Powershell command to read EventLog - c#

I am reading a event log using a Powershell command like the 1 below:
get-winevent -Path "C:\Test.evtx" -oldest | convertto-xml -as Stream > "C:\Test.xml"
As you can see, I am storing the result in a XML file for later reading.
For few events in the event log, I need a special query as follows:
$evtWithoutMsg = get-winevent -Path "C:\Test.evtx" | Where-Object {($_.RecordId -eq 53593)}
$xmlThing = [xml]$evtWithoutMsg.toxml()
$msg = $xmlThing.Event.EventData.Data
$msg
My question is can I have this '$xmlThing.Event.EventData.Data' as a new node or something in the xml file output (test.xml) of the initial command?

Related

Getting the Keyboard Layout in WPF C#

I need to get the Current Windows Keyboard Layout for my WPF application to map each key correctly and handle AZERTY as well as QWERTY and QWERTZ (and so on...)
I noticed a problem since I am working with a French layout (azerty) but my windows is displayed in English.
I tried various methods to get the layout correctly but without results :
var test1 = InputLanguageManager.Current.CurrentInputLanguage;
and
var test2 = CultureInfo.CurrentCulture;
I tried by having ENG language with AZERTY layout, ENG language with QWERTY layout and FRA language with AZERTY layout but the output from my tests were always different. I could get the language displayed correctly (en-GB) but not the layout.
The following PowerShell1 script declares Get-KeyboardLayoutForPid function which reliably gets the Current Windows Keyboard Layout for any process2.
if ( $null -eq ('Win32Functions.KeyboardLayout' -as [type]) ) {
Add-Type -MemberDefinition #'
[DllImport("user32.dll")]
public static extern IntPtr GetKeyboardLayout(uint thread);
'# -Name KeyboardLayout -Namespace Win32Functions
}
Function Get-KeyboardLayoutForPid {
[cmdletbinding()]
Param (
[parameter(Mandatory=$False, ValueFromPipeline=$False)]
[int]$Id = $PID,
# used formerly for debugging
[parameter(Mandatory=$False, DontShow=$True)]
[switch]$Raw
)
$InstalledInputLanguages = [System.Windows.Forms.InputLanguage]::InstalledInputLanguages
$CurrentInputLanguage = [System.Windows.Forms.InputLanguage]::DefaultInputLanguage # CurrentInputLanguage
$CurrentInputLanguageHKL = $CurrentInputLanguage.Handle # just an assumption
### Write-Verbose ('CurrentInputLanguage: {0}, 0x{1:X8} ({2}), {3}' -f $CurrentInputLanguage.Culture, ($CurrentInputLanguageHKL -band 0xffffffff), $CurrentInputLanguageHKL, $CurrentInputLanguage.LayoutName)
Function GetRealLayoutName ( [IntPtr]$HKL ) {
$regBase = 'Registry::' +
'HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layouts'
$LayoutHex = '{0:x8}' -f ($hkl -band 0xFFFFFFFF)
if ( ($hkl -band 0xFFFFFFFF) -lt 0 ) {
$auxKeyb = Get-ChildItem -Path $regBase |
Where-Object {
$_.Property -contains 'Layout Id' -and
(Get-ItemPropertyValue -Path "Registry::$($_.Name)" `
-Name 'Layout Id' `
-ErrorAction SilentlyContinue
) -eq $LayoutHex.Substring(2,2).PadLeft(4,'0')
} | Select-Object -ExpandProperty PSChildName
} else {
$auxKeyb = $LayoutHex.Substring(0,4).PadLeft(8,'0')
}
$KbdLayoutName = Get-ItemPropertyValue -Path (
Join-Path -Path $regBase -ChildPath $auxKeyb
) -ErrorAction SilentlyContinue -Name 'Layout Text'
$KbdLayoutName
# Another option: grab localized string from 'Layout Display Name'
} # Function GetRealLayoutName
Function GetKbdLayoutForPid {
Param (
[parameter(Mandatory=$True, ValueFromPipeline=$False)]
[int]$Id,
[parameter(Mandatory=$False, DontShow=$True)]
[string]$Parent = ''
)
$Processes = Get-Process -Id $Id
$Weirds = #('powershell_ise','explorer') # not implemented yet
