Powershell
Windows PowerShell Information
Enabling PowerShell Script Execution
Running PowerShell Commands as Administrator - Needed for System/Server/User Administration
Many, if not most, administrative PowerShell commands require being run as the Administrator user or what is referred to as elevated privileges. Depending on if you are wanting to open a window from a CMD/Command prompt, or if you are opening it from a PowerShell command prompt, the process is very similar.
From PowerShell, here is the command to open an elevated PowerShell window to then run administrative command from:
PS C:\Users\jamie.DAWGLAND> Start-Process powershell -verb runas
This will open up a new PowerShell window with administrative privileges.
If you are in a CMD/DOS/Command Prompt, first type "powershell" to start PowerShell, and then just follow the above commands to open an elevated PowerShell window in which you can then run administrative commands to manage your system.
< br />
DOS/CMD - Miscellaneous Command Line Commands
This command shows how long a Windows computer has been powered on since the last time it was shut down or rebooted, which can be helpful when diagnosing issues with a sluggish, slow-responding system. this is also known as a system's "Uptime". This is the command along with its output. Note the line starting with "Statistics since", which shows the actual date and time the system was last powered on.
C:\Users\Administrator.DAWGLAND>net stats workstation Workstation Statistics for \\WIN22VM01 Statistics since 2/6/2023 10:22:32 AM Bytes received 502580 Server Message Blocks (SMBs) received 2 Bytes transmitted 952389 Server Message Blocks (SMBs) transmitted 0 Read operations 366 Write operations 0 Raw reads denied 0 Raw writes denied 0 Network errors 0 Connections made 0 Reconnections made 0 Server disconnects 0 Sessions started 0 Hung sessions 0 Failed sessions 0 Failed operations 0 Use count 109 Failed use count 0 The command completed successfully.
You can trim/filter out most of the output, so that you only get the actual info you are looking for, in this case, the two-word phrase "Statistics since". This is how you would do it, "piping" the output of the previous command into the "findstr" command to find the line(s) containg the phrase "Statics since", case sensitive:
PS C:\Users\Administrator.DAWGLAND> net stats workstation | findstr /C:"Statistics since" Statistics since 2/6/2023 10:22:32 AM
You can shorten the command even further if you instead of searching for the two-word phrase "Statistics since", you can just search for/find the one word "since", as it's the only line in the entire output of the "net stats workstation" command that contains that one word. Here's an example:
PS C:\Users\Administrator.DAWGLAND> net stats workstation | findstr since Statistics since 2/6/2023 10:22:32 AM
Enabling & Configuring OpenSSH Server on Windows Using PowerShell
First, confirm the current state of the OpenSSH Server and OpenSSH Clients, whether either are installed, enabled, and configured.
Type this command to check the current status of both the server and client:
PS C:\Users\Administrator.DAWGLAND> Get-WindowsCapability -Online | ? Name -like 'OpenSSH*' Name : OpenSSH.Client~~~~0.0.1.0 State : Installed Name : OpenSSH.Server~~~~0.0.1.0 State : NotPresent
As you can see from output of the above command, OpenSSH Client is installed on the server, but OpenSSH Server is "NotPresent", meaning it's not been installed/enabled on the server yet. Will fix that next so that users can log into the Windows server using SSH, the Secure Shell to remotely connect annd manage the server.
Use this PowerShell command to install/enable the OpenSSH Server:
PS C:\Users\Administrator.DAWGLAND> Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 Path : Online : True RestartNeeded : False
Run the previous "Get-WindowsCapability -Online | ? Name -like 'OpenSSH*'" command and confirm that OpenSSH Server is now installed.
Next, manually start the OpenSSH service, like this:
PS C:\Users\Administrator.DAWGLAND> Start-Service sshd WARNING: Waiting for service 'OpenSSH SSH Server (sshd)' to start...
You can use this command to confirm the SSH server service has been started and is now running:
PS C:\Users\Administrator.DAWGLAND> Get-Service | findstr -i sshd Running sshd OpenSSH SSH Server
Use this command to check on the startup type, referring to the setting to have the OpenSSH Server startup automatically on each computer reboot or power on.
