# List of remote computer names
$computers = @("Server01", "Server02", "Server03", "Server04", "Server05", "Server06")
# Name of the service you want to check
$serviceName = "PrintSpooler"
# Loop through the list of remote computers and check the service status
foreach ($computer in $computers) {
try {
$serviceStatus = Get-Service -ComputerName $computer -Name $serviceName
Write-Host "Service $serviceName on $computer is $($serviceStatus.Status)"
} catch {
Write-Host "Failed to get service status on" $computer
}
}
Show all users RDP’d into many computers
# List of computer names or IP addresses.
# Note: Un-comment the preferred source
#$computers = @("ServerA", "ServerB")
#$computers = Get-Content -Path "C:\TEMP\AllNodes.txt
foreach ($computer in $computers) {
Write-Host "Users logged on to"$computer":"
try {
$loggedOnUsers = query user /server:$computer 2>&1 | ForEach-Object {
# Split the line into individual pieces of information
$userDetails = $_ -split '\s+'
if ($userDetails[1] -ne "USERNAME" -and $userDetails[1] -ne "No") {
# Filter out header and empty lines
$userDetails[1]
}
}
if ($loggedOnUsers -eq $null) {
Write-Host "No users are currently logged on to $computer."
} else {
$loggedOnUsers
}
} catch {
Write-Host "Error connecting to "$computer": $_"
}
Write-Host
}
Check for Windows Activation for a group of nodes
# Define list of nodes to check
$servers = Get-Content -Path "C:\TEMP\AllNodes.txt"
# Query activation status
foreach ($server in $servers) {
$activation = Get-WmiObject -Query "SELECT * FROM SoftwareLicensingProduct WHERE (PartialProductKey IS NOT NULL)" -ComputerName $server
if ($activation) {
Write-Host "Server $server is activated."
} else {
Write-Host "Server $server is not activated."
}
}
SolarWinds File Rate of Growth Monitor
# This script can be used with SolarWinds SAM to monitor for rate of growth for a specific file
# Globally used variables
$FileToMonitor = "C:\Temp\FileToMonitor.txt"
$CacheFile = "C:\Temp\Cache.txt"
# Get Current file size
$FileSize = Get-Item -Path $FileToMonitor | Select-Object -ExpandProperty Length
# Write current file size to a cache file
Add-Content $CacheFile $FileSize
# Calculate the percent difference and round it to a whole number
$oldValue = Get-Content $CacheFile -First 1
$newValue = Get-Content $CacheFile -Last 1
$percentageDifference = (($newValue - $oldValue) / $oldValue) * 100
$percentageDifference = ([Math]::Round($percentageDifference, 0))
# Write to the host for SolarWinds to ingest
Write-Host "Message: File growth was calculated as $percentageDifference%"
Write-Host "Statistic:" $percentageDifference
# Keep the cache file clean/small (litterally just keeping 2-lines)
(Get-Content "$CacheFile" -Tail 2) | Set-Content "$CacheFile"
# Exit Session
Exit 0;
PowerShell Append 2mb of Junk to a .txt file
# Specify the path to the existing text file
$filePath = "C:\TEMP\Rubbish.txt"
# Calculate the size of 2MB in bytes
$additionalDataSize = 2 * 1024 * 1024
# Generate 2MB of random data
$randomText = [byte[]]::new($additionalDataSize)
$random = New-Object System.Random
$random.NextBytes($randomText)
# Open the file in append mode and write the random data
$fileStream = [System.IO.File]::Open($filePath, [System.IO.FileMode]::Append)
$fileStream.Write($randomText, 0, $randomText.Length)
$fileStream.Close()
Write-Host "Added 2MB of random data to $filePath"
Encode Files with Certutil
Encode
certutil -encode "C:\Wherever\Whatever.whatever" "C:\Wherever.whatever"
Decode
certutil -decode "C:\Wherever\Whatever.whatver" "C:\Wherever\Whatever.Whatever"
Ping Sweep a Network from Windows CMD Line
From a Microsoft OS command line interface, enter the following:
for /l %i in (1,1,254) do @ping -n 1 -w 100 <first three octets of host network>.%i
Also useful in ping sweep scenerios:
arp -a
New acoustic attack steals data from keystrokes with 95% accuracy
Find a file in an array of computers
# Define the array of computer names
$computers = @("Computer1", "Computer2", "Computer3")
# Define the file name or pattern you want to search for (with wildcards if needed)
$targetFileName = "*password*.txt"
# Define the directory where you want to start the recursive search on each computer
$targetDirectory = "C$"
# Loop through each computer and search for the file
foreach ($computer in $computers) {
$filePath = "\\$computer\$targetDirectory"
# Get all files with the specified name/pattern in the target directory and its subdirectories
$foundFiles = Get-ChildItem -Path $filePath -Filter $targetFileName -Recurse -ErrorAction SilentlyContinue
# Check if any file was found
if ($foundFiles) {
foreach ($file in $foundFiles) {
Write-Host "File '$($file.Name)' found on $computer at $($file.FullName)"
}
} else {
Write-Host "File '$targetFileName' not found on $computer"
}
}
DRM Management
# This script lists all files that haven't been modified within three years.
# Get the current date and time.
$currentDateTime = Get-Date
# Calculate the date three years ago.
$threeYearsAgo = $currentDateTime - (3 * (365.25 * 24 * 60 * 60))
# Find all files that have not been modified since three years ago.
$files = Get-ChildItem -Recurse -ErrorAction SilentlyContinue | Where-Object {
# Get the last modified date of the file.
$lastModifiedDateTime = $_.LastWriteTime
# Compare the last modified date to the date three years ago.
$lastModifiedDateTime -lt $threeYearsAgo
}
# Print the list of files.
ForEach ($file in $files) {
Write-Host $file.FullName
}