Folders size #powershell

#get size of all folder’s subdirectories in the first level

PowerShell bulk copy and remove file $Computers

BULK COPY

$Computerlist = Get-Content  C:\Scripts\Computers.txt

foreach ($Computer in $Computerlist) {

Copy-Item -Path \\share\Install\test.txt -Destination \\$Computer\c$ -Recurse -PassThru

}

BULK REMOVE

$Computerlist = Get-Content  C:\Scripts\Computers.txt

foreach ($Computer in $Computerlist) {

Get-ChildItem -Path \\$Computer\c$\test.txt | Remove-Item -Force

}

Bitlocker #bulk computers status

Get information about #bitlocker status if is on or off against list of computers.

#$Computers = get-content -path C:\comps.txt
ForEach ($Computer in $Computers)
{
Invoke-Command -ComputerName $Computer -ScriptBlock {
(Get-BitlockerVolume -MountPoint “C:”).ProtectionStatus } | select PsComputerName, Value
}

Windows 10 reset forgotten local user password

  1. Download Microsoft media creation tool and create boot usb flash or dvd
  2. Boot PC with usb flash/dvd
  3. Switch to recovery mode – run with command line
  4. > cd Windows\System32
  5. > ren utilman.exe utilman.exe.bak
  6. > copy cmd.exe utilman.exe
  7. Reboot PC
  8. Wait until login screen present and click on ease of access
  9. > net user “myLogin” newpassword

10. Here you go with your “newpassword”

WMIC network, #NIC, services

Very simple but useful command wmic #wmic

Last time we’ve learnt, how to run wmic under user profile – (run cmd as different user – Admin).

Today let me show, how to run wmic on the remote machine.

Magic syntax is /node:PC_Name

easy to start/stop local/remote service (for example Themes)

wmic /node:PC001 process call create “net stop/start Themes”

enable/disable particular NIC (as different user, or remotly)

wmic (/node:PCxxx) nic get name, index

wmic /node:PC002 path win32_networkadapter where index=2 call enable/disable

(restart needed)

Zabbix Appliance 4.4.0 # VMWare

Download a .vmdk of Zabbix appliance. Create the new virtual machine. (For me was necessary to change SCSI type to LSI Logic Parallel instead SAS) 😦

1. Login as a root: appliance/zabbix

2. set static IP:

* cd /etc/network
* sudo vi interfaces (make sure to know, how to move in Vi editor)
* iface ens160 (eth0 or ensX) inet static
   set IP, mask, gateway

* sudo /etc/init.d/networking restart

https://www.zabbix.com/forum/zabbix-help/366600-zabbix-appliance-4-0-installation-issues-vmware-esxi-6-5

Check IP:

* ifconfig -a

3. http://ipaddress/zabbix

login: Admin/zabbix

A. create host = server, PC etc. (item = service etc.)

B. add some template (ICMP Ping etc.)

C. create trriger to host or item

D. create an Action (alert e-mail or sms)

Anyway follow the offical Zabbix Documentation 4.4.

 

https://kb.vmware.com/s/article/1022525

 

vmwtools_ubu

 

 

Change Active Directory Group type

Modify Active Directory Group type from Global Security do Domain Local etc.

 

step1:

Get-ADGroup -Filter ‘GroupCategory -eq “Security” -and GroupScope -eq “Global”‘ -SearchBase ‘OU=groups,Ou=domain,DC=domain,DC=local’ | Set-ADGroup -GroupScope Universal

Enter

 

step2:

Get-ADGroup -Filter ‘GroupCategory -eq “Security” -and GroupScope -eq “Universal”‘ -SearchBase ‘OU=groups,OU=domain,DC=domain,DC=local’ | Set-ADGroup -GroupScope Domainlocal

Enter

 

 

Get PC from AD which are not renamed

PowerShell Script which find PC with wrong name.  Default name MiniNT etc.

 

$body = Get-ADComputer -Filter “Name -like ‘minint*'” -SearchBase ‘OU=Desktop,OU=Computers,OU=company,DC=company,DC=local’
If ($body -ne $Null) {
$emailFrom = “alert@mail.com”
$emailTo = “somebody@company.com”
$subject = “Wrong name PC in Active Directory”
$body = $body
$smtpServer = “webmail.com”
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($emailFrom, $emailTo, $subject, $body)
}

Get all recent user permissions / network files entries / user’s permissions

$filteracl = {$_.IdentityReference -match “domain user” -and ($_.FileSystemRights -band 131241 -or $_.FileSystemRights -band 278)}
$objects = Get-ChildItem \\domain.local\dfs\department -Recurse -Force | Export-Csv c:\user.txt
foreach ($i in $objects)
{
$i.GetAccessControl().Access | Where $filteracl | Select `
@{n=”Path”;e={$i.fullname}},
@{n=”User”;e={$_.IdentityReference}},
@{n=”Permission”;e={$_.FileSystemRights}}
}

Trojan:Win32/Shapouf.A

Trojan:Win32/Shapouf.A

This trojan infects pc from phishing mail attachment sent from some bank institute etc.
Fully updated Microsoft Windows 7 SP1 with real time scanning msft essential security antivirus is disarmed by this trojan!
Safety scanner detects this tojan but not purges it!
Reinstalled msft security essential tries to clean it, but unsuccessful!
Try better antvirus or completely reinstall/recover system.
Don’t open phishing mail!!!

http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fShapouf.A