Skip to content

Instantly share code, notes, and snippets.

View mortenya's full-sized avatar

mortenya

6 followers · 11 following
  • Oregon, USA
View GitHub Profile
@mortenya
mortenya / Get-SharedFolderACL.ps1
Last active August 29, 2015 14:02
Function Get-SharedFolderACL {
<#
.Synopsis
Recursively steps through folders and collects the Access Control List
.DESCRIPTION
Run the cmdlet against one or more Mapped Drives or Shares and it will create a .txt file with the ACLs of every folder in the structure
If you are getting the ACL from a share with many nested folders then it will take a significant amount of time to run
and the resulting .txt files can be quite large
.PARAMETER Shares
@mortenya
mortenya / CustomModule.psm1
Last active August 29, 2015 14:02
Originally written by Boe Prox, when loading a custom module this will source any scripts in the $ModulePath\Scripts folder, as well as check if you've loaded PowerShell as an Administrator.
#Validate user is an Administrator
Write-Verbose "Checking Administrator credentials"
If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
Write-Warning "You are not running this as an Administrator!`nPlease re-run module with an Administrator Account."
Break
}
#Load Functions
$ScriptPath = Split-Path $MyInvocation.MyCommand.Path
Try {
@mortenya
mortenya / 01-inputs.conf
Last active September 14, 2017 02:07
I have this taking events from my Snort Defense Center, it's light right now, mostly a proof of concept.
input {
syslog {
port => 1514
}
}
filter {
#IP Address of Snort
if [host] =~ /192\.168\.0\.250/ {
mutate {
@mortenya
mortenya / Get-MappedDrives.ps1
Last active August 29, 2015 14:07
function Get-MappedDrives {
<#
.Synopsis
Returns the Mapped Drives on the system
.DESCRIPTION
This function uses WMI to query computers on the network and return the mapped drives, not local drives.
If no user is logged on there will likely be an error about RPC server not available.
.PARAMETER ComputerName
The name of the system(s) you want to check
.EXAMPLE
@mortenya
mortenya / Parse-DHCPLog.ps1
Last active August 29, 2015 14:08
This scripts takes a DHCP Log as input, and then parses it for unique Devices that requested a lease, Event ID 10.
Function Get-FileName($initialDirectory) {
Add-Type -Assembly System.windows.forms | Out-Null
$initialDirectory = "C:\"
$OpenFileDialog = New-Object System.Windows.Forms.OpenFileDialog
$OpenFileDialog.InitialDirectory = $initialDirectory
$OpenFileDialog.Filter = "Log files (*.Log)| DhcpSrvLog-*.log"
$OpenFileDialog.Multiselect = $false
$OpenFileDialog.ShowDialog() | Out-Null
$OpenFileDialog.FileName
} #end function Get-FileName
@mortenya
mortenya / Get-DefinitionUpdates.ps1
Last active August 29, 2015 14:12
Function to grab Definition updates for Windows Defender. Felt a little messy how I used the foreach loop, but it works.
Function WSUSUpdate {
<#
Slight modification of https://gist.github.com/jacobludriks/9ca9ce61de251a5476f1
#>
$Criteria = "IsInstalled=0 and Type='Software'"
$Searcher = New-Object -ComObject Microsoft.Update.Searcher
try {
$SearchResult = $Searcher.Search($Criteria).Updates
if ($SearchResult.Count -eq 0) {
Write-Output "There are no applicable updates."
@mortenya
mortenya / Get-MemberOf.ps1
Last active August 29, 2015 14:12
Just one way to get the names, (CN), of the groups that an ADUser is a member of.
(Get-ADUser –Identity $user –Properties MemberOf).MemberOf -replace '^CN=([^,]+),OU=.+$','$1' > c:\user-groups.txt
# The -replace will strip the CN of the group from the Distinguished Name.
# This isn't error proof, but will be adequate for most use cases when dealing with Security Groups.
@mortenya
mortenya / Get-LoggedOnUserSession.ps1
Last active October 14, 2015 21:25
A function that grabs all logon sessions from the script center
function Get-LoggedOnUserSession {
#mjolinor 3/17/10
[CmdletBinding()]
param
(
[Parameter(Position=0,
ValueFromPipeline=$true,
ValueFromPipelineByPropertyName=$true)]
[string[]]$Name = $env:COMPUTERNAME)
@mortenya
mortenya / New-DSSearcher.ps1
Created February 6, 2015 21:49
A very simple Directory Searcher example.
$strFilter = "(&(objectClass=Person)(objectCategory=User))"
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.PageSize = 1000
$objSearcher.Filter = $strFilter
$objSearcher.SearchScope = "Subtree"
@mortenya
mortenya / Generate-RandomPassword.ps1
Last active August 29, 2015 14:15
Incomplete, but the point is to change the local admin password on all computers, would then need to drop that password and $env:COMPUTERNAME into an encrypted spreadsheet so that you could get it.
$Computers = Get-ADComputer -Filter * | Where distinguishedName -NotLike "*DC*"
$user = Get-WmiObject Win32_UserAccount -Filter "LocalAccount=true" | where { $_.Name -eq 'Administrator' }
$Count = 1
$CharSet1 = [Char[]]"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890"
ForEach ($c in $Computers)
{ Write-Progress -Id 1 -Activity "Changing Server Passwords" -Status "Current Progress: $Count of $($Servers.Count): $($Server.Name)" -PercentComplete (($Count / $c.Count) * 100)
$Ping = Test-Connection $c.Name -Count 2 -Quiet
If ($Ping) {
$Password = (($CharSet1 | Get-Random -Count 5) -join "") + " " + `