Skip to content

Instantly share code, notes, and snippets.

@SasStu
SasStu / detect-LAPSUser.ps1
Created September 21, 2023 11:38
detect-LAPSUser.ps1
$AdminAccountName = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Policies\LAPS' -Name 'AdministratorAccountName' -ErrorAction SilentlyContinue).AdministratorAccountName
$item = Get-LocalUser -Name $AdminAccountName -ErrorAction SilentlyContinue
if ($null -eq $item -and $null -ne $AdminAccountName -and ((Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\LAPS' -Name 'BackupDirectory' -ErrorAction SilentlyContinue).BackupDirectory) -ne '0' -and (Get-Item -Path ($env:windir + '\system32\laps.dll') -ErrorAction SilentlyContinue)) {
exit 1
}else{
Write-Output "User exists"
exit 0
}
@SasStu
SasStu / Get-LocalPrincipal.ps1
Last active November 1, 2022 09:17
Get-LocalPrincipal
function Get-LocalPrincipal {
[CmdletBinding()]
param(
# SID of the local object to determine the localized name of
[Parameter(Mandatory = $true)]
[string]
$SID
)
begin {
Write-Verbose -Message "Start function: $($MyInvocation.MyCommand.Name)"
@SasStu
SasStu / detection.ps1
Last active July 5, 2022 15:43
LAPS User Intune
function Get-LocalUserAccount {
[CmdletBinding()]
param (
[Parameter(
ValueFromPipeline = $true,
ValueFromPipelineByPropertyName = $true
)]
[string[]] $Computer = $env:COMPUTERNAME,
@SasStu
SasStu / AAD-Group-Query-Lenovo-Windows10
Last active July 8, 2019 15:26
Master-Client-LenovoVantage-Intune
(device.deviceOSVersion -startsWith "10.0") -and (device.DeviceOSType -startsWith "Windows") -and (device.managementType -eq "MDM") -and (device.deviceManufacturer -contains "Lenovo")
@SasStu
SasStu / ASR-Event-Query.xml
Last active March 25, 2019 16:48
ASR-Blog
<QueryList>
<Query Id="0" Path="Microsoft-Windows-Windows Defender/Operational">
<Select Path="Microsoft-Windows-Windows Defender/Operational">*[System[(EventID=1121 or EventID=1122)]]</Select>
<Select Path="Microsoft-Windows-Windows Defender/WHC">*[System[(EventID=1121 or EventID=1122)]]</Select>
</Query>
</QueryList>
@SasStu
SasStu / Example.ps1
Last active May 8, 2018 06:15
Orphaned ADML
Get-OrphanedADML -Path 'C:\Program Files (x86)\Microsoft Group Policy\Windows 10 April 2018 Update (1803)' | Remove-Item -Force -Verbose
#Requires -Modules GPWMIFilter
#Source: https://gallery.technet.microsoft.com/scriptcenter/Group-Policy-WMI-filter-38a188f3
function Import-GPOBaselines {
param(
# Specifies a path to one or more locations.
[Parameter(Mandatory = $true,
Position = 0,
ValueFromPipeline = $true,
ValueFromPipelineByPropertyName = $true,
HelpMessage = "Path to the folder containing the exported GPO baseline folder.")]
@SasStu
SasStu / Export-VMService.ps1
Last active April 19, 2018 12:53
MCPSHVTag
Export-VM -VM ((Get-VMTopology).Environment | where-object -property name -eq 'LAB').VM
function New-LocalUserAccount {
[CmdletBinding()]
param (
[Parameter(
ValueFromPipeline = $true,
ValueFromPipelineByPropertyName = $true
)]
[string] $Computer = $env:COMPUTERNAME,
function Get-LocalUserAccount {
[CmdletBinding()]
param (
[Parameter(
ValueFromPipeline = $true,
ValueFromPipelineByPropertyName = $true
)]
[string[]] $Computer = $env:COMPUTERNAME,