====== Useful Powershell Commands ======

===== Get Systemboot/Reboot/Shutdown Events =====

<code powershell>
Get-EventLog System -Newest 10000 | `
        Where EventId -In 41,1074,1076,6005,6006,6008,6009,6013 | `
        Format-Table TimeGenerated,EventId,UserName,Message -AutoSize -Wrap
</code>

===== Ping with Timestamps =====

<code powershell>
$target = "www.google.com"
ping -t $target | ForEach {"{0} - {1}" -f (Get-Date),$_}
</code>

===== Simple TCP Portscan =====
<code powershell>
$target = "portquiz.net"
$firstport = 1
$lastport = 65535
for($port=$firstport; $port -le $lastport; $port++) {
  Test-NetConnection -ComputerName $target -Port $port
}
</code>
===== Packet Capture =====
==== Capture ====
<code powershell>
$duration=90
$env:HostIP = (
    Get-NetIPConfiguration |
    Where-Object {
        $_.IPv4DefaultGateway -ne $null -and
        $_.NetAdapter.Status -ne "Disconnected"
    }
).IPv4Address.IPAddress

netsh trace start capture=yes IPv4.Address=$env:HostIP tracefile=c:\temp\capture.etl
Start-Sleep $duration
netsh trace stop
</code>
==== Convert to PCAP ====
https://github.com/microsoft/etl2pcapng/releases
<code powershell>
Invoke-Webrequest -O etl2pcapng.exe https://github.com/microsoft/etl2pcapng/releases/download/v1.9.0/etl2pcapng.exe
./etl2pcapng.exe c:\temp\capture.etl c:\temp\capture.pcap
</code>
===== Useful Commandlets =====
<code powershell>
Format-Hex $filename
</code>

===== ActiveDirectory Commandlets/Scripts =====

==== Groups / GroupMembers ====

<code powershell>
$file="C:\Temp\GroupCount.csv"
Get-ADGroup -Filter * -Properties Member `
  | Select-Object Name,@{n="MemberCount";e={$_.Member.Count}} `
  | Export-Csv -Path $file -Delimiter '|'
</code>




{{tag>kb windows powershell}}