PS C:\Users\jamie.DAWGLAND> Get-Service -Name sshd | Select -property name,starttype Name StartType ---- --------- sshd Manual
As you can see from the output of the above command, the "StartType" for "sshd"(sshd stands for "SecureSHell Daemon". Daemon is another word for "Server".
As we want to always be able to securly log into the server remotely to perform routine maintenance and configuration, we want to configure the SSHD(OpenSSH Server) to automatically start up every time the computer is started up or rebooted. Here's how:
PS C:\Users\jamie\Downloads> Set-Service -Name sshd -StartupType 'Automatic'
Now, confirm it's set to start up automatically:
PS C:\Users\jamie\Downloads> Get-Service -Name sshd | Select -property name,star ttype Name StartType ---- --------- sshd Automatic
Confirm firewall rule has been created for the SSH service:
PS C:\Users\jamie.DAWGLAND> Get-NetFirewallRule -Name *ssh* Name : OpenSSH-Server-In-TCP DisplayName : OpenSSH SSH Server (sshd) Description : Inbound rule for OpenSSH SSH Server (sshd) DisplayGroup : OpenSSH Server Group : OpenSSH Server Enabled : True Profile : Any Platform : {} Direction : Inbound Action : Allow EdgeTraversalPolicy : Block LooseSourceMapping : False LocalOnlyMapping : False Owner : PrimaryStatus : OK Status : The rule was parsed successfully from the store. (65536) EnforcementStatus : NotApplicable PolicyStoreSource : PersistentStore PolicyStoreSourceType : Local RemoteDynamicKeywordAddresses : {}
Finally, last, but not least, configure PowerShell to be the default environment when logging into the Windows server using SSH protocol. Here's the command:
PS C:\Users\jamie.DAWGLAND> New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force DefaultShell : C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\ OpenSSH PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE PSChildName : OpenSSH PSDrive : HKLM PSProvider : Microsoft.PowerShell.Core\Registry
AD-DS - Active Directory - Domain Services
Here is the DOS/CMD command to show the current state of each of the 5 FSMO roles configured for MS AD-DS using the "netdom query fsmo" command:
C:\Users\Administrator.DAWGLAND>netdom query fsmo Schema master win19vm10.dawgland.com Domain naming master win19vm10.dawgland.com PDC win19vm10.dawgland.com RID pool manager win19vm10.dawgland.com Infrastructure master win19vm10.dawgland.com The command completed successfully.
As you can see from the output of the "netdom query fsmo" command, all 5 roles are hosted on the same Windows Server 2019 machine/VM. This is required information when it comes time to migrate AD-DS from an older server to a newwer server with a newer version of MS Windows Server.
Miscellaneous PowerShell Commands
Here are some of the PowerShell commands I use regularily to to manage Windows machines:
Create NEW Active Directory Domain Controller/AD DS: Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools Install-ADDSForest -DomainName thebestlinux.net -DomainNetbiosName THEBESTLINUX -InstallDNS OTHER COMMANDS: Disable IPv6 on ALL NIC’s: Disable-NetAdapterBinding -Name Ethernet* -ComponentID ms_tcpip6 Get-NetTCPConnection Get-NetConnectionProfile Get-NetAdapter Set-DnsClientServerAddress -InterfaceIndex 3 -ServerAddresses ("192.168.200.103","192.168.200.121","75.75.76.76") Install-Module PSWindowsUpdate Set-PSRepository