kewalaka

<#

This gist illustrates collecting event ID 4769 (auditing of Kerberos service tickets),
placing these into a PSobject so they can be further analysed and filtered.

Advanced auditing policies needs to be enabled for this event ID to be recorded in the security,
specifically: Account Logon->Audit Kerberos Service Ticket Operations

#>

kewalaka

#
# simple script that gets the SQL Alias info from remote machines 
#
[scriptblock]$GetSQLAliases = {

    $aliasRegistryPath = 'HKLM:\SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo'

    If (Test-Path($aliasRegistryPath)) {

        $aliases = @()

kewalaka

$aliasRegistryPath = 'HKLM:\SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo'
(Get-Item $aliasRegistryPath).Property | ForEach-Object {
    $aliasName = $_
    $aliasTarget = Get-ItemPropertyValue $aliasRegistryPath -Name $aliasName
    
    $aliasTargetType = switch ($aliasTarget.split(',')[0])
    {
        'DBNMPNTW' {'a named pipe'}
        'DBMSSOCN' {'a tcp port'}
        Default { ("an unknown target: '{0}'" -f $aliasTarget.split(',')[0]) }

kewalaka

$dependencies = @('netlogon', 'w32time')
# to remove:
#$dependencies = @('')

Get-CimInstance –Query 'select * from Win32_Service where name like "mssql%"'  | foreach {

    $serviceCimInstance = $_
    $serviceName = $_.name

    write-host "Apply service dependencies '$dependencies' to: $serviceName"

kewalaka

<#
.Synopsis
   Divides the Partition hosting C: into two partitions

.DESCRIPTION
   This script;
    - moves the optical drive to Z:
    - divides c: into two partitions
    - creates partition & formats D: with the label 'Local Data'
    - enables BitLocker for D: (assumes that the recovery key is stored in AD)

kewalaka

# this stuff corresponds to my lab, I don't care that the info is public :)

# this group contains the service accounts that can read the gMSA password
# creating a group is optional.
$GroupToReadPassword = (Get-ADGroup g-labsql03)

$params = @{
    Name                                       = 'gmsaSQL03'
    DNSHostName                                = 'gmsaSQL03.kewalaka.nz'
    Description                                = 'this is not an awesome description'

kewalaka

$id = (manage-bde -protectors -get c: | select-string 'Numerical Password' -context 1 |select -expandproperty context).Postcontext
if ($id.Length -eq 1)
{
    $trimmedId = $id[0].Substring($id[0].IndexOf("{"))
    Write-Host "Setting ID $trimmedId for computer $($env:COMPUTERNAME)"
    manage-bde -protectors -adbackup c: -id $trimmedId
}

kewalaka

How to add an image to a gist

1. Create or find a gist that you own.
2. Clone your gist (replace <hash> with your gist's hash):

   # with ssh
   git clone [email protected]:<hash>.git mygist
   
   # with https

git clone https://gist.github.com/.git mygist

kewalaka

kewalaka

$assemblies=(
	"System"
)

$source=@"
using System;
using Microsoft.Win32;
using System.Diagnostics;

namespace Helloworld