PowerShell One Liners
- By g2
- August 23, 2017
- No Comments
Display Server Information
get-wmiobject -class win32_OperatingSystem | Select-Object -Property CSName,ProductType,Caption,Version,OSArchitecture,CSDVersion
Display all installed Roles and Features on 2012 Server
Import-module servermanager ; Get-WindowsFeature | where-object {$_.Installed -eq $True} | Sort-Object FeatureType, DisplayName | format-list DisplayName,FeatureType
Displays events for who shut down the system
Get-EventLog -LogName System | Where {$_.eventid -eq 1074} | format-List -Property *
Get all Shutdown events
Get-EventLog -LogName System | Where {(($_.eventid -eq 1074) -or($_.eventid -eq 6008) -or ($_.eventid -eq 6009))}
Display installed programs and the date installed
get-wmiobject -class win32_Product | Select-Object -Property Name,InstallDate | Sort-Object InstallDate -Descending
Checking for Journal Wrap
Get-EventLog -LogName “File Replication Service” | Where {$_.eventid -eq 13568} | Sort-Object TimeGenerated | format-Table -Property TimeGenerated,EventID,Source
Network Adapter Info for all VMs on a Host
Get-VM | Select -ExpandProperty NetworkAdapters | Select VMName, MACAddress, IPAddresses, Status
Displays events for account lockout
Run on a DC
Get-EventLog -LogName Security | Where {$_.eventid -eq 4740} | format-List -Property *
Displays a count by source of errors in the system log
Get-EventLog -LogName system -EntryType error | Group source,eventid | Sort count -desc | Select -first 5 | Ft count,name
Change Ft count,name to Export-Csv c:\SystemErrors.csv -Not to export
Find Bug Checks on multi systems
$computers = “Computer1″,”Computer2”
Foreach ($computer in $computers){
get-EventLog -ComputerName $computer -LogName System -Source “BugCheck” | Where {$_.eventid -eq 1001} | Export-Csv -Append -Path c:\temp\bugchk.csv
}
List NIC Team Members
foreach ($i in ((Get-NetLbfoTeam).name)) { {Write-Host “`nTeam Name – “$i`n”Team Members: “Get-NetAdapter (Get-NetLbfoTeamMember -Team $i).Name | FT} }
Enable Enhanced Session Mode Policy in Hyper-V
Set-VMhost -EnableEnhancedSessionMode $TRUE
Cashed accounts
rundll32.exe keymgr.dll,KRShowKeyMgr
Delete all reg keys that match under a key
Get-ChildItem -path “HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageIndex” -Recurse | where { $_.Name -match ‘~amd64~en-US’} | Remove-Item -Force
Get all VMs in Hyper-V cluster
Get-vm -ComputerName (Get-ClusterNode -Cluster (Get-Cluster).Name | Select Name).Name
Get Integration Services Version Hyper-V Cluster
Get-vm -ComputerName (Get-ClusterNode -Cluster (Get-Cluster).Name | Select Name).Name | ft ComputerName,Name,IntegrationServicesVersion,IntegrationServicesState
Mellanox Driver Check
Get-NetAdapter -InterfaceDescription *Mellanox* | select Name,InterfaceDescription,DriverVersion
Get all Driver versions
Get-WmiObject Win32_PnPSignedDriver| select DeviceName, DriverVersion, Manufacturer | Sort DeviceName
Check Integration Services Version Hyper-V Standalone
Get-vm -ComputerName $Env:computername | ft ComputerName,Name,State,IntegrationServicesVersion,IntegrationServicesState
Leave a Reply