Category: Microsoft Windows

# Add New Registry Key
$regHive='REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM'
$keyname='OleDbTimeout'
$value=600
Set-ItemProperty -Path $regHive -Name $keyname -value $value

# Validation
Get-ItemProperty $regHive -name $keyname

PS C:\Users\backupadmin> Get-ItemProperty $regHive -name $keyname
OleDbTimeout : 600
PSPath       : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
PSChildName  : MSCRM
PSProvider   : Microsoft.PowerShell.Core\Registry

# Remove Registry Key
$regHive='REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM'
$keyname='OleDbTimeout'
Remove-ItemProperty -Path $regHive -Name $keyname -value $value

# setServiceStartupMode.ps1

$computernames=@(
    'TESTWINDOWS001',
    'TESTWINDOWS002'
)
$servicename='TrustedInstaller'
$startupType='Automatic'

foreach ($computername in $computernames){
    Set-Service -computername $computername -Name $servicename -StartupType $startupType
    Get-Service -computername $computername -Name $servicename|start-service
}

Get-Service -computername $computernames -Name $servicename

$path='C:\Windows\servicing'
$accountsToAdd='Administrators'
$permissions='Full'

function addNtfsPermissions ($path,$accountsToAdd,$permissions){
  $acl = Get-ACL $path
  $accessRule=New-Object System.Security.AccessControl.FileSystemAccessRule($accountsToAdd,$permissions,"Allow")
  $acl.AddAccessRule($accessRule)
  Set-Acl $path $acl
  Get-ACL $path
}

addNtfsPermissions $path $accountsToAdd $permissions

$computernames=@(
  'TESTWINDOWS1',
  'TESTWINDOWS2'
  )

$path='C:\Windows\servicing'
$accountsToAdd='Administrators'
$permissions='Full'

function addNtfsPermissions ($path,$accountsToAdd,$permissions){
  $acl = Get-ACL $path
  $accessRule=New-Object System.Security.AccessControl.FileSystemAccessRule($accountsToAdd,$permissions,"Allow")
  $acl.AddAccessRule($accessRule)
  Set-Acl $path $acl
  Get-ACL $path
}

foreach($computername in $computernames){
  invoke-command -computername $computername -scriptblock{
    param($addNtfsPermissions,$path,$accountsToAdd,$permissions)
    write-host "Invoking function on $env:computername"
    [scriptblock]::create($addNtfsPermissions).invoke($path,$accountsToAdd,$permissions)
    start-service trustedinstaller
    get-service trustedinstaller
  } -ArgumentList ${function:addNtfsPermissions},$path,$accountsToAdd,$permissions
}

[TESTWINDOWS]: PS C:\Users\kimconnect\Documents> Get-ACL $localPath|select *

PSPath                  : Microsoft.PowerShell.Core\FileSystem::C:\Windows\servicing
PSParentPath            : Microsoft.PowerShell.Core\FileSystem::C:\Windows
PSChildName             : servicing
PSDrive                 : C
PSProvider              : Microsoft.PowerShell.Core\FileSystem
CentralAccessPolicyId   :
CentralAccessPolicyName :
Path                    : Microsoft.PowerShell.Core\FileSystem::C:\Windows\servicing
Owner                   : NT SERVICE\TrustedInstaller
Group                   : NT SERVICE\TrustedInstaller
Access                  : {System.Security.AccessControl.FileSystemAccessRule,
                          System.Security.AccessControl.FileSystemAccessRule,
                          System.Security.AccessControl.FileSystemAccessRule,
                          System.Security.AccessControl.FileSystemAccessRule...}
Sddl                    : O:S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464G:S-1-5-80-956008885-34185226
                          49-1831038044-1853292631-2271478464D:PAI(A;OICIIO;GXGR;;;SY)(A;;0x1200a9;;;SY)(A;;FA;;;BA)(A;
                          OICIIO;GXGR;;;BA)(A;OICIIO;GXGR;;;BU)(A;;0x1200a9;;;BU)(A;OICIIO;GA;;;S-1-5-80-956008885-3418
                          522649-1831038044-1853292631-2271478464)(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-185
                          3292631-2271478464)(A;;0x1200a9;;;AC)(A;OICIIO;GXGR;;;AC)(A;;0x1200a9;;;S-1-15-2-2)(A;OICIIO;
                          GXGR;;;S-1-15-2-2)
AccessToString          : NT AUTHORITY\SYSTEM Allow  -1610612736
                          NT AUTHORITY\SYSTEM Allow  ReadAndExecute, Synchronize
                          BUILTIN\Administrators Allow  FullControl
                          BUILTIN\Administrators Allow  -1610612736
                          BUILTIN\Users Allow  -1610612736
                          BUILTIN\Users Allow  ReadAndExecute, Synchronize
                          NT SERVICE\TrustedInstaller Allow  268435456
                          NT SERVICE\TrustedInstaller Allow  FullControl
                          APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow  ReadAndExecute, Synchronize
                          APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow  -1610612736
                          APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES Allow  ReadAndExecute,
                          Synchronize
                          APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES Allow  -1610612736
AuditToString           :
AccessRightType         : System.Security.AccessControl.FileSystemRights
AccessRuleType          : System.Security.AccessControl.FileSystemAccessRule
AuditRuleType           : System.Security.AccessControl.FileSystemAuditRule
AreAccessRulesProtected : True
AreAuditRulesProtected  : False
AreAccessRulesCanonical : True
AreAuditRulesCanonical  : True

