CHEAT SHEET – PowerShell

By mikado on

Get-Service

Get-Service | Where-Object {$_.Status -eq “Running”}

Out-File

Get-Process | Out-File -FilePath .\Process.txt

ConvertTo-HTML

Get-PSD Drive | ConvertTo-Html | Out-File -FilePath PSDrives.html

Export-CSV

Get-Service | Export-CSV c:\service.csv

Get-Process

Get-Process windowrd, explorer | Format-List *

Stop-Process

Stop-Process -Name "notepad"
Get-Process notepad,mspaint | Stop-Process -Verbose

Get-EventLog

Get-EventLog -List
Get-EventLog -LogName System -EntryType Error
Get-EventLog - LogName “Windows PowerShell” -ComputerName "local computer", "Server1", "Server2"

local user account

$PASSWORD= ConvertTo-SecureString –AsPlainText -Force -String myPassword
New-LocalUser -Name "mika" -Description "just a user" -Password $PASSWORD
Get-LocalUser
  • Set new user account as a member of a local group
Add-LocalGroupMember -Group "Administrators" -Member "mika"
Get-LocalGroupMember -Group "Administrators"

HTTP header

  • Get HTTP header (as admin)
$url = 'http://alkolo.com'
$result = Invoke-WebRequest -Method HEAD -Uri $url -UseBasicParsing
$result.RawContent
  • Formatted as a table
$url = 'http://alkolo.com'
$result = Invoke-WebRequest -Method HEAD -Uri $url -UseBasicParsing
$result.Headers
  • Specific item from the HTTP header
$url = 'http://techexpert.tips'
$result = Invoke-WebRequest -Method HEAD -Uri $url -UseBasicParsing
$result.Headers.Date

Get user SID

  • Get SID for a local user account
$username='mika'
$user = New-Object System.Security.Principal.NTAccount($username) 
$sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) 
$sid.Value
  • Get local username from a SID
$sid='S-1-5-21-**********-*********-*****46743-1001'
$osid = New-Object System.Security.Principal.SecurityIdentifier($sid)
$user = $osid.Translate( [System.Security.Principal.NTAccount])
$user.Value
  • Get SID from Active Directory username
Get-ADUser -Identity 'mika' | select SID
$username = 'mika@alkolo.com'
(New-Object System.Security.Principal.NTAccount($username)).Translate([System.Security.Principal.SecurityIdentifier]).value
  • Get username from Active Directory SID
$sid = 'S-1-5-21-**********-*********-*****46743-1001'
$osid = new-object System.Security.Principal.SecurityIdentifier($sid)
$user = $osid.Translate([System.Security.Principal.NTAccount])
$user.value

External IP address

Invoke-RestMethod -Uri https://ipinfo.io
Category: CHEAT SHEETS