Tag: #Informational

<#
.SYNOPSIS
    Logs all USB devices connected to the system.

.DESCRIPTION
    This script uses CIM/WMI to query for USB devices (by filtering for PNPDeviceIDs that start with "USB")
    and logs their details (Name, PNPDeviceID, Description) along with a timestamp. The log is appended to a file,
    which by default is stored in the same directory as the script (USBDeviceLog.txt).

.NOTES
    Run this script with the necessary permissions. 
    Adjust the log file path if needed.
#>

# Define the log file location (you can change this to an absolute path if desired)
$logFilePath = Join-Path -Path $PSScriptRoot -ChildPath "USBDeviceLog.txt"

# Get the current timestamp
$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

# Create the log entry header
$logEntry = "USB Device Log - $timestamp`r`n" + ("=" * 50) + "`r`n"

# Query for USB devices by filtering Win32_PnPEntity for entries with a PNPDeviceID starting with "USB"
try {
    $usbDevices = Get-CimInstance -ClassName Win32_PnPEntity | Where-Object { $_.PNPDeviceID -like "USB*" }
}
catch {
    Write-Error "Error querying USB devices: $_"
    exit
}

if ($usbDevices) {
    foreach ($device in $usbDevices) {
        $logEntry += "Name         : " + $device.Name + "`r`n"
        $logEntry += "PNPDeviceID  : " + $device.PNPDeviceID + "`r`n"
        $logEntry += "Description  : " + $device.Description + "`r`n"
        $logEntry += ("-" * 40) + "`r`n"
    }
}
else {
    $logEntry += "No USB devices found." + "`r`n"
}

$logEntry += "`r`n"

# Append the log entry to the log file
try {
    Add-Content -Path $logFilePath -Value $logEntry
    Write-Host "USB devices logged successfully to $logFilePath" -ForegroundColor Green
}
catch {
    Write-Error "Failed to write to log file: $_"
}

# Get-DriveSpaceInfo.ps1
# This script retrieves space information for each local drive (DriveType=3) on the computer.
# It displays the drive letter, total size, free space, used space, and percentage of free space.

# Retrieve local disk drives (DriveType=3 indicates local fixed disks)
$drives = Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DriveType=3"

if (!$drives) {
    Write-Host "No local drives found."
    exit
}

foreach ($drive in $drives) {
    $driveLetter = $drive.DeviceID
    $totalSize = $drive.Size
    $freeSpace = $drive.FreeSpace

    # Calculate used space and percentage of free space (if total size is not zero)
    if ($totalSize -gt 0) {
        $usedSpace = $totalSize - $freeSpace
        $percentFree = [Math]::Round(($freeSpace / $totalSize) * 100, 2)
        $totalSizeGB = [Math]::Round($totalSize / 1GB, 2)
        $freeSpaceGB = [Math]::Round($freeSpace / 1GB, 2)
        $usedSpaceGB = [Math]::Round($usedSpace / 1GB, 2)
    }
    else {
        $usedSpace = 0
        $percentFree = 0
        $totalSizeGB = 0
        $freeSpaceGB = 0
        $usedSpaceGB = 0
    }

    Write-Host "Drive: $driveLetter" -ForegroundColor Cyan
    Write-Host "  Total Size: $totalSizeGB GB"
    Write-Host "  Free Space: $freeSpaceGB GB ($percentFree`%)"
    Write-Host "  Used Space: $usedSpaceGB GB"
    Write-Host "-------------------------------------"
}

<#
.SYNOPSIS
    Lists the largest files in a directory with a truncated display and full detail lookup.

.DESCRIPTION
    This script recursively scans a specified directory (or the current directory by default),
    sorts all files by size in descending order, and displays the top N largest files as specified by the user.
    It shows a truncated file name and full path for a neat table view.
    After displaying the table, the user can choose an index (or "all") to view full details of the file(s).