[TESTWINDOWS]: PS C:\Users\kimconnect\Documents> get-service trustedinstaller
Status   Name               DisplayName
------   ----               -----------
Stopped  trustedinstaller   Windows Modules Installer

[TESTWINDOWS]: PS C:\Users\kimconnect\Documents> get-service trustedinstaller|start-service
[TESTWINDOWS]: PS C:\Users\kimconnect\Documents> get-service trustedinstaller
Status   Name               DisplayName
------   ----               -----------
Running  trustedinstaller   Windows Modules Installer

PS C:\Windows\system32> get-service -Name trustedinstaller -ComputerName $computernames|start-service

PS C:\Windows\system32> get-service -Name trustedinstaller -ComputerName $computernames|select MachineName,ServiceName,S
tartType,Status

MachineName     ServiceName      StartType  Status
-----------     -----------      ---------  ------
TESTWINDOWS0001 trustedinstaller    Manual Running
TESTWINDOWS0002 trustedinstaller    Manual Running

# Search for Windows computers in a certain subnet using Active Directory
$subnetQuery='10.10'
$filterString='2016'
$computers=Get-ADComputer -Filter "enabled -eq 'true' -and OperatingSystem -like '*$filterString*'"`
-Properties Name,Operatingsystem,OperatingSystemVersion,IPv4Address |
Sort-Object -Property Operatingsystem | Select-Object -Property Name,Operatingsystem,OperatingSystemVersion,IPv4Address
$results=$computers|?{$_.IPv4Address|?{[string]$_ -like "*$subnetQuery*"}}
write-host "$($results.count) computer(s) have been matched.`r`n$results"

# Sample output
Name            Operatingsystem              OperatingSystemVersion IPv4Address
----            ---------------              ---------------------- -----------
SERVER-NAME-001 Windows Server 2016 Standard 10.0 (14393)           10.10.120.9
SERVER-NAME-002 Windows Server 2016 Standard 10.0 (14393)           10.10.120.10
------ Results truncated ---------

# copyADUser.ps1
# Version 0.01

$fromUsername='mTyson'
$newUserFirstname='Bruce'
$newUserLastname='Lee'
$newPassword='SOMEPASSWORD'
$newEmailAddress='bruce.lee@kimconnect.com'
$setProxyAddress=$false

function copyADUser{
  param(
    $fromUsername,
    $newUserFirstname,
    $newUserLastname,
    $newPassword,
    $newEmailAddress,
    $setProxyAddress=$false
  )
  try{
    Import-Module activedirectory
  }catch{
    write-warning $_
    return $false
  }
  $availableUserName=.{
    $index=0
    $x=($newUserFirstname.toLower())[$index]+$newUserLastname.tolower()
    do{
      $usernameExists=try{$null=get-aduser $x;$true}catch{$false}
      if($usernameExists){
        $index+=1
        $x=(($newUserFirstname.toLower())[0..$index] -join '')+$newUserLastname.tolower()
      }else{
        return $x
      }
    }until(!$usernameExists -or $newUserFirstname.length+$newUserLastname.length -eq $x.length)
    $number=1
    $x=($newUserFirstname.toLower())[$index]+$newUserLastname.tolower()
    do{
      $y=$x+"$number"
      $usernameExists=try{$null=get-aduser $y;$true}catch{$false}
      if($usernameExists){
        $number+=1
        $y=$x+"$number"
      }else{
        return $y
      }      
    }until($number -ge 10000)
    return $null
  }
  if(!$availableUserName){
    write-warning "Unable to proceed due to username being NOT available."
    return $false
  }
  function copyGroupMemberships($fromIdentity,$toIdentity){
    $ErrorActionPreference='stop'
    try{
      Import-module activedirectory
      $groupNames=(Get-ADPrincipalGroupMembership $fromIdentity).Name
      $groupNames|%{try{Add-ADGroupMember -Identity "$_" -Members $toIdentity -ea SilentlyContinue}catch{}}
      $currentMemberships=(Get-ADPrincipalGroupMembership $toIdentity).Name
      write-host "User '$env:USERDOMAIN\$toIdentity' now has these memberships:`r`n---------------------------------`r`n$($currentMemberships|out-string)"
      return $true
    }catch{
      write-warning $_
      return $false
    }
  }

