Skip to content

Instantly share code, notes, and snippets.

View wellknownsids.md

Well-Known Security Identifiers


|Name|Type|Security Identifier (SId)|Identifies| |-|-|-|-| |childWebContent|AppContainer|S-1-15-3-1024-2440306377-3304611049-1494399071-1161926223-163912384-1437065773-1456820560-2390158196|| |confirmAppClose|AppContainer|S-1-15-3-1024-719903687-4232398539-3510704256-4190309334-1296461745-392634193-3994393407-3122493104|| |cortanaSettings|AppContainer|S-1-15-3-1024-1216833578-114521899-3977640588-1343180512-2505059295-473916851-3379430393-3088591068|| |enterpriseAuthentication|AppContainer|S-1-15-3-8|| |enterpriseCloudSSO|AppContainer|S-1-15-3-1024-983922258-2159917625-2751362240-3284369410-2497023943-943411171-3503282929-3741434461|| |enterpriseDataPolicy|AppContainer|S-1-15-3-1024-373139346-748750918-1948434659-2643498477-4072104851-1007166015-1979446734-3878125657||
View Get-SleepHistory.ps1
function Get-SleepHistory {
[CmdletBinding()]
PARAM(
[string[]]
$ComputerName = @($env:COMPUTERNAME)
)
begin {
}
View Get-PowerScheme.ps1
function Get-PowerScheme {
$ActivePowerSchemeGuid = (Get-ItemProperty -Path Registry::"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\User\PowerSchemes" -Name 'ActivePowerScheme').ActivePowerScheme
Get-ChildItem -Path Registry::"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\User\PowerSchemes" | ForEach-Object {
$PowerScheme = $_ | Get-ItemProperty
$Properties = [ordered]@{
Guid = $PowerScheme.PSChildName
Name = ($PowerScheme.FriendlyName -split ',')[-1]
Description = (($PowerScheme.Description -split ',') | Select-object -Skip 2) -join ','
Active = $false
}
@MyITGuy
MyITGuy / Get-AnyConnectMessageHistory.ps1
Last active Sep 10, 2021
Reads events from the Cisco AnyConnect Secure Mobility Client to generate something close to the Message History from the client.
View Get-AnyConnectMessageHistory.ps1
function Get-AnyConnectMessageHistory {
$regex = [regex]'Message type information sent to the user:|Message type prompt sent to the user:'
$WinEvents = Get-WinEvent -LogName 'Cisco AnyConnect Secure Mobility Client' | Where-Object { $_.Message -match $regex } | ForEach-Object {
$Event = $_
$_ | Add-Member -MemberType NoteProperty -Name 'MessageSentToUser' -Value ($Event | Select-Object -ExpandProperty Message | ForEach-Object { ($_ -replace $regex, '').Trim() } | Where-Object { $_ })
if ( [System.String]::IsNullOrEmpty($_.MessageSentToUser) -eq $true ) { $_.MessageSentToUser = 'Waiting for user response.' }
$_ | Add-Member -MemberType NoteProperty -Name 'Date' -Value (Get-Date -Date $_.TimeCreated -Format d)
$_ | Add-Member -MemberType NoteProperty -Name 'Time' -Value (Get-Date -Date $_.TimeCreated -Format "h:mm:ss tt")
$_
}
@MyITGuy
MyITGuy / Get-CMSystemRole.ps1
Created Aug 30, 2021
Gets resources that have a system role, gets all system role names, sorts them and outputs the resource name, IP address and system role.
View Get-CMSystemRole.ps1
Import-Module ($Env:SMS_ADMIN_UI_PATH.Substring(0, $Env:SMS_ADMIN_UI_PATH.Length - 5) + '\ConfigurationManager.psd1')
$SiteCode = (Get-WmiObject -Namespace "root\sms" -Class "__NAMESPACE" | Select-Object -ExpandProperty Name).Substring(5, 3)
if ((Get-PSDrive -Name $SiteCode) -isnot [Microsoft.ConfigurationManagement.PowerShell.Provider.CMDriveInfo]) {
