WmiObject -class Win32_computersystem -comp ( Get-ADComputer -filter * -SearchBase "OU=ORG_UNIT2, OU=ORG_UNIT1, DC=DOMAIN, DC=local" | Select-Object -expand name ) | SELECT PSComputerName,Username,Manufacturer,Model,Domain,SystemType Get-WmiObject -class Win32_networkadapterconfiguration -comp ( Get-ADComputer -filter * -SearchBase "OU=ORG_UNIT2, OU=ORG_UNIT1, DC=DOMAIN, DC=local" | Select-Object -expand name ) | SELECT PSComputerName,ipaddress,macaddress,description Invoke-command -comp ( Get-ADComputer -filter * -SearchBase "OU=ORG_UNIT2, OU=ORG_UNIT1, DC=DOMAIN, DC=local" | Select-Object -expand name ) {Get-PSDrive C} | Select-Object PSComputerName,Used,Free | ForEach-Object {$_.used / 1GB} < --------------------------------------------------------- IMPORT PCS FROM AD INTO COMMAND --------------------------------------------------------- > Get-HotFix | where InstalledOn -ge ([datetime]”11/1/2013″) get-hotfix -id KB974332 get-hotfix -id KB974332 -computername HOSTNAME if (!(get-hotfix -id KB974332 -computername HOSTNAME)) \{ add-content $_ -path Missing-KB974332.txt \} get-content computers.txt | foreach \{ if (!(get-hotfix -id KB974332 -computername $_)) \{ add-content $_ -path Missing-KB974332.txt \}\} Get-HotFix : This command cannot find hot-fix on the machine 'savdaldc11'. Verify the input and Run your command again. At line:1 char:55 + get-content computers.txt | foreach \{ if (!(get-hotfix <<<< -id KB974332 -computername $_)) \{ add-content $_ -path Missing-KB974332.txt \}\} get-hotfix | Where-Object {$_.installedon -gt (get-date).addmonths(-6)} | Sort-Object -property installedOn -Descending Get-Hotfix | where {$_.HotFixId -like "KB000000"} Get-CimInstance Win32_StartupCommand | Select-Object Name, command, Location, User | Format-List ($result.IPV6Address).IPAddressToString < ---------- Clean Shutdown ------------------------------------------------------------------------------------------------------------------------------ > Get-Process | Where-Object MainWindowTitle | Out-GridView -Title 'Select Program To Kill' -PassThru | ForEach-Object { $_.CloseMainWindow() } Get-Process | Where-Object MainWindowTitle | Out-GridView -Title 'Select Program To Kill' -PassThru | Stop-Process < ---------- Foreced Shutdown ---------------------------------------------------------------------------------------------------------------------------- > Get-Process | Where-Object { $_.MainWindowTitle } | Select-Object -Property Name, Company, Description, CPU | Out-Excel Get-Process | Where-Object { $_.MainWindowTitle } | Select-Object -Property Name, Company, Description, CPU Get-Process | Where-Object { $_.MainWindowTitle } | Select-Object -Property Name,Company,Description,CPU,ID,FileVersion,ProductVersion,StartTime,Path Get-Process -ComputerName HOSTNAME | Select-Object name,fileversion,productversion,company Get-Process -id (get-process ProtectionUtilSurrogate*).id -FileVersionInfo (Get-Process -id (get-process PfuSsMon*).id -module).count (get-process explorer).id Get-Process -Name prt* | select Name,ID,PriorityClass,FileVersion,HandleCount,TotalProcessorTime,Handles,Company,CPU,ProductVersion,Description,Product,ExitCode,HasExited,ExitTime,Handle,PriorityBoostEnabled,ProcessName,ProcessorAffinity,Responding,SessionID,StartTime,EnableRaisingEvents,Site,Container get-process | select -Property Name,ID,handlecount,PagedMemorySize,Handles,Path,Company,CPU,ProductVersion,Description,Product | Out-GridView Get-FileHash "C:\Users\Username\Downloads\ImgBurn\SetupImgBurn_2.5.8.0.exe" -Algorithm md5 -Algorithm {SHA1 | SHA256 | SHA384 | SHA512 | MACTripleDES | MD5 | RIPEMD160} dir "DIRECOTRY PATH" -Recurse | Where-Object {!$_.psiscontainer } | get-filehash | ? {$_.hashstring -match ‘f64a28eaa82a657e16044ca85b5f0571’} dir "DIRECTORY PATH" -Recurse | Where-Object {!