Powershell

From bibbleWiki
Jump to navigation Jump to search

Getting Event Logs

Get-CimInstance Win32_NTLogEvent | Where-Object {$_.Category -eq "1"}

1 Error
2 Warning
3 Information
4 Security Audit Success
5 Security Audit Failure

Entering a powershell command prompt remotely

Configure one time only

First change your network to private using powershell as admin

$networkListManager = [Activator]::CreateInstance([Type]::GetTypeFromCLSID([Guid]"{DCB00C01-570F-4A9B-8D69-199FDBA5723B}")) 
$connections = $networkListManager.GetNetworkConnections()
$connections | % {$_.GetNetwork().SetCategory(1)}

Then quick configuration in dos

Winrm quickconfig
Set-Item WSMan:\localhost\Client\TrustedHosts –Value <ipAddress>

Then for non joined

Enter-PSSession -ComputerName <IP> -Credential <Machine Name>\<username>

or for AD Joined

Could not find a way to do this so ended up creating a user and adding it to the local users and group using lusmgr.msc and under groups adding the user to Remote Management User