Here's a small PowerShell command/module I've written. It contains the following reports.

Usage:

Find-Events -Report ADGroupMembershipChanges -DatesRange Last3days -Servers AD1, AD2 | Format-Table -AutoSize

ReportTypes:

• Computer changes – Created / Changed – ADComputerCreatedChanged

• Computer changes – Detailed – ADComputerChangesDetailed

• Computer deleted – ADComputerDeleted

• Group changes – ADGroupChanges

• Group changes – Detailed – ADGroupChangesDetailed

• Group changes – Created / Deleted – ADGroupCreateDelete

• Group enumeration – ADGroupEnumeration

• Group membership changes – ADGroupMembershipChanges

• Group policy changes – ADGroupPolicyChanges

• Logs Cleared Other – ADLogsClearedOther

• Logs Cleared Security – ADLogsClearedSecurity

• User changes – ADUserChanges

• User changes detailed – ADUserChangesDetailed

• User lockouts – ADUserLockouts

• User logon – ADUserLogon

• User logon Kerberos – ADUserLogonKerberos

• User status changes – ADUserStatus

• User unlocks – ADUserUnlocked

DatesRanges are also provided. Basically what that command does it scans DC's for event types you want it to scan. It does that in parallel, it overcomes limitations of Get-WinEvent and generally prettifies output.

The output of that command (wrapped in Dashimo to show the data): https://evotec.xyz/wp-content/uploads/2019/04/DashboardFromEvents.html

GitHub Sources: https://github.com/EvotecIT/PSWinReporting

Full article (usage/know-how): https://evotec.xyz/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/

Hope you like it :-)

So in march 2020, Microsoft is supposed to block insecure LDAP bindings. I've updated my 3 Powershell modules to help you track down machines/accounts doing that.

Blog post with know-how and images: https://evotec.xyz/four-commands-to-help-you-track-down-insecure-ldap-bindings-before-march-2020/

Instead of spending time manually scrolling thru logs or enabling LDAP diagnostics... you do it in 8 lines of code

To find out about events:

$Events = Find-Events -Report LdapBindingsDetails,LdapBindingsSummary -DatesRange Last7days -DetectDC
$Events
$EVents.LdapBindingsSummary | Out-htmlView -ScrollX
$Events.LdapBindingsDetails | Out-HtmlView -ScrollX

To enable/disable diagnostics on whole forest/domain with the ability to exclude/include

Get-WinADDiagnostics
Set-WinADDiagnostics -Diagnostics 'LDAP Interface Events' -Level Basic -SkipRoDC

To scan DC's and see if they are affected.

invoke-testimo -Sources DCLDAPInsecureBindings -showreport

More information is in the blog post. Enjoy

Hello Everyone,

In the last 2 years, I've written over 40 PowerShell modules releasing them all for free on GitHub and providing an overview on my blog. The blog is free, it has no ads, it doesn't cost anything except my time to prepare it and money to host it.

Summary blog posts with description/screenshots and links to sources: https://evotec.xyz/powershell-modules-ive-worked-on-in-2019

Here's a list of +-40 PowerShell Modules I've created over the last 2 years. There are modules that provide a full spectrum of options for anyone interested:

• Active Directory Functions

• Word creating/reading

• PDF creating/split/merge

• HTML creating without zero HTML/CSS/js knowledge

• HTML parsing

• RSS

• SIEM, Event Logs

• Microsoft Teams

• Discord

• Lansweeper

And many others.

As PowerShell is no longer Windows only some of those modules work just fine on Linux and macOS. Usually, PowerShell 5.1, PowerShell 6 and PowerShell 7 are supported if the underlying .NET provides that option.

All those modules are free, fully open source.

• In 2018 I've written 21 of them

• In 2019 another 20

In 2020 I plan to reduce the number of modules integrating some of the stuff together, however, it's possible new ones will be born.

As I don't have too much place here to provide a full overview of it here I do encourage you to visit blog post I wrote that covers in the summary which module does what and how you can use it. I've logged 1,427 hours on, on average, of 3 hrs 59 mins per day. my best day was Feb 17, 2019, with 10 hrs 22 mins.

With regards,

MadBoyEvo

Hi! I've been working on these scripts for the last year and just today I have released a GUI for it. I wanted to share this since it seems that more people have been using it lately.

This started off as a way for me to learn PowerShell and it kind of took off from there.

https://github.com/Sycnex/Windows10Debloater

Bottom line: "Gotta catch 'em all"

If a JRE manages to squeak through, post here or PM me and I'll update the script to catch it.

UPDATE 2024-04-30: I am still actively maintaining this script and will continue to do so for the foreseeable future. PM me if you have any problems with it.

