MigrationBot: Backfill (v3.0 review queue): added to the review queue

2026-09-22T05:42:50Z

Backfill (v3.0 review queue): added to the review queue

← Older revision		Revision as of 05:42, 22 September 2026
Line 220:		Line 220:
	[[Category:Windows PowerShell\|010]]		[[Category:Windows PowerShell\|010]]
	[[Category:Migrated from cypat.guide]]		[[Category:Migrated from cypat.guide]]
			[[Category:Pending review]]

MigrationBot: Import from cypat.guide: docs/windows/scripting/intermediate_powershell.md

2026-09-18T17:06:36Z

Import from cypat.guide: docs/windows/scripting/intermediate_powershell.md

New page

{{Submit}}

'''Author(s):''' Byrch<br />
'''Last Updated:''' 2025‑07‑30<br />
'''Recommended Prerequisites:''' None

<blockquote>This content was written with the intermediate audience in mind. For the experienced Powershell users in the community its important to emphasize that all scripts should be tested in a safe environment before being run in production. Additionally, development of scripts should following best practices and modularity to ensure maintainability and reusability despite what environment might be thrown at it.
</blockquote>

-----

== Learning objectives ==

By the end, learners should be able to:

* Write reusable '''functions''' and bundle them into '''modules''' with help/validation.
* Inspect and control '''Windows services''' and '''processes''' safely.
* Make targeted, reversible '''registry''' changes.
* Manage '''local users, groups, and permissions''' with audit trails.
* Build "'''automation'''" that logs actions and supports Powershell best practices.

-----

== 1) Functions & modules ==

=== Minimal, production‑ish function ===

<syntaxhighlight lang="powershell">
# Powershell functions follow a verb-noun naming convention, with only a few verbs approved for use.

function Set-StartupType {

# Parameter validation and support for -WhatIf and -Confirm
# CmdletBinding attribute enables advanced function features (and pipeline support)
[CmdletBinding(SupportsShouldProcess, ConfirmImpact='Medium')]
param(
[Parameter(Mandatory, ValueFromPipelineByPropertyName)]
[ValidateSet('Automatic','Manual','Disabled')]
[string]$StartupType,

[Parameter(Mandatory, ValueFromPipeline, ValueFromPipelineByPropertyName)]
[Alias('Name')]
[string[]]$ServiceName
)

# Function body should follow a begin, process, end pattern for structure and organization.
begin { }
process {
foreach ($svc in $ServiceName) {
if ($PSCmdlet.ShouldProcess("service '$svc'", "set startup to $StartupType")) {
try {
Set-Service -Name $svc -StartupType $StartupType -ErrorAction Stop
}
catch { Write-Error "Failed to set $svc: $_" }
}
}
}
}</syntaxhighlight>
=== Turning functions into a module ===

* Create a folder named for your module or script. Below is a simple structure for a module named <code>MyTeam.SecurityTools</code>. Such structure is the gold standard for modular and reusable Powershell code. (It also makes readability and maintenance easier :)

<syntaxhighlight lang="text">MyTeam.SecurityTools\
MyTeam.SecurityTools.psd1 # module manifest (version, author, tags)
MyTeam.SecurityTools.psm1 # exported functions
Private\*.ps1 # helpers</syntaxhighlight>
* Export with <code>Export-ModuleMember</code>.
* Version your manifest; keep functions idempotent and <code>-WhatIf</code> friendly.

-----

== 2) Working with services & processes ==

=== Example of an auditing of services ===

<syntaxhighlight lang="powershell">$knownGood = 'wuauserv','BITS','WinDefend','LanmanWorkstation','LanmanServer','Dhcp','Dnscache'
Get-Service | Select-Object Name, Status, StartType | Sort-Object Name |
Tee-Object -FilePath "$env:USERPROFILE\Desktop\services-audit.csv" | Out-Host
# Keeping a CSV of current services is a great way to baseline and track changes over time. Additionally, it can be useful for troubleshooting unexpected errors or behaviors.

# Highlight non-standard auto services
Get-Service | Where-Object { $_.StartType -eq 'Automatic' -and $_.Name -notin $knownGood } |
Select Name,DisplayName,Status | Format-Table -AutoSize</syntaxhighlight>
=== Safe scripting tips ===

* Prefer <code>Set-Service -StartupType Manual</code> over disabling until you confirm necessity.

<syntaxhighlight lang="powershell">$baseline = @{ 'Workstation' = @('WinDefend','wuauserv','BITS'); }
$expected = $baseline.Workstation
Get-Service | Where-Object Name -notin $expected | Export-Csv baseline-delta.csv -NoTypeInformation</syntaxhighlight>

-----

== 3) Registry edits (reversible and targeted) ==

=== Always: export before you change ===

<syntaxhighlight lang="powershell">$stamp = Get-Date -Format 'yyyyMMdd-HHmmss'
reg.exe export HKLM\SOFTWARE "HKLM_SOFTWARE_$stamp.reg" /y | Out-Null</syntaxhighlight>
=== Common, defensible tweaks ===

<syntaxhighlight lang="powershell"># Show file extensions (reduces double-extension tricks)
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name HideFileExt -Value 0

