Torxsmind

let oldest = ProtectionStatus 
| where TimeGenerated < ago(1h)
| top 10 by TimeGenerated desc;
let newest = ProtectionStatus
| where TimeGenerated < ago(1h)
| top 10 by TimeGenerated asc;
union oldest, newest

Torxsmind

SigninLogs
| where Status contains "MFA"
| project TimeGenerated,OperationName,ResultDescription,AuthenticationRequirement,Status.additionalDetails,AuthenticationDetails,ConditionalAccessPolicies

Torxsmind

$now = Get-Date -UFormat "%Y-%m-%d_%H-%M-%S"
$filepath = 'C:\temp\AD_User_password_dates_' + $now + '.csv'

$ADUsers = Get-ADUser `
    -Searchbase "OU=A,DC=domain,DC=com" `
    -Filter {PasswordExpired -eq "False" -and PasswordNeverExpires -eq "False" -and Enabled -eq "True"} `
    –Properties "DisplayName", "DistinguishedName", "msDS-UserPasswordExpiryTimeComputed", "passwordlastset", "PasswordExpired", "PasswordNeverExpires", "Enabled" `
    | Where-Object {($_.DistinguishedName -notmatch "OU=1,OU=A,DC=domain,DC=com") `
        -and ($_.DistinguishedName -notmatch "OU=A,OU=2,OU=A,DC=domain,DC=com") `
        -and ($_.DistinguishedName -notmatch "OU=B,OU=2,OU=A,DC=domain,DC=com") `

Torxsmind

$now = Get-Date -UFormat "%Y-%m-%d_%H-%M-%S"
$filepath = 'C:\temp\Azure_vnet_export_' + $now + '.csv'

$subs = Get-AzSubscription
foreach ($sub in $subs) {
  Select-AzSubscription -Subscription $sub.Name
  $VNETs = Get-AzVirtualNetwork
  foreach ($VNET in $VNETs) {
    $subnets = Get-AzVirtualNetworkSubnetConfig -VirtualNetwork $vnet
    foreach ($subnet in $Subnets) {

Torxsmind

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore]
"DisableStoreApps"=dword:00000000
"RemoveWindowsStore"=dword:00000000
 
[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\WindowsStore]
"DisableStoreApps"=dword:00000000
"RemoveWindowsStore"=dword:00000000

Torxsmind

$now = Get-Date -UFormat "%Y-%m-%d_%H-%M-%S"
$filepath = 'C:\temp\Azure_PIP_export_' + $now + '.csv' 
$subs = Get-AzSubscription

foreach ($sub in $subs) {
    Select-AzSubscription -Subscription $sub.Name
        Get-AzPublicIpAddress `
        | Select-Object -Property Name, ResourceGroupName, IpAddress, `
        @{label='FQDN';expression={$_.DnsSettings.Fqdn}}, `

Torxsmind

$settings = New-ScheduledTaskSettingsSet `
            –AllowStartIfOnBatteries `
            –DontStopIfGoingOnBatteries `
            -Hidden `
            -ExecutionTimeLimit (New-TimeSpan -Minutes 5) `
            -RestartCount 3
$Time = New-ScheduledTaskTrigger -At 01:00 -Daily
$PS = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "Restart-Service -Name Spooler"
Register-ScheduledTask -TaskName "Restart-Service-Spooler" -Trigger $Time -Action $PS -Settings $settings -User System

Torxsmind

import-module MSOnline
Connect-MsolService
$now = Get-Date -UFormat "%Y-%m-%d_%H-%M-%S"
$filepath = 'C:\temp\MFA_Users_' + $now + '.csv'
Get-MsolUser -All | Select-Object UserPrincipalName, DisplayName, Title,
    @{n="MFA"; e={$_.StrongAuthenticationRequirements.State}},
    @{n="Default Method"; e={($_.StrongAuthenticationMethods | where-object isdefault -eq 'true').MethodType}},
    @{n="Methods"; e={($_.StrongAuthenticationMethods).MethodType}} | Export-Csv -Path $filepath -NoTypeInformation

Torxsmind

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.NETWORK"
| where Category == "NetworkSecurityGroupEvent"
| where direction_s == "In" and type_s == "block"

Torxsmind

Get-Mailbox -ResultSize Unlimited | Where {$_.LitigationHoldEnabled -match "True"} | Select Name,LitigationHoldDate,AccountDisabled | Sort-Object Name | Export-CSV -Path c:\temp\lit-hold.csv