Rob Derickson robderickson

Run regedit.exe elevated.
Take ownership of HKEY_CLASSES_ROOT\AppID{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}.
Rename the RunAs value to _RunAs.
Create a new shortcut on your Desktop for C:\Windows\System32\runas.exe.
Name it something like Admin-Explorer.
Right-click the new shortcut and click Properties.
Change the target to: C:\Windows\System32\runas.exe /noprofile /user:<domain>\<username> "c:\windows\explorer.exe /separate"
(Optional) Change the icon.
(Optional) Pin to taskbar.

# Get some events
$Computer = 'dc01'
$User = 'rob'
$Events = Get-WinEvent -ComputerName $Computer -LogName Security -FilterXPath "*[System[(EventID='4776']][EventData[Data='$User']]"
$xml = [xml]$Events[0].ToXml()

The document looks like this.

	all:
	children:
	web:
	hosts:
	192.168.56.3:
	vars:
	# These credentials are being "rejected by the server"; Can do interactive login with same credentials
	ansible_user: vagrant
	ansible_password: vagrant
	ansible_port: 5985

	function Get-UserAndManager {
	[cmdletbinding()]
	param(
	[parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
	[string]$userid
	)

	process {
	$user = $null
	$manager = $null

	$dirSearcher = New-Object DirectoryServices.DirectorySearcher
	$dirSearcher.PageSize = 1000
	$dirSearcher.SizeLimit = 100000
	$dirSearcher.Filter = "(samaccountname=$username)"
	$dirSearcherResult = $dirSearcher.FindAll()
	$results = $dirSearcherResult \| ForEach-Object {$_.Properties.title}

	{
	"name": "SynthWave",
	"description": "Ripped off of robb0wen's SynthWave 84 VS Code theme: https://github.com/robb0wen.",
	"repository": "https://github.com/mmims",
	"background": "Black",
	"foreground": "Blue",
	"popupBackground": "Cyan",
	"popupForeground": "Gray",
	"palette": {
	"Black": "#262335",

	#Requires -Modules PSPKI
	[CmdletBinding()]
	param(
	[string[]]$ComputerName,
	[string]$From,
	[string[]]$To,
	[string]$Subject,
	[string]$SmtpServer
	)

	$Html = @"
	<html>
	<head>
	<style>
	body {
	font-family: Calibri, sans-serif;
	font-size: 11pt;
	}

	h2 {

	if ($ComputerName) {
	$GetADRootDSESplat['Server'] = $ComputerName
	$GetADObjectSplat['Server'] = $ComputerName
	$SetADObjectSplat['Server'] = $ComputerName
	}

	[CmdletBinding()]
	param(
	[string[]]$ComputerName,
	[string]$SamAccountName
	)

	PROCESS {
	foreach ($computer in $ComputerName) {
	$events = Get-WinEvent -ComputerName $computer -LogName Security -FilterXPath "*[System[(EventID='4771' or EventID='4776')]][EventData[Data='$SamAccountName']]"
	foreach ($event in $events) {