1
2

$file2 = Get-Content "file2.log"
Add-Content "file1.log" $file2

Now, what if we want to copy the contents of file1.log and file2.log into a completely new file called file3.log

1
2
3
4
5

New-Item -ItemType file "file3.log"
$file1 = Get-Content "file1.log"
$file2 = Get-Content "file2.log"
Add-Content "file3.log" $file1
Add-Content "file3.log" $file2

What if we want to erase everything in file3.log before we add new content? In this case, instead of creating a new file, we’ll use the Clear-Contents cmdlet.

1
2
3
4
5

Clear-Content "file3.log"
$file1 = Get-Content "file1.log"
$file2 = Get-Content "file2.log"
Add-Content "file3.log" $file1
Add-Content "file3.log" $file2

Ok, well, what if I don’t know if file3.log already exists? If it doesn’t exist and I run the Clear-Contents cmdlet then I’ll get an error. And if it does exist and I try to create it as a new file I’ll still get an error. There’s an easy way to do this, we’ll use the New-Item cmdlet from the example above, but we’ll add the -force argument, so even if the file exists it will overwrite it.

1
2
3
4
5

New-Item -ItemType file "file3.log" -force
$file1 = Get-Content "file1.log"
$file2 = Get-Content "file2.log"
Add-Content "file3.log" $file1
Add-Content "file3.log" $file2

Alright, so I guess I got the hang of this, now lastly since these are log files, how can I append the date to the file name? Simple, with the Get-Date cmdlet. Let’s output our file name as YYYYMMDD-WebAccess.log in this example.

1
2
3
4
5
6
7

$date= (Get-Date).ToString("yyyyMMdd")
$NewFileName = "$date-WebAccess.log"
New-Item -ItemType file $NewFileName
$file1 = Get-Content "file1.log"
$file2 = Get-Content "file2.log"
Add-Content $NewFileName $file1
Add-Content $NewFileName $file2

Get-Acl "C:\Documents and Settings\Administrator"

Now this return everything that I would expect it to, but I prefer the Format-List view, so let’s check the permissions on the the file C:\Windows\clock.avi and output it in a list view.

Get-Acl "C:\Windows\clock.avi" | Format-List

Ok, now I did say we could check the permissions of a registry key, so let’s go for it…

1

Get-Acl HKLM:\Software\Microsoft

Now if you just want to find out the owner of the file you could pull back just that value

1

Get-Acl "C:\Windows\clock.avi" | Select Owner

1
2

$ping = New-Object System.Net.NetworkInformation.Ping
$ping.Send("www.brangle.com")

We can also set a timeout so that our computer doesn’t hang to long on a server that won’t respond. Let’s add a timeout of a 5 seconds, we will first need to convert this to milliseconds, so that’s 5,000ms. Of course 5 seconds may not be a resonable timeout, you need to figure out what’s appropriate for you and what you’re willing to tolerate.

1
2

$ping = New-Object System.Net.NetworkInformation.Ping
$ping.Send("www.brangle.com", 5000)

Technical details: System.Net.NetworkInformation.Ping requires that you have .NET 2.0 or greater.

To retrieve the comptuer name

1

[System.Environment]::MachineName

Get Operating System Information (such as Platform, service pack, version, and version string)

1

[System.Environment]::OSVersion

Checking to see if your computer has started to shutdown

1

[System.Environment]::HasShutdownStarted

Instead of trying to remember if you should use `r`n or is it just `n? A simple way is just to get .NET to tell you and assign this value to a variable.

1

$nl = [System.Environment]::NewLine

Get the system directory (normally this is C:\Windows\System32), but for some computers it could be different

1

[System.Environment]::SystemDirectory

Get the user’s domain name

1

[System.Environment]::UserDomainName

Get the user’s name

1

[System.Environment]::UserName

Get a list of all environment variables

1

[System.Environment]::GetEnvironmentVariables()

Get a particular environment variable

1
2
3
4

$path = [System.Environment]::GetEnvironmentVariable("path")
$temp = [System.Environment]::GetEnvironmentVariable("temp")
$os = [System.Environment]::GetEnvironmentVariable("os")
$homedrive = [System.Environment]::GetEnvironmentVariable("homedrive")

Create a new environment variable, or overwrite an existing one

1

[System.Environment]::SetEnvironmentVariable("VariableName","VariableValue")

Get all logical drives

1

[System.Environment]::GetLogicalDrives()

1
2
3
4
5
6
7
8
9

$emailFrom = "sender@example.com"
$emailTo = "recipient@example.com"
 
$subject = "Subject"
$body = "This is my automated email`nThis is line number 2"
$smtpServer = "localhost"
 
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($emailFrom, $emailTo, $subject, $body)

Now let’s send a SMS text massage alert, in this message we will include how much free space we have on our C: drive. Most cell carriers limit text messages to 160 characters, so we want to keep them as short and useful as possible. Check the list below to see see what the email address of your phone is and make sure to replace the $to variable.

