I am restricted to PowerShell version 2, I have crafted a command that lists out all of the accounts in the disabled state:
Get-WmiObject Win32_UserAccount | where{$_.Disabled -eq "True"} | select Name, Disabled
This works well, however, it also lists DC user accounts, I am only trying to query local users.
Is there any way to query only local user accounts in the disabled state?
Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount=True and Disabled=True" | Select-Object Name, Disabled
Old school Windows Tools still work, even from PowerShell regardless of version.
wmic useraccount get Name,Disabled
or
Start-Process powershell -ArgumentList '-NoExit', '-NoProfile', '-Command &{ "wmic useraccount get Name,Disabled" }'
# Results
<#
Disabled Name
TRUE Administrator
...
#>
Update for proof relative to your comment...
...it seems to give me an Invalid GET Expression error message on
PowerShell version 2
...
C:\>powershell -version 2.0 -nologo -noprofile
PS C:\> (Get-WmiObject -Class Win32_OperatingSystem).Caption
Microsoft Windows 10 Pro
PS C:\> $PSVersionTable
Name Value
---- -----
CLRVersion 2.0.50727.9151
BuildVersion 6.1.7600.16385
PSVersion 2.0
WSManStackVersion 2.0
PSCompatibleVersions {1.0, 2.0}
SerializationVersion 1.1.0.1
PSRemotingProtocolVersion 2.1
PS C:\> wmic useraccount get Name
Name
Administrator
...
PS C:\> wmic useraccount get Disabled
Disabled
TRUE
..
PS C:\> wmic useraccount get "Name,Disabled"
Disabled Name
TRUE Administrator
...
Related
This is a script to get the version of an installed software on remote computers.
Is there any way I can show the computer names in the result?
Please check the screenshot.
$pcname1 = 'TestServer1','TestServer2','TestServer3'
Get-WmiObject -Class Win32_Product -ComputerName $pcname1 |
where name -eq 'VMware Tools' |
select Name,Version
Both the obsolete Get-WmiObject cmdlet and its successor, Get-CimInstance,[1] add a .PSComputerName property to its output objects whenever the -ComputerName parameter is used.
Therefore:
$pcnames = 'TestServer1','TestServer2','TestServer3'
Get-CimInstance -Class Win32_Product -ComputerName $pcnames |
Where-Object Name -eq 'VMware Tools' |
Select-Object Name, Version, PSComputerName
[1] The CIM cmdlets (e.g., Get-CimInstance) superseded the WMI cmdlets (e.g., Get-WmiObject) in PowerShell v3 (released in September 2012). Therefore, the WMI cmdlets should be avoided, not least because PowerShell (Core) v6+, where all future effort will go, doesn't even have them anymore. Note that WMI still underlies the CIM cmdlets, however. For more information, see this answer.
I'm trying to get details on the marking technology my printer uses but upon running the "wmic printer get MarkingTechnology" command i just get a blank screen here's a picture of the command prompt displaying the command after being run
I don't know if this source How to get model of printer with POWERSHELL? can help you or not ?
get-wmiobject win32_printer -ComputerName localhost
or
get-wmiobject win32_printer | ft
get-wmiobject win32_printer | ?{$_.ShareName -eq "Printer01"} | fl *
get-wmiobject win32_printer | ft Name,ShareName,DriverName -Autosize
How to sort the services under windows 2012r2 with powershell to show only ones executed with service account "...name..." In the enterprise domain environment
You can do that by querying the WMI Win32_Service class using the Get-WmiObject cmdlet.
For example, this will retrieve all the Windows Services that run under the LocalSystem account:
Get-WmiObject -Query "select name, startname from Win32_Service where startname = 'LocalSystem'"
Alternatively, you can retrieve all Windows Services from WMI and filter them in PowerShell using:
Get-WmiObject Win32_Service | where StartName -eq "LocalSystem"
I am trying to end a powershell window I spawned from a task running as SYSTEM. I don't have the ID of the process since I am launching it through psexec to be able to set the session id. The task and the target powershell process are in different sessions.
I thought it would be simple just to set a window title and then query on the window title but I am running to issues since processes running under the system don't seem to see the window title. For example when I run get-process powershell | format-table -property Name, MainWindowTitle as a user I get:
Name MainWindowTitle
---- ---------------
powershell Administrator: C:\Windows\System32\cmd.exe
powershell My Title
powershell
By when I run the same command under the system account I get:
Name MainWindowTitle
---- ---------------
powershell
powershell
powershell
I am not sure what is going on here. Is there a way to get the MainWindowTitle from the SYSTEM account? If not, is there something else I could query for that would return my powershell window and leave any other powershell processes running?