$allLayouts = foreach ( $Proces in $Processes ) {
$LayoutsExtra = [ordered]#{}
$auxKLIDs = #( for ( $i=0; $i -lt $Proces.Threads.Count; $i++ ) {
$thread = $Proces.Threads[$i]
## The return value is the input locale identifier for the thread:
$LayoutInt = [Win32Functions.KeyboardLayout]::GetKeyboardLayout( $thread.Id )
$LayoutsExtra[$LayoutInt] = $thread.Id
})
Write-Verbose ('{0,6} ({1,6}) {2}: {3}' -f $Proces.Id, $Parent,
$Proces.ProcessName, (($LayoutsExtra.Keys |
Select-Object -Property #{ N='Handl';E={('{0:x8}' -f ($_ -band 0xffffffff))}} |
Select-Object -ExpandProperty Handl) -join ', '))
foreach ( $auxHandle in $LayoutsExtra.Keys ) {
$InstalledInputLanguages | Where-Object { $_.Handle -eq $auxHandle }
}
$ConHost = Get-WmiObject Win32_Process -Filter "Name = 'conhost.exe'"
$isConsoleApp = $ConHost | Where-Object { $_.ParentProcessId -eq $Proces.Id }
if ( $null -ne $isConsoleApp ) {
GetKbdLayoutForPid -Id ($isConsoleApp.ProcessId) -Parent ($Proces.Id -as [string])
}
}
if ( $null -eq $allLayouts ) {
# Write-Verbose ('{0,6} ({1,6}) {2}: {3}' -f $Proces.Id, $Parent, $Proces.ProcessName, '')
} else {
$allLayouts
}
} # GetKbdLayoutForPid
$allLayoutsRaw = GetKbdLayoutForPid -Id $Id
if ( $null -ne $allLayoutsRaw ) {
if ( ([bool]$PSBoundParameters['Raw']) ) {
$allLayoutsRaw
} else {
$retLayouts = $allLayoutsRaw |
Sort-Object -Property Handle -Unique |
Where-Object { $_.Handle -ne $CurrentInputLanguageHKL }
if ( $null -eq $retLayouts ) { $retLayouts = $CurrentInputLanguage }
$RealLayoutName = $retLayouts.Handle |
ForEach-Object { GetRealLayoutName -HKL $_ }
$ProcessAux = Get-Process -Id $Id
$retLayouts | Add-Member -MemberType NoteProperty -Name 'ProcessId' -Value "$Id"
$retLayouts | Add-Member -MemberType NoteProperty -Name 'ProcessName' -Value ($ProcessAux | Select-Object -ExpandProperty ProcessName )
# $retLayouts | Add-Member -MemberType NoteProperty -Name 'WindowTitle' -Value ($ProcessAux | Select-Object -ExpandProperty MainWindowTitle )
$retLayouts | Add-Member -MemberType NoteProperty -Name 'RealLayoutName' -Value ($RealLayoutName -join ';')
$retLayouts
}
}
<#
.Synopsis
Get the current Windows Keyboard Layout for a process.
.Description
Gets the current Windows Keyboard Layout for a process. Identify the process
using -Id parameter.
.Parameter Id
A process Id, e.g.
- Id property of System.Diagnostics.Process instance (Get-Process), or
- ProcessId property (an instance of the Win32_Process WMI class), or
- PID property from "TaskList.exe /FO CSV", …
.Parameter Raw
Parameter -Raw is used merely for debugging.
.Example
Get-KeyboardLayoutForPid
This example shows output for the current process (-Id $PID).
Note that properties RealLayoutName and LayoutName could differ (the latter is wrong; a bug in [System.Windows.Forms.InputLanguage] implementation?)
ProcessId : 2528
ProcessName : powershell
RealLayoutName : United States-International
Culture : cs-CZ
Handle : -268368891
LayoutName : US
.Example
. D:\PShell\tests\Get-KeyboardLayoutForPid.ps1 # activate the function
Get-Process -Name * |
ForEach-Object { Get-KeyboardLayoutForPid -Id $_.Id -Verbose }
This example shows output for each currently running process, unfortunately
even (likely unusable) info about utility/service processes.
The output itself can be empty for most processes, but the verbose stream
shows (hopefully worthwhile) info where current keboard layout is held.
Note different placement of the current keboard layout ID:
- console application (cmd, powershell, ubuntu): conhost
- combined GUI/console app (powershell_ise) : the app itself
- classic GUI apps (notepad, notepad++, …) : the app itself