1
2
3
4
5
6
7
8
9
10
11
12

$freeSpace = gwmi win32_logicaldisk -filter "DeviceID=`"C:`"" | % { $_.freespace/1GB }
$freeSpace = [System.Math]::round($FreeSpace,2)
 
$from = "from@example.com"
$to = "1234567890@example.com"
 
$subject = ""
$body = "C: free space is " + $freeSpace + " GB"
 
$smtpServer = "localhost"
$smtp = New-Object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($from, $to, $subject, $body)

Now we need to figure out what email address to use so that we can send the SMS address, below are a few examples for several US carriers. Make sure to replace 1234567890 with your ten digit phone number.

Alltel
1234567890@message.alltel.com

AT&T
1234567890@txt.att.net

Boost Mobile
1234567890@myboostmobile.com

MetroPCS
1234567890@mymetropcs.com

Nextel
1234567890@messaging.nextel.com

Sprint PCS
1234567890@messaging.sprintpcs.com

T-Mobile
1234567890@tmomail.net

Verizon
1234567890@vtext.com

Virgin Mobile
1234567890@vmobl.com

1

Add-Content c:\sample.txt "This is the last line"

The example above adds the text to the last line, it doesn’t actually create a new line, so let’s try it again, and make sure that this time the text that we concatenate is on the last line all by itself.

1

Add-Content c:\sample.txt "`r`nThis is the last line"

You’ll notice a `r`n this is an escape character to tell PowerShell to add a carriage return and a new line, you’ll need this when working with Windows file. If your going to move this file to a unix or linux computer, you’ll only need a `n there’s no need for the carriage return.

Here is a list of escape characters:

• `0 — Null
• `a — Alert
• `b — Backspace
• `n — New line
• `r — Carriage return
• `t — Horizontal tab
• `’ — Single quote
• `” — Double quote

The example I gave above was the quick and dirty, we should really explicitly state our arguments and use quotes around the path, to do that we will add a path and a value argument

1

Add-Content -Path "c:\sample.txt" -Value "`r`nThis is the last line"

Here’s a useful example, suppose you want to map hostname to a particular IP address. Let’s map example.com to point to 127.0.0.1, we’ll do this using the ac alias for Add-Content.

1

ac -Path "C:\WINDOWS\system32\drivers\etc\hosts" -Value "`r`n127.0.0.1    example.com"

1. Entering your own unique credentials
2. Entering a service account password, ie: the same username (or hard coding a username)
3. Hard coding a user name and password

Method 1:

Windows PowerShell Credentials Request Box

1
2
3
4
5
6

PS C:\> $cred = Get-Credential
 
cmdlet Get-Credential at command pipeline position 1
Supply values for the following parameters:
Credential
PS C:\> gwmi win32_LoggedOnUser -computer "dev-ghost" -credential $cred

Method 2
In this example, we are going to do the same as above, except we will specify the username, this is perfect for whenever you use service accounts.

1
2

PS C:\>PS C:\> $cred = Get-Credential "dev-ghost\administrator"
PS C:\> gwmi win32_LoggedOnUser -computer "dev-ghost" -credential $cred

Now let’s do the same as above, but instead of saving our credentials to a variable, we will just use it once and call it inline.

1

PS C:\> gwmi win32_LoggedOnUser -computer "dev-ghost" -credential "dev-ghost\administrator"

Method 3
I don’t think password should ever be hard coded into scripts, especially ones that can be decrypted. PowerShell provides a SecureString, this is nothing more than a joke. The reason I call it a joke is because anyone can decrypt a SecureString if they know a little bit of PS. But ignorance is bliss right? So let’s get to it…

1

PS C:\windows\system32\windowspowershell\v1.0> Read-Host -AsSecureString | ConvertFrom-SecureString | Out-File C:\PowerShell\MyPassword.txt

Once you press enter just type in your password, this will save your password to a file called MyPassword.txt. So now that the password is saved as a "SecureString" we can now use these saved credentials.

1
2

$password = type C:\PowerShell\MyPassword.txt | ConvertTo-SecureString
$cred = New-Object -TypeName System.Management.Automation.PSCredential -argumentlist “administrator”,$password

and that’s it, your all set to start impersonating your credentials so that you can run scripts or executable under your service accounts.

