92 lines
3.5 KiB
PowerShell
92 lines
3.5 KiB
PowerShell
[Console]::OutputEncoding = [Text.Encoding]::UTF8
|
|
$ErrorActionPreference = 'SilentlyContinue'
|
|
|
|
function Section($title) {
|
|
Write-Host ''
|
|
Write-Host ('=' * 6) $title ('=' * 6) -ForegroundColor Cyan
|
|
}
|
|
|
|
Section 'Computer'
|
|
Get-ComputerInfo -Property CsName,CsDomain,CsManufacturer,CsModel,
|
|
WindowsProductName,OsVersion,OsBuildNumber,OsArchitecture,OsInstallDate,
|
|
CsNumberOfProcessors,CsNumberOfLogicalProcessors,OsTotalVisibleMemorySize,
|
|
CsUserName,TimeZone | Format-List
|
|
|
|
Section 'Boot Time'
|
|
(Get-CimInstance Win32_OperatingSystem).LastBootUpTime
|
|
|
|
Section 'Local Users'
|
|
Get-LocalUser | Select-Object Name,Enabled,LastLogon,Description | Format-Table -AutoSize
|
|
|
|
Section 'Administrators Group'
|
|
Get-LocalGroupMember -Group Administrators |
|
|
Select-Object Name,ObjectClass,PrincipalSource | Format-Table -AutoSize
|
|
|
|
Section 'Disks'
|
|
Get-Volume | Where-Object DriveLetter | Select-Object DriveLetter,FileSystemLabel,
|
|
@{n='Size(GB)';e={[math]::Round($_.Size / 1GB, 1)}},
|
|
@{n='Free(GB)';e={[math]::Round($_.SizeRemaining / 1GB, 1)}} |
|
|
Format-Table -AutoSize
|
|
|
|
Section 'IPv4 Addresses'
|
|
Get-NetIPAddress -AddressFamily IPv4 |
|
|
Where-Object { $_.InterfaceAlias -notmatch 'Loopback' } |
|
|
Select-Object InterfaceAlias,IPAddress,PrefixLength | Format-Table -AutoSize
|
|
|
|
Section 'Listening TCP Ports'
|
|
Get-NetTCPConnection -State Listen |
|
|
Select-Object LocalAddress,LocalPort,OwningProcess |
|
|
Sort-Object LocalPort -Unique | Format-Table -AutoSize
|
|
|
|
Section 'Firewall Profiles'
|
|
Get-NetFirewallProfile |
|
|
Select-Object Name,Enabled,DefaultInboundAction,DefaultOutboundAction |
|
|
Format-Table -AutoSize
|
|
|
|
Section 'SMB Shares'
|
|
Get-SmbShare | Select-Object Name,Path,Description | Format-Table -AutoSize
|
|
|
|
Section 'Defender'
|
|
Get-MpComputerStatus |
|
|
Select-Object AMRunningMode,AntivirusEnabled,RealTimeProtectionEnabled,
|
|
AMEngineVersion,AntivirusSignatureLastUpdated | Format-List
|
|
|
|
Section 'Installed Apps (non-Microsoft)'
|
|
$uninstallPaths = @(
|
|
'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
|
|
'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
|
|
)
|
|
Get-ItemProperty $uninstallPaths |
|
|
Where-Object { $_.DisplayName -and $_.Publisher -notmatch 'Microsoft' } |
|
|
Select-Object DisplayName,DisplayVersion,Publisher,InstallDate |
|
|
Sort-Object DisplayName | Format-Table -AutoSize
|
|
|
|
Section 'Startup Commands'
|
|
Get-CimInstance Win32_StartupCommand |
|
|
Select-Object Name,Command,Location,User | Format-Table -AutoSize
|
|
|
|
Section 'Scheduled Tasks (non-Microsoft, enabled)'
|
|
Get-ScheduledTask |
|
|
Where-Object { $_.State -ne 'Disabled' -and $_.TaskPath -notlike '\Microsoft\*' } |
|
|
Select-Object TaskPath,TaskName,State | Format-Table -AutoSize
|
|
|
|
Section 'SSH Services'
|
|
Get-Service sshd,ssh-agent | Format-Table Name,Status,StartType -AutoSize
|
|
|
|
Section 'Recent Logons (Security 4624, last 48h)'
|
|
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-48)} -MaxEvents 50 |
|
|
ForEach-Object {
|
|
$xml = [xml]$_.ToXml()
|
|
$d = @{}
|
|
$xml.Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
|
|
[pscustomobject]@{
|
|
Time = $_.TimeCreated
|
|
LogonType = $d['LogonType']
|
|
User = "$($d['TargetDomainName'])\$($d['TargetUserName'])"
|
|
IP = $d['IpAddress']
|
|
Process = $d['ProcessName']
|
|
}
|
|
} |
|
|
Where-Object { $_.User -notmatch 'SYSTEM|ANONYMOUS|LOCAL SERVICE|NETWORK SERVICE|DWM-|UMFD-|\$$' } |
|
|
Format-Table -AutoSize
|