Because of inconsistencies in Sun/Oracle's installation methods and naming conventions, there's no "one way" to purge every outdated Java Runtime from a machine, so I spent 15 18 ~23 hours collecting various methods of removing Java and integrated them into a single script. This should give you a "clean slate" to work with for laying down new versions of Java.

---->> Download from Github here <<----

Notes:

• Removes all versions of the Java Runtime Environment (series 3 through 11), x86 and x64

• Will catch future updates to JRE 5, 6, 7, 8, 9, 10, 11+

• Checks WMI before running, repairs if broken

• Searches for residual registry keys, backs them up, then deletes them*

• Searches for residual files and directories and deletes them

• Removes the Java Quickstarter and Java Updater services

• Leaves all Java Development Kit installations intact

• Writes a logfile to C:\Logs\<hostname>_java_runtime_removal.log (configurable)

If you have additional methods that work for you, please post them below or do a PR on Github. If they catch something the script misses, I will integrate them. Critique and advice welcome.

*Registry cleanup is skipped on Windows XP. This is because of differences in the reg.exe binary on XP. If anyone can look at how to search the Windows XP registry for leftover keys, I can integrate it into the script, but right now that section is skipped.

1. Configure Event Logs:

Run eventvwr.msc → Windows Logs → Right-click “Application” log → Properties: Make sure the “Enable logging” check box is selected Increase the log size for at least 1gb Set retention method to “Overwrite events as needed” or “Archive the log when full”.

2) Creating an alert:

To create an instant alert that is triggered upon any software installation, you need to edit the following powershell script by setting your parameters up and saving it anywhere as .ps1 file (e.g., detect_software.ps1):

3) Code:

$Subject = “New Software Has Been Installed” # Message Subject 
$Server = “smtp.server” # SMTP Server 
$From = “[email protected]” # From whom we are sending an   e-mail(add anonymous logon permission if needed) 
$To = “[email protected]” # To whom we are sending 
$Pwd = ConvertTo-SecureString “enterpassword” -AsPlainText –Force #Sender account password 
#(Warning! Use a very restricted account for the sender,  because the password stored in the script will be not encrypted) 
$Cred = New-Object  System.Management.Automation.PSCredential(“[email protected] m” , $Pwd) #Sender account credentials 
$encoding = [System.Text.Encoding]::UTF8 #Setting encoding to UTF8 for message correct display 
#Powershell command for filtering the security log about software installation event 
$Body=Get-WinEvent -FilterHashtable @{LogName=”Application”;ID=11707;ProviderName='MsiInstaller'} | Select TimeCreated, Message, UserID | select-object -first 1 
#Sending an e-mail. 
Send-MailMessage -From $From -To $To -SmtpServer $Server - Body “$Body” -Subject $Subject -Credential   $Cred -Encoding  $encoding

4) Create new scheduled task

Run Task Scheduler → Create new schedule task → Enter its name → Triggers tab → New trigger → Set up the following options: Begin the task on an event Log – Application Source – Blank EventID – 11707.

5)Action settings

Go to the Actions Tab → New action with following parameters: Action – Start a program Program script: powershell Add arguments (optional): -File "specify file path to our script" Click “OK”.

Now you will be notified about every software installation on your Windows server via e-mail message that will contain details on software installation time, software name and installer’s userID (SID).

6) Convert SID to username:

$objSID = New-Object System.Security.Principal.SecurityIdentifier("Enter your SID Here") 
$objUser =        $objSID.Translate([System.Security.Principal.NTAccount]) 
$objUser.Value

We're using Azure Functions to add Exchange Transport Rules to our customers' tenants to help spot phishing emails with a recognizable display name.

If an external sender has the same display name of someone in your organisation, a warning is added to the top of the email to let them know.

Here's a guide on how to set this up for your own, or your customer's, Office 365 tenants.

Hello,

I wrote this nice PowerShell module, PasswordSolution, in the last couple of months. It has two functionalities:

• send password notifications to users (not today's topic, separate blog post coming)

• analyze active directory passwords (today's topic)

The feature to analyze active directory passwords utilizes the DSInternals PowerShell module and provides HTML-based reports around its output, making it nice and pretty, ready for management.

