We use powersell command-let invoke-command to execute the command in the remote systems. Invoke-Command is the most used command-let to execute scripts remotely.

To use Invoke-Command, powershell remoting has to be enabled in the remote system. Group policy can be used to deploy this feature in the organization.

One liner to fetch local administrator group details

Invoke-Command -ScriptBlock { Get-LocalGroupMember administrators } -ComputerName pc1, pc2, pc3 | select PSComputerName, Name, SID, PrincipalSource

Result:

PSComputerName Name                 SID                                            PrincipalSource
 -------------- ----                 ---                                            ---------------
 pc1            pc1\Administrator    S-1-5-21-1644265705-1531034170-3899888674-500  Local          
 pc1            pc1\user             S-1-5-21-1644265705-1531034170-3899888674-1002 Local          
 pc2            pc2\Administrator    S-1-5-21-1644265705-1531034170-3899899674-500  Local          
 pc3            pc3\Administrator    S-1-5-21-1644265705-1531034170-3899875674-500  Local  

This one liner will connect to the respective computers mentioned in the ComputerName parameter and lists out the member details. The PrincipalSource shows whether the object belongs to local or domain.

Note: As the script will connect to the remote computers, we need to run it with a user account which has access to these machines.

Get-LocalGroupMember command-let is part of Microsoft.PowerShell.LocalAccounts and was made available from the version Powershell 5.1.

Further details of al commands are documented at https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/?view=powershell-5.1

Script to fetch the local administrator group details

We will now wrap the above one liner to a function with the necessary checks to ensure that the computers are online by checking with a ping request.

function Fetch-LocalAdminMembers
 {
     [CmdletBinding()]
     [Alias()]
     Param
     (
         [Parameter(Mandatory=$true)]
         [String[]]$Computers,
         [Parameter()]
         [pscredential]$Credential
     )
     begin
     {
         #Checking whether the systems are online
         #OnlineComputers variable will have all the computers which responded to ping
         $OnlineComputers = @()
         $Computers | ForEach-Object {
             if(Test-Connection $_ -Count 1 -ErrorAction SilentlyContinue) {
                 $OnlineComputers += $_
             }
         }

     }

     process
     {
         #If credentials are not passed, the script runs in current user context
         if($Credential -eq $null)
         {
             Invoke-Command -ScriptBlock {Get-LocalGroupMember administrators; Start-Sleep -Seconds 2} -ComputerName $OnlineComputers   | select PSComputerName, Name, SID, PrincipalSource
         }
         else
         {
             Invoke-Command -ScriptBlock {Get-LocalGroupMember administrators; Start-Sleep -Seconds 2} -ComputerName $OnlineComputers -Credential $Credential  | select PSComputerName, Name, SID, PrincipalSource
         }
     }

     end
     {
         $OnlineComputers = $Credential = $null
     }
 }

Executing the function

Fetch-LocalAdminMembers -Computers pc1, pc2

Result:

PSComputerName Name                 SID                                            PrincipalSource
 -------------- ----                 ---                                            ---------------
 pc1           pc1\Administrator    S-1-5-21-1644265705-1531034170-3899888674-500  Local          
 pc1           pc1\user             S-1-5-21-1644265705-1531034170-3899888674-1002 Local          
 pc2           pc2\Administrator    S-1-5-21-1644265705-1531034170-3894649674-500  Local          
 pc2           pc2\user2            S-1-5-21-1644265705-1531034170-3894649674-1002 Local  

We can refine the script further for faster execution, If you can identify it, I highly recommend you to comment it with the code snippet.

This will be helpful for the readers and will make this more interactive.

Hope you liked the article and thank you for reading

Last Windows Update Information

We use the com object Microsoft.Update.Session to get the update results.

Below one liner will tell us the previous update search and the last update installation date.

(New-Object -com "Microsoft.Update.AutoUpdate").Results

Output:

LastSearchSuccessDate LastInstallationSuccessDate
--------------------- --------------------------- 
 6/17/2021 3:54:31 AM  6/16/2021 3:57:34 AM

New Windows Update Count

Furthermore, to get the number of updates which are yet to be installed.