  $fullName=$newUserFirstname+' '+$newUserLastname
  $newPrinciplename=$availableUserName+'@'+$env:USERDNSDOMAIN
  $securedPass=(ConvertTo-SecureString $newPassword -AsPlainText -Force)
  write-host "Creating UserID '$availableUserName' with full name of '$fullname', and setting the password of '$newPassword'"
  try{
    $copyAttributes=Get-ADUser -Identity $fromUsername -Properties StreetAddress,City,Title,PostalCode,Office,Department,Manager
    $targetOu=.{
      $x=((Get-aduser $fromUsername).DistinguishedName -split ',')
      return $x[1..$x.length] -join ','
    }
    New-ADUser -SAMAccountName $availableUserName -Name $fullName -GivenName $newUserFirstname -Surname $newUserLastname -Instance $copyAttributes -DisplayName $fullName -UserPrincipalName $newPrincipleName -AccountPassword $securedPass -ChangePasswordAtLogon $false -Enabled $true
    Set-ADUser -Identity $availableUserName -EmailAddress $newEmailAddress
    if($setProxyAddress){
      Set-ADUser -Identity $availableUserName -Add @{proxyAddresses="SMTP:$newEmailAddress";proxyAddressesForGapps="SMTP:$newEmailAddress"}
    }

    # This error would occur if UserPrincipleName is not specified or having conflicts
    # New-ADUser : The operation failed because UPN value provided for addition/modification is not unique forest-wide
    # At line:1 char:5
    # +     New-ADUser -Name $fullName -GivenName $newUserFirstname -Surname  ...
    # +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    #     + CategoryInfo          : NotSpecified: (CN=Bruce Lee...DC=kimconnect,DC=com:String) [New-ADUser], ADException
    #     + FullyQualifiedErrorId : ActiveDirectoryServer:8648,Microsoft.ActiveDirectory.Management.Commands.NewADUser

    $currentIdentity=(Get-aduser $availableUserName).DistinguishedName
    Move-ADObject -Identity $currentIdentity -TargetPath $targetOu
    copyGroupMemberships $fromUsername $availableUserName
    return $true
  }catch{
    write-warning $_
    return $false
  }
}

copyADUser $fromUsername `
  $newUserFirstname `
  $newUserLastname `
  $newPassword `
  $newEmailAddress `
  $setProxyAddress

$newVmNames=@(
    'SERVER0001', 
    'SERVER0002'
)
$newUsers=@(
    'domain\user1'
)
$groupNames='Administrators','Remote Desktop Users'

$newVmNames|%{
    invoke-command -computername $_ {
        param($newUsers,$groupNames)
        try{            
            $groupNames|%{
                Add-LocalGroupMember -Group $_ -Member $newUsers
                write-host "$env:computername`: Group name '$groupName' now has these users`r`n$(get-localgroupmember $groupName)"
            }
        }catch{
            write-warning $_
        }        
    } -ArgumentList $newUsers,$groupNames
}

# To disable service as well as stopping it, assuming that the service does not have dependencies
$serviceName='windows_exporter'
$computernames=@('SERVER02','SERVER03')
$setStatus='stopped'
$setStartup='disabled'

Set-Service -Name $serviceName -Status $setStatus -StartupType $setStartup -computername $computernames

# Possible error: this means the service cannot be disabled without disabling its upstream parent services
Set-Service : Cannot stop service 'windows_exporter (windows_exporter)' because it is dependent on other services.
At line:1 char:1
+ Set-Service -Name $serviceName -Status stopped -StartupType disabled  ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.ServiceProcess.ServiceController:ServiceController) [Set-Service], ServiceCommandException
    + FullyQualifiedErrorId : ServiceIsDependentOnNoForce,Microsoft.PowerShell.Commands.SetServiceCommand

$computernames=@('SERVER01','SERVER02')
$serviceName='windows_exporter'
$action='start' # or stop

function setService{
    param(
        $computernames=$env:computername,
        $serviceName='RemoteRegistry',
        $action='start' # or stop
    )
    $computernames|%{Start-Process "$env:WINDIR\system32\sc.exe" \\$_,start,$serviceName -NoNewWindow -Wait}
}

setService $computerNames $serviceName $action

# To simply stop or start a service using the legacy tool SC.EXE on a list of servers
$computerNames=$env:computername
$serviceName='windows_exporter'
$action='start' # or stop
$computernames|%{Start-Process "$env:WINDIR\system32\sc.exe" \\$_,$action,$serviceName -NoNewWindow -Wait}