By running the command (yes, it's a single line after installing 2 PS Modules):

Show-PasswordQuality -FilePath C:\Temp\PasswordQuality.html -WeakPasswords "Test1", "Test2", "Test3" -Verbose -SeparateDuplicateGroups -AddWorldMap -PassThru

It will create an HTML report and analyze password hashes of all users in Active Directory, find duplicate passwords between user groups, and finds who's using weak passwords provided along with several other problems around passwords hygiene:

• AESKeysMissing

• DESEncryptionOnly

• DelegatableAdmins

• DuplicatePasswordGroups

• DuplicatePasswordUsers

• ClearTextPassword

• LMHash

• EmptyPassword

• WeakPassword

• PasswordNotRequired

• PasswordNeverExpires

• PreAuthNotRequired

• Kerberoastable

• SmartCardUsersWithPassword

While it uses DSInternals for the data, it then prettifies the output by using PSWriteHTML and ActiveDirectory module to make sure it gives you a complete picture

The blog post about it:

• https://evotec.xyz/strengthening-password-security-in-active-directory-a-powershell-powered-approach/

Sources:

• https://github.com/EvotecIT/PasswordSolution

Here's what you get after you run this little function

Useful PowerShell modules for any occasion: https://evotec.xyz/sixteen-powershell-modules-that-ive-worked-on-in-2018/

I see requests here for some common Active Directory tasks such as disabling inactive accounts or checking group members and thought some of the scripts I have written may be of use to those starting out.

Let me know any questions/thoughts/improvements.

http://www.roggy.uk/blog

For the last few weeks, I've been working on a PowerShell module that reads and configures Office 365 that are (in large portions) not available to read or configure using official Microsoft PowerShell modules.

To introduce you to it a bit more: https://evotec.xyz/configuring-office-365-settings-using-powershell-the-non-supported-way/ with screenshots and how things work.

Sources available: https://github.com/EvotecIT/O365Essentials/

Here's the current command list. I've few non-working commands because of some problems, but most of them work great.

As you can see above, the list is quite comprehensive and allows you to get or set settings for multiple apps, change bing settings, read domains health status, DNS records, licenses, or domain dependencies. This was only possible by reverse engineering how Microsoft does it while you click thru GUI.

I hope this helps someone other than me. Enjoy

Hi everyone, a few comments in /r/sysadmin prompted me to start looking at options to remove some of the less-desireable features and options from Windows 10 and I thought it might be neat if we try and work to come up with something together.

The user I am picturing running this is someone in Operations that might want to include as a post-installation task when imaging a laptop. The things we'd like to remove or disable are Wi-Fi Sense, Customer Improvement Experience Program, Onedrive, Cortana, ErrorReporting, P2P WSUS Sharing, and any other modern apps people want to suggest like Xboxapp.

What I have so far is very simple, if you run get-appxpackage -allusers you can see a list of modern apps installed for all users, for additional readability pipe to select name

get-appxpackage -allusers | select name

There are a number of options to remove here, such as Cortana and the Xboxapp, however I see two problems with using "remove-appxpackage -package xxxxx" in that you can't specify multiple packages (unless I'm blind, very possible) and that this cmdlet lacks a switch to remove it for -allusers. Using the cmdlet as-is only uninstalls it for the current user.

If anyone has suggestions for packages they'd like removed or has ideas to contribute, please leave them here. I'll keep looking for how I might adjust the options for the non-modern-app packages like WiFi Sense

Some time ago I really wanted to create PSWriteVisio to be able to create some simple diagrams so I could automate some of my needs for graphs. I expected it to be a pain, going thru XML, finding out how Visio document is built and then finally using different Visio objects and trying to automate how objects are placed. I've planned this exercise for 2020 but it seems I won't have to do it.

As part of PSWriteHTML, I've added an ability to create easy to use diagrams

New-HTML -TitleText 'My diagram' -UseCssLinks -UseJavaScriptLinks -FilePath $PSScriptRoot\Example-Easy.html {
    New-HTMLPanel {
        New-HTMLDiagram {
            New-DiagramNode -Label 'One node' -To 'Second node', 'Third node' -ColorBackground Bisque
            New-DiagramNode -Label 'Second node'
            New-DiagramNode -Label 'Third node'
        }
    }
} -ShowHTML

Or

New-HTML -TitleText 'My Ubiquiti Network' -UseCssLinks:$true -UseJavaScriptLinks:$true -FilePath $PSScriptRoot\Example-ID.html {
    New-HTMLSection -HeaderText 'Diagram - My Network' -CanCollapse {
        New-HTMLDiagram -Height '1000px' {
            New-DiagramOptionsInteraction -Hover $true
            New-DiagramOptionsPhysics
            New-DiagramOptionsLayout -RandomSeed 500
            New-DiagramNode -Label 'DC2' -IconSolid address-card -IconColor Green -To '17000', '17001'
            New-DiagramNode -ID '17000' -Label 'DC2'
            New-DiagramNode -ID '17001' -Label 'DC2'
        }
    }
} -ShowHTML

More code, harder examples in a blog post describing usage, some "workarounds". Code and samples on GitHub as well.