- advanced GUI apps (iexplore) : Id ≘ tab
- "modern" GUI apps (MicrosoftEdge*) : Id ≟ tab (unclear)
- combined GUI/service app (explorer) : indiscernible
- etc… (this list is incomplete).
For instance, iexplore.exe creates a separate process for each open window
or tab, so their identifying and assigning input languages is an easy task.
On the other side, explorer.exe creates the only process, regardless of
open visible window(s), so they are indistinguishable by techniques used here…
.Example
gps -Name explorer | % { Get-KeyboardLayoutForPid -Id $_.Id } | ft -au
This example shows where the function could fail in a language multifarious environment:
ProcessId ProcessName RealLayoutName Culture Handle LayoutName
--------- ----------- -------------- ------- ------ ----------
5344 explorer Greek (220);US el-GR -266992632 Greek (220)
5344 explorer Greek (220);US cs-CZ 67699717 US
- scenario:
open three different file explorer windows and set their input languages
as follows (their order does not matter):
- 1st window: let default input language (e.g. Czech, in my case),
- 2nd window: set different input language (e.g. US English),
- 3rd window: set different input language (e.g. Greek).
- output:
an array (and note that default input language window isn't listed).
.Inputs
No object can be piped to the function. Use -Id pameter instead,
named or positional.
.Outputs
[System.Windows.Forms.InputLanguage] extended as follows:
note the <…> placeholder
Get-KeyboardLayoutForPid | Get-Member -MemberType Properties
TypeName: System.Windows.Forms.InputLanguage
Name MemberType Definition
---- ---------- ----------
ProcessId NoteProperty string ProcessId=<…>
ProcessName NoteProperty System.String ProcessName=powershell
RealLayoutName NoteProperty string RealLayoutName=<…>
Culture Property cultureinfo Culture {get;}
Handle Property System.IntPtr Handle {get;}
LayoutName Property string LayoutName {get;}
.Notes
To add the `Get-KeyboardLayoutForPid` function to the current scope,
run the script using `.` dot sourcing operator, e.g. as
. D:\PShell\tests\Get-KeyboardLayoutForPid.ps1
Auhor: https://stackoverflow.com/users/3439404/josefz
Created: 2019-11-24
Revisions:
.Link
.Component
P/Invoke
<##>
} # Function Get-KeyboardLayoutForPid
if ( -not ('System.Windows.Forms.InputLanguage' -as [type]) ) {
Add-Type -AssemblyName System.Windows.Forms
}
The Get-KeyboardLayoutForPid function contains a Comment-Based Help placed at the end of its body. I hope that its principle is implementable in C# easy.
The main idea of my approach:
Suppose that the current keyboard layout (CurrentInputLanguage) for a given process is the (user-dependant) default one (DefaultInputLanguage).
Collect keyboard layouts associated with every thread of given process (allLayoutsRaw). Note this trick for a console application: collect keyboard layouts associated with every thread of child conhost process as well.
If there is a keyboard layout different from DefaultInputLanguage in the allLayoutsRaw collection then it's the sought-after one (retLayouts).
1 Does not work in PowerShell Core (pwsh.exe).
2 Might fail for explorer process in a language multifarious environment, see an example of failing scenario in the Comment-Based help.
I am not sure of the ask - whether you want to know the current keyboard layout or you want to set the keyboard layout.
In both cases, InputLanguageManager should help.
You can try setting input language manager to appropriate cultureInfo object.
This should change the keyboard layout for your WPF application
InputLanguageManager.Current.CurrentInputLanguage = new CultureInfo("fr-FR");

