https://rbac.codeplex.com

 a picture worth a thousand words :)

Reference #1: https://www.microsoft.com/technet/scriptcenter/resources/pstips/may08/pstip0516.mspx

Cheers, CanD

Set-Ace.ps1

Get-Ace indeed uses Get-Acl cmdlet and doing nothing special that you can't do with Get-Acl. So why we need that? It just exists to make things easier when one is using Set-Acl which is the subject of next post

Standart output of the Get-Ace (check the attachment for .ps1 file) with no parameters; this will return all of the ACEs which can be assigned to a variable

Usage of the Get-Ace with -List and -Number parameter; -List parameter returns a numbered list so that you can associate an ACE with a number and call it later with -Number parameter. With -Number you can return single ACE from the ACL and assign it to a varibable. For example;

 $authUserAce = Get-Ace c:\ps\test.txt -Number 3

Cheers, CanD

Get-Ace.ps1

For example "Test-FileSizeUntil" function had the following parameter declaration; $AsJob is [bool] -> BAD IDEA :)

[Parameter(mandatory=$false)]
[bool]$AsJob=$false

it should be:

[Parameter(mandatory=$false)]
[switch]$AsJob

Check the references for more info..

Reference#1: https://devcentral.f5.com/weblogs/Joe/archive/2009/01/13/powershell-abcs---p-is-for-parameters.aspx

Reference#2: https://msgoodies.blogspot.com/2006/12/negating-powershell-switch-parameters.html

 Cheers, CanD

-Size parameter is the targeted size of the file; thanks to Powershell you can use values like 10KB, 1MB, 3GB

 Test-FileSizeUntil returns the job object when it is used with "-AsJob $true" parameter; please note that you have to copy Test-FileSizeUntil.ps1 file under "C:\ps\library" otherwise script does not function with "AsJob" parameter. Please check How Do I Use the Functions Provided in This Blog post for more information

Below you may see the usage of the function; I decided not to copy-paste script anymore inside of the blog; instead check the attachment

Cheers, CanD

Test-FileSizeUntil.ps1

In order to be able to run these functions every time you open a new Powershell window you need to edit your Powershell profile. Powershell console and GUI versions has both their own profile files so you need to edit them both; simply type "notepad $profile" in Powershell and start editing your profile

I added the following line so that all files under C:\ps\library will be dotted during profile execution before you see actual prompt

Probably in the end I'll find myself creating a module for this:) 

Cheers, CanD

Hunt-EventLog also can be called as a background job with -AsJob $true parameter. When you call Hunt-EventLog with -AsJob $true parameter it returns the Job object that is created for it; so you can assign it to a variable to return the output later. AsJob parameter works only if you copy the Hunt-EventLog.ps1 file under C:\ps\library\Hunt-EventLog.ps1. I will post another blog about how I'm using these scripts in my own environment

Here is the function code; as usual check the attachment to get it in ps1 format 

function Hunt-EventLog
{

<#

.Synopsis
 Searches for a specific EventID in Event Viewer and gives a specific response
.Description
 This cmdlet loops until it finds the EventID that user enters and gives the response user wants
.Parameter EventID
 Specifies EventID that is being search for
.Parameter LogName
 Specifies the name of the event log. EventID will be searched in this log
.Parameter ScriptString
    Specifies the action commands to run. Enclose the commands in double quotes ( " " ) to create a script string
.Parameter Interval
 Specifies the wait interval between the executions of the function. The value of this parameter is second and default value is 30 seconds
.Parameter Silent
 Specifies whether output to the screen is allowed or not
.Parameter AsJob
 Creates a background job for the cmdlet and echoes the jobID
.Example
Hunt-EventLog -LogName Application -EventID 8225 -ScriptString "do something"
.Example
Hunt-EventLog -LogName Application -EventID 8225 -Interval 60
.Link
 https://blogs.msdn.com/candede
.Notes
 Author: Can Dedeoglu
#>

param
(
[Parameter(mandatory=$true,position=0)]
[string]$LogName
,
[Parameter(mandatory=$true,position=1)]
[string]$EventID
,
[Parameter(mandatory=$true)]
[string]$ScriptString
,
[Parameter(mandatory=$false)]
[int]$Interval = 30
,
[Parameter(mandatory=$false)]
[bool]$Silent = $false
,
[Parameter(mandatory=$false)]
[bool]$AsJob = $false
)