$UpdateSession = New-Object -ComObject Microsoft.Update.Session
$UpdateSearcher = $UpdateSession.CreateupdateSearcher()
$Updates = @($UpdateSearcher.Search("IsInstalled=0").Updates)

#This will give the number of updates yet to install.
$Updates.Title.count 

Pending Operating System Restart

Any pending restart because of previous update can be identified through the registry “HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired”

The entry will have a value “true” if the operating system is waiting for a restart which is needed to complete an update.

Windows Update Status

Above codes can be combined to get following information about a computer.

1. LastSearchSuccessDate
2. LastInstallationSuccessDate
3. NewUpdateCount
4. PendingReboot

We can now wrap the script with invoke-command to remote execute in multiple systems

function Get-WindowsUpdateInformation()
 {
     param
     (
         [Parameter()]
         [string[]]
         $ComputerName="localhost"
     )


     $Results = Invoke-Command -ScriptBlock  {     
         $result = (New-Object -com "Microsoft.Update.AutoUpdate").Results     
         $UpdateSession = New-Object -ComObject Microsoft.Update.Session     
         $UpdateSearcher = $UpdateSession.CreateupdateSearcher()     
         $Updates = @($UpdateSearcher.Search("IsInstalled=0").Updates)     
         $PendingReboot = $false     
    
         #Checking pending reboot
         if (Get-Item "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired" -EA Ignore) { $PendingReboot=$true }     
   
         #Framing the result to a list
         New-Object psobject -Property @{         
              LastSearchSuccessDate = $result.LastSearchSuccessDate         
              LastInstallationSuccessDate = $result.LastInstallationSuccessDate         
              NewUpdateCount = $Updates.Title.count         
              PendingReboot = $PendingReboot     
         } 
     } -ComputerName $ComputerName 

     $Results | Select-Object @{Name="ServerName"; Expression={$_.PSComputerName}}, LastSearchSuccessDate, LastInstallationSuccessDate, NewUpdateCount, PendingReboot
 }
 

Multiple server/computer names can be passed as an array to get the update information, or the server name can also be read from a text file and passed as parameter.

Get-WindowsUpdateInformation -ComputerName testhost1, testhost2

Output:

ServerName LastSearchSuccessDate LastInstallationSuccessDate NewUpdateCount PendingReboot
---------- --------------------- --------------------------- -------------- -------------
 testhost1  6/17/2021 5:31:12 PM  5/16/2021 2:56:21 PM                     1         False
 testhost2  6/16/2021 6:33:22 PM  5/21/2021 4:22:34 AM                     1         False

If you have some better ideas or know other ways of doing this, please comment it. It will be informative for me and for the readers.

Hope you liked this article and thank you for reading

CloudFlare does provide free plan where one can add one domain and proxy the traffic for FREE. Cloudflare also do give the provision to manage the domain using API’s.

We will see how to create a DNS record and update the record using PowerShell.

To manage the DNS record in cloudflare, we need to obtain the API token and permission to edit the DNS records.

To obtain the API token, login to cloudflare, under your domain portal, click on “Get your API token”. Also note the “Zone Id” in the page, which is required in the API.

Click on “API Tokens” tab and click “Create Token” button.

click the “Use Template” button as shown below.

Select the zone setings as below with the required domain details and click “Continue to summary”

Click “Create Token” to generate the api key.

Copy the generated key to access the DNS using PowerShell.

Sample Token : p6bfghn0rsdfghc-34ggb5tdas8w7ysdftj-C4
Sample ZoneID : 6cd345qefad7c71dfg5q23573017

Validating cloudflare API key using Powershell

Run the below script in PowerShell to validate the access

Invoke-RestMethod -Method Get -Uri "https://api.cloudflare.com/client/v4/user/tokens/verify" -Headers @{
 "Authorization" = "Bearer p6bfghn0rsdfghc-34ggb5tdas8w7ysdftj-C4"
 "Content-Type" = "application/json"
 } 

Result with success = True shows that the key is valid and accepted.

