PowerShell + Commands for System Protection Instructor Guide

By: Kevin O'Neill

Narrated by: Virtual Voice

PowerShell is a powerful scripting language and command-line tool which provides several useful commands for system protection of one’s environment. Therefore, this instructor guide covers useful and not common commands to utilize for system protection. The commands can be utilized for personal, educational, or corporate usage. It is envisioned that the instructor utilizes the material from this guide via a demonstration type format.

Contents
How to Use and Run Commands
System Protection Command Examples
Accounts & Credentials
Get-LocalUser
Key Parameters Get-LocalUser
Why Get-LocalUser Is Useful
Get-LocalGroupMember
Key Parameters of Get-LocalGroupMember
Why Get-LocalGroupMember Is Useful
whoami /priv
Key Parameters of whoami /priv
Why whoami /priv Is Useful
Auditing & Event Logs
$PSVersionTable
Key Parameters of $PSVersionTable
Why $PSVersionTable Is Useful
Get-Acl
Key Parameters of Get-Acl
Why Get-Acl Is Useful
Get-CimInstance
Key Parameters of Get-CimInstance
Why Get-CimInstance Is Useful
Get-ComputerInfo
Key Parameters of Get-ComputerInfo
Why Get-ComputerInfo Is Useful
Get-EventLog -LogName System -EntryType Error -Newest 10
Key Parameters of Get-EventLog -LogName System -EntryType Error -Newest 10
Why Get-EventLog -LogName System -EntryType Error -Newest 10 Is Useful
Get-WinEvent
Key Parameters of Get-WinEvent
Why Get-WinEvent Is Useful
Get-WmiObject Win32_Product
Key Parameters of Get-WmiObject Win32_Product
Why Get-WmiObject Win32_Product Is Useful
wevtutil el
Key Parameters of wevtutil el
Why wevtutil Is Useful
Network & Firewall
arp -a
Key Parameters of arp -a
Why arp -a Is Useful
Get-NetAdapter
Key Parameters of Get-NetAdapter
Why Get-NetAdapter Is Useful
Get-NetFirewallRule
Key Parameters of Get-NetFirewallRule
Why Get-NetFirewallRule is Useful
Get-NetTCPConnection
Key Parameters of Get-NetTCPConnection
Why Get-NetTCPConnection Is Useful
route print
Key Parameters of route print
Why route print Is Useful
Test-NetConnection
Key Parameters of Test-NetConnection
Why Test-NetConnection Is Useful
Security & Execution Policies
Get-ExecutionPolicy
Get-ExecutionPolicy -List
Key Parameters of Get-ExecutionPolicy
Why Get-ExecutionPolicy Is Useful
Get-TlsCipherSuite
Key Parameters of Get-TlsCipherSuite
Why Get-TlsCipherSuite Is Useful
System Integrity
Get-Process
Key Parameters of Get-Process
Why Get-Process Is Useful
Get-Service
Key Parameters of Get-Service
Why Get-Service Is Useful
Get-WmiObject Win32_SystemDriver
Key Parameters of Get-WmiObject Win32_SystemDriver
Why Get-WmiObject Win32_SystemDriver Is Useful
sigverif
Key Parameters of sigverif
Why sigverif Is Useful
tasklist /m
tasklist /v
Key Parameters of tasklist
Why tasklist Is Useful
Windows Defender & Malware Protection
Get-Item
Key Parameters of Get-Item
Why Get-Item Is Useful
Get-MpComputerStatus
Key Parameters of Get-MpComputerStatus
Why Get-MpComputerStatus Is Useful
Get-MpPreference
Key Parameters of Get-MpPreference
Why Get-MpPreference Is Useful
Get-HotFix
Key Parameters of Get-HotFix
Why Get-HotFix Is Useful
Get-ProcessMitigation
Key Parameters of Get-ProcessMitigation
Why Get-ProcessMitigation Is Useful
Start-MpScan
Key Parameters of Start-MpScan
Why Start-MpScan Is Useful
About the Author
Notes