Skip to content

Instantly share code, notes, and snippets.

View noblevarghese's full-sized avatar
:octocat:
it's raining PowerShell

noblevarghese noblevarghese

:octocat:
it's raining PowerShell
View GitHub Profile
openapi: 3.0.4
info:
title: Entra Workload ID Viewer API
description:
This API provides endpoints to securely query and retrieve Workload Identity
data from Microsoft Entra ID. Built on Azure Functions, the API enables to
access Workload IDs details like AppId, AppDisplayName, AppPublisherId etc.
version: v1.0
servers:
- url:
@noblevarghese
noblevarghese / EntraApplicationsCopilotAgentSpec.yml
Last active September 9, 2025 05:33
Entra Applications Copilot Agent Spec.yml
openapi: 3.0.4
info:
title:
Entra Workload ID Viewer API
description:
This API provides endpoints to securely query and retrieve Workload Identity data from Microsoft Entra ID.
Built on Azure Functions, the API enables to access information such as Workload IDs that are registered in own tenant or applications that are homed in another tenant.
version: v1.0
servers:
- url:
@noblevarghese
noblevarghese / BYT-ServiceAccountInventory.ps1
Created August 23, 2022 18:21 — forked from bytemech/BYT-ServiceAccountInventory.ps1
Service Account Inventory Generator
[CmdletBinding()]
param ()
<#
.SYNOPSIS
Collects service account information from servers in a domain to a central file.
@noblevarghese
noblevarghese / ServiceAccounts.ps1
Created August 23, 2022 18:16 — forked from andreafortuna/ServiceAccounts.ps1
Powershell script to read service configuration from all Windows servers in the current domain and generate report listing all domain accounts used as service logon account
<#
Service account report scrip that reads service configuration from
all Windows servers in the current domain and generate a report listing all
domain accounts used as service logon account.
By Andrea Fortuna (andrea@andreafortuna.org)
*** Based on "report-service-accounts.ps1" by Gleb Yourchenko (fnugry@null.net) ***
#>
@noblevarghese
noblevarghese / Get-WindowsServicesAndTasksWithHardcodedPasswords.ps1
Created August 23, 2022 18:05 — forked from JohnL4/Get-WindowsServicesAndTasksWithHardcodedPasswords.ps1
PowerShell command to find logon account of Windows services; also cmd line to dump attributes of scheduled tasks to CSV file
<#
This might help in finding that pesky windows service that's always locking you out when you change your password and reboot.
#>
# ft is Format-Table; -auto is auto column width; -wrap is wrap text if necessary
Get-WmiObject win32_service | sort startname,startmode,state,displayname | select StartMode,State,StartName,DisplayName | ft -auto -wrap
# Or you can select only certain services.
# '?' is 'where' alias; -match uses regular expressions; -not is (obviously) a 'not' operator.
Get-WmiObject win32_service | ? {-not ($_.state -match 'running')} | sort startname,displayname | select StartMode,State,StartName,DisplayName | ft -auto -wrap
@noblevarghese
noblevarghese / remove-gamebar-powershell-win10.md
Created September 8, 2021 16:22 — forked from joshschmelzle/remove-gamebar-powershell-win10.md
How to Remove the Xbox Game Bar with Powershell on Windows 10

You've probably stumbled upon this researching how to remove the Xbox Game Bar. This gist includes a few different methods you can try. Please note that some of these first options are probably not be available unless you are running an older version of Windows 10.

Uninstalling/Removing the Game Bar (old Windows 10 build GUI options)

(this is no longer an option on any recent Windows 10 build)

  1. Press Windows Key or click on the Start menu.
  2. Start typing Xbox or Game Bar, until you get the Xbox Game Bar app to appear in the results.
  3. Right-click on the app and pick Uninstall. Answer Yes to the prompt, and wait for the process to finish.
function Set-JumpHostDefenderConfiguration
{
<#
.Synopsis
Set-JumpHostDefenderConfiguration
.DESCRIPTION
Set-JumpHostDefenderConfiguration configures the following Defender Security settings for JumpHosts that are not
managed by Intune
@noblevarghese
noblevarghese / localgroupmembershipchanges.kql
Created May 13, 2021 04:33 — forked from alexverboon/localgroupmembershipchanges.kql
Hunting for local group membership changes
let ADAZUsers = IdentityInfo
| extend DirectoryDomain = AccountDomain
| extend DirectoryAccount = AccountName
| distinct DirectoryDomain , DirectoryAccount , OnPremSid , CloudSid, AccountUpn, GivenName, Surname;
// check for any new created or modified local accounts
let NewUsers = DeviceEvents
| where ActionType contains "UserAccountCreated" // or ActionType contains "UserAccountModified"
| extend lUserAdded = AccountName
| extend NewUserSID = AccountSid
| extend laccountdomain = AccountDomain