New-PSDrive -Name $SiteCode -PSProvider "AdminUI.PS.Provider\CMSite" -Root ([System.Net.Dns]::GetHostByName(($env:computerName))).Hostname -Description "$($SiteCode) Primary Site"
}
Set-Location -Path "$($SiteCode):"
$Resources = Get-CMResource -Fast -ResourceType System | Where-Object { $_.SystemRoles }
$SystemRoles = $Resources | Select-Object -ExpandProperty SystemRoles | Sort-Object -Unique
foreach ($SystemRole In $SystemRoles) {
View WinSxSDirectorySecurity.psm1
#region Reset-WinSxSDirectorySecurity
function Reset-WinSxSDirectorySecurity {
[CmdletBinding()]
PARAM(
)
begin {
#region Enable-Privilege
function Enable-Privilege {
param(
@MyITGuy
MyITGuy / DefaultMediaCost.psm1
Created Oct 6, 2020
Get-DefaultMediaCost / Set-DefaultMediaCost to assist in managing metered connections in Windows 10. (requires a reboot after modification)
View DefaultMediaCost.psm1
#region Get-DefaultMediaCost
function Get-DefaultMediaCost {
[CmdletBinding()]
PARAM(
)
DynamicParam {
# Set the dynamic parameters' name. You probably want to change this.
$DynamicParam_MediaType = 'MediaType'
@MyITGuy
MyITGuy / Get-RepAdmin.ps1
Last active Sep 28, 2020
This function will run the repadmin command and format the results into a PSCustomObject.
View Get-RepAdmin.ps1
#region Get-RepAdmin
function Get-RepAdmin {
[CmdletBinding()]
PARAM(
[Parameter(Mandatory = $false, Position = 0, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
[string]
$Server = ([System.DirectoryServices.ActiveDirectory.Domain]::GetDomain((New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext([System.DirectoryServices.ActiveDirectory.DirectoryContextType]"Domain")))).FindDomainController().Name
,
[Parameter(Mandatory = $true, Position = 1, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)]
[string]
@MyITGuy
MyITGuy / resetguid.ps1
Created Feb 4, 2020
Change GUID then force client to update configuration and send basic inventory
View resetguid.ps1
Stop-Service -Name AeXNSClient -Force
$sNewGuid = [System.Guid]::NewGuid().ToString('B').ToUpper()
New-ItemProperty -Path Registry::"HKLM\Software\Altiris\Altiris Agent" -Name "MachineGuid" -PropertyType "String" -Value $sNewGuid -Force
New-ItemProperty -Path Registry::"HKLM\SOFTWARE\Altiris\Client Service" -Name "NSMachineGuid" -PropertyType "String" -Value $sNewGuid -Force
New-ItemProperty -Path Registry::"HKLM\SOFTWARE\Altiris\eXpress" -Name "MachineGuid" -PropertyType "String" -Value $sNewGuid -Force
New-ItemProperty -Path Registry::"HKLM\SOFTWARE\Altiris\eXpress\NS Client" -Name "MachineGuid" -PropertyType "String" -Value $sNewGuid -Force
New-ItemProperty -Path Registry::"HKLM\SOFTWARE\Computing Edge\Notification Server" -Name "MachineGuid" -PropertyType "String" -Value $sNewGuid -Force
Start-Service -Name AeXNSClient
$InstallDir = (Get-ItemProperty -Path Registry::"HKLM\SOFTWARE\Altiris\Altiris Agent" -Name "InstallDir")."InstallDir"
& "$InstallDir\AeXAgentUtil.exe" /sendbasicinventory
@MyITGuy
MyITGuy / Get-WILocalPackages.ps1
Created Jan 22, 2020
1612 - The installation source for this product is not available. Verify that the source exists and that you can access it. Error 1612 may be produced during a repair or uninstall of a Windows Installer product. In some environments, files in the '$
View Get-WILocalPackages.ps1
#region Get-WILocalPackages
function Get-WILocalPackages {
[CmdletBinding()]
PARAM(
[Parameter(Mandatory = $false)]
[switch]
$Audit
,
[Parameter(Mandatory = $false)]
[string[]]