Get commands behind windows explorer context menu verbs

I would like to get the list of windows explorer context menu entitites (verbs) and commands behind it. Something like this:
Open with notepad++ | C:\Program Files\NOtepad++\NppShell_06.dll
Add to archive | C:\Program Files\WinRAR\rarext.dll
Play with VLC | "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe"
--started-from-file --no-playlist-enqueue "%1"
and so on.
I've wrote PS script to get all commands from context menu (all the same I can do via C#):
$ErrorActionPreference= 'silentlycontinue'
Set-Location -LiteralPath HKLM:\SOFTWARE\Classes\*\shellex\ContextMenuHandlers;
$o = Get-ChildItem -LiteralPath HKLM:\SOFTWARE\Classes\*\shellex\ContextMenuHandlers;
foreach($obj in $o)
{
$prop = (Get-ItemProperty $obj.PSChildName).'(default)';
"-------------------------------------------------------------";
try
{
$obj.PSChildName;
$sub = (Get-Item -LiteralPath ("HKLM:\SOFTWARE\Classes\CLSID\" + $prop.ToString())).GetSubKeyNames();
foreach($s in $sub)
{
(Get-ItemProperty -LiteralPath ("HKLM:\SOFTWARE\Classes\CLSID\" + $prop.ToString() + "\" + $s)).'(default)';
}
}
catch
{}
}
Output:
-------------------------------------------------------------
ANotepad++64
C:\Program Files\Notepad++\NppShell_06.dll
-------------------------------------------------------------
EPP
C:\Program Files\Windows Defender\shellext.dll
10.0.14393.1198
-------------------------------------------------------------
Open With
C:\Windows\system32\shell32.dll
-------------------------------------------------------------
WinRAR
C:\Program Files\WinRAR\rarext.dll
........
There is script to get verbs for specific file:
$o = new-object -com Shell.Application
$folder = $o.NameSpace("C:\Users\User\Documents")
$file=$folder.ParseName("file.txt")
$file.Verbs() | select *
Output:
Application Parent Name
&Open
&Print
&Edit
Edit with &Notepad++
Check with Windows Defender...
&Add to archive...
Add &to "file.rar"
Compress and email...
Compress to "file.rar" and email
.....
So, I do not know how to combine these solutions. Is there some command/elegant way to do what I want?

outlook powershell replied email property

Hi I am creating a powershell script to read e-mail from outlook on which i have replied. can someone help me to find out the property in the variable.
all emails are in $monitor variable.
Add-type -assembly “Microsoft.Office.Interop.Outlook” | out-null
$olFolders = “Microsoft.Office.Interop.Outlook.olDefaultFolders” -as [type]
$outlook = new-object -comobject outlook.application
$namespace = $outlook.GetNameSpace(“MAPI”)
$folder = $namespace.getDefaultFolder($olFolders::olFolderInBox)
$Monitor = $folder.Folders.Item("Test")
From https://stackoverflow.com/a/15323686/478656 and comments at https://www.slipstick.com/developer/code-samples/forward-messages-not-replied/ it looks like you want
$Email.PropertyAccessor.GetProperty("http://schemas.microsoft.com/mapi/proptag/0x10810003")
Which is the property for PR_LAST_VERB_EXECUTED, and the output is either 0 (not replied), 102 ('Reply') or 103 ('Reply All').
So maybe
$LastVerb = "http://schemas.microsoft.com/mapi/proptag/0x10810003"
$Monitor.Items | Where-Object { $_.PropertyAccessor.GetProperty($LastVerb) -gt 0 }

