Book Image

Enterprise PowerShell Scripting Bootcamp

By : Brenton J.W. Blawat
Book Image

Enterprise PowerShell Scripting Bootcamp

By: Brenton J.W. Blawat

Overview of this book

Enterprise PowerShell Scripting Bootcamp explains how to create your own repeatable PowerShell scripting framework. This framework contains script logging methodologies, answer file interactions, and string encryption and decryption strategies. This book focuses on evaluating individual components to identify the system’s function, role, and unique characteristics. To do this, you will leverage built-in CMDlets and Windows Management Instrumentation (WMI) to explore Windows services, Windows processes, Windows features, scheduled tasks, and disk statistics. You will also create custom functions to perform a deep search for specific strings in files and evaluate installed software through executable properties. We will then discuss different scripting techniques to improve the efficiency of scripts. By leveraging several small changes to your code, you can increase the execution performance by over 130%. By the end of this book, you will be able to tie all of the concepts together in a PowerShell-based Windows server scanning script. This discovery script will be able to scan a Windows server to identify a multitude of components.
Table of Contents (21 chapters)
Enterprise PowerShell Scripting Bootcamp
Credits
About the Author
About the Reviewer
www.PacktPub.com
Customer Feedback
Preface
3
Working with Answer Files
Index

Identifying scheduled tasks running as alternate users


There may be instances where you need to identify scheduled tasks that are running with non-default credentials. If a user leverages their identity to run a scheduled task, or you are leveraging a service account, you will need to identify its usage on a system. The Get-ScheduledTasks cmdlet has the Principal property, which contains information about the user account running the scheduled task. The UserID reflects the username of the account that is designated to run the scheduled task.

In addition to identifying the Principal UserId, you will need to filter out built-in Windows accounts. To perform this, you can create a switch statement to make multiple evaluations of the Principal UserIds. If the process owner username is NETWORK SERVICE, LOCAL SERVICE, $null, or System, you can skip reporting the username. If it doesn't match any of those values, it will use the default switch and report the user to a list. Since multiple scheduled...