If the folder you want to mount happens to exist on the same computer, i.e. locally we can use the subst.exe command. Let’s assume we want to mount the administrators photos to the drive letter P: we should run the following in the command prompt:

subst P: "C:\Documents and Settings\Administrator\My Documents\My Pictures"

Do not put a trailing slash at the end of Pictures, subst.exe doesn’t like it and will complain that it can’t find the path. Of course you don’t even need to run this command from the command prompt, you could run it from the Run menu. In general the command to create a virtual drive is

subst [drive1:] [drive2:]path]

where drive1 is the drive letter that you want to create and drive2:path is the file location of the folder you want to map.

Ok, so now we’v created the virtual drive and we’re ready to get rid of it. This procedure isn’t as easy as right clicking on the drive and selecting Disconnect, after all you can’t disconnect if it’s a local folder. You’re going to have to delete the virtual drive using the delete switch /d

subst P: /d

It really can’t get any simplier.

Ok, so now let’s try mapping a UNC drive with PowerShell. It’s just that simple.

1
2

$drive = $(New-Object -Com WScript.Network)
$drive.MapNetworkDrive("w:", "\\ComputerName\Share")

Get-Help *

Well honestly this returned more than I was expecting in included aliases, providers, and help files, I on the otherhand was only interested in cmdlets, at least for the moment. So in true PowerShell style, I ran the following query against PowerShell to only show me the cmdlets in the help section.

Get-Help * | Where-Object { $_.Category -eq 'Cmdlet' }

Of course, this also told me that that the category was a Cmdlet and to keep things looking nice, I decided to filter out only what I wanted by taking it a step further and running another query against my query…

Get-Help * | Where-Object { $_.Category -eq 'Cmdlet' } | Select Name,Synopsis,PSSnapIn | Sort Name

The following command returned a lot of useful information about PowerShell cmdlets.  Every item in the PSSnapIn should be prefixed with “Microsoft.PowerShell,” I just edited it out room to make it look cleaner.

Get-WmiObject Win32_OperatingSystem

The following command returned the following on my Windows XP box, and yes, anywhere you see XXXXX I censored the data for my personal privacy…

SystemDirectory : C:\WINDOWS\system32
Organization    : XXXXX
BuildNumber     : 2600
RegisteredUser  : XXXXX
SerialNumber    : XXXXX-XXX-XXXXXXX-XXXXX
Version         : 5.1.2600

If we use a pipe command, we can return the information in a table

PS H:\powershell> Get-WmiObject Win32_OperatingSystem | format-table

SystemDirecto Organization  BuildNumber  RegisteredUs SerialNumber Version
ry                                       er
------------- ------------  -----------  ------------ ------------ -------
C:\WINDOWS... XXXXX...      2600         XXXXX...     XXXXX-XXX... 5.1.2600

Of course, what if we just wanted to return the Windows Version and not all of the miscellaneous/irrelevant data? We can pipe the Get-Member command to see all of the properties that are hidden in that class.

Get-WmiObject Win32_OperatingSystem | Get-Member

Running this command shows us a list of MemberType, if you see a MemberType of Property we can query to see what is contained within that property field by using the Format Table command “ft.” For example

PS H:\powershell> Get-WmiObject Win32_OperatingSystem | ft Version, ServicePackMajorVersion

Version                                                 ServicePackMajorVersion
-------                                                 -----------------------
5.1.2600                                                                      3

Now, what if we want to access information on a remote client or server? Simple! just concat the computer name to the WMI call. Just make sure to change “ComputerName” to the client/server name.

PS H:\powershell> Get-WmiObject Win32_OperatingSystem -computer "ComputerName" | ft Version, ServicePackMajorVersion

That’s great, but if you don’t have access to client/server under your normal Windows or AD credentials, we can authenticate as a different user. To do this we are going to assign our credentials to the variable $cred (short for credentials), you can change this name to whatever you want. Once we’ve logged in, we will pass those to the client or server that we are trying to authenticate against to login and view the WMI system info. When we call Get-Credential this causes a Windows popup asking us to login.

PS H:\powershell> $cred = Get-Credential

cmdlet Get-Credential at command pipeline position 1
Supply values for the following parameters:
Credential

PS H:\powershell> Get-WmiObject Win32_OperatingSystem -computer dev-ghost -Credential $cred

SystemDirectory : C:\WINDOWS\system32
Organization    : XXXXX
BuildNumber     : 3790
RegisteredUser  : XXXXX
SerialNumber    : XXXXX-XXX-XXXXXXX-XXXXX
Version         : 5.2.3790