Powershell

Powershell

Useful Commands

Show command history

get-history | more

Test if port open from one server to another

Test-NetConnection 10.10.10.10 -port 445

Example output:

ComputerName           : 10.10.10.10
RemoteAddress          : 10.10.10.10
RemotePort             : 445
InterfaceAlias         : Ethernet
SourceAddress          : 10.10.10.20
PingSucceeded          : True
PingReplyDetails (RTT) : 29 ms
TcpTestSucceeded       : True

Check who rebooted the server

Get-EventLog –Log System –Newest 100 | Where-Object {$_.EventID –eq ‘1074’} | FT MachineName, UserName, TimeGenerated -AutoSize

Example output:

MachineName          UserName           TimeGenerated
-----------          --------           -------------
server01.lab.local LABLOCAL\user01 28/8/2018 4:28:20 PM

Show DNS Cache

Get-DnsClientCache

When was Windows installed

wmic os get installdate

Example output:

InstallDate
20190402093338.000000+060

Watch port availability

cls;while($true){get-date;$t = New-Object Net.Sockets.TcpClient;try {$t.connect("10.10.10.10",3389);write-host "RDP is up"}catch{write-Host "RDP is down"}finally{$t.close();sleep 30}}

Example output:

Thursday, August 29, 2019 11:27:17 AM
RDP is down
Thursday, August 29, 2019 11:28:08 AM
RDP is down
Thursday, August 29, 2019 11:28:59 AM
RDP is down
Thursday, August 29, 2019 11:29:50 AM
RDP is UP

Watch event viewer

cls;$idxA = (get-eventlog -LogName Application -Newest 1).Index;while($true){$idxA2 = (Get-EventLog -LogName Application -newest 1).index;get-eventlog -logname Application -newest ($idxA2 - $idxA) |  sort index;$idxA = $idxA2;sleep 10}

Example output:

Index Time          EntryType   Source                 InstanceID Message
----- ----          ---------   ------                 ---------- -------
23698 Aug 29 11:31  Information ESENT                  916 DllHost (20044,G,0) The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.