Scot Gabriel scotgabriel

## Get user licenses.ps1
et-azureaduser -SearchString $UserDisplayName | Get-AzureADUserLicenseDetail | Select-Object SkuId, SkuPartNumber

## Get user manager.ps1
get-azureaduser -SearchString $UserDisplayName | Select-Object *

## get user manager.ps1
get-azureaduser -SearchString $UserDisplayName | Get-AzureADUserManager

## get user group memberhip.ps1
get-azureaduser -SearchString $UserDisplayName | Get-AzureADUserMembership

## keybase.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                scotgabriel
                / keybase.md
            
            
              Created
              November 14, 2021 21:13
            
          
    Keybase proof

I hereby claim:

I am gabe31415 on github.
I am gabe31415 (https://keybase.io/gabe31415) on keybase.
I have a public key ASDX7NpinGc-PZVTMJlBSO22vbVK5lvpkZ3EY55lQCGm9Ao

To claim this, I am signing this object:

  
## plex-movie-list-export.sh
#!/usr/bin/env bash

/usr/bin/sqlite3 /var/lib/plexmediaserver/Library/Application\ Support/Plex\ Media\ Server/Plug-in\ Support/Databases/com.plexapp.plugins.library.db 'SELECT title,added_at from metadata_items WHERE metadata_type=1 ORDER BY title ASC;' >> /path/to/save/to/plex-ordered-by-movie-name.txt
/usr/bin/sqlite3 /var/lib/plexmediaserver/Library/Application\ Support/Plex\ Media\ Server/Plug-in\ Support/Databases/com.plexapp.plugins.library.db 'SELECT title,added_at from metadata_items WHERE metadata_type=1 ORDER BY added_at DESC;' >> /path/to/save/to/plex-ordered-by-added-date.txt

## firefox-install.ps1
# Silently Install Firefox

# Path for the workdir
$workdir = "c:\installer\"

# Check if work directory exists if not create it

If (Test-Path -Path $workdir -PathType Container)
{ Write-Host "$workdir already exists" -ForegroundColor Red}
ELSE

## Windows-Compromised-System-EventLog-checks.ps1
# github username: gabe31415
# events compiled from: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor
# NOTES:
# get-winevent has an UNDOCUMENTED id list max of '23' events, therefore i chose to just loop through
#     one event at a time


# Get OS version
$wmiOS = Get-WmiObject -Class Win32_OperatingSystem

## check-modified-date-less-than.ps1
$folderToCheck = "E:\data\backups"
if ((Get-ChildItem -Path $folderToCheck | ? {$_.LastWriteTime -gt (Get-Date).AddDays(-1)}.Count -lt 1) {
  write-host "Bad Juju"
} else {write-host "G2g"}

## commandToPrepEventLogForwarding.ps1
### Run on SOURCE computers
# from elevated command prompt
winrm quickconfig
# Collecting from DC(s)? Then you won't be able to modify local policy or local admin group, do this instead on each SOURCE
wevtutil sl security /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;s-1-5-20)


### Run on COLLECTOR computer
#from elevated command prompt
wecutil qc
	#!/usr/bin/env bash

	/usr/bin/sqlite3 /var/lib/plexmediaserver/Library/Application\ Support/Plex\ Media\ Server/Plug-in\ Support/Databases/com.plexapp.plugins.library.db 'SELECT title,added_at from metadata_items WHERE metadata_type=1 ORDER BY title ASC;' >> /path/to/save/to/plex-ordered-by-movie-name.txt
	/usr/bin/sqlite3 /var/lib/plexmediaserver/Library/Application\ Support/Plex\ Media\ Server/Plug-in\ Support/Databases/com.plexapp.plugins.library.db 'SELECT title,added_at from metadata_items WHERE metadata_type=1 ORDER BY added_at DESC;' >> /path/to/save/to/plex-ordered-by-added-date.txt
	# Silently Install Firefox

	# Path for the workdir
	$workdir = "c:\installer\"

	# Check if work directory exists if not create it

	If (Test-Path -Path $workdir -PathType Container)
	{ Write-Host "$workdir already exists" -ForegroundColor Red}
	ELSE
	# github username: gabe31415
	# events compiled from: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor
	# NOTES:
	# get-winevent has an UNDOCUMENTED id list max of '23' events, therefore i chose to just loop through
	# one event at a time



	# Get OS version
	$wmiOS = Get-WmiObject -Class Win32_OperatingSystem
	$folderToCheck = "E:\data\backups"
	if ((Get-ChildItem -Path $folderToCheck \| ? {$_.LastWriteTime -gt (Get-Date).AddDays(-1)}.Count -lt 1) {
	write-host "Bad Juju"
	} else {write-host "G2g"}
	### Run on SOURCE computers
	# from elevated command prompt
	winrm quickconfig
	# Collecting from DC(s)? Then you won't be able to modify local policy or local admin group, do this instead on each SOURCE
	wevtutil sl security /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;s-1-5-20)


	### Run on COLLECTOR computer
	#from elevated command prompt
	wecutil qc