Skip to content

Instantly share code, notes, and snippets.

View santisq's full-sized avatar

Santiago Squarzon santisq

View GitHub Profile
@jborean93
jborean93 / Appx-Server2025.ps1
Created November 10, 2024 21:40
Fix Appx in PSRemoting for Server 2025
# Server 2025 fails to run Get-AppxPackage and other DISM module commands in
# a PSRemoting (psrp) session as it has a dependency on some dll's not present
# in the GAC and only in the powershell.exe directory. As PSRP runs through
# wsmprovhost.exe, it fails to find those dlls. This hack will manually load
# the 4 required dlls into the GAC. This is a hack and should be removed in the
# future if MS fix their bug on 2025.
Add-Type -AssemblyName "System.EnterpriseServices"
$publish = [System.EnterpriseServices.Internal.Publish]::new()
@jborean93
jborean93 / New-ScheduledTaskSession.ps1
Last active March 12, 2025 18:18
Creates a PSSession that targets a scheduled task process
# Copyright: (c) 2024, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
Function New-ScheduledTaskSession {
<#
.SYNOPSIS
Creates a PSSession for a process running as a scheduled task.
.DESCRIPTION
Creates a PSSession that can be used to run code inside a scheduled task
@figueroadavid
figueroadavid / Test-EventSourceByLog.ps1
Created January 10, 2024 17:38
Test multiple logs for different event sources that may or may not be in the registry keys
function Test-EventSourceByLog {
<#
.SYNOPSIS
This tests for multiple sources in multiple eventlogs
.DESCRIPTION
This works regardless of if it exists directly in registry or not.
This is different than the Test-EventSource which uses a dotnet function
to check for all the sources that are directly listed in the registry.
@jborean93
jborean93 / AsyncPSCmdlet.cs
Last active May 29, 2024 07:38
Async PSCmdlet base class
using System;
using System.Collections.Concurrent;
using System.Management.Automation;
using System.Threading;
using System.Threading.Tasks;
public abstract class AsyncPSCmdlet : PSCmdlet, IDisposable
{
private enum PipelineType
{
@JustinGrote
JustinGrote / TestICMP.csproj
Last active February 14, 2023 18:10
Async Pinger Powershell Cmdlet in C#
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<TargetFramework>net7.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="System.Management.Automation" Version="7.3.2" PrivateAssets="all" />
<Configuration>
<ViewDefinitions>
<View>
<Name>Utility.PullRequest</Name>
<ViewSelectedBy>
<TypeName>Utility.PullRequest</TypeName>
</ViewSelectedBy>
<CustomControl>
<CustomEntries>
<CustomEntry>
@jborean93
jborean93 / Get-WTSSessionInfo.ps1
Last active March 26, 2024 14:49
Tries to replicate qwinsta but return structured objects
# Copyright: (c) 2022, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
Function Get-WTSSessionInfo {
<#
.SYNOPSIS
Enumerates sessions on a Windows host.
.DESCRIPTION
Enumerates all the sessions available on a Windows host through the WTSEnumerateSessionsExW API.
using namespace System
using namespace System.Linq
using namespace System.Collections
using namespace System.Collections.Generic
using namespace System.Management.Automation
using namespace System.Management.Automation.Language
using namespace System.Reflection
# Hey person reading this! Don't do this, alright? You'll have a bad time. ty
@jborean93
jborean93 / Start-ProcessEx.ps1
Last active June 27, 2024 06:20
PowerShell wrapper around CreateProcess that exposes more low level items
# Copyright: (c) 2021, Jordan Borean (@jborean93) <jborean93@gmail.com>
# MIT License (see LICENSE or https://opensource.org/licenses/MIT)
using namespace System.Management.Automation
using namespace System.Management.Automation.Host
using namespace System.Runtime.InteropServices
$typeParams = @{
TypeDefinition = @'
using Microsoft.Win32.SafeHandles;