PowerShell

With thanks to the 50 staff from across the University for attending please see below the links to the videos and PowerPoints of the day!

Direct link to Playlist – https://www.youtube.com/watch?list=PLRxbdlgJzwyjAf820T0u4GpP0E01a9LEX&v=u-GVJ_0VuRM

Slides as PowerPoint

  1 Intro (4.3 MiB, 17 hits)

  2 MDT (85.2 MiB, 27 hits)

  3 PowerShell (27.5 MiB, 12 hits)

  4 PRTG Network Monitor (47.5 MiB, 12 hits)

  5 OpenVAS (32.9 MiB, 12 hits)

  6 WSUS and Chocolatey (60.3 MiB, 9 hits)

  7 NPS and VLANs (10.7 MiB, 8 hits)

Slides as PDF

  1 Intro (2.0 MiB, 11 hits)

  2 MDT (2.2 MiB, 11 hits)

  3 PowerShell (1.8 MiB, 10 hits)

  4 PRTG Network Monitor (3.2 MiB, 13 hits)

  5 OpenVAS (2.3 MiB, 16 hits)

  6 WSUS and Chocolatey (2.9 MiB, 14 hits)

  7 NPS and VLANs (1.4 MiB, 13 hits)

Stay tuned over the coming days for the scripts that are mentioned through the video which will be linked to from this post.

A little bit of fun today with Milestone XProtect (in our case the express version) today; with the goal of improving our documentation I wanted to somehow obtain a list of all of the hardware devices (and to some degree the cameras) including there names, MAC addresses and IP addresses from our XProtect server.

Lone behold the configuration.xml file typically stored at “C:\ProgramData\Milestone\Milestone Surveillance\configuration.xml” held just the information I wanted; a little bit of PowerShell later and I had CSVs with the information in a human readable form.

To do the same on your server follow the guide using the Export-MilestoneConfig.ps1 script show below.

Download Export-MilestoneConfig.ps1 (download from GitHub)

This entry is part 2 of 4 in the series A Windows SysAdmin installs and uses OpenVAS

Following on from the previous post (A Windows SysAdmin installs and uses OpenVAS – End to end guide – Simple Beginnings) in this post we’ll be using PowerShell, OpenVAS and the OMP (Open Management Protocol from Greenbone) to create a Target (a machine/device) to conduct some Pen Testing against, create a Task to scan the target and then generate a report.

The final step is quite possibly the most important though; it’s worth pointing out (hopefully the obvious) that you could have the most amazing Pen Testing software package on the planet but unless you then absorb the reports and take action to Mitigate/Resolve/Eliminate the risks identified it’s all just a horrible waste of CPU cycles.

A quick note – this guide is shown as only a small example of how you can get started with OpenVAS, stay tuned for more in depth guides!

Getting Ready

In this first stage we will download the OMP client for Windows (from http://docs.greenbone.net/GSM-Manual/gos-4/en/tools.html#omp), get it into the right place on our computer as well as create a omp.config file (you can download an example from below) which will provide settings and credentials to the OMP client.

Example OMP File (hosted on GitHub – https://gist.github.com/jamesfed/4ed9be7de2adb83d1d442cc06ea1dbeb).

In addition to follow through with this guide you should download the .ps1 file below which contains the PowerShell code for the steps shown in the screenshots.

OpenVAS-Simple-Example.ps1 (hosted on GitHub – https://gist.github.com/jamesfed/6a5c6634abc12c180f125e25c2764d1f).

Creating a Target

Creating and kicking off a Task

Exporting the Report

Reading the Report

There’s more!

To discover more about the omp.exe tool take a look here – http://docs.greenbone.net/GSM-Manual/gos-4/en/omp.html#access-with-omp.

In the next post of this series I’ll be covering how we can take these simple beginnings and start to build something more in depth through OMP and PowerShell.

If you are running (or use) the Sympa Mailing List but also use Windows PowerShell then you may want to be aware of PSSympa which recently went v1.0 on GitHub and the PowerShell Gallery.

In this release we have…

Functions

  • Get-SympaLogin (to login and get a session cookie – the result of which is used with all other functions)
  • Get-SympaMailingListMember (get the members of a list or list(s))
  • Add-SympaMailingListMember (add a member(s) to a list)
  • Remove-SympaMailingListMember (removes a member(s) from a list)
  • Test-SympaMailingListMember (checks to see if someone is a Subscriber, Owner or Editor of a list)
  • Sync-SympaMailingList (based on the contents of a reference CSV makes changes to the membership of a list)

Samples

  • How a CSV storing credentials might look (samplecredsfile.csv)
  • How a CSV that is used to Add/Remove members in bulk to/from a single list (samplememberslist.csv)
  • How a CSV that is used with the Sync- function would look (samplesynclist.csv)

Super Awesome Features

  • Credentials can be stored in a CSV to avoid them being typed in as part of a wider script
  • Pipeline support for members in lists

How to get it

The PowerShell Gallery is the best route to get your hands on the Module, see this link – https://www.powershellgallery.com/packages/PSSympa for the full details in short though you should only need to run the following command at your PowerShell prompt (assuming you are running a recent version of PowerShell) to install the module on your PC.