I am on Window 7 x64
Name Value
---- -----
CLRVersion 2.0.50727.5477
BuildVersion 6.1.7601.17514
PSVersion 2.0
WSManStackVersion 2.0
PSCompatibleVersions {1.0, 2.0}
SerializationVersion 1.1.0.1
PSRemotingProtocolVersion 2.1
If there is something unique about the command line of the process you'd like to kill, maybe you could use something like:
Get-CimInstance Win32_Process -Filter "Name='powershell.exe'" |
Where-Object { $_.CommandLine -match $commandLineToMatch } |
ForEach-Object { Stop-Process -WhatIf -Id $_.ProcessId }
I added -WhatIf for testing purposes.
You need to call the GetOwner() method on the Win32_Process object to get the user that started the process.
Get-WmiObject -Class Win32_Process -Filter "Name='powershell.exe'" | ForEach-Object {
if ($_.GetOwner().User -match 'system') {
$_.Terminate()
}
}
I’m attempting to install the .net framework on a windows server 2008 r2 machine remotely via PowerShell. Reading about it seems that this cannot be achieved through an existing PowerShell session but credentials need to be explicitly passed in (any idea why this is?). However, I'm still getting permission errors.
For example, If I run:
$cred = Get-Credential -Credential 10.20.0.13\administrator
$Session=New-PsSession -ComputerName 10.20.0.13 -Credential $cred
Invoke-command -ScriptBlock {Start-Process -FilePath c:\installers\dotNetFx40_Full_x86_x64.exe -ArgumentList "/q /norestart /log c:\" -Wait} -Credential $cred -ComputerName 10.20.0.13
I can see on the remote machine that the installer runs (in task manager), the temporary folder is created on the root of c:\, the files extracted and then I get a 700kb log file. At the foot of that log file I get:
OS Version = 6.1.7601, Platform 2, Service Pack 1 OS Description =
Win2K8R2 - x64 Standard Edition Service Pack 1 CommandLine =
C:\b65da67b927bfb71c84adcecefc019\Setup.exe /q /norestart /log c:\
/x86 /x64 TimeZone = GMT Standard Time Initial LCID = 2057 Using
Simultaneous Download and Install mechanism Operation: Installing
Package Name = Microsoft .NET Framework 4 Setup Package Version =
4.0.30319 User Experience Data Collection Policy: Disabled Number of applicable items: 11 Exe
(C:\b65da67b927bfb71c84adcecefc019\SetupUtility.exe) succeeded. Exe
Log File: dd_SetupUtility.txt ServiceControl operation succeeded!
ServiceControl operation succeeded! Exe
(C:\b65da67b927bfb71c84adcecefc019\Windows6.1-KB958488-v6001-x64.msu)
failed with 0x5 - Access is denied. . Final Result: Installation
failed with error code: (0x00000005), "Access is denied. " (Elapsed
time: 0 00:01:12).
So access is denied. However, using the exact same credentials I can perform other tasks (add server roles in Powershell, add windows features via powershell etc) and I can RDP onto the box using the same username/password and run the installer there (which completes fine).
I’m missing something somewhere, but can’t seem to find out what it is. I can see its worked for someone else (http://social.technet.microsoft.com/Forums/windowsserver/ar-SA/3045eb24-7739-4695-ae94-5aa7052119fd/install-dotnet-framework-4-using-powershell?forum=winserverpowershell) so no idea why I’m getting this.
Any help much appreciated.
Thanks
You're creating a session but never using it?
I haven't tried this on a remote computer beforey, but try to run the process "as admin" by using -Verb RunAs, like this:
$cred = Get-Credential -Credential 10.20.0.13\administrator
$Session=New-PsSession -ComputerName 10.20.0.13 -Credential $cred
Invoke-command -ScriptBlock {Start-Process -FilePath c:\installers\dotNetFx40_Full_x86_x64.exe -ArgumentList "/q /norestart /log c:\" -Wait -Verb RunAs } -Session $Session
While installation of .NET framework 4.0, It installs some updates as well (.msu) files.
But when we are installaing .NET 4.0 remotely, It fails because of these updates. The reason behind that is, it's not allowable to install these updates remotely. Please find the KB article here. This article also mentioned the workaround for this.
you have servername in textfile or machine names in OU based. create .bat which has .exe to run C:\temp\xxx.exe /S /qn
$ou='OU=subou3,OU=subou2,OU=subou1,DC=domain,DC=com'
$filter = #("machinename1", "machinename2")
$compute= Get-ADComputer -Filter * -SearchBase $ou | where-object{$filter -contains $_.name}
$comp=$compute.name
foreach ($Computer in $Comp) {
Write-Host "Processing $Computer"
{
Write-Host " Installing application on $Comp"
psexec $Compter path\XXX.bat /S /qn
}
}