Powershell - A Simple Way to Create User Friendly Complex Passwords

Super simple.

I do a lot of password temporary resets. Some of the folks I work with prefer a default password, but I like to new passwords that translate easily when working with clients. 

So, at a minimum I like two words, a symbol, and a number. Something like: !TestPassword42

For my less savvy friends, I created the a code pile similar to the following password generator.


I'm hoping that the format is easy enough to follow. 

• List blocks to work with.
• Putting random list block elements together to create a password.

The list blocks are simple arrays, add, modify or delete elements as you need to each. I made a $Verbs, $Colors, $Nouns, and $Symbols for the basic parts. Then I also added a $Today and I demonstrate a number at the end.

This demonstration creates two outputs. 

1. Creates passwords from $Symbols, $Verbs, $Colors, $Nouns, and a number from 1 to 99.
2. Creates passwords from $Today, $Symbols, $Verbs, $Nouns, and a number from 1 to 99.

By this sample symbols, verbs, colors, nouns, and number you can support 9,022,860 a day.

Or, 3,293,343,900 a year.


You can get a copy of the code on GitHub.

Powershell - Create New CentOS Workstation VM

 

I put this initial rundown together for further coding thingies, like state checking and condition handling. Simple enough, with room to grow.   : )

I did this using on Windows 10 pro, with Hyper-V, using Powershell 7 for a CentOS workstation.

The pile of code: https://github.com/LesleyPhillips/Build-CentOSWorkstation.ps1/blob/main/Build-CentOSWorkstation.ps1

Normally, I just throw up CentOS minimal builds. This time I thought I'd try something prettier.

Windows 10 Firewall Ports

From time to time I have to open a port to do something and close it back up when I'm done. As I do this fairly often (but not often enough to memorize) I created this recipe. There is an example using Docker below.

ugh! an error! what to do?

Background Information...

How to do this by the Windows user Interface (UI)

https://www.google.com/search?q=windows+10+firewall+enable+localhost%3A80+traffic

How to do this with Powershell

https://www.google.com/search?q=powershell+TCP+Port+80+in+Windows+Firewall 

https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=win10-ps

https://serverfault.com/questions/883266/powershell-how-open-a-windows-firewall-port

 

Powershell 

Open the port

New-NetFirewallRule -DisplayName "Allow inbound TCP port 81" -Direction inbound -LocalPort 81 -Protocol TCP -Action Allow
Name                  : {af16f2f3-3221-4191-8c5a-f44a5f60ca58}
DisplayName           : Allow inbound TCP port 81

Test (while something is listening on the port)

 Get-NetFirewallRule -Name '{af16f2f3-3221-4191-8c5a-f44a5f60ca58}'

    ** You can also see this in the Windows firewall inbound rules

$tcp = New-Object System.Net.Sockets.TcpClient
$tcp.Connect("localhost","81")
$tcp.Connected
True

Close the port back up

Remove-NetFirewallRule -Name '{af16f2f3-3221-4191-8c5a-f44a5f60ca58}'

** If you test again, you should get a failure (or, your listening port was not blocked already). And, the control panel, on refresh, will show the rule is missing.

You're done! 

Example

As a semi-practical example, Start a Docker container, test and clean up. For this to be a real example, you would have to imagine that port 81 was the blocked port. On port 80, I got stuff running there already. So, I did this on port 81.

Open the Port

New-NetFirewallRule -DisplayName "Allow inbound TCP port 81" -Direction inbound -LocalPort 81 -

Start the getting-started container

docker run -d -p 81:80 docker/getting-started
6d44c9240e688b69a212fe24e58d2302b658bfcbcee787030943b04f12cde38b

Test that the container is running and on the proper port.

docker ps
CONTAINER ID        IMAGE                    COMMAND                  CREATED             STATUS              PORTS                NAMES
6d44c9240e68        docker/getting-started   "/docker-entrypoint.…"   6 seconds ago       Up 4 seconds        0.0.0.0:81->80/tcp   goofy_elion

Test the port via Powershell

(New-Object System.Net.Sockets.TCPClient –Argument "localhost","81").Connected
True

Open page in local browser http://localhost:81

 

Hooray! It works!   : ) 

Clean up the container

docker stop 6d44c9240e68
6d44c9240e68

Remove the firewall rule by Powershell

Remove-NetFirewallRule -Name '{af16f2f3-3221-4191-8c5a-f44a5f60ca58}'

You're done again!

