Putting The PowerShell Window Title To Better Use

The default title for a PowerShell window is simply ‘Windows PowerShell’, and this is fine, but customising it can make things a little more convenient. The Problem If you’re anything like me you typically have between 3 and 33 PowerShell windows open, and this is a regular…

PowerShell 7 ForEach-Object -Parallel Memory Consumption

I’m undertaking a project where one of of the tasks involves processing some 350,000 XML files. If each file takes one second to process that’s just over 4 days, which is not a particularly appealing length of time. I’ve been working on improving performance by implementing…

Running A Powershell Script As A Service

A few people have asked if it was possible to run PSKindleWatch as a Windows service. This is a guide on how to accomplish that using NSSM. To be clear, this method can be used to run any PowerShell script as a Windows service, but we’ll use PSKindleWatch an an example. The…

Processing Tshark Streams With PowerShell

Wireshark is a packet capture and analysis tool, however, not as well known is the command line version that is bundled into the install - tshark. One huge advantage of tshark is its ability to write packet data directly to disk, which avoids a common issue with leaving Wireshark…

Get-ADGroupMember -Recursive Doesn't Return All Members

This recently cropped up when I was running some auditing scripts to ensure Domain/Enterprise/etc Admins were part of the Protected Users group. It was a simple script that pulled members from the privileged groups, and compared them to members of the Protected Users group. Quick…

Finding Active Windows 7 Machines In Active Directory

Quick one today (won’t even need a TL;DR), with Windows 7 no longer supported (ESU program being the exception) we’re all making sure either existing or new clients have no leftover machines on the domain. Here is a quick PowerShell snippet to find any Win 7 machines that have…

Monitoring FRS For Journal Wrap Errors (JRNL_WRAP_ERROR)

TL;DR If you’re monitoring for NtFrs Event Id 13568, you should also monitor for NtFrs Event Id 13561. But why? Most of us that look after AD environments are familiar with NtFrs Event Id 13568 - maybe not the number itself (because what kind of masochist forces themselves to…