PsExec_Registry_Check.ps1

# stupid overengineered solution
$ErrorActionPreference= 'silentlycontinue'; 
$value = gp "REGISTRY::HKEY_USERS\*\Software\Sysinternals\PsExec";
$SID = $value.PsPath -split '\',4,'SimpleMatch' | select-string -pattern "S-" | % { $_.Line }
$NAME = gwmi win32_useraccount | ? SID -match $SID | select -expandproperty Name;
if ($value.EulaAccepted -eq 0){} else { write-host -NoNewline "`n Registry confirms PsExec used by "; write-host "$Name`n" -ForegroundColor magenta}