Powershell

Handy Powershell

Open another powershell window as admin:

Start-Process powershell -Verb runAs

Delete contents of folder

• Get-ChildItem C:\LocationOfFolder\Folder -Recurse | ForEach { Remove-Item $_.FullName -Force -Recurse }

Change to environment locations:

cd $Env:<vairable>

cd $Env:userprofile

Show all environment vairables:

• dir env:

Show path to PS modules:

$env:PSProfilepath

Restart computer remotely:

restart-computer -Computername [hostname] -Credential [domain\username] -force

Send a message to a user on a remote host:

msg /server:<server name> /v <user name> <message>

Connect to remote powershell session:

$cred=Get-Credential

$sess = New-PSSession -Credential $cred -ComputerName <remotemachinename>

Enter-PSSession $sess

<Run commands in remote session>

Exit-PSSession

Remove-PSSession $sess

Get services running on computer and display in a pauseable list:

Get-service | Where-Object {$_.Status -eq "Stopped"} | More

gsv | where {$_.Status -eq "running"} | more

Output Command History to text file:

Get-History | ForEach-Object { $_.CommandLine } > $env.USERPROFILE\testoutput.txt

Script to ping IP address and log time and status of ping:

https://github.com/AleksPish/NetworkPingTest/blob/master/NetworkDownTest.ps1

Download file from internet:

• Invoke-WebRequest <URL> | out-file <File Pathway>

Also can use Download method of WebClient

• $client = New-Object System.Net.WebClient
  • $client.DownloadFile($url, $path)
• (new-object System.Net.WebClient).DownloadFile( '$url, $path)

Add Exclusions to security check from downloaded programs:

add-mppreference -exclusionpath "<full filepath - eg C:\users\downloads>"

Get members of ad group:

get-adgroupmember -identity "<name of adgroup>" | select-object name

Get Computer / Server Uptime - last boot time

• (get-date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
• Get-ComputerInfo | Select-Object OsUptime - can also use OsLastBootUpTime to work it out

Get detailed information on server / computer operating system

• Get-CimInstance Win32_OperatingSystem | FL *

Add exception to windows defender for downloads in default user location:

• add-mppreference -exclusionpath "C:\Users\*\Downloads\noActiveX-*.exe"

Active Directory Powershell

Export details of users in a specific OU:

$OUpath = '<place OU path here distinguished name of ou in attribute editor>'
$ExportPath = '<place where to put output>'
Get-ADUser -Filter * -SearchBase $OUpath | Select-object DistinguishedName,Name,UserPrincipalName,sAMAccountName | Export-Csv -NoType $ExportPath

Get all groups a user is assigned to

• Get-ADPrincipalGroupMembership username | select name

Powershell for Admin

Get powershell update

• iex "& { $(irm https://aka.ms/install-powershell.ps1) } -UseMSI"

Get FSMO roles on which domain controllers at domain level:

Get-ADDomain | Select-Object InfrastructureMaster,PDCEmulator,RIDMaster | Format-List

Get FSMO roles on which domain controllers at forest level:

Get-ADForest | Select-Object DomainNamingMaster,SchemaMaster | Format-List

Installing packages in powershell

Can use chocolatey to get packages:

Set-ExecutionPolicy Unrestricted
iwr https://chocolatey.org/install.ps1 -UseBasicParsing | iex

For SSH connections:

Putty:

choco install putty

OpenSSH:

choco install openssh                # installs open ssh
refreshenv                           # reloads the environment variables
ssh remoteClient -i "MyKeyPair.pem"  # connects to remoteClient via ssh

poshSSH:

Install-Module Posh-SSH                                   # installs the posh-ssh module
Get-Command -Module Posh-SSH                              # shows all posh-ssh commandlets
New-SSHSession myclient -KeyFile "c:\data\MyKeyPair.pem"  # connect to my client with the give keyfile
Invoke-SSHCommandStream "ifconfig" -SessionId 0           # send ifconfig to the ssh session with id 0
Invoke-SSHCommand -SessionId 0 -Command "ifconfig"        # send ifconfig to the ssh session with id 0 
Invoke-SSHCommand -SessionId 0 -Command "logout"          # send logout to the ssh session with id 0
Remove-SSHSession 0                                       # removes and closes the ssh session

For firefox:

choco install firefox -y

Powershell Alias

gsv Get-Service

spsv Stop-Service

sasv Start-Service

Powershell for Services and Processes

Get all properties of a service and display specific properties of the service:

• get-service | get-member
• get-service wuauserv | select Displayname,Status,ServiceName,Can*

Display list of only running services:

• Get-Service | Where-Object {$_.Status -EQ "Running"}

Remotely Check Service:

• get-service wuauserv -ComputerName remotePC1

Get top 10 processes by memory usage

• Get-Process | Select-Object name,workingset64 | Sort-Object -Property workingset64 -Descending | Select-Object -First 10