sever audit

Get-ServiceAccounts posh

check powerpacks: Local System (Local System / Local Users and Groups) and Network
$administratorsAccount = Get-WmiObject Win32_Group -filter "LocalAccount=True AND SID='S-1-5-32-544'"

last login

$administratorQuery = "GroupComponent = `"Win32_Group.Domain='" + $administratorsAccount.Domain + "',NAME='" + $administratorsAccount.Name + "'`""
$user = Get-WmiObject Win32_GroupUser -filter $administratorQuery | select PartComponent |where {$_ -match $userToFind}
$user

Binding to Active Directory objects with the WinNT provider

 ENUMERATING users\GROUPS IN A COMPUTER

local accts

List the Local Users on a Set of Computers

Submitted by: Robert Cott

List Members of the Local Administrators Group

Submitted by: Anonymous Submission

Add Users to the Local Administrators Group or other local group

Submitted by Jimmy Godard

sub localAccts(strComputer)

Dim objNetwork,  objComputer, objUser 

Set objNetwork = CreateObject("Wscript.Network") 

strComputer = objNetwork.ComputerName 

'Set objComputer = GetObject("WinNT://" & strComputer) 

objComputer.Filter = Array("user") 

For Each objUser In objComputer 

    Wscript.Echo objUser.Name & ", " & objUser.Description 

Next 

end Sub

Dude, where’s my script ?

function Get-ScriptPath{     Split-Path $myInvocation.ScriptName 

}

cls

$a = Get-ScriptPath

$a


$b = & { $myInvocation.ScriptName }


$b

split-path $b   


split-path info


# PowerShell's Split-Path can do this for you: 
# parent path: 
split-path c:\myproject\Csharpproject\memo.txt -Parent 
# same as above, w/o the -Parent switch: 
split-path c:\myproject\Csharpproject\memo.txt 
# file name: 
split-path c:\myproject\Csharpproject\memo.txt -Leaf 

# ...and more: 
split-path c:\myproject\Csharpproject\memo.txt -Qualifier 
split-path c:\myproject\Csharpproject\memo.txt -NoQualifier 
split-path c:\myproject\Csharpproject\memo.txt -IsAbsolute 


Get the Data You Need

Select-Properties: a helper for exporting DirectoryEntry objects

Microcode: PowerShell Scripting Tricks: Select-Object (Note Properties) vs Add-Member (Script Properties)

ServerAuditReports

Day 7: Manage Users< 

scheduledTasks

powershellPing

# This is the key part

$ping = new-object System.Net.NetworkInformation.Ping

$Reply = $ping.send($strComputer)

if ($Reply.status –eq “Success”) 

{

# do somethine if online

}

else 

{

# do somethine if NOT online

}

$Reply = ""

Get-QADComputer -sizeLimit 0 -osName *Server* | Where-Object { (Get-WmiObject Win32_PingStatus -Filter "Address='$($_.DNSHostName)'").StatusCode -eq 0 } | Foreach-Object { 

  # Do your other work here

}

function Ping-Address {

  PROCESS {

    $ping = $false

    $results = Get-WmiObject -query `

    "SELECT * FROM Win32_PingStatus WHERE Address = '$_'"

    foreach ($result in $results) {

      if ($results.StatusCode -eq 0) {

        $ping = $true

      }

     }

     if ($ping -eq $true) {

       Write-Output $_

     }

   }

 }

 

 function Restart-Computer {

   PROCESS {

     $computer = Get-WmiObject Win32_OperatingSystem -computer $_

     $computer.Reboot()

   }

 }

Ping-Address and Restart-Computer

.net ping

Finding Services Using non-System Accounts With PowerShell

What functions are there in powershell to determine when password was last set. 

google search results 4 powershell pwdLastSet "get-qadcomputer"

performing-networking-tasks-pinging-from-powershell

move an sms 2003 collection

# powershell script to move a sms 2003 collection from one parent collection to another then
# request refresh of the parent collections

# replace the collection IDs with your own

# collection to move and its original and new parents collection IDs
$origParent = "C0100026" # collectionID of original parent of the collection to be moved
$coll2Move1 = "C01000B8" # ollectionID of the collection to be moved
$newParent = "C01002BC" # collectionID of the new parent of the collection to be moved
$collectionarray = $origParent,$newParent

$Computer = "your sms site server" # replace with your data
$CollectionClass = "SMS_Collection"
$collectToSubCollectionClass = "SMS_CollectToSubCollect"
$smsNameSpace = "root\SMS\your sms site code" # replace with your data
$Method = "RequestRefresh"

$c = Get-WmiObject -class $collectToSubCollectionClass -namespace $smsNameSpace -computerName $Computer
Where-Object {
$_.parentCollectionID -match $origParent -and $_.subCollectionID -match $coll2Move1
}
$c
# set new parent relationship
foreach ($item in $c)
{
Write-Host $c.parentCollectionID
Write-Host $c.subCollectionID
$c.parentCollectionID = $newParent
$c.put()
}
# delete old relationalship
$c = Get-WmiObject -class $collectToSubCollectionClass -namespace $smsNameSpace -computerName $Computer
Where-Object {
$_.parentCollectionID -match $origParent -and $_.subCollectionID -match $coll2Move1
}
$c.Delete()
#refresh collections
#adapted from SMS_Collection Method : RequestRefresh method script generated by PowerShell WmiExplorer
#
# /\/\o\/\/ 2006
# www.ThePowerShellGuy.com
#
foreach ($memb in $collectionarray)
{
write-host "The value in the current element is $memb"
# SMS_Collection. Key Properties :
# $CollectionID = $memb
$filter="CollectionID = '$memb'"
$MC = get-WMIObject $CollectionClass -computer $Computer -Namespace $smsNameSpace -filter $filter
# $MC = [Wmi]"\\$Computer\Root\CimV2:$Class.$filter"
$InParams = $mc.psbase.GetMethodParameters($Method)
$InParams.includesubcollections = $false
# "Calling SMS_Collection. : RequestRefresh with Parameters :"
$inparams.PSBase.properties select name,Value format-Table
$R = $mc.PSBase.InvokeMethod($Method, $inParams, $Null)
"Result :"
$R Format-list
}

projects

this section will be where i will post scripts that i have used in my job.
for while i may have written these scripts they are authored by the suggestions from the community to whom i, and if you find the scripts valuabe, ow a greate debt of thanks