Domino Port Audit

Pretend some server admins were going to change out their IPs from their 208 addresses for some new IPs and you needed to test for connectivity for all the IPs involved; server and services. You may want to do something similar to the following...

## The Scripting Guys Test-Port script
## https://gallery.technet.microsoft.com/scriptcenter/97119ed6-6fb2-446d-98d8-32d823867131

## Pretend I got IBM Domino servers in cluster pairs like this...
 app001/srv/mycompany 10.10.10.23
 app011/srv/mycompany 10.10.10.24
 app021/srv/mycompany 208.109.4.218   # godaddy.com is not my server.
 app022/srv/mycompany 208.109.4.219   # I don't know who this is.
 app002/srv/mycompany 10.10.2.54
 app012/srv/mycompany 10.10.2.55

## From a cmd I can issue these commands and capture the results
ping 10.10.10.23
ping 10.10.10.24
ping 208.109.4.218
ping 208.109.4.219
ping 10.10.2.54
ping 10.10.2.55

tracert 10.10.10.23
tracert 10.10.10.24
tracert 208.109.4.218
tracert 208.109.4.219
tracert 10.10.2.54
tracert 10.10.2.55

## I Want to see the successful connection to the NRPC port
start telnet 10.10.10.23 1352
start telnet 10.10.10.24 1352
start telnet 208.109.4.218 1352
start telnet 208.109.4.219 1352
start telnet 10.10.2.54 1352
start telnet 10.10.2.55 1352

## Domino console batch saved as trace.txt and piped in to the console
trace 10.10.10.23
trace 10.10.10.24
trace 208.109.4.218
trace 208.109.4.219
trace 10.10.2.54
trace 10.10.2.55
## When your done with this you can search the log for messages like...
## Network: 10.10.10.23 is the server address of server CN=app001/OU=srv/O=mycompany
## I typically just search on " is the server address of server CN=" 
## Make sure to include the double quotes.

## Singular test 
$tcpObject = New-Object System.Net.Sockets.TcpClient
$tcpConnect = $tcpObject.BeginConnect('10.10.10.23','1352',$null,$null)
$tcpConnect.AsyncWaitHandle.WaitOne(1000)
$tcpObject.Close()

## playing around
$Server = '10.10.10.23'
$Server = '10.10.10.24'
$Server = '208.109.4.218'
$Server = '208.109.4.219'
$Server = '10.10.2.54'
$Server = '10.10.2.55'

## Lets to a batch
$ServerList = @('10.10.10.23',
                '10.10.10.24',
                '208.109.4.218',
                '208.109.4.219',
                '10.10.2.54',
                '10.10.2.55')
$port=1352
foreach($Server in $ServerList){
   $tcpObject = New-Object System.Net.Sockets.TcpClient
   $tcpConnect = $tcpObject.BeginConnect($Server,$port,$null,$null)
   $wait = $tcpConnect.AsyncWaitHandle.WaitOne(1000)
   ($server+" "+$wait)
   $wait=$null
   $tcpObject.Close()
}

This batch audit at the end creates a result similar to ...

10.10.10.23 True
10.10.10.24 True
208.109.4.218 False
208.109.4.219 False
10.10.2.54 True
10.10.2.55 True

Getting Started with Powershell and Office365 scripting

Here's what I know today...

# Managing Office 365 and Exchange Online with Windows PowerShell
# https://support.office.com/en-us/article/Managing-Office-365-and-Exchange-Online-with-Windows-PowerShell-06a743bb-ceb6-49a9-a61d-db4ffdf54fa6

#Connect to Office 365 PowerShell
$UserCredential = Get-Credential
$MsolService = Connect-MsolService -Credential $UserCredential
    # do stuff here like... 
    Get-Module
    Get-Command -Module MSOnline
# no remove: https://technet.microsoft.com/en-us/library/dn568015.aspx#Step8

# Connect to Exchange Online using remote PowerShell
Set-ExecutionPolicy RemoteSigned
$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session
    # do stuff here like... 
    Get-Module
    Get-Command -Module tmp_mjopwmqk.4nu #or whatever it is named

Remove-PSSession $Session

# Connect to Office 365 Compliance Center PowerShell - need a role first
Set-ExecutionPolicy RemoteSigned
$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session
    # do stuff here?
Remove-PSSession $Session #Security limits 3 connections only - Clean up!