Install-Module -Name PSSympa

Continue reading

One of my favourite features of PowerShell is the Invoke-RestMethod cmdlet which (among a great many other things) can download the data from an RSS feed. One application I’ve found for this is to stay on top of security bulletins from organisations like Adobe and Drupal.

However just downloading the data from the feed and kicking it out in an email isn’t quite good enough for my needs thus the script below gets data from a CSV which contains the URL to the feed as well as some extra details to inject into any email notification (e.g. a link to the guide on how to deploy Adobe Updates).

In my production environment this script creates tickets on a FreskDesk helpdesk to log and manage any new update notifications. In the attached example below the script just fires off email notifications.

Have a look at the screenshot sequence below for more info!

  Get-Rss (4.0 KiB, 142 hits)

Update 09/05/2017 – v0.2 – Now handles XML and Arrays in the link and title objects (good for reddit and blogspot!)

So this post is a more a reminder to me than anything else but…having recently come across the Microsoft TechNet article ‘Keyboard Shortcuts for the Windows PowerShell ISE’ (https://msdn.microsoft.com/powershell/scripting/core-powershell/ise/keyboard-shortcuts-for-the-windows-powershell-ise) I thought it necessary to highlight the two keyboard shortcuts….

Ctrl + J – brings up a list of code snippet templates (e.g. try-catch-finally and do-until)
Ctrl + M – expand or collapse braces

See the screenshots below for a demo and do make sure you try them yourself!

Looking for some fun ways to get more out of your your Smart Card deployment? If so have you tried……?

  1. Use Smart Cards to login to your Servers via Remote Desktop
  2. Use Smart Cards with the PowerShell Get-Credential Commandlet
  3. Use Smart Cards with your Firewall for single sign on
  4. Use Smart Cards to login to IIS Web Applications (just a box to tick and a radio option to select)
  5. Store multiple identities on your Smart Card and assign different (and perhaps more complex) PINs to the identities

Have a look at the screen shots below for some more details…

So first things first….the title of this article is misleading; thus far Avid do not seem to have released a sounds pack specific for Sibelius 8 as you will see on the website when you login in (https://my.avid.com/account/orientation) the only option is for the 7.5 sounds pack. But…this works!

Now deploying Sibelius it’s self in a silent manner is (in my opinion) pretty well documented at this link – http://avid.force.com/pkb/articles/en_US/how_to/en396971.

When you get to the sounds the documentation (again in my opinion) (which can be found here – http://avid.force.com/pkb/articles/en_US/How_To/Installing-and-using-Sibelius-Sounds-across-a-network) is flaky at best not to mention the confusion around version 7/7.5/8.

For example the install path is listed as C:\Program Files (x86)\Avid\Sibelius Sounds\Sibelius 7 Sounds, well Sibelius 8 is x64 only so do we put it in the C:\Program Files folder instead? The registry entry is listed as HKEY_LOCAL_MACHINE\SOFTWARE\Avid\Sibelius Sounds\Sibelius 7 Sounds\ContentPath – well again do we update this to be ‘Sibelius 8 Sounds’?

Well as it transpires their guide is correct in all respects; however, as it states in the clear there is no silent install command for the sounds. Ultimately though its just a copy and paste operation with the addition of a registry key so lets use some PowerShell to get this software deployed! Continue reading

Check DCsOne of those monthly jobs that every SysAdmin will come across is good old Patch Tuesday; to help make Patch Tuesday a little more fun after all of the servers have been updated I use Hyper-V Replica (run by a PowerShell script) to shutdown each Virtual Machine and move it onto another host (ticks the box for the machine reboot component of Windows Updates and also tests our DR solution in one hit!).
However as both of my DCs are Virtual Machines I want to make sure that at least one DC is up at all times, to do that I have built a little PowerShell function (see below to download it within a zip file!) that is run before every migration to ensure that both DCs are up and running (along with the Network Policy Server service which is used to authenticate clients on the network (and so is very important!!)) before any migration happens.

Hopefully this will help someone someday!

  See if DCs are up (905 bytes, 283 hits)

This is how your folder should look once updated

This is how your folder should look once updated

Following from Automated backup for your network switches with WinSCP and PowerShell you can take things one step further and with a little more PowerShell its possible to get email reports on any changes between switch configs.

This kind of setup would be useful for any sized organisation who have a need to ensure changes are logged or want to ensure that no one has maliciously changed a configuration.

Make sure you edit lines 6-8 with your SMTP details

Make sure you edit lines 6-8 with your SMTP details

The setup is simple, just as with the automated backup these will need to be extracted to your C:\Network Switch Backup folder which should look something like the screenshot to the right once done.

I’ve also included an updated .cmd file which calls the Backup Network Switches.ps1 script and then the Compare Configs.ps1 script in turn.

  Network Switch Change Log (1.6 KiB, 498 hits)

There is plenty of description within the PowerShell file; even a little error handling as well! Be sure to edit lines 6-8 with your SMTP settings.