Here’s a collection of smaller script bits that I have used to audit computers, that don’t need a separate post to explain – they’re pretty much one-liners – but thought I’d add them here for completeness sake. This is Part 3 of 4 (Part 1 is here, Part 2 is here, and Part 4 is here)
Note: these are somewhat tailored, and there is a lot more information available from each WMI query – I’ve just chosen select fields that are important to me. Your circumstances may require different properties to be returned. Modify as needed.
Installed Windows features:
|
1 2 3 |
$features = gwmi win32_optionalfeature | where {$_.installstate -eq 1} | select name, caption |
Bios information:
|
1 2 3 |
$bios = gwmi win32_bios | select caption, description, manufacturer, serialnumber, version; |
Operating System information, including current PowerShell version:
|
1 2 3 4 5 |
$os = gwmi win32_operatingsystem | select caption, lastbootuptime, osarchitecture, servicepackmajorversion, servicepackminorversion, psversion; $os.psversion = [String]$psversiontable.psversion.major + "." + [String]$psversiontable.psversion.minor; |
Computer System information, including Intune status:
|
1 2 3 4 5 |
$computersystem = gwmi win32_computersystem | select domain, workgroup, manufacturer, model, systemfamily, numberoflogicalprocessors, numberofprocessors, totalphysicalmemory, intune; $computersystem.intune = ((Get-Item HKLM:\SYSTEM\ControlSet001\Control\CloudDomainJoin -ea 0) -ne $null); |
Logical Disk information:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
# Get all logical disks $logicaldisk = gwmi win32_logicaldisk | select caption, description, drivetype, filesystem, freespace, size; # Check number of disks found $logicaldiskcount = ($logicaldisk | measure-object).count; # Convert disk info into an array if only 1 disk is found if ($logicaldiskcount -eq 1) { $temparray = @(); $temparray += $logicaldisk; $logicaldisk = $temparray; } |
Network Adapter information:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
# Get all enabled network adapters $networkadapter = gwmi win32_networkadapterconfiguration | where {$_.ipenabled} | select dhcpenabled, dhcpserver, dnsdomain, dnsserversearchorder, ipaddress, defaultipgateway, ipsubnet, macaddress; # Check number of adapters found $networkadaptercount = ($networkadapter | measure-object).count; # Convert network adapter info into an array if only 1 disk is found if ($networkadaptercount -eq 1) { $temparray = @(); $temparray += $networkadapter; $networkadapter = $temparray; } |
Certificates installed:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
# Get all certificates from the computers Personal certificate store $certificates = get-childItem cert:\LocalMachine\My | select friendlyname, notafter, notbefore, hasprivatekey, serialnumber, thumbprint, version, issuer, subject; # Check number of certificates found $certcount = ($certificates | measure-object).count; # Convert certificate info into an array if only 1 disk is found if ($certcount -le 1) { $temparray = @(); $temparray += $certificates; $certificates = $temparray; } |
Scheduled Tasks:
Steal some code from HERE