# Connecting to Skype for Business Online by using Windows PowerShell 
$UserCredential = Get-Credential
$Session = New-CsOnlineSession -Credential $UserCredential
    # do stuff here
Remove-CsOnlineSession $Session

# Set up the SharePoint Online Management Shell Windows PowerShell environment 
$UserCredential = Get-Credential
$URL ='https://MyCompany-my.sharepoint.com'
Connect-SPOService -Url $URL -credential $UserCredential
    # do stuff here
Disconnect-SPOService

I wonder what I'll know tomorrow...

Domino Mail Stats with Powershell

I was helping a project team implement ZL Tech's (zlti.com) archiving with folks from Honda (Honda.com) and ViewPointe (Viewpointe.com) and found myself getting metrics every couple of hours. Which got really annoying pretty fast... And, so the following bit of code helped me to let other folks do the same as needed.
Have Fun! : )

The Output...

PS D:\data\scripts\ps-notes> ./MailStats.ps1
Start: 13:09:57.0831

Host            Drive    Size GB    Free GB
=============== ===== ========== ==========
AMnotes01          F:     150.00      28.19

   Mailbox            Size MB  Doc Count
   =============== ========== ==========
   mail1.box           12,336          6
   mail2.box            4,884          4
   mail3.box            4,727          4
   mail4.box            4,651          4
   --------------- ---------- ----------
   Totals              26,598          4

Elapsed Time: 00:00:17.0125

The Code...

## MailStats.ps1
## First Code 07:05:20.0415
## initial runtime 00:00:48.0165
## 
$dtStart = (get-date)
"Start: "+($dtStart.Hour.ToString()).PadLeft(2,"0")+":"+($dtStart.Minute.ToString()).PadLeft(2,"0")+":"+($dtStart.Second.ToString()).PadLeft(2,"0")+"."+($dtStart.Millisecond.ToString()).PadLeft(4,"0")
$StartPath = Get-Location

## Vars to set
$LocalDataDir = 'C:\Program Files (x86)\IBM\Lotus\Notes\Data' ## your local Notes data dir
$DominoServiceName = 'UserSMTPgw01/SRV/AM/MyCompany' ## your Notes/Domino Server
$HostName = 'AMnotes29' ## the host name that the Domino service runs on
$HostDataDir = 'f$\notes\data\' ## the rest of the unc path to the Domino services' data dir 
$HostDataDrive = 'F:' ## drive where the Domino services' data dir is on 

$UNCMailboxPath = '\\'+$HostName+'\'+$HostDataDir+'mail*.box'
$MailBoxes = Get-ChildItem -Path $UNCMailboxPath

Set-Location $LocalDataDir
$Notes = New-Object -ComObject Lotus.NotesSession
$Notes.Initialize()

$HostMBDisk = Get-WmiObject Win32_LogicalDisk -ComputerName $HostName | where {$_.DeviceID -eq 'F:'} | Select-Object Size,FreeSpace

Write-output ""
Write-Output "Host            Drive    Size GB    Free GB"
Write-Output "=============== ===== ========== =========="
Write-Output  ( $HostName.PadRight(15)+' '   `
               +$HostDataDrive.PadLeft(5)+' '    `
               +("{0:N2}" -f ($HostMBDisk.Size/1GB)).ToString().PadLeft(10)+' '   `
               +("{0:N2}" -f ($HostMBDisk.FreeSpace/1GB)).ToString().PadLeft(10))
Write-output ""
Write-Output "   Mailbox            Size MB  Doc Count"
Write-Output "   =============== ========== =========="