# Disable Guest if present
Get-LocalUser -Name 'Guest' -ErrorAction SilentlyContinue | ForEach-Object {
Disable-LocalUser -Name $_.Name
}</syntaxhighlight>
<blockquote>Keep a small revert script (or robust change log) alongside your changes.
</blockquote>

-----

== 4) Permissions & Users ==

=== Local accounts & groups ===

<syntaxhighlight lang="powershell"># Create a standard user
$u = 'ExampleTestUser'
if (-not (Get-LocalUser -Name $u -ErrorAction SilentlyContinue)) {
$pw = Read-Host -AsSecureString "Enter password for $u"
New-LocalUser -Name $u -Password $pw -AccountNeverExpires:$true -FullName 'Student Standard'
}

# Add new user to group
Add-LocalGroupMember -Group 'Users' -Member $u -ErrorAction SilentlyContinue

# Review admins
$approvedAdmins = @('Administrator','SusAdmin')
(Get-LocalGroupMember 'Administrators').Name |
Where-Object { $_ -notin $approvedAdmins } |
ForEach-Object { Write-Output "Review admin member: $_" }</syntaxhighlight>
=== NTFS ACLs ===

<syntaxhighlight lang="powershell">$path = 'C:\Shared'
if (-not (Test-Path $path)) { New-Item -ItemType Directory -Path $path | Out-Null }
$acl = Get-Acl $path
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule('Users','Modify','ContainerInherit,ObjectInherit','None','Allow')
$acl.SetAccessRule($rule)
Set-Acl -Path $path -AclObject $acl</syntaxhighlight>
==== - It is important to note that some cmdlets used in this section may require recent versions of Windows Powershell (or Powershell Core). ====

==== - Please ensure the support of these commandlets in your environment before using them. (i.e. Get-LocalUser, Get-LocalGroupMember, Add-LocalGroupMember will not work in Microsoft Windows 7 Powershell) ====

-----

== 5) Now that we have the scripting basics down, let's look at what more we can do with Powershell. Take a look at all these cmdlets! ==

= Management Module =

<syntaxhighlight lang="powershell">Get-Command -Module Microsoft.PowerShell.Management | Out-GridView</syntaxhighlight>
= Users =

<syntaxhighlight lang="powershell">Get-Command -Noun *User | Out-GridView</syntaxhighlight>
= Services =

<syntaxhighlight lang="powershell">Get-Command -Noun *Service | Out-GridView</syntaxhighlight>
= Processes =

<syntaxhighlight lang="powershell">Get-Command -Noun *Process | Out-GridView</syntaxhighlight>
= Registry =

<syntaxhighlight lang="powershell">Get-Command -Noun *ItemProperty | Out-GridView</syntaxhighlight>
= Firewall =

<syntaxhighlight lang="powershell">Get-Command -Noun *Firewall* | Out-GridView</syntaxhighlight>
= Scheduled Tasks =

<syntaxhighlight lang="powershell">Get-Command -Noun *ScheduledTask* | Out-GridView</syntaxhighlight>
= Transcription (Logging) =

<syntaxhighlight lang="powershell">Get-Command -Noun *Transcript* | Out-GridView</syntaxhighlight>

-----

== 9) Comment‑based help template ==

<syntaxhighlight lang="powershell"><#!
.SYNOPSIS
Sets a service startup type with WhatIf/Confirm support.
.DESCRIPTION
Safe wrapper around Set-Service for baseline enforcement.
.PARAMETER ServiceName
One or more service names.
.PARAMETER StartupType
Automatic, Manual, or Disabled.
.EXAMPLE
'WinDefend' | Set-StartupType -StartupType Automatic -WhatIf
#></syntaxhighlight>

-----

== 10) Quick reference (cheat sheet) (more cmdlets to take a look at) ==

* '''List services:''' <code>Get-Service | Sort Name</code>
* '''Change startup:''' <code>Set-Service -Name <svc> -StartupType Manual</code>
* '''Running processes:''' <code>Get-Process | Sort CPU -Desc | Select -First 10</code>
* '''Local users:''' <code>Get-LocalUser</code> / <code>Enable-LocalUser</code> / <code>Disable-LocalUser</code>
* '''Local groups:''' <code>Get-LocalGroupMember Administrators</code>
* '''Registry provider:''' <code>Get-Item 'HKLM:\...'</code> / <code>Set-ItemProperty</code>
* '''Firewall:''' <code>Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True</code>
* '''Logging:''' <code>Start-Transcript</code> / <code>Stop-Transcript</code>
* '''Scheduled task:''' <code>Register-ScheduledTask</code>

-----

== 12) Notes & guardrails ==

* Use <code>-WhatIf</code> first; only remove or disable after documenting a reason.
* Create a restore point if available: <code>Checkpoint-Computer -Description 'BeforeHygiene'</code> (requires System Protection).
* Avoid blanket disabling of services; prefer Manual unless you’ve confirmed.
* Keep all changes reversible and logged to a dated folder on the Desktop.

-----

=== Attribution ===

You may copy/adapt with attribution.

[[Category:Windows PowerShell|010]]
[[Category:Migrated from cypat.guide]]

Draft:PowerShell for Intermediate Users - Revision history

MigrationBot: Backfill (v3.0 review queue): added to the review queue

MigrationBot: Import from cypat.guide: docs/windows/scripting/intermediate_powershell.md