Splunk | Never Expire | Table Filter

Splunk search

"'Don't Expire Password' - Enabled"  | eval Administrator=mvindex(Account_Name, 0), User=mvindex(Account_Name, -1) | table _time,Administrator,User

indexes the Account Name field then maps out for easy viewing.

<search here>  | eval Administrator=mvindex(Account_Name, 0), User=mvindex(Account_Name, -1) | table _time,Administrator,User

GPO Registry Values with recursive array

Sorry using a global array, in function, just needed to get it done. no time today.
Read a GPO, locate the keys need then
Then clone the settings to another GPO

http://pastebin.com/ipDjYMds

Powershell | GPO Link report

[array]$Report = @()

$GPOs = Get-GPO -all | Sort-Object Displayname

foreach ($GPO in $GPOs) {


    Write-Host "Processing GPO $($GPO.DisplayName)"
    $XMLReport = Get-GPOReport -GUID $($GPO.id) -ReportType xml
    $XML = [xml]$XMLReport

    foreach ($gpolink in $xml.GPO.LinksTo.SomPath) {
        $Report += New-Object PSObject -Property @{
       'GPOName' = $xml.gpo.name
            'gpoLink' = $gpolink }
       }

    if ($xml.GPO.LinksTo.SomPath -eq $null) {
       $Report += New-Object PSObject -Property @{
       'GPOName' = $xml.gpo.name
            'gpoLink' = "Nolink" }
            }
       
}

$Report | Export-CSv C:\reporting\GPOLinks.csv

RDP session timeouts copy with powershell

#
# using an account as a template update other account to same value.
#yes.. not the best way.
#

$basic=Get-adUser jeff -Properties userParameters | select userParameters

$userlist=Get-aduser -Filter {samaccountname -like "nerds*"}
foreach ($target in $userlist){
$user=get-aduser $target.SamAccountName -Properties userParameters
$user.userParameters=$basic.userParameters
Set-ADUser -instance $user
$user=$null
}

Update Outlook Store Display Name - with powershell

# Outlook Store Display Name
# http://blogs.msdn.com/b/emeamsgdev/archive/2012/10/29/outlook-code-change-the-name-of-the-root-folder-in-outlook-2010-after-an-smtp-address-change.aspx

$outlook = New-Object -ComObject 'Outlook.Application'
$stores = $Outlook.GetNamespace("MAPI").Session.stores

Foreach ($Store in $stores){
If ($store.ExchangeStoreType -eq "0") {
       
        $updatestore=$store.GetRootFolder()
        $updatestore.Name="Work-Email"       
        }
}

Powershell | Event Log Message content

Security Event Log Taken from 2003 Domain Controller
fixed with http://www.cwflynt.com/logFixer/
Filtered with Eventvwr on Windows 10 saved as evtx

Loaded into powershell and filtered on the message content.


#
# Eventlog filtering
#
$logdetail=Get-WinEvent -path .\filteredchanges.evtx
$results=@()

Foreach($event in $logdetail){
        $mess=$event.message -split "`n"
        $a=$Mess| select-string "Target Account Name"
        $a=$a.ToString().split(":")[1]
        $b=$mess | select-string "Don't Expire Password"
        $c=$mess | select-string "Logon Hours"
        $c=$c.ToString().split(":")[1]
        $d=$mess | select-string "Caller User Name"
        $d=$d.ToString().split(":")[1]

                        $tempObJ = "" | Select Name,Expired,Logon,Changetime,userid
                        $tempObJ.Name = $a
                        $tempObJ.ChangeTime = $event.TimeCreated
                        $tempObJ.Expired = $b
                        $tempObJ.Logon = $c
                        $tempObJ.userid = $d
                        $results+=$tempObJ
}

Powershell : Clone DNS

$xraydns=Get-DnsServerResourceRecord -zonename "elephant.com.au" -ComputerName acdc001 -RRType A
foreach ($dns in $tangodns){
Add-DnsServerResourceRecordA -ZoneName "panda.com.au" -ComputerName acdc001 -Name $dns.hostname -IPv4Address $dns.recorddata.IPv4Address.IPAddressToString #-WhatIf
}