Powershell

From Piszczynski
Revision as of 12:22, 5 August 2022 by piszczynski>Aleks

Handy Powershell

Open another powershell window as admin:

Start-Process powershell -Verb runAs

Delete contents of folder

  • Get-ChildItem C:\LocationOfFolder\Folder -Recurse | ForEach { Remove-Item $_.FullName -Force -Recurse }

Change to environment locations:

cd $Env:<vairable>

cd $Env:userprofile

Show all environment vairables:

  • dir env:

Show path to PS modules: 

$env:PSProfilepath

Restart computer remotely:

restart-computer -Computername [hostname] -Credential [domain\username] -force

Send a message to a user on a remote host: 

msg /server:<server name> /v <user name> <message>

Connect to remote powershell session:

$cred=Get-Credential

$sess = New-PSSession -Credential $cred -ComputerName <remotemachinename>

Enter-PSSession $sess

<Run commands in remote session>

Exit-PSSession

Remove-PSSession $sess

Get services running on computer and display in a pauseable list:

Get-service | Where-Object {$_.Status -eq "Stopped"} | More

gsv | where {$_.Status -eq "running"} | more

Output Command History to text file: 

Get-History | ForEach-Object { $_.CommandLine } > $env.USERPROFILE\testoutput.txt

Get Powershell to display all output in the case that output is displayed truncated:

Pipe to "out-string -width 500" to display in a sting of set number of characters:

  • <command> | out-string -width 500

In the case of an array change the vairable $FormatEnumerationLimit to -1

  • $FormatEnumerationLimit=-1

Script to ping IP address and log time and status of ping:

https://github.com/AleksPish/NetworkPingTest/blob/master/NetworkDownTest.ps1

Download file from internet:

  • Invoke-WebRequest <URL> | out-file <File Pathway>

Also can use Download method of WebClient

  • $client = New-Object System.Net.WebClient
    • $client.DownloadFile($url, $path)
  • (new-object System.Net.WebClient).DownloadFile( '$url, $path)

Add Exclusions to security check from downloaded programs: 

add-mppreference -exclusionpath "<full filepath - eg C:\users\downloads>"

Get members of ad group: 

get-adgroupmember -identity "<name of adgroup>" | select-object name

Get Computer / Server Uptime - last boot time

  • (get-date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
  • Get-ComputerInfo | Select-Object OsUptime - can also use OsLastBootUpTime to work it out

Get detailed information on server / computer operating system

  • Get-CimInstance Win32_OperatingSystem | FL *

Add exception to windows defender for downloads in default user location:

  • add-mppreference -exclusionpath "C:\Users\*\Downloads\noActiveX-*.exe"

Get time between two dates:

  • New-TimeSpan -start <date> -end <date>

Install PS module

  • Install-Module <name of module>

If there is an error the issue may be with TLS - run the following command first:

  • [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

File Admin Powershell

List folders

  • Get-childitem

Move all files of a specified extension from the current directory to another directory, move recursively

  • Move-Item -Path .\*.txt -Destination <path>
    • Get-ChildItem -Path ".\*.txt" -Recurse | Move-Item -Destination "C:\TextFiles"

Move registry keys and values to another key

  • Move-Item "HKLM:\software\mycompany\*" "HKLM:\software\mynewcompany"

Active Directory Powershell

Export details of users in a specific OU: 

$OUpath = '<place OU path here distinguished name of ou in attribute editor>'
$ExportPath = '<place where to put output>'
Get-ADUser -Filter * -SearchBase $OUpath | Select-object DistinguishedName,Name,UserPrincipalName,sAMAccountName | Export-Csv -NoType $ExportPath

Get all groups a user is assigned to

  • Get-ADPrincipalGroupMembership username | select name

Change password expiry setting on ad accounts by OU Import-Module ActiveDirectory

  • Get-ADUser -Filter * -SearchBase "OU=TestOU,DC=TestDomain,DC=Local" | Set-ADUser -PasswordNeverExpires:$True