# Note: The native stop-service Powershell command does not have a computername parameter; Hence, the native command above is used as a workaround
Stop-Service : A parameter cannot be found that matches parameter name 'computername'.
At line:1 char:14
+ stop-service -computername $computernames -name $servicename -force
+              ~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Stop-Service], ParameterBindingException
    + FullyQualifiedErrorId : NamedParameterNotFound,Microsoft.PowerShell.Commands.StopServiceCommand

# Sample output
SERVICE_NAME: windows_exporter
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 3  STOP_PENDING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

PS C:\Users\administrator> get-service windows_exporter -computername $computernames|select MachineName,Name,Status

MachineName   Name              Status
-----------   ----              ------
dev01 windows_exporter Stopped
dev02  windows_exporter Stopped
dev03   windows_exporter Stopped
dev04   windows_exporter Stopped

$accountsToAdd='intranet\user1','intranet\user2'
$localgroup='Remote Desktop Users'

# Check on whether certain accounts exist in a local group
invoke-command -scriptblock{
            param($principleNames,$groupName)
            $results=@()
            $currentMembers=try{
                (get-localgroupmember $groupName -ea stop).Name
            }catch{
                $x=net localgroup $groupName
                $x[6..$($x.length-3)]
            }
            write-host "Current members of $groupName`:`r`n$($currentMembers|out-string)"
            foreach($principle in $principleNames){
                $results+=[pscustomobject]@{
                    computername=$env:computername
                    groupname=$groupName
                    userName=$principle
                    usernameIsMember=[bool]($principle -in $currentMembers)
                }
            }
            return $results
        } -ArgumentList $accountsToAdd,$localGroup

$accountsToAdd='intranet\user1','intranet\user2'
$localgroup='Remote Desktop Users'

# Check on whether certain accounts exist in a local group
invoke-command -scriptblock{
            param($principleNames,$groupName)
            $results=@()
            $currentMembers=try{
                (get-localgroupmember $groupName -ea stop).Name
            }catch{
                $x=net localgroup $groupName
                $x[6..$($x.length-3)]
            }
            write-host "Current members of $groupName`:`r`n$($currentMembers|out-string)"
            foreach($principle in $principleNames){
                $results+=[pscustomobject]@{
                    computername=$env:computername
                    groupname=$groupName
                    userName=$principle
                    usernameIsMember=[bool]($principle -in $currentMembers)
                }
            }
            return $results
        } -Args (,$accountsToAdd),$localGroup

# Sample Output:

WARNING: Cannot convert 'intranet\user1 intranet\user2' to the type 'Microsoft.PowerShell.Commands.LocalPrincipal' required by parameter 'Member'. Specified method is not supported.
Failed to compare two elements in the array.

# PowerShell
$computername='TESTSERVER'
Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration -Filter "IPEnabled='True'" -ComputerName $computername|Select-Object -Property MACAddress, Description

# Sample output:
MACAddress        Description
----------        -----------
BC:30:5B:XX:XX:XX Intel(R) Ethernet 10G 4P X540/I350 rNDC #2

# Command-line (can also be invoked in PowerShell)
getmac.exe /s COMPUTERNAMEHERE

# Sample output:
PS C:\Windows\system32> getmac.exe /s TESTSERVER01

Physical Address    Transport Name
=================== ==========================================================
BC-30-5B-F8-XX-XX   Media disconnected
BC-30-5B-F8-XX-XX   Media disconnected
BC-30-5B-F8-XX-XX   Media disconnected
BC-30-5B-F8-XX-XX   \Device\Tcpip_{XXXXXXXX-7399-4307-87BA-XXXXXXXX}

$accounts=@(
    'orange',
    'apple',
    'pear',
    'dog',
    'cat',
    'dinosaur',
    'chicken',
    'cow',
    'yomama',
    'yodada'
)
$accounts|%{try{Set-ADUser -Identity $_ -PasswordNeverExpires $false;write-host "$_ : done"}catch{write-warning "$_ : error"}}

'orange': done
'apple': done
'pear': done
'dog': done
'cat': done
'dinosaur': done
'chicken': done
'cow': done
'yomama': done
'yodada': done

  $requiredTls='Tls12'
  $availableSslProtocols=[enum]::getnames([net.securityprotocoltype])
  if([Net.ServicePointManager]::SecurityProtocol -notin $requiredTls -and $requiredTls -in $availableSslProtocols){
      [Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::$requiredTls
  }