Add-WUServiceManager -MicrosoftUpdate Get-WindowsUpdate Get-Service | findstr Admin sc queryex type=service state=all Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize Get-WindowsFeature Get-package | Select-Object Name,Version Get-WindowsUpdate -v Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -AutoSize New-ADUser /? get-localuser get-roles Get-DnsServerResourceRecord dawgland.com Get-DnsServerQueryResolutionPolicy dcdiag /a CONFIRM ALL 5 Roles of Active Directory Servers are up and running!!!: Get-ADDomain dawgland.com | Format-Table PDCEmulator,RIDMaster,InfrastructureMaster Get-ADForest dawgland.com | Format-Table SchemaMaster,DomainNamingMaster Get-DnsServerResourceRecord -ZoneName dawgland.com Get-NetConnectionProfile Get-NetTCPConnection Get-CimInstance -Class CIM_LogicalDisk Get-DiskFreeSpace Get-GPRegistryValue -Key HKEY_LOCAL_MACHINE Get-GPRegistryValue -Guid 31b2f340-016d-11d2-945f-00c04fb984f9 -Key HKEY_LOCAL_MACHINE Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 Import-Module GroupPolicy -verbose
More PowerShell Commands with Some Examples
Here are some more commands I use when working on headless Windows Server hardware and virual machines, such as
Windows Server Core:
Open a Windows command prompt as Administrator: runas /user:administrator CMD.exe List Installed Apps: Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table –AutoSize Install Failover Cluster Tools: Install-WindowsFeature -Name Failover-Clustering –IncludeManagementTools Include command line management tools: Install-WindowsFeature RSAT-Clustering-CmdInterface Find out if package is installed. This example uses GIT: PS C:\Users\Administrator> Get-Package | Select-Object Name | findstr -i git Git Find out if package is installed. This exampled uses WAC(Windows Admin Center): PS C:\Users\Administrator> get-package | select-object Name | findstr -i Admin Windows Admin Center Another way to do same as above, but more “Precise”. Can USE WILD-CARDS!!!: PS C:\Users\Administrator> get-package | Where-Object {$_.Name -like "*Windows Admin Center*"} Name Version Source ProviderName ---- ------- ------ ------------ Windows Admin Center 1.3.53858.0 C:\Program Files\Windows Admi... msi Display ALL services installed and their status: Get-Service | Select-Object Name,Status,DisplayName Check Status of Windows Admin Center(IF Installed – Otherwise will not find it! Get-Service | Select-Object Name,Status,DisplayName | findstr Admin FINDS: “ServerManagementGateway”, the ACTUAL name of WAC! ServerManagementGateway Running Windows Admin Center Service ServerManagementGatewayAccount Stopped Windows Admin Center Account Service Configure DNS Servers: Set-DnsClientServerAddress -InterfaceIndex 3 -ServerAddresses ("192.168.200.103","192.168.200.121","75.75.76.76") Disable ALL Firewall Zones: Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False Enable a port through firewall: netsh advfirewall firewall add rule name="WinRM-HTTP" dir=in localport=5985 protocol=TCP action=allow Check if Windows Admin Center has been installed: Get-WmiObject -Class win32_service | Where-Object {$_.name -like "WinRM"} Download a file using PowerShell: $WebClient = New-Object System.Net.WebClient $WebClient.DownloadFile("http://192.168.200.125/WindowsAdminCenter2110.2.msi","C:\Users\Administrator\WindowsAdminCenter2110.2.msi") Check EvenLogs