Torxsmind’s gists

Torxsmind / Fix_LLMR_Netbios.ps1

Last active August 21, 2019 14:08

Using Desired State Configuration to resolve LLMNR and Netbios security risks

	Configuration Fix_LLMR_Netbios
	{
	Import-DSCResource -ModuleName 'PSDesiredStateConfiguration'
	Import-DSCResource -ModuleName 'AuditPolicyDSC'
	Import-DSCResource -ModuleName 'SecurityPolicyDSC'
	Import-DscResource -ModuleName 'NetworkingDsc'

	Node localhost
	{
	NetBios DisableNetBios

Torxsmind / override_wsus-install_rsat.ps1

Created December 9, 2019 16:06

	Stop-Service -Name wuauserv
	Remove-Item HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate -Recurse
	Start-Service -name wuauserv

	Get-WindowsCapability -Online \|
	? {$_.Name -like "RSAT" -and $_.State -eq "NotPresent"} \|
	Add-WindowsCapability -Online

Torxsmind / gist:9988f6f33133fbd1ad6ae595fc468eec

Created January 24, 2020 21:21

O365 Litigation Hold Export

Get-Mailbox -ResultSize Unlimited | Where {$_.LitigationHoldEnabled -match "True"} | Select Name,LitigationHoldDate,AccountDisabled | Sort-Object Name | Export-CSV -Path c:\temp\lit-hold.csv

Torxsmind / get_azure_nsg_blocks.txt

Last active March 6, 2020 17:21

Azure NSG Blocked Events

	AzureDiagnostics
	\| where ResourceProvider == "MICROSOFT.NETWORK"
	\| where Category == "NetworkSecurityGroupEvent"
	\| where direction_s == "In" and type_s == "block"

Torxsmind / Azure_Get_MFA_Default_Method

Created March 6, 2020 18:11

Azure Get MFA Default Method

	import-module MSOnline
	Connect-MsolService
	$now = Get-Date -UFormat "%Y-%m-%d_%H-%M-%S"
	$filepath = 'C:\temp\MFA_Users_' + $now + '.csv'
	Get-MsolUser -All \| Select-Object UserPrincipalName, DisplayName, Title,
	@{n="MFA"; e={$_.StrongAuthenticationRequirements.State}},
	@{n="Default Method"; e={($_.StrongAuthenticationMethods \| where-object isdefault -eq 'true').MethodType}},
	@{n="Methods"; e={($_.StrongAuthenticationMethods).MethodType}} \| Export-Csv -Path $filepath -NoTypeInformation

Torxsmind / Powershell_create_scheduled_service_restart

Created March 9, 2020 21:55

Powershell to create a automated service restart

	$settings = New-ScheduledTaskSettingsSet `
	–AllowStartIfOnBatteries `
	–DontStopIfGoingOnBatteries `
	-Hidden `
	-ExecutionTimeLimit (New-TimeSpan -Minutes 5) `
	-RestartCount 3
	$Time = New-ScheduledTaskTrigger -At 01:00 -Daily
	$PS = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "Restart-Service -Name Spooler"
	Register-ScheduledTask -TaskName "Restart-Service-Spooler" -Trigger $Time -Action $PS -Settings $settings -User System

Torxsmind / Azure_Get-AzPublicIpAddress_All_Subscriptions.ps1

Last active April 5, 2020 02:28

Get all Azure Public IPs from all subscriptions that the current in user has access to.


	$now = Get-Date -UFormat "%Y-%m-%d_%H-%M-%S"
	$filepath = 'C:\temp\Azure_PIP_export_' + $now + '.csv'
	$subs = Get-AzSubscription

	foreach ($sub in $subs) {
	Select-AzSubscription -Subscription $sub.Name
	Get-AzPublicIpAddress `
	\| Select-Object -Property Name, ResourceGroupName, IpAddress, `
	@{label='FQDN';expression={$_.DnsSettings.Fqdn}}, `

Torxsmind / Bypass_Windows_Store_GPO_Block.reg

Created April 17, 2020 13:18

Bypass_Windows_Store_GPO_Block

	Windows Registry Editor Version 5.00

	[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore]
	"DisableStoreApps"=dword:00000000
	"RemoveWindowsStore"=dword:00000000

	[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\WindowsStore]
	"DisableStoreApps"=dword:00000000
	"RemoveWindowsStore"=dword:00000000

Torxsmind / get-azure-subnets.ps1

Created April 20, 2020 15:05

Get all Azure Subnet information

	$now = Get-Date -UFormat "%Y-%m-%d_%H-%M-%S"
	$filepath = 'C:\temp\Azure_vnet_export_' + $now + '.csv'

	$subs = Get-AzSubscription
	foreach ($sub in $subs) {
	Select-AzSubscription -Subscription $sub.Name
	$VNETs = Get-AzVirtualNetwork
	foreach ($VNET in $VNETs) {
	$subnets = Get-AzVirtualNetworkSubnetConfig -VirtualNetwork $vnet
	foreach ($subnet in $Subnets) {

Torxsmind / get-aduser-password-dates.ps1

Created April 20, 2020 19:33

Get Domain User's password dates

	$now = Get-Date -UFormat "%Y-%m-%d_%H-%M-%S"
	$filepath = 'C:\temp\AD_User_password_dates_' + $now + '.csv'

	$ADUsers = Get-ADUser `
	-Searchbase "OU=A,DC=domain,DC=com" `
	-Filter {PasswordExpired -eq "False" -and PasswordNeverExpires -eq "False" -and Enabled -eq "True"} `
	–Properties "DisplayName", "DistinguishedName", "msDS-UserPasswordExpiryTimeComputed", "passwordlastset", "PasswordExpired", "PasswordNeverExpires", "Enabled" `
	\| Where-Object {($_.DistinguishedName -notmatch "OU=1,OU=A,DC=domain,DC=com") `
	-and ($_.DistinguishedName -notmatch "OU=A,OU=2,OU=A,DC=domain,DC=com") `
	-and ($_.DistinguishedName -notmatch "OU=B,OU=2,OU=A,DC=domain,DC=com") `

Keith Templin Torxsmind