To know your public IP, please refer to my other post

Adding a new record to Cloudflare DNS

 $token = "p6bfghn0rsdfghc-34ggb5tdas8w7ysdftj-C4"
 $hostname = "dyDNS.domain.com"
 $ip = Invoke-RestMethod -uri "https://ifconfig.io/ip"  #Your Public IP 
 $zoneid = "6cd345qefad7c71dfg5q23573017"
 $url = "https://api.clouflare.com/client/v4/zones/$zoneid/dns_records"

 $Body = @{
     "type" = "A"
     "name" =  $hostname
     "content" = $ip
     "proxied" = $true # To mask the real IP
 }

 $Body = $Body | ConvertTo-Json

 $result = Invoke-RestMethod -Method post -Uri $url -Headers @{
 "Authorization" = "Bearer p6bfghn0rsdfghc-34ggb5tasdas8w7ysdftj-C4"
 } -Body $Body -ContentType "application/json"

 $result.result

Edit an existing Cloudflare DNS record

 $hostname = "dyDNS.domain.com"
 $zoneid = "6cd345qefad7c71dfg5q23573017"
 $token = "p6bfghn0rsdfghc-34ggb5tdas8w7ysdftj-C4"
 $url = "https://api.cloudflare.com/client/v4/zones/$zoneid/dns_records" 

 # Fetch the record information
 $record_data = Invoke-RestMethod -Method get -Uri "$url/?name=$hostname" -Headers @{
 "Authorization" = "Bearer $token"
 } 

 # Modify the IP from the fetched record
 $record_ID = $record_data.result[0].id
 $record_data.result[0].content = Invoke-RestMethod -uri "https://ifconfig.io/ip" #Your Public IP 

 $body = $record_data.result[0] | ConvertTo-Json

 # Update the record
 $result = Invoke-RestMethod -Method put -Uri "$url/$record_ID" -Headers @{
 "Authorization" = "Bearer $token"
 } -Body $body -ContentType "application/json"

Run this script in a Scheduled Task, your Public IP will get updated in DNS !!!

Hope you like this article and thank you for reading.

To get information about our public IP, open any web browser and visit the page https://ifconfig.io/.

The same page also provide api to get the details.

Public IP using PowerShell

( Invoke-WebRequest -uri "https://ifconfig.io/ip" ).content 

Refer to https://ifconfig.io/ to get more information about the API

Hope you like this article and thank you for reading.

We can leverage the pnputil.exe tool to perform the installation fast and easy.

Consider a scenario of a multiple drivers packed to an iso image. Below script will install all the required drivers.

# Mount the driver iso image
Mount-DiskImage D:\Driver\drivers-windows.iso

# Get the mount point/drive letter, considering that the above one is the only disk mounted
$isoMount = (Get-DiskImage -DevicePath \\.\CDROM0  | Get-Volume).DriveLetter

# Find the inf files and install
Get-ChildItem "$($isoMount):\" -Recurse -Include *.inf | ForEach-Object {
     $_.FullName
     pnputil /add-driver $_.FullName /install 
}

Running the script would update all the drivers which are meant for your system hardware.

Hope you like this article and thank you for reading.

PowerShell commands can be executed on a remote systems by using PowerShell-Remoting. By default, PowerShell remoting is disabled on clients operating systems.

We can either enable PowerShell remoting by executing the command “Enable-PSRemoting -Force” under administrative context. This can be either done locally on each systems by executing the commands or remotely via a group policy or through SCCM.

But if we have administrative access to a system, we can execute PowerShell commands remotely by means of PSEXEC.EXE (https://docs.microsoft.com/en-us/sysinternals/downloads/psexec)

PSEXEC shell does not work well (interactively) with PowerShell as it works with cmd commands.

Interactive Powershell prompt with PSExec

In windows 10, the interactive part is much better.

