PowerShell on Vibhu Bhatnagar — PowerShell & Infrastructure Engineer

Basics

Mon, 01 Jan 0001 00:00:00 +0000

PowerShell Version

$PSVersionTable

Get Help for Any Command

Get-Help Get-Service -Full
Get-Help Get-Service -Examples

Find Commands by Noun or Verb

# All commands that work with services
Get-Command -Noun Service

# All commands that use the verb 'Get'
Get-Command -Verb Get

List All Aliases

Get-Alias

Pipeline — Filter & Select

# Filter objects
Get-Process | Where-Object { $_.CPU -gt 10 }

# Select specific properties
Get-Process | Select-Object Name, CPU, WorkingSet | Sort-Object CPU -Descending

Format Output

# Table
Get-Service | Format-Table Name, Status, StartType -AutoSize

# List (detailed)
Get-Service -Name "wuauserv" | Format-List *

System Information

Mon, 01 Jan 0001 00:00:00 +0000

Last Boot Time

# Method 1 — TimeSpan since boot
(Get-Date) - (Get-ComputerInfo).OsLastBootUpTime

# Method 2 — Exact timestamp
(Get-CimInstance Win32_OperatingSystem).LastBootUpTime

Computer System Details

Get-CimInstance Win32_ComputerSystem

BIOS Information

Get-CimInstance Win32_BIOS

Check Computer Domain

(Get-CimInstance Win32_ComputerSystem).Domain

All Drive Disk Space

Get-PSDrive -PSProvider FileSystem

System Drive Free Space (GB)

(Get-PSDrive $env:SystemDrive.Trim(':')).Free / 1GB

Volume Storage Information

Get-Volume

Printer Information

Get-CimInstance Win32_Printer |
 Select-Object Name, PortName, Default |
 Format-List

Services & Scheduled Tasks

Mon, 01 Jan 0001 00:00:00 +0000

Get Stopped Automatic Services

Get-Service |
 Where-Object { $_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic' }

Set Execution Policy

Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser

Restart LTServices (ConnectWise Automate)

# Stop related processes
$processes = "ltsvcmon","ltsvc","lttray","labvnc","labtechupdate"
Stop-Process -Name $processes -Force -ErrorAction SilentlyContinue

# Restart services
$services = "ltsvcmon","labvnc","ltservice"
Restart-Service -Name $services -Force -ErrorAction SilentlyContinue

Scheduled Tasks Run in Last 30 Days

$cutoff = (Get-Date).AddDays(-30)

Get-ScheduledTask | ForEach-Object {
 $info = Get-ScheduledTaskInfo $_
 [PSCustomObject]@{
 TaskName = $_.TaskName
 State = $_.State
 LastRunTime = $info.LastRunTime
 TaskPath = $_.TaskPath
 }
} | Where-Object { $_.LastRunTime -ge $cutoff } |
 Sort-Object LastRunTime |
 Format-Table -AutoSize

Common LastTaskResult codes:

Networking

Mon, 01 Jan 0001 00:00:00 +0000

Quick LAN Speed Test

# Adapter speed and status
Get-NetAdapter | Select-Object Name, LinkSpeed, Status

# Packet statistics
Get-NetAdapterStatistics |
 Select-Object Name, ReceivedPackets, ReceivedDiscardedPackets, OutboundDiscardedPackets

Wireless Report Generation

netsh wlan show wlanreport

Generates a full HTML report saved to: C:\ProgramData\Microsoft\Windows\WlanReport\wlan-report-latest.html

Utilities & Scripting

Mon, 01 Jan 0001 00:00:00 +0000

Keep System Awake (VBS)

Set wsc = CreateObject("WScript.Shell")
Do
' Sleep 5 minutes, then send a harmless keypress
WScript.Sleep(5 * 60 * 1000)
wsc.SendKeys("{F13}")
Loop

Save as keepawake.vbs and run with wscript keepawake.vbs.

Remove Header from Transcript

Start-Transcript -Path "C:\Logs\output.txt" -IncludeInvocationHeader $false -Force
# Your commands here
Stop-Transcript

Install Chocolatey + PowerShell Core

# Step 1 — Install Chocolatey
Set-ExecutionPolicy Bypass -Scope Process -Force
[System.Net.ServicePointManager]::SecurityProtocol =
 [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
Invoke-Expression ((New-Object System.Net.WebClient).DownloadString(
 'https://community.chocolatey.org/install.ps1'))

# Step 2 — Install PowerShell Core
choco install powershell-core -y --force

Active Directory

Mon, 01 Jan 0001 00:00:00 +0000

Get AD Group Members Recursively

Get-ADGroupMember -Identity <group_name> -Recursive |
 Select-Object Name, SamAccountName

Find Inactive Enabled User Accounts

$tspan = (New-TimeSpan -Days 90)

$inacUser = Search-ADAccount -AccountInactive -TimeSpan $tspan -UsersOnly |
 Where-Object { $_.Enabled -eq $true } |
 Select-Object Name, DistinguishedName, LastLogonDate

Write-Host "$($inacUser.Count) inactive enabled user accounts found" -ForegroundColor Green
$inacUser

Get Users Created in the Last 7 Days

$week = (Get-Date).AddDays(-7)

$ADuserInWeek = Get-ADUser -Filter { whenCreated -ge $week } -Properties WhenCreated |
 Select-Object Name, WhenCreated, DistinguishedName

Write-Host "$($ADuserInWeek.Count) users created in the last 7 days" -ForegroundColor Green
$ADuserInWeek

Verify DC DNS SRV Records

Resolve-DnsName -Type ALL -Name "_ldap._tcp.dc._msdcs.$env:USERDNSDOMAIN"

List All Installed Software

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
 Select-Object DisplayName, DisplayVersion, Publisher, InstallDate |
 Format-Table -AutoSize

Get All Active Users with Last Logon Timestamp

Get-ADUser -Filter { Enabled -eq $true } -Properties LastLogonTimeStamp |
 Select-Object Name, @{
 Name = "LastLogon"
 Expression = { [DateTime]::FromFileTime($_.LastLogonTimeStamp).ToString('dd-MM-yyyy HH:mm:ss') }
 } | Sort-Object LastLogon -Descending

Backup All GPOs

Backup-GPO -All -Path "C:\Temp\AllGPO"