# Powershell Master Cheatsheet - Cheatsheet

# Powershell Master Cheatsheet

## Hide a user from the Global Address List

```
Set-ADUser paulie -Replace @{msExchHideFromAddressLists=$true}
```

<div class="code-toolbar" id="bkmrk-copy-1">---

<div class="toolbar">  
</div></div>## Unhide a user from the Global Address List

```
Set-ADUser paulie -Replace @{msExchHideFromAddressLists=$false}
```

<div class="code-toolbar" id="bkmrk-copy-2">---

<div class="toolbar">  
</div></div><div class="code-toolbar" id="bkmrk-copy-3"></div>## Remove Object From Azure Recycle Bin

```none
Remove-MsolUser -UserPrincipalName user3453@microsoft.com -RemoveFromRecycleBin
```

<div class="code-toolbar" id="bkmrk-copy-4">---

<div class="toolbar">  
</div></div>## Set Azure User Immutable ID

```
#$credential = Get-Credential
#Connect-MsolService -Credential $credential
$ADUser = "user"
$365User = "user@mutschlerhome.com"
$guid =(Get-ADUser $ADUser).Objectguid
$immutableID=[system.convert]::ToBase64String($guid.tobytearray())
Set-MsolUser -UserPrincipalName "$365User" -ImmutableId $immutableID
```

<div class="code-toolbar" id="bkmrk-copy-5">---

<div class="toolbar">  
</div></div>## Set Azure Group mS-DS-ConsistencyGUID ID

```
Set-ADGroup -Identity 'CN=Service Accounts - Deny Interactive Logon,OU=To Move,DC=corp,DC=mutschlerhome,DC=com' -Replace @{'mS-DS-ConsistencyGuid'='2155c959-564f-405e-bea9-395632aba1d1'} -ErrorAction Stop
```

<div class="code-toolbar" id="bkmrk-copy-6">---

<div class="toolbar">  
</div></div>## Remove Object From Active Directory Recycle Bin

1. <p class="callout warning">Run Powershell as an `admin`</p>
2. Check first to verify you only get the user you want from the following command.

```
Get-ADObject -Filter 'isDeleted -eq $True -and Name -like "*username*"' -IncludeDeletedObjects
```

<div class="code-toolbar" id="bkmrk-copy-8"></div>3. Once you verified the only result is the user you want to delete permanently, run the following command.

```
Get-ADObject -Filter 'isDeleted -eq $True -and Name -like "*username*"' -IncludeDeletedObjects | Remove-ADObject
```

<div class="code-toolbar" id="bkmrk-copy-9"></div>[Original Article](https://get-cmd.com/?p=4688/)

---

## [AD Health Check With Email](https://wiki.mutschlerhome.com/Scripts/Powershell/ADHealthCheckWithEmail)

---

<div class="code-toolbar" id="bkmrk-copy-10"></div>## [Custom Intune Detection Script](https://wiki.mutschlerhome.com/Scripts/Powershell/CustomIntuneDetectionScript)

---

## Disconnect Disconnected Users

```
$pc = qwinsta /server:dcwipvmhsj001 | select-string "Disc" | select-string -notmatch "services"

if ($pc)
{
  $pc| % {

  logoff ($_.tostring() -split ' +')[2] /server:SERVERNAME

  }
}
```

<div class="code-toolbar" id="bkmrk-copy-11">---

<div class="toolbar">  
</div></div>## [Distribution List Modification](https://wiki.mutschlerhome.com/Scripts/Powershell/DLModification)

---

<div class="code-toolbar" id="bkmrk-copy-14"></div><div class="code-toolbar" id="bkmrk-copy-16"></div><div class="code-toolbar" id="bkmrk-copy-17"><div class="toolbar">  
</div></div>## [How to Change the Owner of an Azure Active Directory Device](https://wiki.mutschlerhome.com/Scripts/Powershell/ChangeOwnerAzureDevice)

---

## Install Elastic Defend on Windows

> Install within Powershell, NOT Powershell ISE.

```
New-Item -ItemType Directory -Force -Path C:\Temp | Out-Null
cd C:\Temp
Invoke-WebRequest -Uri https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.7.0-windows-x86_64.zip -OutFile elastic-agent-8.7.0-windows-x86_64.zip
Expand-Archive .\elastic-agent-8.7.0-windows-x86_64.zip -DestinationPath .
cd C:\temp\elastic-agent-8.7.0-windows-x86_64
.\elastic-agent.exe install --url=https://192.168.1.191:8220 --insecure --enrollment-token=U1phc3ZZY0JPV053QmVvVGxGNHU6TFR1XzdGMDNSSUdrdklObTJLS2RiQQ==
```

<div class="code-toolbar" id="bkmrk-copy-19">---

<div class="toolbar">  
</div></div>## Mass Service Kill

```
Get-Content c:\scripts\servers.txt | .\Restart-Service –ServiceName dnscache
```

<div class="code-toolbar" id="bkmrk-copy-20">---

<div class="toolbar">  
</div></div>## Mass Task Kill

```
taskkill /F /IM 'wmiprvse.exe
```

<div class="code-toolbar" id="bkmrk-copy-21"><div class="toolbar"><div class="toolbar-item">  
</div></div></div>```none
(Get-Content 'c:\Temp\Computers.txt') | ForEach-Object {
    Get-WmiObject -computer $_ -class win32_process  -filter "name = 'wmiprvse.exe'" -credential $cred| ForEach-Object{$_.terminate()} | out-null
  }
```

<div class="code-toolbar" id="bkmrk-copy-22"></div>[Original Article](https://akfash.wordpress.com/2011/05/24/how-do-you-kill-multiple-tasks-at-once)

---

## [RSAT Install](https://wiki.mutschlerhome.com/Scripts/Powershell/RSATInstall)

---

## [Remove Ghost Devices](https://wiki.mutschlerhome.com/Scripts/Powershell/removeGhosts)

---

## [Test gMSA Account on DCs](https://wiki.mutschlerhome.com/Scripts/Powershell/TestgMSAAccountonDCs)

---

## [View/Delete Local Profile List](https://wiki.mutschlerhome.com/Scripts/Powershell/LocalProfileRemoval)

---

<div class="code-toolbar" id="bkmrk-copy-23"></div>## Revoke Azure Token

1. Connect to Azure

```
Connect-AzureAD
```

<div class="code-toolbar" id="bkmrk-copy-25"></div>2. Revoke Token

```
Revoke-AzureADUserAllRefreshToken -ObjectId johndoe@contoso.com
```

<div class="code-toolbar" id="bkmrk-copy-26"></div>[Original Article](https://learn.microsoft.com/en-us/entra/identity/users/users-revoke-access)

---

# Get Information

# Post Information