Using powershell with .NET returning null

I am using .NET with powershell trying to retrieve result of Get-Acl command of specific AD object. Unfortunately when I run the code from C# code I get 0 result. Also the ThrowIfError is not throwing any error.
Command test01 = new Command("import-module");
test01.Parameters.Add("name", "activedirectory");
session.Commands.AddCommand(test01);
Command test0 = new Command("Set-Location");
test0.Parameters.Add("Path", "AD:");
session.Commands.AddCommand(test0);
Command test1 = new Command("Get-Acl");
test1.Parameters.Add("Path", identity);
session.Commands.AddCommand(test1);
session.AddCommand("select-object");
session.AddParameter("Property", "Access");
var tempResults1 = session.Invoke();
ThrowIfError();
private void ThrowIfError()
{
var errors = session.Streams.Error;
if (errors.Count > 0)
{
var ex = errors[0].Exception;
session.Streams.ClearStreams();
// Never close session to dispose already running scripts.
throw ex;
}
}
This code running on server in powershell is working correctly:
PS AD:\> Import-Module -Name activedirectory
PS AD:\> set-location ad:
PS AD:\> get-acl -path <distinguishedNameOfADObject>
Question
How to get the same result like I get from Powershell? I should get atleast something not a zero result.
Little background:
I am trying to get Send-As rights not using Get-ADPermission cmdlet because its taking too long time when I need to search for rights within thousands of mailboxes. Using this article link I am trying another approach to get the rights. I have already the slower version working using C# code:
Command command = new Command("Get-ADPermission");
command.Parameters.Add("Identity", identity);
session.Commands.AddCommand(command);
session.AddCommand("where-object");
ScriptBlock filter = ScriptBlock.Create("$_.ExtendedRights -eq 'send-as'");
session.AddParameter("FilterScript", filter);
session.AddCommand("select-object");
session.AddParameter("Property", "User");
tempResults = session.Invoke();
The better way is to define a powershell-script instead of multiple commands to get the values you need. Example with your powershell-code:
using System.Collections.ObjectModel;
using System.DirectoryServices;
using System.Management.Automation;
namespace GetAclPowershellTest
{
class Program
{
static void Main(string[] args)
{
/****Create Powershell-Environment****/
PowerShell PSI = PowerShell.Create();
/****Insert PowershellScript****/
string Content = "param($object); Import-Module ActiveDirectory; Set-Location AD:; Get-ACL -Path $object"; //Add Scrip
PSI.AddScript(Content);
PSI.AddParameter("object", "<distinguishedNameOfADObject>");
/****Run your Script with PSI.Invoke()***/
Collection<PSObject> PSIResults = PSI.Invoke();
/****All Errors****/
Collection<ErrorRecord> Errors = PSI.Streams.Error.ReadAll();
/****needed, because garbagecollector ignores PSI otherwise****/
PSI.Dispose();
/**** Your ACL-Object ****/
ActiveDirectorySecurity MyACL = (ActiveDirectorySecurity)PSIResults[0].BaseObject;
/*insert your code here*/
}
}
}
This example works for me.
You have to set a reference to the Powershell-Assembly (Usually you can find it at "C:\Program Files (x86)\Reference Assemblies\Microsoft\WindowsPowerShell\3.0\System.Management.Automation.dll")
Benefit of this solution is, you could read a .ps1-File you got from someone, fill the parameters with the objects you have and the script runs like in a standard powershell-session. The only requirement to set parameters is the param-part in the Script.
More Infos about param: https://technet.microsoft.com/en-us/library/jj554301.aspx
Hope, this helps...
Greetings, Ronny
Update:
string Content = "param($object); Import-Module ActiveDirectory; Set-Location AD:; (Get-ACL -Path $object).Access | Where-Object{($_.ActiveDirectoryRights -eq 'ExtendedRight') -and ($_.objectType -eq 'ab721a54-1e2f-11d0-9819-00aa0040529b')}";
And the loop at the end looks like this now:
foreach (PSObject o in PSIResults)
{
ActiveDirectoryAccessRule AccessRule = (ActiveDirectoryAccessRule)o.BaseObject;
/**do something with the AccessRule here**/
}