Enabling PowerShell Remoting using PSEXEC

#cmd.exe in the administrative context
#navigate to the sysinternals tools folder or add the folder to the PATH
#executing the below command would take us to the powershell prompt of the remote system
psexec.exe \\<computerName powershell.exe

#run the below command to enable PS Remoting or any commands as we wish
Enable-PSRemoting -Force

Execute multiple Powershell commands with PSExec

So, rather than going with interactive way, we can also issue a single command to do the same task

#navigate to the sysinternals suite folder, to directly execute from the prompt, add the folder to the PATH
psexec.exe \\<computerName> powershell.exe -command "& {Enable-PSRemoting -Force}"

Execute multiple Powershell commands with PSExec

We can also execute multiple commands as a single statement

#navigate to the sysinternals suite folder, to directly execute from the prompt, add the folder to the PATH
psexec.exe \\<computerName> powershell.exe -command "& {Get-Process; Get-service; $num1 = 2; $num2 = 1; $num1 + $num2}"

Also, please have a look at my other post about PSEXEC

Hope you liked this article and thank you for reading

In this article, we will see how to get windows device driver details using PowerShell. Finding driver information is necessary as information gathering prior to software or system upgrades.

WMI class Win32_PnPSignedDriver is used to get the device driver information

#Fetch all properties
Get-CimObject Win32_PnPSignedDriver | fl *

Get-CimInstance Win32_PnPSignedDriver | `
    Select DeviceClass, DeviceID, DeviceName, InfName, DriverVersion, FriendlyName, IsSigned

This would enumerate complete information in the local system.

To get information from multiple systems, the command has to be executed against the respective servers. The server names can be either fetched from active directory or from text file.

The code below will query for IBM SDDDSM driver information from a list of servers in a text file.

$servers = Get-Content "D:\server.txt"

foreach($server in $servers)
{
  
    Get-CimInstance Win32_PnPSignedDriver -ComputerName $server -ErrorAction SilentlyContinue | `
        where {$_.devicename -like "*IBM SDDDSM*"} | `
        select PSComputerName, DeviceClass, DeviceID, DeviceName, InfName, DriverVersion, FriendlyName, IsSigned
    if($Error)
    {
        #Display error if any server fails
        $server + " Error"
        $Error.Clear()
    }
}

Hope this is helpful and thank you for reading.

In the previous, we saw how to embed C# code in the PowerShell script. This article is about accessing the dll assembly files in PowerShell

Call dll assembly in PowerShell

Suppose the below C# code is compiled to a dll file custlib.dll, we can add the assembly to PowerShell.

using System;
namespace CustomNamespace
{
    public class CustomClass
    {
        //Function to Split the string
        public string[] Split(string value, char delimiter)
        {
            string[] strArray = value.Split(delimiter);
            return strArray;
        }

        //Function to sort
        public string[] Sorts(string[] strArray)
        {
            Array.Sort(strArray);
            return strArray;
        }
    }
}

Accessing dll in PowerShell

Load assembly Using Add-Type cmdlet

Add-Type -Path "C:\PowerShell\custlib.dll"

#Create object of CustomClass
$custObj = New-Object CustomNamespace.CustomClass

#Calling Split function
$custObj.Split("one,two,three",",")

#Calling Sort function
$custObj.Sorts(@("c","a","b"))

Load assembly using .Net Reflection class Load method

$AssemblyPath = "C:\PowerShell\custlib.dll"

#The dll file has to read as byte string
#The below cmdlet Get-Content with parameter -AsByteStream will only work in PowerShell version 6 and above.
#So .Net class System.IO.File can be used to read the file as byte stream
#$byteValues = Get-Content $AssemblyPath -AsByteStream -Raw

$byteValues = [System.IO.File]::ReadAllBytes($AssemblyPath)
[System.Reflection.Assembly]::Load($byteValues)


#Create object of CustomClass
$custObj = New-Object CustomNamespace.CustomClass

#Calling Split function
$custObj.Split("one,two,three",",")

#Calling Sort function
$custObj.Sorts(@("c","a","b"))

Compiling C# files to dll

CSharp code can be compiled to dll files using csc command line compiler.

One-liner to compile the C# to dll using PowerShell

Save the C# source code to custlib.cs to any folder

&"$env:windir\Microsoft.NET\Framework\v4.0.30319/csc" /target:library C:\PowerShell\custlib.cs 

Running the above line will generate the dll file.

Reference taken from https://gallery.technet.microsoft.com/scriptcenter/c66c2a00-8a24-4412-aa00-c18bda570508

Hope this is helpful and thank you for reading.