• Blog post: https://evotec.xyz/easy-way-to-create-diagrams-using-powershell-and-pswritehtml/

• Github Sources: https://github.com/EvotecIT/PSWriteHTML

PS. Dashimo has now been integrated into PSWriteHTML

PS2. There are about 50+ examples for PSWriteHTML on GitHub for different cool samples - for tables, charts, diagrams, and other stuff. Go an enjoy :-)

It's me again. Today you get 4 cmdlets:

• Get-WinADGroupMember

• Show-WinADGroupMember

• Get-WinADGroupMemberOf

• Show-WinADGroupMemberOf

Get cmdlets display group membership in console so you can work with it as you like. They show things like all members and nested members along with their groups, nesting level, whether group nesting is circular, what type of group it is, whether members of that group are cross-forest and what is their parent group within nesting, and some stats such as direct members, direct groups, indirect members and total members on each group level.

This allows for complete analysis of nested group membership. On top of that the Show commands display it all in nice Table that's exportable to Excel or CSV, Basic Diagram and Hierarchical diagrams making it super easy to understand how bad or good (very rarely) nesting is. They also allow to request more than one group at the same time so you can display them side by side for easy viewing. And on top of that they also provide Summary where you can put two or more groups on single diagram so you can analyze how requested groups interact with each other.

In other words - with one line of PowerShell you get to analyze your AD structure in no time :-)

Here's the blog post: https://evotec.xyz/visually-display-active-directory-nested-group-membership-using-powershell/

Sources/Issues/Feature Requests: https://github.com/EvotecIT/ADEssentials

Ok, so I got called at home for an outage a few weeks ago and had to walk our users yet again how to ping specific IP addresses. This has been enough of a headache over and over that I decided to just make a small GUI tool. I made this not long after in Powershell Studio 2015. I'm not sure it was the best way to put it all together, but it works fine for my purposes. Feel free to take this and turn it into what you want (or if you only want to edit it for your organization, have at it.)

Currently all device IPs are set to 8.8.8.8 (Google DNS) and the labels are set to generic "Device1", "Device2", etc. You should be able to find these without problem and change them to suit your needs.

When the user clicks "Go", it goes down the list and runs a Test-Connection on each IP address. I have mine configured for the "next hop" so it's easier to see where things stop. A text box was added so an IP can be typed in manually and it will be added to the list of devices to test.

I have also included the Powershell Studio 2015 source file in case you want to edit it further or change the GUI around. I'm going to cross-post this to /r/Powershell as well.

Pictures can be seen here: http://imgur.com/a/SR9A0

This is the OLD/ORIGINAL release. The new link is below.*** I zipped both files up and you can download here: https://drive.google.com/file/d/0B2qUAZfwYIRXQjBQbnpuRy14blE

Enjoy!

EDIT: I have since updated this tool with the below suggestions. I also cleaned up the code a good bit, and added comments that explain what is what. The IP address and Default Gateway now update each time the "Go" button is pressed. I really hope this helps someone out there.

Thanks to /u/kaltec for the assistance!

Here's a new screenshot: http://imgur.com/BMQZEta

The latest version (v1.1.0.1) can be downloaded here: https://drive.google.com/file/d/0B2qUAZfwYIRXRGVadmgxdVd1WjA

2nd EDIT: I have published this to Microsoft's Script Center as well. It can be found here: https://gallery.technet.microsoft.com/Interactive-Network-4e16b5f9

friendly boast cable boat distinct handle tidy childlike cows abounding

This post was mass deleted and anonymized with Redact

I have been inactive a little on Reddit in the last few months, but it's because I've lots of different projects that take time to make and polish correctly. By the end of the year, I've finally managed to release my PowerShell module that tries to solve people's most common needs when dealing with PowerShell images (aka pictures).

The module is called ImagePlayground here's a short list of features it currently has:

• Resize Images (Resize-Image)

• Convert Images between formats (ConvertTo-Image)

• Combine Images (Merge-Image)

• Create three types of charts (Bar, Line, Pie) in their basic form

• Get Image Exif Data

• Set Image Exif Data

• Remove Image Exif Data

• Add a watermark as a text or an image

• Manipulate image

  • By changing the background color,

  • Making it black and white,

  • Adding bokeh blur,

  • Changing brightness and contrast

  • Cropping

  • Flipping

  • Applying Gaussian Blur or Sharpening

  • Making it GrayScale

  • Applying Hue

  • Making it OilPaint

  • Making it Pixelate

  • Making it look like an old Polaroid

  • Resize

  • Rotate

  • Rotate and Flip

  • Saturate

• Create QR codes

  • Standard QR Code

  • WiFi QR Code

  • Contact QR Code

• Reading QR  codes

• Reading Barcodes

• Create Barcodes

It works on Windows, macOS, and Linux, except for Charts, which have some dependencies that are a bit harder to solve now.

