Fortytwo - Answer to the Ultimate Question of Life, the Universe, and Everything

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

====== Useful Powershell Commands ======

===== Get Systemboot/Reboot/Shutdown Events =====

<code powershell>
Get-EventLog System -Newest 10000 | `
        Where EventId -In 41,1074,1076,6005,6006,6008,6009,6013 | `
        Format-Table TimeGenerated,EventId,UserName,Message -AutoSize -Wrap
</code>

===== Ping with Timestamps =====

<code powershell>
$target = "www.google.com"
ping -t $target | ForEach {"{0} - {1}" -f (Get-Date),$_}
</code>

===== Simple TCP Portscan =====
<code powershell>
$target = "portquiz.net"
$firstport = 1
$lastport = 65535
for($port=$firstport; $port -le $lastport; $port++) {
  Test-NetConnection -ComputerName $target -Port $port
}
</code>
===== Packet Capture =====
==== Capture ====
<code powershell>
$duration=90
$env:HostIP = (
    Get-NetIPConfiguration |
    Where-Object {
        $_.IPv4DefaultGateway -ne $null -and
        $_.NetAdapter.Status -ne "Disconnected"
    }
).IPv4Address.IPAddress

netsh trace start capture=yes IPv4.Address=$env:HostIP tracefile=c:\temp\capture.etl
Start-Sleep $duration
netsh trace stop
</code>
==== Convert to PCAP ====
https://github.com/microsoft/etl2pcapng/releases
<code powershell>
Invoke-Webrequest -O etl2pcapng.exe https://github.com/microsoft/etl2pcapng/releases/download/v1.9.0/etl2pcapng.exe
./etl2pcapng.exe c:\temp\capture.etl c:\temp\capture.pcap
</code>
===== Useful Commandlets =====
<code powershell>
Format-Hex $filename
</code>

===== ActiveDirectory Commandlets/Scripts =====

==== Groups / GroupMembers ====

<code powershell>
$file="C:\Temp\GroupCount.csv"
Get-ADGroup -Filter * -Properties Member `
  | Select-Object Name,@{n="MemberCount";e={$_.Member.Count}} `
  | Export-Csv -Path $file -Delimiter '|'
</code>




{{tag>kb windows powershell}}