DRM Management

# This script lists all files that haven't been modified within three years.

# Get the current date and time.
$currentDateTime = Get-Date

# Calculate the date three years ago.
$threeYearsAgo = $currentDateTime - (3 * (365.25 * 24 * 60 * 60))

# Find all files that have not been modified since three years ago.
$files = Get-ChildItem -Recurse -ErrorAction SilentlyContinue | Where-Object {
    # Get the last modified date of the file.
    $lastModifiedDateTime = $_.LastWriteTime

    # Compare the last modified date to the date three years ago.
    $lastModifiedDateTime -lt $threeYearsAgo

# Print the list of files.
ForEach ($file in $files) {
    Write-Host $file.FullName

Export a listing of all enabled Active Directory users

Exports a listing of all enabled Active Directory users

Author: Brandon Lanczak

Date: 03-20-2023

Note: Adjust properties as needed. 

Get-ADUser -LDAPFilter "(objectCategory=User)" -Properties Enabled, Name, EmailAddress, Title | Where { $_.Enabled -eq $True } | Select-Object Name, EmailAddress,Title, Enabled | Sort-Object -Property Name | Export-CSV -NoType 'C:\Temp\blah mm-dd-yyyy.csv'

Export GAL as Standard Outlook User

[Microsoft.Office.Interop.Outlook.Application] $outlook = New-Object -ComObject Outlook.Application
$entries = $outlook.Session.GetGlobalAddressList().AddressEntries
foreach($entry in $entries){
    write-output ("{0}: {1}" -f $entry.Name, $entry.GetExchangeUser().PrimarySMTPAddress), $entry.GetExchangeUser().MobileTelephoneNumber)


param (
$OutFile = (Get-Date -Format yyyy-MM-dd) + "_GALEntries.csv"

$Outlook = New-Object -ComObject Outlook.Application
$GlobalAddressList = $Outlook.Session.GetGlobalAddressList().AddressEntries
$TotalObjects = $GlobalAddressList.Count

$i = 1
foreach ($entry in $GlobalAddressList)
    Write-Progress -Id 1 -Activity "Exporting Global Address List Entries" -PercentComplete (($i / $TotalObjects) * 100) -Status "[$($i)/$($TotalObjects)] entries exported"
    If ($entry.Address -match "\/o\=")
        $EntryData = $entry.GetExchangeUser()
        $RecordData = [ordered]@{
            Name                = $EntryData.Name
            First                = $EntryData.FirstName
            Last                = $EntryData.Last
            PrimarySmtpAddress     = $EntryData.PrimarySmtpAddress
            UserPrincipalName    = $EntryData.PrimarySmtpAddress
            x500                 = $EntryData.Address
            Alias                = $EntryData.Alias
            AssistantName         = $EntryData.AssistantName
            BusinessPhone         = $EntryData.BusinessTelephoneNumber
            MobilePhone            = $EntryData.MobileTelephoneNumber
            Title                 = $EntryData.JobTitle
            Department            = $EntryData.Department
            Company              = $EntryData.CompanyName
            OfficeLocation         = $EntryData.OfficeLocation
            Address             = $EntryData.StreetAddress
            City                = $EntryData.City
            StateOrProvince     = $EntryData.StateOrProvince
            PostalCode            = $EntryData.PostalCode
        $Record = New-Object PSobject -Property $RecordData
        $Record | Export-csv $OutFile -NoTypeInformation -Append
Write-Progress -Id 1 -Status "Completed." -Completed

Powershell Find & Replace IPs in a PCAP

# Netshark Powershell Module is required for this operation. Install if needed with this line
#Install-Module NetShark

# Import the NetShark module
Import-Module NetShark

# Set the path to the input pcap file
$inputFile = "C:\Path\To\Input\File.pcap"

# Set the path to the output pcap file
$outputFile = "C:\Path\To\Output\File.pcap"

# Set the original IP address to be replaced
$originalIpAddress = ""

# Set the new IP address to replace the original one
$newIpAddress = ""

# Create a filter expression to match packets with the original IP address
$filterExpression = "ip.addr == $originalIpAddress"

# Use NetShark to read the input pcap file and filter packets matching the filter expression
Get-NetSharkCapture -FilePath $inputFile -FilterExpression $filterExpression |
ForEach-Object {
    # Replace the original IP address with the new IP address in each matching packet
    $_.Packet.IP.DstAddr = $newIpAddress
    $_.Packet.IP.SrcAddr = $newIpAddress
} |
# Use NetShark to write the modified packets to the output pcap file
Set-NetSharkCapture -FilePath $outputFile

Upcoming Microsoft Time bombs

Microsoft Authenticator for M365 users

Synopsis: Microsoft will turn on number matching on 2/27/2023 which will undoubtedly cause chaos if you have users who are not smart enough to use mobile devices that are patchable and updated automatically.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match.

Date of change: March 2023


DCOM changes

Synopsis: Changes to the security posture of DCOM (first released in June of 2021) become enforced.

References: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26414 and https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c.

Date of change: 03-14-2023


AD Connect 2.0.x

Synopsis: AD Connect 2.0.x versions are going end-of-life for those syncing with M365.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-version-history

Date of change: April 2023


AD Permissions issue becomes enforced

Synopsis: To address an Active Directory Domain Services Elevation of Privilege Vulnerability and AD audit mode will become enforced.

References: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42291 and https://support.microsoft.com/en-us/topic/kb5008383-active-directory-permissions-updates-cve-2021-42291-536d5555-ffba-4248-a60e-d6cbc849cde1

Date of change: 04-11-2023


NetLogon RPC becomes enforced

Synopsis: Windows domain controllers will require that Netlogon clients use RPC seal if they are running Windows, or if they are acting as either domain controllers or as trust accounts.

References: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-38023 and https://support.microsoft.com/en-us/topic/kb5021130-how-to-manage-the-netlogon-protocol-changes-related-to-cve-2022-38023-46ea3067-3989-4d40-963c-680fd9e8ee25

Date of Change: 04-11-2023


Kerberos Protocol Changes

Synopsis: Enforcement mode will be enabled on all Windows domain controllers and will block vulnerable connections from non-compliant devices (aka those using weak RC4-HMAC for negotiation).

References: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-37966 , https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d , https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-37967 , and https://support.microsoft.com/en-us/topic/kb5020805-how-to-manage-kerberos-protocol-changes-related-to-cve-2022-37967-997e9acc-67c5-48e1-8d0d-190269bf4efb#timing

Date of change: 07-11-2023


Office 2016/2019 dropped from being able to connect to M365 services

Synopsis: Office 2016/2019 dropped from being able to connect to M365 services due to end-of-support.

References: https://learn.microsoft.com/en-us/deployoffice/endofsupport/microsoft-365-services-connectivity

Date of Change: 10-10-2023


Kerberos/Certificate-based authentication on DCs becomes enforced

Synopsis: Kerberos/Certificate-based authentication on DCs becomes enforced. By 11-14-2023, or later, all devices will be updated to Full Enforcement mode. In this mode, if a certificate fails the strong (secure) mapping criteria, authentication will be denied.

References: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-26931 and https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16

Date of change: 11-14-2023

PowerShell Move Mouse every 10-seconds

Add-Type -AssemblyName System.Windows.Forms
while ($true)
  $Pos = [System.Windows.Forms.Cursor]::Position
  $x = ($pos.X % 500) + 1
  $y = ($pos.Y % 500) + 1
  [System.Windows.Forms.Cursor]::Position = New-Object System.Drawing.Point($x, $y)
  Start-Sleep -Seconds 10