Skip to content

Instantly share code, notes, and snippets.

View scotgabriel's full-sized avatar

Scot Gabriel scotgabriel

View GitHub Profile
@scotgabriel
scotgabriel / Windows command line gui access.md
Last active November 11, 2023 14:53
Common windows functions via rundll user32 and control panel

Rundll32 commands

OS: Windows 10/8/7

Add/Remove Programs

  • RunDll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,0

Content Advisor

  • RunDll32.exe msrating.dll,RatingSetupUI

Control Panel

@scotgabriel
scotgabriel / Windows-Access-Special-Folders-From-Shell.md
Last active September 15, 2023 00:27
How to access Windows Special Folders using Shell Commands

Since Windows Vista, the list of available shell shortcuts can be found here:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\

Command Win 10 Win 8 Win 7 Vista XP
shell:AccountPictures x x - - -
shell:Roaming Tiles x x - - -
shell:Common Programs x x x x x
@scotgabriel
scotgabriel / Get user licenses.ps1
Created February 15, 2022 16:56
Azure AD User - Get licenses assigned
et-azureaduser -SearchString $UserDisplayName | Get-AzureADUserLicenseDetail | Select-Object SkuId, SkuPartNumber
@scotgabriel
scotgabriel / Get user manager.ps1
Created February 15, 2022 16:55
Azure AD User - Get attributes/properties
get-azureaduser -SearchString $UserDisplayName | Select-Object *
@scotgabriel
scotgabriel / get user manager.ps1
Created February 15, 2022 16:54
Azure AD User - Get Manager
get-azureaduser -SearchString $UserDisplayName | Get-AzureADUserManager
@scotgabriel
scotgabriel / get user group memberhip.ps1
Created February 15, 2022 16:52
Azure AD User - Get Group Membership
get-azureaduser -SearchString $UserDisplayName | Get-AzureADUserMembership

Keybase proof

I hereby claim:

  • I am gabe31415 on github.
  • I am gabe31415 (https://keybase.io/gabe31415) on keybase.
  • I have a public key ASDX7NpinGc-PZVTMJlBSO22vbVK5lvpkZ3EY55lQCGm9Ao

To claim this, I am signing this object:

@scotgabriel
scotgabriel / Windows-Compromised-System-EventLog-checks.ps1
Created August 2, 2018 22:20
"Compromised System" eventlog checks
# github username: gabe31415
# events compiled from: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor
# NOTES:
# get-winevent has an UNDOCUMENTED id list max of '23' events, therefore i chose to just loop through
# one event at a time
# Get OS version
$wmiOS = Get-WmiObject -Class Win32_OperatingSystem
@scotgabriel
scotgabriel / Powershell-Exchange.md
Last active April 4, 2021 15:35
Powershell commands to interact with Microsoft Exchange

Powershell Commands to Interact with Microsoft Exchange

Connect, via Powershell, to Exchange Server remotely

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://server.domain.dom/PowerShell/ -Authentication Kerberos
import-pssession $session

Add Exchange Module

must already have Exchange Management Console installed

#!/usr/bin/env bash
/usr/bin/sqlite3 /var/lib/plexmediaserver/Library/Application\ Support/Plex\ Media\ Server/Plug-in\ Support/Databases/com.plexapp.plugins.library.db 'SELECT title,added_at from metadata_items WHERE metadata_type=1 ORDER BY title ASC;' >> /path/to/save/to/plex-ordered-by-movie-name.txt
/usr/bin/sqlite3 /var/lib/plexmediaserver/Library/Application\ Support/Plex\ Media\ Server/Plug-in\ Support/Databases/com.plexapp.plugins.library.db 'SELECT title,added_at from metadata_items WHERE metadata_type=1 ORDER BY added_at DESC;' >> /path/to/save/to/plex-ordered-by-added-date.txt