$TotSize = 0
$TotDocs = 0

foreach ($mailbox in $MailBoxes) {
   
   $dbMB = $Notes.GetDatabase($DominoServiceName, $mailbox.name.ToString(), 1)

   if ($dbMB -ne $null) {

      $colAllDocs = $dbMB.AllDocuments

      Write-output  ( "   "   `
                      +$mailbox.name.ToString().PadRight(15)+' '   `
                      +("{0:N0}" -f ($dbMB.Size/1MB)).ToString().padleft(10)+' '   `
                      +($colAllDocs.Count.ToString().padleft(10)))
      $TotSize = $TotSize + $dbMB.Size
      $TotDocs = $colAllDocs.Count

      $colAllDocs = $null

   } else {
         
      $strStatus = 'No Mailbox'

   }
      
   $dbMb = $null

}
Write-Output "   --------------- ---------- ----------"
Write-output  ( '   Totals          '   `
               +("{0:N0}" -f ($TotSize/1MB)).ToString().padleft(10)+' '   `
               +($TotDocs.ToString().padleft(10)))

Write-output ""

Set-Location $StartPath
$dtDiff = (New-Timespan -Start $dtStart -End (Get-Date))
"Elapsed Time: "+($dtDiff.Hours.ToString()).PadLeft(2,"0")+":"+($dtDiff.Minutes.ToString()).PadLeft(2,"0")+":"+($dtDiff.Seconds.ToString()).PadLeft(2,"0")+"."+($dtDiff.Milliseconds.ToString()).PadLeft(4,"0")
$TotSize = $null
$TotDocs = $null
$dbMB = $null
$Notes = $null
$StartPath = $null
$dtStart = $null

Getting a Web Page with PowerShell

This is a patern to get a webpage. I sometimes work in a network accessing the internet through a proxy, So there is included a block where proxy creds are used.

GetWebPage.ps1

#http://learn-powershell.net/2011/02/11/using-powershell-to-query-web-site-information/
#http://stackoverflow.com/questions/571429/powershell-web-requests-and-proxies

Begin {
    $user = $env:username
    $url = "https://hereisasite.net"
    #$url = "http://google.com"
    $pwd = Read-Host "Password?" -assecurestring
    $account = new-object System.Net.NetworkCredential($user,[Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($pwd)), "")

    #$proxyAddr = (get-itemproperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings').ProxyServer
    #$proxy = new-object System.Net.WebProxy
    #$proxy.Address = $proxyAddr
    #$proxy.credentials = $account
    #$proxy.useDefaultCredentials = $true

    $web = New-Object System.Net.WebClient
    $web.Credentials = $account
    #$web.proxy = $proxy

    $flag = $false
}
Process {
    While ($flag -eq $false) {
        Try {
            $webpage = $web.DownloadData($url)
            $str = [System.Text.Encoding]::ASCII.GetString($webpage)
            $flag = $true
        } Catch {
             Write-host -fore Red -nonewline "Access down... "
             $str = "Nothing to see here... "
             $flag = $true
        }
    }
}
End{
    Write-Host $str
}

Powershell - Active Directory User's Group List

All I wanted to do was to see a list a semi-readable list of the groups a client belongs to.

Get-ADUser am00000b

gives me a list of default values returned.

PS C:\WINDOWS\system32> get-aduser am00000b


DistinguishedName : CN=Lesley,OU=Users,OU=AM,DC=MyCompany,DC=com
Enabled           : True
GivenName         : Lesley
Name              : am00000b
ObjectClass       : user
ObjectGUID        : ffffffff-ffff-ffff-ffff-ffffffffffff
SamAccountName    : am00000b
SID               : S-1-5-21-999999999-999999999-9999999999-99999
Surname           : Phillips
UserPrincipalName : am00000b@am.mycompany.com

Get-ADUser am00000b -Properties * shows me all the AD properties associated with the user. (which you can do on your own). From there I can see the property I'm looking for... MemberOf . If you have a lot of groups assigned to the user, it may be truncated. And, it is not in any particular order. However, you can add MembersOf to the results with -Properties memberof

PS C:\WINDOWS\system32> get-aduser am00000b -Properties memberof


DistinguishedName : CN=Lesley,OU=Users,OU=AM,DC=MyCompany,DC=com
Enabled           : True
GivenName         : Lesley
MemberOf          : {CN=AMG-Heat-Users,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com,
                    CN=AMG_Internet_USERS,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com,
                    CN=RightFax,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com,
                    CN=APP-ATTConnect-stduser,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com,...}
Name              : am00000b
ObjectClass       : user
ObjectGUID        : ffffffff-ffff-ffff-ffff-ffffffffffff
SamAccountName    : am00000b
SID               : S-1-5-21-999999999-999999999-9999999999-99999
Surname           : Phillips
UserPrincipalName : am00000b@am.mycompany.com

Passing that into a Select -ExpandProperty memberof gives the following result.