for logins, failures, apps, etc: get-eventlog -list get-eventlog Application -after (get-date).addhours(-1) get-eventlog Application -after (get-date).addhours(-8) USE Security log for checking logins: get-eventlog Security -after (get-date).addhours(-1) FORMATTING Example of explicit log index number: Get-EventLog Security | where index -eq 3704 | format-list * DOWNLOAD & Install MS SQL Server: $wc=new-object system.net.webclient $wc.downloadfile("https://go.microsoft.com/fwlink/?linkid=866662","SQL2019-SSEI-Dev.exe") GIT Download: $wc.downloadfile("https://github.com/git-for-windows/git/releases/download/v2.36.0.windows.1/Git-2.36.0-64-bit.exe","Git-2.36.0-64-bit.exe") Get-Service -Name vds get-service | Where-Object {$_.status -eq "stopped"} get-service -name wisvc PS C:\Users\Administrator> get-service | grep -i admin Stopped sacsvr Special Administration Console Helper Running ServerManagemen... Windows Admin Center Service Stopped ServerManagemen... Windows Admin Center Account Service PS C:\Users\Administrator> Get-Item WSMan:\localhost\Client\TrustedHosts Get-CimInstance -Class CIM_LogicalDisk DeviceID DriveType ProviderName VolumeName Size FreeSpace -------- --------- ------------ ---------- ---- --------- C: 3 53109321728 44553736192 D: 5 Get-NetTCPConnection LocalAddress LocalPort RemoteAddress RemotePort State AppliedSetting ------------ --------- ------------- ---------- ----- -------------- :: 56357 :: 0 Bound :: 56268 :: 0 Bound :: 54693 :: 0 Bound :: 54690 :: 0 Bound :: 54689 :: 0 Bound :: 54688 :: 0 Bound :: 54687 :: 0 Bound :: 54671 :: 0 Bound :: 54667 :: 0 Bound :: 54665 :: 0 Bound :: 54663 :: 0 Bound :: 49712 :: 0 Bound :: 49706 :: 0 Bound :: 49695 :: 0 Bound :: 49680 :: 0 Bound :: 49679 :: 0 Bound ::1 56357 ::1 49666 Established Datacenter fe80::b586:d0e3:8c2b:2229%5 56268 fe80::b586:d0e3:8c2b:2229%5 49666 Established Datacenter fe80::b586:d0e3:8c2b:2229%5 54815 fe80::b586:d0e3:8c2b:2229%5 135 TimeWait fe80::b586:d0e3:8c2b:2229%5 54671 fe80::b586:d0e3:8c2b:2229%5 389 Established Datacenter fe80::b586:d0e3:8c2b:2229%5 54667 fe80::b586:d0e3:8c2b:2229%5 389 Established Datacenter ::1 54665 ::1 389 Established Datacenter fe80::b586:d0e3:8c2b:2229%5 54663 fe80::b586:d0e3:8c2b:2229%5 389 Established Datacenter :: 49715 :: 0 Listen fe80::b586:d0e3:8c2b:2229%5 49712 fe80::b586:d0e3:8c2b:2229%5 49666 Established Datacenter fe80::b586:d0e3:8c2b:2229%5 49695 fe80::b586:d0e3:8c2b:2229%5 49666 Established Datacenter :: 49692 :: 0 Listen :: 49686 :: 0 Listen ::1 49680 ::1 389 Established Internet ::1 49679 ::1 389 Established Datacenter :: 49676 :: 0 Listen :: 49675 :: 0 Listen :: 49668 :: 0 Listen fe80::b586:d0e3:8c2b:2229%5 49666 fe80::b586:d0e3:8c2b:2229%5 56268 Established Datacenter fe80::b586:d0e3:8c2b:2229%5 49666 fe80::b586:d0e3:8c2b:2229%5 49712 Established Datacenter fe80::b586:d0e3:8c2b:2229%5 49666 fe80::b586:d0e3:8c2b:2229%5 49695 Established Datacenter ::1 49666 ::1 56357 Established Datacenter :: 49666 :: 0 Listen :: 49665 :: 0 Listen :: 49664 :: 0 Listen :: 47001 :: 0 Listen :: 9389 :: 0 Listen :: 5985 :: 0 Listen :: 3389 :: 0 Listen :: 3269 :: 0 Listen :: 3268 :: 0 Listen :: 636 :: 0 Listen :: 593 :: 0 Listen :: 464 :: 0 Listen :: 445 :: 0 Listen fe80::b586:d0e3:8c2b:2229%5 389 fe80::b586:d0e3:8c2b:2229%5 54671 Established Datacenter fe80::b586:d0e3:8c2b:2229%5 389 