Fast & Efficient Windows Troubleshooting via PowerShell

As given live at the VirtualExpo Event, September 2024

Video here https://youtu.be/1-Z6InTWdv0

Transcript

1. Welcome
2. Fast & Efficient Windows Troubleshooting via PowerShell
3. Whoami.exe Independent Consultant-cum-Developer Wrote first code in 1980 (5 decades ago!) EUC focus since 1995 PowerShell since 2014 (C, C++, C# previously as well as vbs, cmd, kix, *nix shell) Mostly write PowerShell for software vendors like ControlUp, Parallels, Flexxible & more Microsoft MVP in PowerShell category (5 years) Available Services – code reviews, performance improvements, training, stand-up comedy @guyrleech
4. Two Parts to Being Fast & Efficient 1. Knowing what to run and when (& where & how) 2. Efficient/smart use of PowerShell
5. Efficient/Smart Use of PowerShell #1 Reuse & Recycle Persistent History Searching Set history to OneDrive or similar (in $profile) Leave searchable breadcrumbs # findme Ctrl r Ctrl space (tab completion on (legal) steroids) Get-Help (with –ShowWindow or –Online) Get-Command & Get-Module Start commands with ( [Console]::title = ‘Purpose of Window to help quick finding’
6. Efficient/Smart Use of PowerShell #2 Use (get-)date before/after commands and/or use (get-)history (alias h) Measure-Command ok but swallows output Out-GridView (ogv) –Passthru (+ ctrl c), Export-CSV and Export-CLIXML Jump box with all modules, SDKs, etc (& use for scheduled tasks) Measure(-Object) (I’m too lazy/old to count things ) Put # in front of command if realise need to do something first so return to it & uncomment AI but beware of the lies (“hallucinations”)
7. Efficient/Smart Use of PowerShell #3 • Ctrl Backspace/Delete to delete whole word back/forward • Ctrl Home/End to delete to start/end of line • Ctrl z/y – undo (multiple)/redo • Ctrl arrow – jump words • Number conversions • ‘{0:x}’ –f 1234 • 0x4d2 • [convert]::ToString( 1234 , 2 ) • scb/gcb – pipe to/from clipboard • (gcb).length – how long is that string in the clipboard • (get-date) - (gcim Win32_OperatingSystem).LastBootUpTime – what's the uptime?
8. Event Logs Event Viewer is (mostly) lame – 1 event detail at a time from 1 log ?? Explore event providers Get-WinEvent –ListProvider *interesting* -FilterHashTable -Computername Script to bring all event logs together (was a one liner)
9. Process Auditing • Enable creation & termination success auditing • GPO • Secpol.msc (Advanced Audit Policy Configuration->Detailed Tracking) • auditpol.exe (use GUIDs if non-English locale) • P/Invoke AuditSetSystemPolicy • Also cmd line auditing (potential security implications) • Increase Security event log size/make persistent • Event ids 4688 and 4689 in Security event log • Can troubleshoot as far back as the Security event log goes • Did something crash or exit prematurely (and if so what exit code)? • What launched that cmd.exe (at logon)? • Is something running a lot? • Is something running from a strange location? • Script to show processes, durations, parents, command lines or summary
10. Remoting Mstsc is lazy, bloated, tricky with single user OS, security woes Options -ComputerName -CIMSession -PowerShell Remoting (but accessing UNCs generally won’t work) WinRM Winrm /quickconfig Enable-PSRemoting GPO SSH Local admin or in “Remote Management Users” group Enter-PSSession (gcm *pssession) History is on client device – use same local script folder on all machines
11. WMI/CIM • Huge amount of available information (over 800 non performance classes by default) • Tab completion of classes or list with Get-CimClass (avoid WMI calls) • Great way to get computer details and export to CSV for reference/analysis • Some classes have methods which can be called, e.g. Win32_UserProfile • Filter in query, not afterwards if possible (speed, memory) • Can take array of machines via –ComputerName • Other name spaces, e.g. SCCM, Citrix • Get-CimInstance -Namespace Root -ClassName __Namespace • Tab/control space completion so easy to explore • Script to Monitor WMI activity
12. Networking Gip (alias for Get-NetIPConfiguration) (-detailed) Test-NetConnection Get-NetTCPConnection & Get-NetUDPEndpoint (netstat++) Get-NetFirewallPortFilter & Get-NetFirewallRule
13. Active Directory • Install ActiveDirectory module or use built-in ADSI or WMI/CIM • Great for bulk/complex queries and changes • Report to csv/html and email via scheduled task, e.g. expired/expiring accounts • Do big lookups and cache (hashtable) rather than lots of individual requests • Be careful! • Use –WhatIf/-Confirm (SupportsShouldProcess/ConfirmImpact/ShouldProcess) • Backup/test in non-production • GroupPolicy module • E.g. what GPOs have changed in the last 7 days? • Graph module for Entra ID
14. Reference Material • @guyrleech • github.com/guyrleech • pastebin.com/u/guyrleech • www.youtube.com/c/GuyLeech42 • linkedin.com/in/guyrleech/ • guyrleech.wordpress.com • Available for hire – code reviews, performance improvements, training, coaching
15. Exit 0