PowerShell is a cross-platform language build on top of .Net framework which accepts and returns objects. PowerShell can access the libraries written in C#, VB, jScript.

Scripts are usually build using PowerShell cmdlets but we can use the libraries coded in C#.

Embed C# (CSharp) code directly in PowerShell

Below example shows how to use C# (CSharp) code directly in PowerShell

#Defining Class in C# with functionality methods

$Source = @"
using System;
namespace CustomNamespace
{
    public class CustomClass
    {
        //Function to Split the string
        public string[] Split(string value, char delimiter)
        {
            string[] strArray = value.Split(delimiter);
            return strArray;
        }

        //Function to sort
        public string[] Sorts(string[] strArray)
        {
            Array.Sort(strArray);
            return strArray;
        }
    }
}
"@

#Adding the C# source code to powershell    
Add-Type -TypeDefinition $Source -Language CSharp

#Creating the object of the class defined in C#
$objCustomClass = New-Object CustomNamespace.CustomClass

#Sorting array of string
"Sorting array of string`n" | Out-Host
$arrays = "b","a","c"
"Original array" | Out-Host
$arrays

#Sorting using C# custom method
"Sorted array using C#" | Out-Host
$objCustomClass.Sorts($arrays)

#Sorting using PowerShell by using dotnet class
"Sorted array using PowerShell" | Out-Host
[Array]::Sort($arrays)
$arrays


#Split string
"`n`nSplit function`n" | Out-Host
$str = "one,two,three"
$delimiter = ","
"Source string is : " + $str + " `nand delimiter is : " + $delimiter + "`n"| Out-Host
#Split using C# custom method
"Split string using C#" | Out-Host
$objCustomClass.Split($str, $delimiter)

#Split using powershell
"Split string using PowerShell" | Out-Host
$str.Split($delimiter)

Result

Benefits of using C# (CSharp) in PowerShell

1. .Net codes are faster than PowerShell scripts
2. Can use the existing libraries coded in C# or vb

Hope this is helpful and thank you for reading.

NSG is stateful, which means if an incoming port is open and when a connection hits the port, outgoing port is automatically opened to allow the return traffic.

In the previous post, we saw how to create virtual network and subnets in Azure.

Existing infrastructure diagram (refer the above mentioned article)

This article will describe how to create two network security group for the internal and DMZ subnet.

For the subnets, two NSG is required to manage the traffic.

#Connect to azure network
Connect-AzAccount 

#virtual network information
$resource_locaton_main = 'West US'
$resourceGroup_Name = "RG-HOSite"
$vnet_Name = "vnet-ho"

#Fetching information about resource group and virtual network
$rg = Get-AzResourceGroup $resourceGroup_Name
$vnet = Get-AzVirtualNetwork -Name $vnet_Name -ResourceGroupName $rg.ResourceGroupName

#Getting subnet information from the virtual network object
$subnet_INT = $vnet.Subnets[0]
$subnet_DMZ = $vnet.Subnets[1]


#Creating internal network NSG
$nsg_int = New-AzNetworkSecurityGroup -Name "nsg-int" `
-Location $rg.Location `
-ResourceGroupName $rg.ResourceGroupName

#Adding the nsg to VNET INT
Set-AzVirtualNetworkSubnetConfig -NetworkSecurityGroup $nsg_int `
-Name $subnet_INT.Name `
-VirtualNetwork $vnet `
-AddressPrefix $subnet_INT.AddressPrefix | Set-AzVirtualNetwork

#Creating DMZ network NSG
$nsg_dmz = New-AzNetworkSecurityGroup -Name "nsg-dmz" `
-Location $vnet.Location `
-ResourceGroupName $rg.ResourceGroupName

#adding the DMZ NSG to subnet
Set-AzVirtualNetworkSubnetConfig -Name $subnet_DMZ.Name  `
-VirtualNetwork $vnet  `
-NetworkSecurityGroup $nsg_dmz `
-AddressPrefix $subnet_DMZ.AddressPrefix | Set-AzVirtualNetwork

Executing the above script will create two NSG and attach to the internal and DMZ subnet as shown below.

Hope this is informative and thank you for reading.