Skip to content

Instantly share code, notes, and snippets.

Keybase proof

I hereby claim:

  • I am kmhuglen on github.
  • I am kmhuglen (https://keybase.io/kmhuglen) on keybase.
  • I have a public key ASDEpvr-pgtnSZ8Cf9UGFbdxRjeyVtyWSXMdH7Znc1OQAwo

To claim this, I am signing this object:

@kmhuglen
kmhuglen / RDS_List_Logon_Events.ps1
Last active August 12, 2019 08:55
RDS: Find out who, when and from where users logon/logoff
$allRDPevents = Get-WinEvent -FilterHashtable @{Logname = "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" ; ID = 1149,1150,1148} -ErrorAction SilentlyContinue
$RDPevents = @()
foreach ($event in $allRDPevents)
{
$result = $null
switch ($event.ID)
{
1148 { $result = "failed" }
1149 { $result = "succeeded" }
You're gonna need a bigger boat.
.
$EntryType = "{Output - 1 - Value from "monitor Orchestrator SNMP Traps"}"
$Message = "{Output - 2 - Value from "monitor Orchestrator SNMP Traps"} - {Output - 3 - Value from "monitor Orchestrator SNMP Traps"}"
$EventID = "1000"
$LogName = "SNMPTrapMonitor"
$SourceName = "SNMPTrapMonitor"
$NewEventLog = Get-EventLog -list | Where-Object {$_.logdisplayname -eq $LogName}
IF (!$NewEventLog.Log -eq $LogName) {New-EventLog -LogName $LogName -Source $SourceName}
Write-EventLog -logname $LogName -source $SourceName -eventID $EventID -message $Message -EntryType $EntryType
strComputer = "."
quote= chr(34)
XMLtag="<?xml version=” + quote + "1.0" + quote + " encoding=" + quote + "UTF-8" + quote + " standalone=" + quote + "yes" + quote + "?>"
drvold="<DRV old=" +quote
newdrv=quote + " new=" +quote +"Generic / Text Only" + quote + "/>"
[HKEY_CURRENT_USERSoftwareMicrosoftCommunicatorContextPackages{54C2C31A-A291-4DFA-825A-18994EBE9877}]
“Name”=”Conversation Translator”
“ExtensibilityApplicationType”=dword:00000000
“ExtensibilityWindowSize”=dword:00000001
“DefaultContextPackage”=dword:00000000
“InternalURL”=”http://input.microsoft.com/translator/OCTranslatorTestPage.html”
“ExternalURL”=”http://input.microsoft.com/translator/OCTranslatorTestPage.html”
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZoneMapDomainsmicrosoft.cominput]
“http”=dword:00000002[/code]
$UserInput= '{UserInput from "Get Incident Request"}'
$nl = [Environment]::NewLine
$content=[XML]$UserInput
$inputs = $content.UserInputs.UserInput
foreach ($input in $inputs)
{
if($($input.Answer) -like "&lt;value*")
{
[xml]$answer = $input.answer
foreach($value in $($($answer.values)))
[reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") | out-null
$wsus = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer();
$cleanupScope = new-object Microsoft.UpdateServices.Administration.CleanupScope;
$cleanupScope.DeclineSupersededUpdates = $true
$cleanupScope.DeclineExpiredUpdates = $true
$cleanupScope.CleanupObsoleteUpdates = $true
$cleanupScope.CompressUpdates = $true
#$cleanupScope.CleanupObsoleteComputers = $true
$cleanupScope.CleanupUnneededContentFiles = $true
$cleanupManager = $wsus.GetCleanupManager();
Param(
)
### FUNCTIONS - STARTS ###
Function LoadForm
{
#http://msdn.microsoft.com/en-us/library/windows/apps/windows.ui.xaml.controls.button.aspx
#http://stackoverflow.com/questions/13845124/wpf-formatting-a-label
<ManagementPack ContentReadable="true" SchemaVersion="2.0" OriginalSchemaVersion="1.1" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<Manifest>
<Identity>
<ID>Custom.KeepClosedIncidentClosed</ID>
<Version>1.0.0.0</Version>
</Identity>
<Name>Custom Keep Closed Incident Closed</Name>
<References>
<Reference Alias="EnterpriseManagement">
<ID>Microsoft.EnterpriseManagement.ServiceManager.UI.Console</ID>