Find the http response headers for IIS using powershell - windows

I want to find the custom headers for a particular site.
I am able to view the raw attributes using the below command. I think this is global value for all sites. I have created some headers for some sites. But I am not able to view it. Is there a command to view for a particular site.
>Get-IISConfigSection -SectionPath system.webServer/httpProtocol | Get-IISConfigCollection -CollectionName "customHeaders"
Attributes : {name, value}
ChildElements : {}
ElementTagName : add
IsLocallyStored : True
Methods :
RawAttributes : {[name, X-Powered-By], [value, ASP.NET]}
Schema : Microsoft.Web.Administration.ConfigurationElementSchema
UPDATE
I was able to find using the below command.
> Get-IISConfigSection -SectionPath system.webServer/httpProtocol -CommitPath "testsite" | Get-IISConfigCollection -CollectionName "customHeaders"
But I am not able to extract the name and value.
I used select-object rawattribute, but it gives empty {}

You can use the Get-Website command to get the configuration information of a specific website:
Get-Website -Name "Default Web Site"
This command will return the configuration information of the default website.

Related

Windows Audit Policy/Registry Key Command Check To Only Apply On Domain Controllers

I am trying to craft a command that would run against all of my Windows machines to check if the "Audit Distribution Group Management" audit policy setting is set to "Success and Failure". I would only like to apply this check to Domain Controller servers and for any other server type to echo out something like "NoCheckRequired", is this possible?
I tried to create an if-else statement on PowerShell for this, but it was not successful.
I tried to use the "wmic.exe ComputerSystem get DomainRole" command to find out the type of machine, values 4 / 5 mean DC server from my understanding, and using an IF statement, I tried to match those values and check if the group policy audit settings were set and for any other values returned other than 4 / 5
wmic.exe ComputerSystem get DomainRole outputs the property name on a separate line before outputting the actual value, so comparing to the number 4 (as an example) will not work.
Instead, use the Get-CimInstance cmdlet:
$CS = Get-CimInstance Win32_ComputerSystem
if($CS.DomainRole -in 4,5){
# We're on a Domain Controller
}
elseif($CS.DomainRole -in 1,3) {
# We're on a Domain member
}
else {
# We're on a workgroup machine
}
Get-ADComputer -Filter 'primarygroupid -eq "516"'
Will filter the Domain controller

Reset 'Friendly Name' certificate property using PowerShell

I need to have a certificate's Friendly Name set to an empty value so in Certificate Console Friendly Name column would display <None>.
Using this code all I could get is just empty value in the column, not <None> I need.
gci "Cert:\LocalMachine\My" | ? {$_.Subject -like "CN=mycer*"} | % { $_.FriendlyName = '' }
I also tried $_.FriendlyName = $null which made no difference.
Strange thing - when I clear Friendly Name using console then from Powershell's perspective the value is '' as the following statement produces True: write-host ($_.FriendlyName -eq ''). However, the ''' value applied vice a versa doesn't provide the expected result.
Any help is greatly appreciated.
UPDATE and ANSWER:
As Kory Gill suggested in comments, certutil.exe is indeed the way to get what I need.
Having created an clear.inf file with content below
[Version]
Signature = "$Windows NT$"
[Properties]
11 =
and executed certutil.exe -repairstore -user my "serial number" clear.inf I managed to reset Friendly Name to <None> value.
As an alternative to the PowerShell cmdlet for managing certificates, which may have issues with some properties, one can use certutil.exe as well to manage certs. This is similar to using robocopy.exe instead of Copy-File. Use the tools that give you the desired results...
This link shows an example of how to use certutil to change the friendly name.
Example usage from that page is:
certutil.exe -repairstore my "{serialnumber}" "change-friendly-name.inf"
where the inf file looks like:
[Version]
Signature = "$Windows NT$"
[Properties]
11 = "{text}new friendly name"
See also certutil reference.

How do I get the specific value from configuration in IIS 8.0 (and above) using appcmd?

I am using IIS 8.5 and I need a getter for a specific property from configuration.
For example, in order to set connectionTimeout property I am using the following syntax :
appcmd.exe set config -section:system.applicationHost/sites /siteDefaults.limits.connectionTimeout:"00:04:00" /commit:apphost
but when I am trying to read the proprety by the following command:
appcmd.exe list config -section:system.applicationHost/sites /siteDefaults.limits.connectionTimeout
I get the following error:
ERROR ( message:The attribute "siteDefaults.limits.connectionTimeout"
is not supported in the current command usage. )
and from what I tried so far it seems that list config command can give me only the section level and not further.
Is there any other way to get a specific property using appcmd?
If Powershell is an acceptable alternative for you, then you can use the WebAdministration Powersell module to get the timeout. Here is a simple script :
#import WebAdministration to access IIS configuration
Import-Module WebAdministration
#declare variables containing your filters
$pspath = "MACHINE/WEBROOT/APPHOST"
$filter = "system.applicationHost/sites/siteDefaults/limits"
$name = "connectionTimeout"
#Read timeout from IIS
$res = Get-WebConfigurationProperty -name $name -filter $filter -pspath $pspath
#Format & write output
Write-Host "Timeout (in seconds): " $res.Value.TotalSeconds -ForegroundColor Yellow
You probably need to run it as admin.
Here is the output:
You can get this using /text:
appcmd.exe list config -section:system.applicationHost/sites /text:siteDefaults.limits.connectionTimeout
if you want to get all possible options for /text: use the following code:
appcmd.exe list config -section:system.applicationHost/sites /text:?

How to use the log parser in Windows PowerShell by using for each loops to query the logs from multiple exchange servers?