I've prepared a short blog post showing how to use it, and what are the features and results:

• https://evotec.xyz/image-manipulation-image-resize-image-combine-and-more-with-powershell/

As always, sources are available on GitHub:

- https://github.com/EvotecIT/ImagePlayground

The module has an MIT license. If you have any issues, feature requests, or ideas feel free to open an issue on Github, or if you know how to improve things - PR would be welcome :-)

To give you some ideas on how to work with it

• To create a QR code:

New-ImageQRCode -Content 'https://evotec.xyz' -FilePath "$PSScriptRoot\Samples\QRCode.png"

• To create an Image Chart:

New-ImageChart {
    New-ImageChartBar -Value 5 -Label "C#"
    New-ImageChartBar -Value 12 -Label "C++"
    New-ImageChartBar -Value 10 -Label "PowerShell"
} -Show -FilePath $PSScriptRoot\Samples\ChartsBar1.png

The rest is on GitHub/blog post. I hope you enjoy this one as much as I do!

If you follow me on Twitter, you already know this one - for those that don't, lemme tell you that I've created a PowerShell module called PowerBGInfo. Since I made ImagePlayground (read about it on another post https://www.reddit.com/r/PowerShell/comments/102bvu2/image_manipulation_image_resizing_image/), I thought about what would be the best way to show its capabilities. Then I saw people complaining that BGInfo from Sysinternals in 2022 still need to add an option to run Powershell scripts to display data from PowerShell (they prefer the VBS option).

So having written ImagePlayground, I spent a few hours preparing an alternative to BGInfo. Fully built on PowerShell (well, with little .NET involved).

Here's a blog post about it: https://evotec.xyz/powerbginfo-powershell-alternative-to-sysinternals-bginfo/

• Sources: https://github.com/EvotecIT/PowerBGInfo (licensed MIT)

Here's a sneak peek:

New-BGInfo -MonitorIndex 0 {
    # Let's add computer name, but let's use builtin values for that
    New-BGInfoValue -BuiltinValue HostName -Color Red -FontSize 20 -FontFamilyName 'Calibri'
    New-BGInfoValue -BuiltinValue FullUserName
    New-BGInfoValue -BuiltinValue CpuName
    New-BGInfoValue -BuiltinValue CpuLogicalCores
    New-BGInfoValue -BuiltinValue RAMSize
    New-BGInfoValue -BuiltinValue RAMSpeed

    # Let's add Label, but without any values, kind of like a section starting
    New-BGInfoLabel -Name "Drives" -Color LemonChiffon -FontSize 16 -FontFamilyName 'Calibri'

    # Let's get all drives and their labels
    foreach ($Disk in (Get-Disk)) {
        $Volumes = $Disk | Get-Partition | Get-Volume
        foreach ($V in $Volumes) {
            New-BGInfoValue -Name "Drive $($V.DriveLetter)" -Value $V.SizeRemaining
        }
    }
} -FilePath $PSScriptRoot\Samples\PrzemyslawKlysAndKulkozaurr.jpg -ConfigurationDirectory $PSScriptRoot\Output -PositionX 100 -PositionY 100 -WallpaperFit Center

You can either use built-in values that I've cooked up in a few minutes that I had or display whatever you wish. Since this is more of a quick concept than a product that I have tested for weeks feel free to create issues/PRs on GitHub if you think it needs improvements.

Enjoy!

Today I've spent some time and wrote a blog post about new features of PSWriteHTML. While it says in the title Advanced HTML reporting it's actually advanced in terms of what you can achieve, but not complicated to use.

• Blog post: https://evotec.xyz/advanced-html-reporting-using-powershell/

• Sources: https://github.com/EvotecIT/PSWriteHTML

Here's Search via Alphabet

Search using Search Builder

Sorting dates

Conditional formatting based on dates, numbers, strings with complicated logic

And future features - maps :-D

All this doable often with 1-5 lines of code. For example

Get-Process | Select-Object -First 5 | Out-HtmlView -SearchBuilder -Filtering {
    New-TableCondition -Name 'PriorityClass' -Value 'Normal' -HighlightHeaders Name,Id -BackgroundColor Red
}

There are also heavy improvements in terms of performance where you're now able to store 50k-100k records in a single HTML file and still have responsive HTML.