windows/SharedScripts
1
0
Fork 0
mirror of https://github.com/jaapbrasser/SharedScripts.git synced 2025-12-24 21:51:38 +02:00
Code Activity

Included HKCU

Browse Source
This commit is contained in:
Jaap Brasser
2019-08-02 09:42:14 +02:00
parent ae26b7ce78
commit 88b26dcfa3
1 changed files with 71 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

139
Get-RemoteProgram/Get-RemoteProgram.ps1
View File

@@ -149,87 +149,90 @@ Will retrieve the InstallDate of all components that match the regex pattern of
try {
$socket = New-Object Net.Sockets.TcpClient($Computer, 445)
if ($socket.Connected) {
$RegBase = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine,$Computer)
$RegistryLocation | ForEach-Object {
$CurrentReg = $_
if ($RegBase) {
$CurrentRegKey = $RegBase.OpenSubKey($CurrentReg)
if ($CurrentRegKey) {
$CurrentRegKey.GetSubKeyNames() | ForEach-Object {
$HashProperty.ComputerName = $Computer
$HashProperty.ProgramName = ($DisplayName = ($RegBase.OpenSubKey("$CurrentReg$_")).GetValue('DisplayName'))
'LocalMachine','CurrentUser' | ForEach-Object {
$RegBase = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::$_,$Computer)
$RegistryLocation | ForEach-Object {
$CurrentReg = $_
if ($RegBase) {
$CurrentRegKey = $RegBase.OpenSubKey($CurrentReg)
if ($CurrentRegKey) {
$CurrentRegKey.GetSubKeyNames() | ForEach-Object {
$HashProperty.ComputerName = $Computer
$HashProperty.ProgramName = ($DisplayName = ($RegBase.OpenSubKey("$CurrentReg$_")).GetValue('DisplayName'))
#$HashProperty.RegPath = "$CurrentReg$_"
if ($IncludeProgram) {
if ($ProgramRegExMatch) {
$IncludeProgram | ForEach-Object {
if ($DisplayName -notmatch $_) {
$DisplayName = $null
}
}
} else {
$IncludeProgram | Where-Object {
$DisplayName -notlike ($_ -replace '\[','`[')
} | ForEach-Object {
$DisplayName = $null
}
}
}
if ($ExcludeProgram) {
if ($ProgramRegExMatch) {
$ExcludeProgram | ForEach-Object {
if ($DisplayName -match $_) {
$DisplayName = $null
}
}
} else {
$ExcludeProgram | Where-Object {
$DisplayName -like ($_ -replace '\[','`[')
} | ForEach-Object {
$DisplayName = $null
}
}
}
if ($DisplayName) {
if ($Property) {
foreach ($CurrentProperty in $Property) {
$HashProperty.$CurrentProperty = ($RegBase.OpenSubKey("$CurrentReg$_")).GetValue($CurrentProperty)
}
}
if ($LastAccessTime) {
$InstallPath = ($RegBase.OpenSubKey("$CurrentReg$_")).GetValue('InstallLocation') -replace '\\$',''
if ($InstallPath) {
$WmiSplat = @{
ComputerName = $Computer
Query = $("ASSOCIATORS OF {Win32_Directory.Name='$InstallPath'} Where ResultClass = CIM_DataFile")
ErrorAction = 'SilentlyContinue'
}
$HashProperty.LastAccessTime = Get-WmiObject @WmiSplat |
Where-Object {$_.Extension -eq 'exe' -and $_.LastAccessed} |
Sort-Object -Property LastAccessed |
Select-Object -Last 1 | ForEach-Object {
$_.ConvertToDateTime($_.LastAccessed)
if ($IncludeProgram) {
if ($ProgramRegExMatch) {
$IncludeProgram | ForEach-Object {
if ($DisplayName -notmatch $_) {
$DisplayName = $null
}
}
} else {
$HashProperty.LastAccessTime = $null
$IncludeProgram | Where-Object {
$DisplayName -notlike ($_ -replace '\[','`[')
} | ForEach-Object {
$DisplayName = $null
}
}
}
if ($psversiontable.psversion.major -gt 2) {
[pscustomobject]$HashProperty
} else {
New-Object -TypeName PSCustomObject -Property $HashProperty |
Select-Object -Property $SelectProperty
if ($ExcludeProgram) {
if ($ProgramRegExMatch) {
$ExcludeProgram | ForEach-Object {
if ($DisplayName -match $_) {
$DisplayName = $null
}
}
} else {
$ExcludeProgram | Where-Object {
$DisplayName -like ($_ -replace '\[','`[')
} | ForEach-Object {
$DisplayName = $null
}
}
}
if ($DisplayName) {
if ($Property) {
foreach ($CurrentProperty in $Property) {
$HashProperty.$CurrentProperty = ($RegBase.OpenSubKey("$CurrentReg$_")).GetValue($CurrentProperty)
}
}
if ($LastAccessTime) {
$InstallPath = ($RegBase.OpenSubKey("$CurrentReg$_")).GetValue('InstallLocation') -replace '\\$',''
if ($InstallPath) {
$WmiSplat = @{
ComputerName = $Computer
Query = $("ASSOCIATORS OF {Win32_Directory.Name='$InstallPath'} Where ResultClass = CIM_DataFile")
ErrorAction = 'SilentlyContinue'
}
$HashProperty.LastAccessTime = Get-WmiObject @WmiSplat |
Where-Object {$_.Extension -eq 'exe' -and $_.LastAccessed} |
Sort-Object -Property LastAccessed |
Select-Object -Last 1 | ForEach-Object {
$_.ConvertToDateTime($_.LastAccessed)
}
} else {
$HashProperty.LastAccessTime = $null
}
}
if ($psversiontable.psversion.major -gt 2) {
[pscustomobject]$HashProperty
} else {
New-Object -TypeName PSCustomObject -Property $HashProperty |
Select-Object -Property $SelectProperty
}
}
$socket.Close()
}
$socket.Close()
}
}
}
}
}
} catch {