I would like to use the below mentioned command in windows powershell by using the for each loops. Please let me know if you have any ideas on this query.
As I have little bit idea to input multiple values for the FROM parameter as because I need to search logs from the different servers from the given location.
I would like to feed the values for FROM filed like below but I don't have an complete idea to create the entire PowerShell script structure.
\\server1\d$\Program Files\Microsoft\Exchange\V15\Logging\HttpProxy\Mapi\*.*
\\server2\d$\Program Files\Microsoft\Exchange\V15\Logging\HttpProxy\Mapi\*.*
Command I created for individual server:
LogParser.exe "
SELECT DateTime,AuthenticatedUser,UserAgent
FROM 'd:\Program Files\Microsoft\Exchange\V15\Logging\HttpProxy\Mapi\*.*'
WHERE AuthenticatedUser LIKE '%user1%'
AND UserAgent LIKE '%Microsoft Office%'" -i:CSV -o:csv > "C:\Log parser\server1\1.csv"
Assuming you have access to the administrative shares on the remote servers you could do something like this:
$servers = 'server1', 'server2', ...
$servers | ForEach-Object {
LogParser.exe -i:csv -o:csv -q "SELECT DateTime,AuthenticatedUser,UserAgent
FROM '\\${_}\D$\Program Files\Microsoft\Exchange\V15\Logging\HttpProxy\Mapi\*.*'
WHERE AuthenticatedUser LIKE '%user1%'
AND UserAgent LIKE '%Microsoft Office%'" |
Out-File "C:\Log parser\${_}.csv"
}

Searching For A Registry Value Then Change It

On all the Windows 10 computers I re-image, I want to disable the option in Sound for giving exclusive control to each device to applications. I have located the registry keys and values:
HKLM\Software\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Capture\RANDOM_STRING\Properties
HKLM\Software\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\RANDOM_STRING\Properties
Within each of these keys (1st one is for Mics and 2nd is for Speakers) their are the two DWORD-32 values in each:
{b3f8fa53-0004-438e-9003-51a46e139bfc},3
{b3f8fa53-0004-438e-9003-51a46e139bfc},4
I want to basically make a batch script that will find these two values and set them to 0 for each audio devices. I'll have it run via Task Scheduler or something to make sure it gets new devices too.
The problem for me is that RANDOM_STRING portion of each path. Each one is ~25 random characters; it looks similar to the value names with the ,# at the end. I know how to change a value via a specific path, but here their is that randomized key name, and then new ones as new devices are plugged in.
Is their any way for me to create a batch file (or VBS/PowerShell) that will search the registry (or just Audio to narrow it down quicker) for those two values, and change their values to 0? Or if any other ways of going about this if so?
An example of the process I'd like (or again, something else similar):
Search for the DWORD-32 value "{b3f8fa53-0004-438e-9003-51a46e139bfc},3" within
the path
"HKLM\Software\Microsoft\Windows\CurrentVersion\MMDevices\Audio\"
and all the sub-keys within.
Set the value of the DWORD-32 value
"{b3f8fa53-0004-438e-9003-51a46e139bfc},3" to 0.
Search for the DWORD-32 value "{b3f8fa53-0004-438e-9003-51a46e139bfc},4" within
the path
"HKLM\Software\Microsoft\Windows\CurrentVersion\MMDevices\Audio\"
and all the sub-keys within.
Set the value of the DWORD-32 value
"{b3f8fa53-0004-438e-9003-51a46e139bfc},4" to 0.
I hope you know what are you doing. Manipulating registry is very risky. If you are absolutely sure, take a look at this script:
ls 'HKLM:\Software\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Capture\*\Properties\' | `
where {$_.Property -contains '{b3f8fa53-0004-438e-9003-51a46e139bfc},3'} | `
Get-ItemProperty -Name '{b3f8fa53-0004-438e-9003-51a46e139bfc},3'
#Set-ItemProperty -Name '{b3f8fa53-0004-438e-9003-51a46e139bfc},3' -Value 0
Make sure this script (with Get-ItemProperty) gets only desired keys. To change values, replace last line with commented one. Make sure you have proper permissions. And finally: do it at you own risk :)
I was unable to get the other answer working. I am trying to ban the Netflix app from being unbearably loud (which it does if it gets exclusive control of the sound device) every time I reinstall the geforce drivers (when the exclusive control resets).
So:
Get-ChildItem -recurse -path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\'| `
Foreach-Object { if ($_.Property -eq '{b3f8fa53-0004-438e-9003-51a46e139bfc},3') {$_|Get-ItemProperty -Name '{b3f8fa53-0004-438e-9003-51a46e139bfc},3'} }`
Gives me this output:
{b3f8fa53-0004-438e-9003-51a46e139bfc},3 : 0
PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\MMDevices\Audio\Render\{94743724-8af1-4abc-8d45-275
7184ec5f2}\Properties
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\MMDevices\Audio\Render\{94743724-8af1-4abc-8d45-275
7184ec5f2}
PSChildName : Properties
PSProvider : Microsoft.PowerShell.Core\Registry
{b3f8fa53-0004-438e-9003-51a46e139bfc},3 : 0
PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\MMDevices\Audio\Render\{b4ed07ae-0ee7-4ffb-8370-8bb
08a59a941}\Properties
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\MMDevices\Audio\Render\{b4ed07ae-0ee7-4ffb-8370-8bb
08a59a941}
PSChildName : Properties
PSProvider : Microsoft.PowerShell.Core\Registry
This looks good.
To write it the Get-ItemProperty needs to change to Set-ItemProperty but it results in a security error, please consult https://stackoverflow.com/a/35844259/308851 to take ownership of the relevant key.

Resources