$_.psiscontainer } | get-filehash | ? {$_.hashstring -match ‘6798240DCFECA09BCD6AE21AC7F5E573’} if ( $($(CertUtil -hashfile C:\TEMP\MyDataFile.img MD5)[1] -replace " ","") -eq "your_hash" ) { echo "ok" } ipconfig | Where-Object { $_ -like "*Address*"} ipconfig | Where-Object { $_ -like "*IPv4 Address*"} dir -Recurse | Where-Object { $_ -like "*Google*"} gwmi -Class win32_process -computername HOSTNAME | select name, kernelmodetime, usermodetime Get-WmiObject Win32_Process | select Name, @{Name="CPU_Time";Expression={$_.kernelmodetime + $_.usermodetime}} | sort CPU_Time -Descending ps -ComputerName HOSTNAME | sort cpu -Descending Invoke-Command -ScriptBlock {get-process} -ComputerName HOSTNAME get-WmiObject -list | where {$_.name -match “Printer”} GWMI WIN32_PRINTER | SELECT CAPTION,COMMENT,DEFAULT,DEFAULTPRIORITY,DESCRIPTION,DRIVERNAME,INSTALLDATE,NAME,PORTNAME,PRINTERSTATE,PRINTERSTATUS,SHARENAME,SPOOLENABLED,STATUS,SYSTEMNAME | ConvertTo-Csv -UseCulture > $env:computername"_PRINTERS.CSV" GWMI WIN32_PRINTER | SELECT CAPTION,COMMENT,DEFAULT,DEFAULTPRIORITY,DESCRIPTION,DRIVERNAME,INSTALLDATE,NAME,PORTNAME,PRINTERSTATE,PRINTERSTATUS,SHARENAME,SPOOLENABLED,STATUS,SYSTEMNAME | ConvertTo-Csv -UseCulture > $env:computername"_$(get-date -f MM-dd-yyyy-HH-mm)".csv Get-WMiObject Win32_USBControllerDevice -computername HOSTNAME | fl Antecedent,Dependent gwmi Win32_USBControllerDevice |%{[wmi]($_.Dependent)} | Sort Description,DeviceID | ft Description,DeviceID -auto Get-WMIObject -class Win32_ComputerSystem | select username Get-WmiObject -Class __Namespace -Namespace root ` -Filter "name='WMI'" (Get-WSManInstance -Enumerate wmicimv2/* -filter "select * from win32_computersystemproduct").uuid Get-WmiObject Win32_NetworkAdapter -Filter "netenabled = true" | Select Guid Get-WmiObject Win32_NetworkAdapter -Filter "netenabled = true" | Select Guid,macaddress,description wmic csproduct get uuid get-history | Format-Table -Property * -AutoSize | Out-String -Width 4096 | clip get-history | Format-Table -Property CommandLine -AutoSize | Out-String -Width 4096 | clip Test-Connection IPADDRESS | Format-list -Property PSComputerName,IPV4Address,ResponseTimeToLive,ReplySize Test-Connection IPADDRESS | Out-GridView -Title 'PING Reply Table' Test-Connection IPADDRESS | Out-GridView -PassThru | Export-Csv -Path .\IPScan.csv Invoke-Command -ComputerName S1, S2 -ScriptBlock {Get-Process PowerShell} -HideComputerName Invoke-Command -ComputerName HOSTNAME -ScriptBlock {Get-Process vm*} Invoke-Command -ComputerName HOSTNAME -ScriptBlock {Get-Process win*} Get-CimClass Win32*Disk* Get-CimInstance -ClassName Win32_DiskDrive | Select Status,InterfaceType,Size,Caption,Description,Name,SystemName,FirmwareRevision,Manufacturer,Model,SerialNumber,Signature Get-CimInstance -ClassName Win32_DiskDrive -Property Status, InterfaceType, Size, Caption, Description, Name, SystemName, FirmwareRevision, Manufacturer, Model, SerialNumber, Signature Get-ChildItem -Path C:\TECH -Recurse -Directory -Force -ErrorAction SilentlyContinue | Select-Object FullName Get-Childitem -Path C:\Users -Include *HSG* -Exclude *.JPG,*.MP3,*.TMP -File -Recurse -ErrorAction SilentlyContinue [ Look for String in files ] ls -r c:\ -file | % {select-string -path $_ -pattern mypassword} [ Look for file name ] ls -r -file -filter *secret* < ------ [ GWMI is alias for Get-WMIObject ] ------ > (Get-WmiObject win32_bios).serialnumber Gwmi Win32_SystemEnclosure | Select Serialnumber Get-WMIObject Win32_SystemEnclosure | Select Serialnumber Gwmi Win32_BIOS | Select Serialnumber Get-WMIObject Win32_BIOS | Select Serialnumber ((Get-CimInstance win32_processor).Name | select -First 1) (Get-CimInstance win32_processor).Name (Get-CimInstance win32_processor) (Get-CimInstance win32_processor).Caption (Get-CimInstance win32_processor).DeviceID (Get-CimInstance win32_processor).MaxClockSpeed (Get-CimInstance win32_processor).SocketDesignation (Get-ADComputer -Filter {OperatingSystem -Like "*Server*"} -Properties OperatingSystem) (Get-WmiObject Win32_OperatingSystem).Version (Get-WmiObject Win32_OperatingSystem) (Get-WmiObject Win32_OperatingSystem) | select * (Get-WmiObject Win32_OperatingSystem).Caption (Get-WmiObject Win32_OperatingSystem).RegisteredUser (Get-WmiObject Win32_OperatingSystem).RegisteredUser.OSArchitecture (Get-WmiObject Win32_OperatingSystem).OSArchitecture (Get-WmiObject Win32_OperatingSystem).Description < ------ [ GWMI is alias for Get-WMIObject ] ------ > Get-CimInstance -ClassName win32_bios | Select SMBIOSBIOSVersion, Manufacturer, Name, SerialNumber, Version Get-CimInstance -ClassName CIM_ComputerSystem | select Name,Caption,PrimaryOwnerName,DayLightInEffectd,DNSHostName,Domain,DomainRole,EnableDayLightSavingsTime,HypervisorPresent,Manufacturer,Model,NumberOfLogicalProcessors,NumberOfProcessors,PartOfDomain,SystemSKUNumber,SystemType,TotalPhysicalMemeory,UserName,WorkGroup Get-CimInstance -ClassName CIM_DiskDrive | select * Get-CimInstance -ClassName CIM_Chip | select * Get-CimInstance -ClassName CIM_PhysicalMemory Get-CimInstance -ClassName CIM_Printer | select Name,Status,Caption,Description,DeviceID,SystemName,Comment,Default,Direct,DriverName,Local,Network,PortName,ServerName,ShareName Get-CimInstance -ClassName CIM_Process Get-CimInstance -ClassName CIM_Processor Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -Property BuildNumber,BuildType,OSType,ServicePackMajorVersion,ServicePackMinorVersion Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object -Property NumberOfLicensedUsers,NumberOfUsers,RegisteredUser Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DriveType=3" Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DriveType=3" | Measure-Object -Property FreeSpace,Size -Sum | Select-Object -Property Property,Sum Get-CimInstance -ClassName Win32_LogonSession < ------------------------------------------------------------------ Invoke-RestMethod ------------------------------------------------------------------ > $Data = Invoke-RestMethod -Uri 'https://gis.iowadot.gov/public/rest/services/Traffic_Safety/Crash_Data/MapServer/0?f=pjson' $Data.fields|Select-Object -Property Name, alias, Domain (Invoke-RestMethod -Uri 'https://gis.iowadot.gov/public/rest/services/Traffic_Safety/Crash_Data/MapServer/0?f=pjson').fields | Select Name,Alias,Domain ((Invoke-RestMethod -Uri 'https://gis.iowadot.gov/public/rest/services/Traffic_Safety/Crash_Data/MapServer/0?f=pjson').fields | Where-Object {$_.name -eq 'weather'}).Domain.CodedValues Invoke-RestMethod -Uri 'https://gis.iowadot.gov/public/rest/services/Traffic_Safety/Crash_Data/MapServer/0?f=pjson' | select -Property Name,CurrentVersion,supportsStatistics,supportedQueryFormats,ownershipBasedAccessControlForFeatures,useStandardizedQueries < ------------------------------------------------------------------ Invoke-RestMethod ------------------------------------------------------------------ > gwmi -ComputerName HOSTNAME -ClassName CIM_Chip Get-PnpDevice -PresentOnly (whoami /all | select-string S-1-16-12288) -ne $null Last Bootup Time - [System.Management.ManagementDateTimeConverter]::ToDateTime((Get-WmiObject Win32_OperatingSystem).LastBootUpTime) Get-WmiObject win32_processor | Measure-Object -property LoadPercentage -Average | Select Average Get-WmiObject -Computername HOSTNAME win32_processor | Measure-Object -property LoadPercentage -Average | Select Average Get-WmiObject -Class win32_Volume | select Name,FileSystem,BlockSize,Capacity,Label,PSComputername | Format-Table Get-WmiObject -Computername HOSTNAME -Class win32_Volume | select Name,FileSystem,BlockSize,Capacity,Label,PSComputername | Format-Table Get-WMIObject Win32_OperatingSystem | select-object caption Get-WMIObject Win32_OperatingSystem Get-WMIObject Win32_OperatingSystem -Computername HOSTNAME | select-object caption (Get-ADDomain).PDCEmulator Get-ADUser -Identity Username -Properties memberof | Select-Object -ExpandProperty memberof (Get-ADUser -Identity Username -Properties memberof).memberof Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol Write-Host (2,4,6,8,10,12) -Separator ", -> " -ForegroundColor Green -BackgroundColor RED Write-Host (2,4,6,8,10,12) -Separator ", -> " -ForegroundColor DarkGreen -BackgroundColor white CommandLine ----------- Get-WinEvent -LogName Microsoft-Windows-TaskScheduler/Operational Get-WinEvent -LogName security Get-WinEvent -LogName Microsoft-Windows-Security-Audit-Configuration-Client/Operational Get-WinEvent -LogName Microsoft-Windows-Winlogon/Operational Get-WinEvent -LogName Microsoft-Windows-Winlogon Get-WinEvent -LogName Microsoft* Get-EventLog -list | Where-Object {$_.logdisplayname -eq "Security"} Get-EventLog "Security" | Where-Object {$_.EventID -eq 4672} Get-EventLog "Security" -ComputerName HOSTNAME | Where-Object {$_.EventID -eq 428 -or } Get-Eventlog -logname Security -ComputerName HOSTNAME | Where EventID -EQ “4740” | Format-Table Get-WinEvent -FilterHashtable @{logname='Security'; id=4672; level=2} -MaxEvents 10 Get-WinEvent -FilterHashtable @{logname='Security'; id=4672; UserID=Username} -MaxEvents 10 Get-WinEvent -FilterHashtable @{logname='Security'; id=4672; UserID=CONTOSO\Username} -MaxEvents 10 Get-WinEvent -FilterHashtable @{logname='Security'; id=4672; UserID=Administratro} -MaxEvents 10 Get-WinEvent -FilterHashtable @{logname='Security'; id=4672; UserID=Administrator} -MaxEvents 10 Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} -MaxEvents 10 Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} -MaxEvents 10 | Group-Object eventid | Sort-Object Name Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Group-Object eventid | Sort-Object Name -MaxEvents 10 Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Group-Object eventid | Sort-Object Name Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Group-Object id | Sort-Object Message Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Group-Object id | Sort-Object Message -MaxEvents 10 Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Group-Object id -MaxEvents 10 Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Group-Object Id -MaxEvents 10 Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} | Format-Table -Property * -AutoSize | Out-String -Width 4096 Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} -MaxEvents 10 | Format-Table -Property * -AutoSize | Out-String -Width 4096 Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} -MaxEvents 10 | Format-Table -Property * -AutoSize | Out-String -Width 4096 | clip Get-WinEvent -FilterHashtable @{logname='Security'; id=4672} -MaxEvents 10 | Format-Table -Property * -AutoSize | clip Get-EventLog -ComputerName SERVER -LogName Security ?{$_.EventID -eq 538 -or $_.Event -eq 540} Get-EventLog -LogName Security ?{$_.EventID -eq 4907 -or $_.Event -eq 4672} Get-EventLog -LogName Security ?{$_.EventID -eq 4907 -or $_.Event -eq 4672} Get-EventLog -LogName Security ?{$_.EventID -eq 4907 -or $_.Event -eq 4672} Get-EventLog -LogName Security | ?{$_.EventID -eq 4907 -or $_.Event -eq 4672} Get-EventLog -ComputerName SERVER -LogName Security | ?{$_.EventID -eq 4907 -or $_.Event -eq 4672} Get-EventLog -ComputerName SERVER -LogName Security | ?{$_.EventID -eq 538 -or $_.Event -eq 540} Get-EventLog -ComputerName SERVER -LogName Security | ?{$_.EventID -eq 538 -or $_.Event -eq 540} Get-EventLog -ComputerName SERVER -LogName Security | ?{$_.EventID -eq 538 -or $_.Event -eq 540} | Format-Table -Property * -AutoSize | Out-String -Width 4096 get-history | Format-Table -Property * -AutoSize | Out-String -Width 4096 | clip Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*konea*' } Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*outlook*' } Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*outlook*' } Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*outlook*' } | clip Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*outlook*' } | Format-Table -AutoSize * Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*outlook*' } | Format-Table -AutoSize Get-WinEvent -FilterHashtable @{logname='application'} | where-object { $_.Message -like '*outlook*' } | select message Get-WinEvent -FilterHashtable @{logname='application'; id=4107; StartTime="1/17/11"} Invoke-Command -Computername Computer01 -ScirptBlock {Get-Eventlog -Logname Security | Select-Object -First 10} Invoke-Command -Computername Computer01 -ScirptBlock {Get-Process} | gm Invoke-Command -Computername Computer01 -ScirptBlock {Get-Process} | where {_.name -eq "notepad"} Measure-Command {Invoke-Command -Computername Computer01 -ScirptBlock {Get-Process} | where {_.name -eq "notepad"} } Measure-Command {Invoke-Command -Computername Computer01 -ScirptBlock {Get-Process | where {_.name -eq "notepad"}} } Invoke-Command -Computername Computer01 -ScirptBlock {Get-Process | where {_.name -eq "notepad"} | Stop-Process} Event Log Archive - Get-WinEvent -FilterHashtable @{logname='security'; id=1105; StartTime="12/12/17"} Event Log Pass Change - Get-WinEvent -FilterHashtable @{logname='security'; id=628; StartTime="12/12/17"} Get-WinEvent -FilterHashtable @{logname='application';id=4107;StartTime="1/15/11";EndTime="1 Get-EventLog "Application" | Where-Object {$_.EventID -eq 1003 -or $_.EventID -eq 62 -or $_.EvendID -eq 902} | select EventID,TimeGenerated,EntryType,Source Get-EventLog "System" | Where-Object {$_.EventID -eq 7 -or $_.EventID -eq 11 -or $_.EventID -eq 51 -or $_.EvendID -eq 52 -or $_.EventID -eq 13150} | select EventID,TimeGenerated,EntryType,Source,Message Get-EventLog "System" | Where-Object {$_.EventID -eq 7 -or $_.EventID -eq 11 -or $_.EventID -eq 51 -or $_.EvendID -eq 52 -or $_.EventID -eq 13150} | select * | ConvertTo-Csv > C:\Test\EvntLog_HD_Failure.csv Get-EventLog "System" | Where-Object {$_.EventID -eq 7 -or $_.EventID -eq 9 -or $_.EventID -eq 11 -or $_.EventID -eq 15 -or $_.EventID -eq 51 -or $_.EvendID -eq 52 -or $_.EventID -eq 13150} | select EventID,TimeGenerated,EntryType,Source,Message Get-EventLog "System" | Where-Object {$_.EventID -eq 7 -or $_.EventID -eq 9 -or $_.EventID -eq 11 -or $_.EventID -eq 15 -or $_.EventID -eq 51 -or $_.EvendID -eq 52 -or $_.EventID -eq 13150} | select * | ConvertTo-Csv > C:\Test\EvntLog_HD_Failure.csv Get-EventLog Security -ComputerName Computer -Source Microsoft-Windows-Security-Auditing | Where {$_.InstanceID -like "4624"} | Select $UserProperty | where {$_.Username -Like "username"} | Export-Csv D:\Logon.csv -NoTypeInformation - Make sure Service "RemoteRegistry" running Get-EventLog Security -ComputerName Computer -Source Microsoft-Windows-Security-Auditing | Where {$_.InstanceID -like "4624"} | Select $UserProperty | where {$_.Username -Like "*blalock"} | Export-Csv D:\Logon.csv -NoTypeInformation Get-EventLog "System" | Where-Object {$_.EntryType -eq 'Error'} | select EventID,TimeGenerated,EntryType,Source Get-EventLog "System" | Where-Object {$_.EntryType -ne "Information"} | select * | more Get-EventLog "System" | Where-Object {$_.EntryType -eq "Error"} | select * | more $date = (Get-Date).AddDays(-1) Get-WinEvent -FilterHashTable @{ LogName = "System"; StartTime = $date; ID = "12" } $formatEnumerationLimit = -1 $formatenumerationlimit Get-WinEvent -FilterHashtable @{logname='application'; ProviderName='MSSQLSERVER'} | where-object { $_.Message -like '*error*' } Get-WinEvent -path "C:\temp\*Security*.evtx" -max 10 -FilterHashtable @{Providername="Microsoft-Windows-Security-Auditing"; id=4740; StartTime='1/7/2013'; EndTime='1/8/2013'} Get-WinEvent -FilterHashtable @{logname='application'; providername='.Net Runtime' } Get-WinEvent -FilterHashtable @{logname='system'; providername='Disk' } Get-WinEvent -FilterHashtable @{logname='system'; level='2'} Get-EventLog Security -Source Microsoft-Windows-Security-Auditing -After ((Get-Date).Date.AddDays(-30)) | Where ($_.EventID -eq 4624) Get-WinEvent -FilterHashTable @{LogName="System"; StartTime=(get-date).AddDays(-13); EndTime=(get-date).AddHours(-1): level='2'} Write-Eventlog -Logname "Operations Manager" -Source 'HealthService' -EventID 100 -EntryType Warning -Message "String `"$string`" has not been found in URL `"$url`" authenticated with username `"$user`" and password `"$password`"." Get-EventLog System | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap | More ############################################################################################################################################################## ## ## https://4sysops.com/archives/search-the-event-log-with-the-get-winevent-powershell-cmdlet/ ## ############################################################################################### Events with a specific information level You must provide the information level with Level as the key and a Number as the value. Here is a list of levels associated with their respective numbers: •LogAlways 0 •Critical 1 •Error 2 •Warning 3 •Informational 4 •Verbose 5 The following command displays all error events from the System log: Get-WinEvent -FilterHashTable @{LogName='System';Level='2'} Unfortunately, you can only specify one level at a time through a hash table. However, we can circumvent this problem by using the Where-Object cmdlet instead of the Level key from the hash table. ############################################################################################################################################################## < ************************************* https://social.technet.microsoft.com/Forums/ie/en-US/c8330f58-f2e5-4681-beb2-b2b6a185f818/how-to-geteventlog-for-offline-evtx-files?forum=winserverpowershell ************** > If you want to export out only some column, then please run below command first to select out one object and get those column: $EventLogonIDs="4624","4634" Get-WinEvent -FilterHashtable @{Path="C:\temp\Security*.evtx";id= @($EventLogonIDs);StartTime="1/7/2013";EndTime="1/8/2013"} | select-object -first 2 OR we also could use get-member command to get all properties of the result, and then choose what you want to export: $EventLogonIDs="4624","4634" Get-WinEvent -FilterHashtable @{Path="C:\temp\Security*.evtx";id= @($EventLogonIDs);StartTime="1/7/2013";EndTime="1/8/2013"} | select-object -first 1 | get-member < ************************************* https://social.technet.microsoft.com/Forums/ie/en-US/c8330f58-f2e5-4681-beb2-b2b6a185f818/how-to-geteventlog-for-offline-evtx-files?forum=winserverpowershell ************** < ---------------------------------- https://www.makeuseof.com/tag/15-advanced-tasks-powershell-can-handle-windows-10/ Set-Date -date "12/25/2016 7:30 AM" Set-Date (Get-Date).AddDays(2) Test-Path c:\Users\Brad\Documents\PowerShell.xls Rename-Item c:\Users\Brad\Documents\PowerShellisDifficult.xls PowerShellisEasy.xls Move-Item c:\Users\Brad\Documents\PowerShellisEasy.xls c:\Users\Brad\Important Documents Move-Item c:\Users\Brad\Documents\*.xls c:\Users\Brad\Important Documents Invoke-Item c:\Windows\System32\notepad.exe Invoke-Item c:\MakeUseOf\Hello.txt Invoke-Item c:\MakeUseOf\*.txt Get-Content c:\MakeUseOf\Hello.txt Get-Content c:\MakeUseOf\Hello.txt -totalcount 5 Add-Content c:\MakeUseOf\Hello.txt "written by Brad Jones" Add-Content c:\MakeUseOf\Hello.txt "`nwritten by Brad Jones" Get-Content c:\MakeUseOf\Hello.txt | Measure Object Get-Service Get-Service | Where-Object {$_.status -eq "stopped"} Restart-Service dbupdate Restart-Service -displayname "Dropbox Update Service" Set-Service dbupdate -startuptype "manual" Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"} powershell -NoExit -Command "Set-Location c:\\" If your path contains spaces, you can wrap it in single-quotes, like so: powershell -NoExit -Command "Set-Location 'c:\\program files'" 'powershell -NoExit -Command "Set-Location ' + path1 + '"' 'start C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -NoExit -Command '; s2 = '"Select-Location ' + "'" + path1 + "'" + '"', and command = s1 + s2 < ---------------------------------- https://www.makeuseof.com/tag/15-advanced-tasks-powershell-can-handle-windows-10/ -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ## Show addins for Outlook ------------------------------------------------------------- $searchScopes = "HKCU:\SOFTWARE\Microsoft\Office\Outlook\Addins","HKLM:\SOFTWARE\Wow6432Node\Microsoft\Office\Outlook\Addins" $searchScopes | % {Get-ChildItem -Path $_ | % {Get-ItemProperty -Path $_.PSPath} | Select-Object @{n="Name";e={Split-Path $_.PSPath -leaf}},FriendlyName,Description} | Sort-Object -Unique -Property name -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- if(test-path "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe"){(ls "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe").VersionInfo | Format-List} if(test-path "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe"){(ls "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe").VersionInfo | select ProductVersion} $path= "\\remote\C$\windows\System32\WindowsPowerShell\v1.0\powershell.exe" if(test-path $path){(ls $path).VersionInfo} -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- < ======================================================= Command Used Excel Formulas ======================================================= > =IF(D1>1024*1024*1024,TRUNC(D1/1024/1024/1024,2)&" GB", IF(D1>1024*1024, ROUND(D1/1024/1024,0)&" MB", ROUND(D1/1024,0)&" KB")) < ======================================================= Command Used Excel Formulas ======================================================= > Powershell.exe -ExecutionPolicy Bypass -File "\\sccm\clienthealth$\ConfigMgrClientHealth.ps1" -Config "\\sccm\clienthealth$\config.xml" < ---------------------------- [ Powershell Versioning ] ---------------------------- > Get-Host | Select-Object Version Invoke-Command -Computername HOSTNAME -Scriptblock {$PSVersionTable.psversion} REG QUERY \\HOSTNAME\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine REG QUERY \\HOSTNAME\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine /V "PowerShellVersion" REG QUERY \\HOSTNAME\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine /V "PowerShellVersion" REG QUERY \\HOSTNAME\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ REG QUERY \\HOSTNAME\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\3 < ---------------------------- [ Powershell Versioning ] ---------------------------- > < ---------------------------- [ Check if Server needs rebooting ] ---------------------------- > reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired" reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /s reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending" reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending" < ---------------------------- [ Check if Server needs rebooting ] ---------------------------- > < ---------------------------- [ Powershell 5.1 Quient Install/Uninstall ] ---------------------------- > wusa.exe Win7AndW2K8R2-KB3191566x64.msu /quiet /norestart wusa.exe /KB3191566 /uninstall /quiet /norestart < ---------------------------- [ Powershell 5.1 Quient Install/Uninstall ] ---------------------------- > function Get-SystemUptime { $operatingSystem = Get-WmiObject Win32_OperatingSystem [Management.ManagementDateTimeConverter]::ToDateTime($operatingSystem.LastBootUpTime) } ########################################################################################################################################## ## ## http://windowsitpro.com/blog/four-ways-get-computer-names-computername-parameter ## ########################################################################################################################################## I'm teaching a class forSAPIEN Technologies in Chicago this week. Actually, everyone's doing a lab on WMI, watching me enter this. Don't you wish you were here? Anyway, we needed to look at various ways to feed computer names to any cmdlet that has a -computerName parameter. Here's what I cam up with: # get names from a file, one name per line Get-WmiObject -class Win32_Whatever -computer (Get-Content names.txt) # get names from Active Directory Import-Module ActiveDirectory Get-WmiObject -class Win32_Something -comp ( Get-ADComputer -filter * | Select-Object -expand name ) # specify one computer Get-WmiObject -class Win32_This -computer SERVER-R2 # specify many computers Get-WmiObject -class Win32_That -computer WESTDC4,EASTDC5 # get names from a CSV file that has a "host" column Get-WmiObject -class Win32_Those -computer ( Import-CSV computerlist.csv | Select-Object -expand host ) I used Get-WmiObject for all of the examples, but you can obviously use this with any cmdlet that supports -computerName. Enjoy! ########################################################################################################################################## ############################################################################################################################################################################## ## ## WINDOWS 7 AND ABOVE - NIC ADAPTER REPAIR EQUIVALENT ## ## http://windowsitpro.com/windows-xp/what-actions-occur-when-i-click-repair-network-connection-windows-xp-and-later ## ############################################################################################################################################################################## If you right-click a network connection and select Status, Windows displays information about the connection's speed, duration of connection, and packet activity. For XP and later, a Repair option appears on the Support tab. When you click Repair, Windows attempts to resolve a range of problems. Specifically, the OS attempts to renew the DHCP lease, if the connection obtains its IP address through DHCP, using a broadcast message. •Flushes the Address Resolution Protocol (ARP) cache using the command arp -d * •Flushes the NetBIOS cache using the command nbtstat -R •Flushes the DNS cache using the command ipconfig /flushdns •Reregisters the NetBIOS name and IP address with WINS using the command nbtstat -RR •Reregisters the computer name and IP address with DNS using the command ipconfig /registerdns arp -d * nbtstat -R ipconfig /flushdns nbtstat -RR ipconfig /registerdns ############################################################################################################################################################################## nmap -sV -script=banner IP / HOSTNAME nmap -p "Port Number" -oA "Base File Name" IP/RANGE - No quotes ############################################################################################################################################################################## ## SERVER ONLY COMMANDS FOR NOW ############################################################################################################################################################################## Get-DhcpServerv4Lease -ScopeId "NETWORK_ID" | select IPAddress,ClientID,HostName ############################################################################################################################################################################## icacls "C:\Program Files (x86)\FourJs" /grant "Users":(OI)(CI)F /inheritance:r icacls DemoOCX.lnk /grant users:F (Topaz signature pad, give full access to local USERS group in %PUBLIC%\DESKTOP\DemoOCX.lnk link file) invoke-command -ComputerName SERVER -ScriptBlock {Test-Connection -ComputerName 10.0.1.4,10.0.2.4,10.0.3.4,10.0.4.4,10.0.5.4,10.0.6.4,10.0.7.1,10.0.8.4,10.0.9.4,10.0.10.4,10.0.11.4,10.0.12.4,10.0.53.4,10.0.61.1 -Count 2 | format-table -autosize} < ##################################################### - ESXi CLI -- Command - ######################################################################################### > ESXi History Log - https://ESXiHostnameOrIP/host/shell.log https://kb.vmware.com/s/article/2004810 [root]: esxcli network ip connection list [root]: vim-cmd vmsvc/getallvms [root]: vim-cmd vmsvc/power.on vcsa [root]: vim-cmd vmsvc/getallvms [root]: vim-cmd vmsvc/power.on 47 [root]: vim-cmd vmsvc/getallvms |grep hall [root]: vim-cmd vmsvc/getallvms |grep HALL [root]: vim-cmd vmsvc/getallvms |grep vcsa [root]: vim-cmd vmsvc/power.on 47 [root]: esxcli vm process list [root]: history < ##################################################### - ESXi CLI -- Command - ######################################################################################### > < ##################################################### - PowerShell Sessions - ######################################################################################### > < ##################################################### > < #### #### < #### https://youtu.be/PMRkM9jlMMw #### < #### #### < ##################################################### > $sess = New-PSSession -ComputerName Computer01 Get-PSSession Process - wsmprovhost.exe - Check username it is running under Invoke-Command -Session $sess {var=10} (remains due to estabilshed session) $sess | Remove-PSSession For domain controllers must be in "Built In" "Administrators" $sess | Remove-PSSession $dcs = "DC01", "DC02" $dcs (should show list of previously added DCs) Invoke-Command -ComputerName $dcs -ScriptBlock {$env:computername} $sess = NewPSSession -ComputerName $dcs Invoke-Command -Session $sess -ScriptBlock {$env:computername} Enter-PSSession -Session $sess [0] gps Get-Service exit Remove-PSSession | remove $sess | Remove [Implicit Remoting is importing modules from remote session] $adsess = NewPSSession -ComputerName DC01 Import-Module -Name ActiveDirectory -PSSession $adsess Get-Module Get-Command -Module ActiveDirectory $c = Get-Command Get-ADUser $c.definition Get-ADUser -filter * | gm (Deserialized) $comm = "Get-Command" & $comm Remove-Module ActiveDirectory Import-Module -Name ActiveDirectory -PSSession $adsess -Prefix OnDC Get-Module $sess = New-PSSession -Name DC1Sess -ComputerName DC01 Get-PSSession Invoke-Command -Session $sess {$var=50} Disconnect-PSSession -ID 2 Connect-PSSession -ID2 Invoke-Command -Session $sess {$var} Try telnet "node" 5985 Import-Module PSDiagnostics Get-Command -Module PSDiagnostics Enable-PSWSManCombinedTrace Invoke-Command -ComputerName Computer01 -ScriptBlock {Get-Process} Disable-PSWSMANCombinedTrace cd .\\LocalMachine\my ls < ##################################################### - PowerShell Sessions - ######################################################################################### > < ##################################################### - Wireshark Filtering - ######################################################################################### > http.request.uri matches "^....$" < ##################################################### - Wireshark Filtering - ######################################################################################### > < ##################################################### - Powershell JSON to XML Conversion - ##################################################### > Get-Content -Path "PATH\FILE-NAME.json" | ConvertFrom-Json | ConvertTo-Xml -As Document -Depth 3 | Out-File -FilePath "PATH\FILE-NAME.xml" < ##################################################### - Powershell JSON to XML Conversion - ##################################################### >