fe80::b586:d0e3:8c2b:2229%5 54667 Established Datacenter fe80::b586:d0e3:8c2b:2229%5 389 fe80::b586:d0e3:8c2b:2229%5 54663 Established Datacenter ::1 389 ::1 54665 Established Datacenter ::1 389 ::1 49680 Established Datacenter ::1 389 ::1 49679 Established Datacenter :: 389 :: 0 Listen :: 135 :: 0 Listen :: 88 :: 0 Listen fe80::b586:d0e3:8c2b:2229%5 53 :: 0 Listen ::1 53 :: 0 Listen 0.0.0.0 49715 0.0.0.0 0 Listen 0.0.0.0 49692 0.0.0.0 0 Listen 0.0.0.0 49686 0.0.0.0 0 Listen 0.0.0.0 49676 0.0.0.0 0 Listen 0.0.0.0 49675 0.0.0.0 0 Listen 0.0.0.0 49668 0.0.0.0 0 Listen 192.168.200.129 49666 192.168.200.216 60179 Established Datacenter 0.0.0.0 49666 0.0.0.0 0 Listen 0.0.0.0 49665 0.0.0.0 0 Listen 0.0.0.0 49664 0.0.0.0 0 Listen 0.0.0.0 9389 0.0.0.0 0 Listen 192.168.200.121 3389 192.168.200.223 64821 Established Datacenter 0.0.0.0 3389 0.0.0.0 0 Listen 0.0.0.0 3269 0.0.0.0 0 Listen 0.0.0.0 3268 0.0.0.0 0 Listen 0.0.0.0 636 0.0.0.0 0 Listen 0.0.0.0 593 0.0.0.0 0 Listen 0.0.0.0 389 0.0.0.0 0 Listen 192.168.200.121 139 0.0.0.0 0 Listen 0.0.0.0 135 0.0.0.0 0 Listen 192.168.200.129 53 0.0.0.0 0 Listen 192.168.200.121 53 0.0.0.0 0 Listen 127.0.0.1 53 0.0.0.0 0 Listen Get-NetConnectionProfile: Name : Unidentified network InterfaceAlias : Ethernet InterfaceIndex : 5 NetworkCategory : Public IPv4Connectivity : NoTraffic IPv6Connectivity : NoTraffic Get-DnsServerResourceRecord -ZoneName dawgland.com HostName RecordType Type Timestamp TimeToLive RecordData -------- ---------- ---- --------- ---------- ---------- @ A 1 2/21/2022 4:00:00 PM 00:10:00 192.168.200.129 @ A 1 2/21/2022 4:00:00 PM 00:10:00 192.168.200.121 @ NS 2 0 01:00:00 win19vm10.dawgland.com. @ SOA 6 0 01:00:00 [33][win19vm10.dawgland.com.][h... _msdcs NS 2 0 01:00:00 win19vm10.dawgland.com. _gc._tcp.Default-First... SRV 33 2/21/2022 4:00:00 PM 00:10:00 [0][100][3268][win19vm10.dawgla... _kerberos._tcp.Default... SRV 33 2/21/2022 4:00:00 PM 00:10:00 [0][100][88][win19vm10.dawgland... _ldap._tcp.Default-Fir... SRV 33 2/21/2022 4:00:00 PM 00:10:00 [0][100][389][win19vm10.dawglan... _gc._tcp SRV 33 2/21/2022 4:00:00 PM 00:10:00 [0][100][3268][win19vm10.dawgla... _kerberos._tcp SRV 33 2/21/2022 4:00:00 PM 00:10:00 [0][100][88][win19vm10.dawgland... _kpasswd._tcp SRV 33 2/21/2022 4:00:00 PM 00:10:00 [0][100][464][win19vm10.dawglan... _ldap._tcp SRV 33 2/21/2022 4:00:00 PM 00:10:00 [0][100][389][win19vm10.dawglan... _kerberos._udp SRV 33 2/21/2022 4:00:00 PM 00:10:00 [0][100][88][win19vm10.dawgland... _kpasswd._udp SRV 33 2/21/2022 4:00:00 PM 00:10:00 [0][100][464][win19vm10.dawglan... DomainDnsZones A 1 2/21/2022 4:00:00 PM 00:10:00 192.168.200.121 DomainDnsZones A 1 2/21/2022 4:00:00 PM 00:10:00 192.168.200.129 _ldap._tcp.Default-Fir... SRV 33 2/21/2022 4:00:00 PM 00:10:00 [0][100][389][win19vm10.dawglan... _ldap._tcp.DomainDnsZones SRV 33 2/21/2022 4:00:00 PM 00:10:00 [0][100][389][win19vm10.dawglan... ForestDnsZones A 1 2/21/2022 4:00:00 PM 00:10:00 192.168.200.121 ForestDnsZones A 1 2/21/2022 4:00:00 PM 00:10:00 192.168.200.129 _ldap._tcp.Default-Fir... SRV 33 2/21/2022 4:00:00 PM 00:10:00 [0][100][389][win19vm10.dawglan... _ldap._tcp.ForestDnsZones SRV 33 2/21/2022 4:00:00 PM 00:10:00 [0][100][389][win19vm10.dawglan... win10vm8 A 1 2/21/2022 9:00:00 PM 00:20:00 192.168.200.216 win19vm10 A 1 0 01:00:00 192.168.200.121 win19vm10 A 1 0 01:00:00 192.168.200.129