PS C:\WINDOWS\system32> get-aduser am00000b -Properties memberof | Select -ExpandProperty memberof
CN=APP-Heat-Users,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com,
CN=AMG-Internet-stdusers,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com,
CN=APP-RightFax-admusers,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com, 
CN=APP-ATTConnect-stduser,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=APP-Clarity-testuser,,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=APP-Clarity-stduser,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=IS-Level-1,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=SecWebAccess(Instant Message),OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=SecWebAccess(email),OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=^PCAdm,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=^DominoServer,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=^RemoteControl,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=SecWebAccess(CompSec),OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=SecWebAccess(Organizational Email),OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=SecWebAccess(MySpace),OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=IS-B-jo,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=AMG-SCCM,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=^LocalDev,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=AMG-FAXServer,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=APP-Heat-stdusers,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=AMG-Smartcard-stdusers,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=AMG-AD-adm,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com

And, finally, to make it semi-readable pass in to a Sort-Object

PS C:\WINDOWS\system32> get-aduser am00000b -Properties memberof | Select -ExpandProperty memberof | Sort-Object
CN=^DominoServer,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=^LocalDev,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=^PCAdm,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=^RemoteControl,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=AMG-AD-adm,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=AMG-FAXServer,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=AMG-Internet-stdusers,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com,
CN=AMG-SCCM,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=AMG-Smartcard-stdusers,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=APP-ATTConnect-stduser,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=APP-Clarity-stduser,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=APP-Clarity-testuser,,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=APP-Heat-stdusers,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=APP-Heat-Users,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com,
CN=APP-RightFax-admusers,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com, 
CN=IS-B-jo,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=IS-Level-1,OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=SecWebAccess(CompSec),OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=SecWebAccess(email),OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=SecWebAccess(Instant Message),OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=SecWebAccess(MySpace),OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com
CN=SecWebAccess(Organizational Email),OU=Global,OU=Groups,OU=AM,DC=MyCompany,DC=com

Most examples I found don't use the shorthand for the CN lookup, but rather use a -filter {CN -eq "am00000b"}. Which would look like this...

get-aduser -filter { CN -eq "am00000b" } -Properties memberof | Select -ExpandProperty memberof | Sort-Object

How to fix WinMgmt

So I was working on a KB article for our support staff and wrote up the
following....

Upon further review, due to the possibility of affecting the wrong systems,
we decided to leave the at-workstation instructions only.

CMD: DOS command prompt
 PS: PowerShell

*** Desk-side support, a PC Administrator or a client with elevated rights  ***
*** can perform the following remotely...                                   ***

1. With elevated rights open a CMD prompt or PowerShell on your, the
   technician's, computer.

2. Stop winmgmt.

 CMD: sc \\clientPC stop winmgmt
  PS: Stop-Service -InputObject $(Get-Service -Computer "clientPC" -Name "winmgmt")

3. Rename the folder.

 CMD: net use z: \\clientPC\c$
      ren z:\windows\system32\wbem\repository repository_bad
      net use z: -d
  PS: rename-item \\clientPC\c$\windows\system32\wbem\repository repository_bad

4. Restart the PC.

 CMD: shutdown /m:\\clientPC /r /t:0
  PS: restart-computer -ComputerName "clientPC" -force

*** Desk-side support, a PC Administrator or a client with elevated rights  ***
*** can perform the following at the client's workstation...                ***

1. With elevated rights open a CMD prompt.

2. Type: net stop winmgmt

   Type "Y" when prompted to stop dependent services.

3. Type: ren %windir%\System32\Wbem\Repository Repository_bad

4. Restart the PC.

5. Try your application again.