dstreefkerk

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="windowsPE">
        <component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <SetupUILanguage>
                <UILanguage>en-AU</UILanguage>
            </SetupUILanguage>
            <InputLocale>0c09:00000409</InputLocale>
            <UserLocale>en-AU</UserLocale>
            <SystemLocale>en-AU</SystemLocale>

dstreefkerk

#requires -version 3
<#
.SYNOPSIS
Parse-HibpJson -   Checks Active Directory for matching users, outputs info as objects 

.DESCRIPTION 
Cross-checks Active Directory for matching aliases from a HIBP breach JSON file, and then
lists the matching users and which breaches they were involved in.

Designed to be output to CSV for easy consumption in Excel with one breach per column

dstreefkerk

function Get-RandomPassword {
    
    [OutputType([string])]
    Param
    (
        [int]
        $Count = 1,

        [string]
        $Separator = '-'

dstreefkerk

# The name of the account
$accountName = 'LocalAdmin'
$accountFullName = 'Local Administrator'
$accountComment = 'Backup Local Administrator Account'

# Any users listed here will be disabled by this script
$usersToDisable = 'Administrator','Guest'

# Set up some Event Log stuff
$sourceName = "$($MyInvocation.MyCommand.Name).ps1"

dstreefkerk

# See if choco.exe is available. If not, stop execution
$chocoCmd = Get-Command -Name 'choco' -ErrorAction SilentlyContinue -WarningAction SilentlyContinue | Select-Object -ExpandProperty Source
if ($chocoCmd -eq $null) { break }

# Settings for the scheduled task
$taskAction = New-ScheduledTaskAction –Execute $chocoCmd -Argument 'upgrade all -y'
$taskTrigger = New-ScheduledTaskTrigger -AtStartup
$taskUserPrincipal = New-ScheduledTaskPrincipal -UserId 'SYSTEM'
$taskSettings = New-ScheduledTaskSettingsSet -Compatibility Win8

dstreefkerk

function Get-PerformanceCounter
{
    # Get the Performance Counters from the Registry
    $counters = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009' -Name 'counter' | Select-Object -ExpandProperty Counter

    # Remove the last line
    $counters = $counters | Select-Object -SkipLast 1

    # Split the string into an array
    $counters = $counters.Split([Environment]::NewLine)

dstreefkerk

# Removed my original snippet. See comments below from Bart.
# The below example is courtesy of Bart.
function Get-ISO8601Week {
     Param(
     [datetime]$DT = (Get-Date)
     )
     <#
     First create an integer(0/1) from the boolean,
     "Is the integer DayOfWeek value greater than zero?".
     Then Multiply it with 4 or 6 (weekrule = 0 or 2) minus the integer DayOfWeek value.

dstreefkerk

#requires -version 3
<#
.SYNOPSIS
Get-DhcpServerLog - Reads the Windows DHCP server logs

.DESCRIPTION 
The Windows DHCP server logs are stored in CSV format in C:\Windows\System32\dhcp

It's difficult to read these logs in Notepad due to them being in CSV format. 

dstreefkerk

select distinct u.email as email,
                u.first_name || ' ' || u.last_name as name,
                u.title as job_title,
                u.cell_phone as mobile,
                u.office_phone as phone,
                u.location as time_zone,
                'en' as language
                from users as u
inner join tickets as t on u.id = t.created_by
where (u.disabled is null) and ((u.first_name is not null) and (u.last_name is not null))

dstreefkerk

# List of add-in names that ARE permitted. Everything else will be disabled
$permittedAddIns = "Redemption.Addin","WorkSiteEmailManagement.Connect","imFileSite.Connect"

# Registry paths to search
$registryPaths = "Registry::HKEY_USERS\S-1-5-21-*\Software\Microsoft\Office\Outlook\Addins",
                 "Registry::HKEY_USERS\S-1-5-21-*\Software\Wow6432Node\Microsoft\Office\Outlook\Addins",
                 "HKLM:\Software\Wow6432Node\Microsoft\Office\Outlook\Addins",
                 "HKLM:\Software\Microsoft\Office\Outlook\Addins"

# Build up a list of add-ins by searching the specified paths