Call WinRT Async method from Powershell to set account picture in win8

I'm trying to put something together that will use the AD Thumbnail photo to set a user's account picture on Windows 8. It seems like I should be able to use the API from WinRT to do this. I've pieced something together from various sources about calling the API from powershell, but I can't get it working. Here's an example of what I've tried to do:
$photo = ([ADSISEARCHER]“samaccountname=$($username)”).findone().properties.thumbnailphoto
$path = "C:\temp\Photo.jpg"
$photo | set-content $path -encoding byte
[Windows.System.UserProfile.UserInformation,Windows.System.UserProfile,ContentType=WindowsRuntime] > $null
[Windows.System.UserProfile.UserInformation]::SetAccountPictureAsync($photo)
I've tried a couple of other variations, but no matter what I do, I end up with an error like this:
Cannot convert argument "image", with value: "System.Object[]", for "setAccountPictureAsync" to type "Windows.Storage.IStorageFile" . . .
Is there something simple that I'm missing here to make this work?
I found this blog post by Keith Hill which seems like it might be helpful, but I am not sure if it directly translates to the issue I'm having.
Thanks!
Aurock
https://fleexlab.blogspot.com/2018/02/using-winrts-iasyncoperation-in.html has a pure-PowerShell solution.
Add-Type -AssemblyName System.Runtime.WindowsRuntime
$asTaskGeneric = ([System.WindowsRuntimeSystemExtensions].GetMethods() | ? { $_.Name -eq 'AsTask' -and $_.GetParameters().Count -eq 1 -and $_.GetParameters()[0].ParameterType.Name -eq 'IAsyncOperation`1' })[0]
function Await($WinRtTask, $ResultType) {
$asTask = $asTaskGeneric.MakeGenericMethod($ResultType)
$netTask = $asTask.Invoke($null, #($WinRtTask))
$netTask.Wait(-1) | Out-Null
$netTask.Result
}
This could then be used as:
$photoPath = "$home\Pictures\Photo.jpg"
$file = Await ([Windows.Storage.StorageFile]::GetFileFromPathAsync($photoPath)) ([Windows.Storage.StorageFile])
$result = Await ([Windows.System.UserProfile.UserInformation]::SetAccountPictureAsync($file)) ([Windows.System.UserProfile.SetAccountPictureResult])
SetAccountPicture expects an object implementing IStorageFile and not a byte array. I would save the picture to your Pictures folder then load that into a StorageFile as shown below. You should be able to pass that object into the SetAccountPicture() method e.g.
$photoPath = "$home\Pictures\Photo.jpg"
$asyncOp = [Windows.Storage.StorageFile]::GetFileFromPathAsync($photoPath)
$typeName = 'PoshWinRT.AsyncOperationWrapper[Windows.Storage.StorageFile]'
$wrapper = new-object $typeName -Arg $asyncOp
$file = $wrapper.AwaitResult()
$asyncOp = [Windows.System.UserProfile.UserInformation]::SetAccountPictureAsync($file)
$typeName = 'PoshWinRT.AsyncOperationWrapper[Windows.System.UserProfile.SetAccountPictureResult]'
$wrapper = new-object $typeName -Arg $asyncOp
$result = $wrapper.AwaitResult()
$wrapper.Dispose()

Categories