Search for adusers using powershell:

Can be used with various options: DistinguishedName, Enabled, GivenName, Name, ObjectClass, Object GUID, SamAccountName, SID, Surname, UserPrincipalName.

get-aduser -filter "name -eq '<name of user>'"

Unlock user account:

  • Get-ADuser -identity <username> | unlock-ADaccount

Check for lock status:

  • Get-ADuser -Identity <username> -properties Lockedout

Powershell for Admin

Get powershell update

Get FSMO roles on which domain controllers at domain level: 

Get-ADDomain | Select-Object InfrastructureMaster,PDCEmulator,RIDMaster | Format-List

Get FSMO roles on which domain controllers at forest level: 

Get-ADForest | Select-Object DomainNamingMaster,SchemaMaster | Format-List

Installing packages in powershell

Can use chocolatey to get packages: 

Set-ExecutionPolicy Unrestricted
iwr https://chocolatey.org/install.ps1 -UseBasicParsing | iex

For SSH connections:

Putty: 

choco install putty

OpenSSH: 

choco install openssh                # installs open ssh
refreshenv                           # reloads the environment variables
ssh remoteClient -i "MyKeyPair.pem"  # connects to remoteClient via ssh

poshSSH: 

Install-Module Posh-SSH                                   # installs the posh-ssh module
Get-Command -Module Posh-SSH                              # shows all posh-ssh commandlets
New-SSHSession myclient -KeyFile "c:\data\MyKeyPair.pem"  # connect to my client with the give keyfile
Invoke-SSHCommandStream "ifconfig" -SessionId 0           # send ifconfig to the ssh session with id 0
Invoke-SSHCommand -SessionId 0 -Command "ifconfig"        # send ifconfig to the ssh session with id 0 
Invoke-SSHCommand -SessionId 0 -Command "logout"          # send logout to the ssh session with id 0
Remove-SSHSession 0                                       # removes and closes the ssh session

For firefox: 

choco install firefox -y


Powershell Alias

gsv Get-Service

spsv Stop-Service

sasv Start-Service

Powershell for Services and Processes

Get all properties of a service and display specific properties of the service:

  • get-service | get-member
  • get-service wuauserv | select Displayname,Status,ServiceName,Can*

Display list of only running services:

  • Get-Service | Where-Object {$_.Status -EQ "Running"}

Remotely Check Service:

  • get-service wuauserv -ComputerName remotePC1

Get Service PID to kill process:

  • $ServicePID = (get-wmiobject win32_service | where { $_.name -eq 'service name'}).processID
  • Stop-Process $ServicePID -Force

Get top 10 processes by memory usage

  • Get-Process | Select-Object name,workingset64 | Sort-Object -Property workingset64 -Descending | Select-Object -First 10

Get User Process with an active GUI (no background processes will be displayed:

  • Get-Process | Where-Object {$_.mainWindowTitle}


Encrypt Passwords for use in Powershell scripts - scheduled tasks

Use the convertfrom-securestring command to take a secure string (password) then store as a file eg:

  • $SecurePassword = Read-host -AsSecureString | ConvertFrom-SecureString
  • $SecurePassword | Out-File -FilePath "C:\Encryptedpassword.key"

To use the the passwords in a script use the get-content:

  • $username = "Administrator"
  • $password = Get-Content "C:\Encrypted.key" | ConvertTo-SecureString
  • $credential = New-Object System.Management.Automation.PsCredential($username,$password)

If you want to encrypt the username and password you can do the following:

  • $securecred = Get-Credential
  • $securecred.UserName | ConvertTo-SecureString -AsPlainText -Force | ConvertFrom-SecureString | set-content "C:\Username.key"
  • $securecred.Password | ConvertFrom-SecureString | set-content "C:\Password.key"

They are stored in separate files

Retrieved from ‘http://piszczynski.com/index.php?title=Powershell&oldid=594’
Last modified
This page was last modified on 5 August 2022, at 12:22.