$startupLog = Get-EventLog $LogName -Newest 1
$startupTime = $startupLog.TimeGenerated
$startupIndex = $startupLog.Index

[bool]$logsCaptured = $false

function startControl([datetime]$time)
{

function writeConsole([int]$output)
{
if(!$Silent)
{
 switch($output)
 {
 1
  {
  $(Get-Date).tostring("HHmmss") + ": Logs between Index " + ($newLogs[-1]).Index  + "-" + ($newLogs[0]).Index + " has been scanned; there is no match"
  }
 2
  {
  (Get-Date).tostring("HHmmss") + ": sleeping " + $Interval + " seconds"
  }
 3
  {
  (Get-Date).tostring("HHmmss") + ": no new logs, last log Index was " + $currentIndex
  }
 }
}
}

$newLogs = @(Get-EventLog $LogName -After $time)

if(!$logsCaptured)
    {
    $currentIndex = $startupIndex
    $currentTime = $startupTime
    }

if($newLogs.count -gt 0)
    {
    $newTime = ($newLogs[-1]).TimeGenerated
    $results = @($newLogs | ?{$_.InstanceId -eq $EventID})
   
    if($results.count -gt 0)
        {
        Invoke-Command -ScriptBlock ([scriptblock]::Create($ScriptString))
        }
    else
        {
        writeConsole(1)
        writeConsole(2)
        $currentIndex = ($newLogs[0]).Index
        $currentTime = ($newLogs[0]).TimeGenerated
        $logsCaptured = $true
        Start-Sleep -Seconds $Interval
        startControl $newTime
        }

    }
else
    {
    writeConsole(3)
    writeConsole(2)
    Start-Sleep -Seconds $Interval
    startControl $currentTime
    }
}

if(!$AsJob)
 {
 startControl $startupTime
 }

else
 {
 Start-Job -ScriptBlock ([scriptblock]::Create(". c:\ps\library\Hunt-EventLog.ps1; Hunt-EventLog -LogName $LogName -EventID $EventID -ScriptString `"$ScriptString`" -Interval $Interval -Silent `$$Silent"))
 }

}

Cheers, CanD

Hunt-EventLog.ps1

If you want to check if Hostname property exists under HKLM:\SYSTEM\CurrentControlSet\services\Tcpip\Parameters; run the function like this:

Test-PathReg HKLM:\SYSTEM\CurrentControlSet\services\Tcpip\Parameters Hostname

Here is the function code; as usual check the attachment to get it in ps1 format

function Test-PathReg
{

<#

.Synopsis
 Validates the existence of a registry key
.Description
 This function searches for the registry value (Property attribute) under the given registry key (Path attribute) and returns $true if it exists
.Parameter Path
 Specifies the Registry path
.Parameter Property
 Specifies the name of the registry property that will be searched for under the given Registry path
.Example
Test-PathReg -Path HKLM:\SYSTEM\CurrentControlSet\services\Tcpip\Parameters -Property Hostname
.Link
 https://blogs.msdn.com/candede
.Notes
 Author: Can Dedeoglu
#>

param
(
[Parameter(mandatory=$true,position=0)]
[string]$Path
,
[Parameter(mandatory=$true,position=1)]
[string]$Property
)

$compare = (Get-ItemProperty -LiteralPath $Path).psbase.members | %{$_.name} | compare $Property -IncludeEqual -ExcludeDifferent
if($compare.SideIndicator -like "==")
    {
        return $true
    }
else
    {
        return $false
    }
}

Cheers, CanD

Test-PathReg.ps1

You may find the script in action below; and find the attachment in txt format...hope it helps!!

PS C:\Windows\system32> function Get-UpTime
>> {
>> foreach($comp in $args)
>> {
>> $upTime = [Management.ManagementDateTimeConverter]::ToDateTime((gwmi win32_operatingsystem -computer $comp).lastbootuptime)
>> write-host $comp "-> server is up since" $upTime "which means" ([datetime]::now - $upTime).Days "days"
>> }
>> }
>>
PS C:\Windows\system32> Get-UpTime cdvm cdvm2
cdvm -> server is up since 12/23/2009 4:24:34 PM which means 20 days
cdvm2 -> server is up since 12/25/2009 2:42:32 PM which means 18 days
PS C:\Windows\system32>

Reference: https://msdn.microsoft.com/en-us/library/system.management.managementdatetimeconverter.todatetime.aspx

Cheers, CanD

Get-UpTime.txt