.NOTES
    Run as Administrator if scanning protected directories.
#>

# Function to convert bytes to a human-readable format.
function Convert-BytesToHumanReadable {
    param ([long]$bytes)
    if ($bytes -ge 1PB) {
        return "{0:N2} PB" -f ($bytes / 1PB)
    }
    elseif ($bytes -ge 1TB) {
        return "{0:N2} TB" -f ($bytes / 1TB)
    }
    elseif ($bytes -ge 1GB) {
        return "{0:N2} GB" -f ($bytes / 1GB)
    }
    elseif ($bytes -ge 1MB) {
        return "{0:N2} MB" -f ($bytes / 1MB)
    }
    elseif ($bytes -ge 1KB) {
        return "{0:N2} KB" -f ($bytes / 1KB)
    }
    else {
        return "$bytes B"
    }
}

# Function to truncate long strings.
function Truncate-String {
    param (
        [Parameter(Mandatory = $true)]
        [string]$str,
        [int]$maxLength = 50
    )
    if ($str.Length -gt $maxLength) {
        return $str.Substring(0, $maxLength - 3) + "..."
    }
    else {
        return $str
    }
}

# Prompt the user for the directory to scan (default is current directory).
$directory = Read-Host "Enter the directory to scan (or press Enter for current directory)"
if ([string]::IsNullOrWhiteSpace($directory)) {
    $directory = (Get-Location).Path
}

if (-not (Test-Path $directory)) {
    Write-Error "Directory '$directory' does not exist."
    exit
}

# Prompt the user for the number of items to list.
$numberOfItems = Read-Host "Enter the number of largest files to list"
if (-not [int]::TryParse($numberOfItems, [ref]$null)) {
    Write-Error "Invalid number entered. Please enter a valid integer."
    exit
}
$numberOfItems = [int]$numberOfItems

Write-Host "Scanning directory '$directory' for files..." -ForegroundColor Cyan

# Recursively retrieve all files within the specified directory.
try {
    $files = Get-ChildItem -Path $directory -File -Recurse -ErrorAction SilentlyContinue
} catch {
    Write-Error "Error retrieving files: $_"
    exit
}

if (!$files) {
    Write-Host "No files found in '$directory'."
    exit
}

# Sort the files by size (Length) descending and take the top N items.
$largestFiles = $files | Sort-Object Length -Descending | Select-Object -First $numberOfItems

# Build a table with an index and truncated file name and path.
$i = 1
$result = foreach ($file in $largestFiles) {
    [PSCustomObject]@{
        Index         = $i
        "File Name"   = Truncate-String -str $file.Name -maxLength 30
        "Full Path"   = Truncate-String -str $file.FullName -maxLength 60
        "Size (Bytes)"= $file.Length
        "Size (Human)"= Convert-BytesToHumanReadable -bytes $file.Length
    }
    $i++
}

# Display the results in a formatted table.
Write-Host "`nTop $numberOfItems largest files in '$directory':" -ForegroundColor Green
$result | Format-Table -AutoSize

# Allow the user to view full details if needed.
$choice = Read-Host "`nEnter a file index to view full details, type 'all' to view details for all files, or press Enter to exit"
if (-not [string]::IsNullOrWhiteSpace($choice)) {
    if ($choice -match '^(all)$') {
        Write-Host "`nFull details for all files:" -ForegroundColor Cyan
        $largestFiles | Format-List *
    }
    elseif ([int]::TryParse($choice, [ref]$null)) {
        $index = [int]$choice
        if ($index -ge 1 -and $index -le $largestFiles.Count) {
            Write-Host "`nFull details for file at index $($index):" -ForegroundColor Cyan
            $largestFiles[$index - 1] | Format-List *
        }
        else {
            Write-Host "Invalid index entered." -ForegroundColor Yellow
        }
    }
}

<#
.SYNOPSIS
    Audits local user accounts by listing their enabled/disabled status and last logon time.

.DESCRIPTION
    This script retrieves local user accounts using Get-LocalUser and then obtains last logon information
    for each account by parsing the output of the "net user" command. It outputs a table showing each account's name,
    whether it is enabled, and its last logon time (or "Never" if the account has not logged on).

.NOTES
    Run as Administrator if necessary.
#>

function Get-LastLogonNetUser {
    param (
        [Parameter(Mandatory = $true)]
        [string]$UserName
    )

    # Execute the "net user" command for the given user
    $netUserOutput = net user $UserName 2>&1

    # Look for a line that contains "Last logon"
    $lastLogonLine = $netUserOutput | Where-Object { $_ -match "Last logon" }
    if ($lastLogonLine) {
        # The expected format is something like:
        #   Last logon                   2/12/2021 3:45:30 PM
        # Remove the label text and trim spaces to isolate the date/time string.
        $logonValue = ($lastLogonLine -replace ".*Last logon\s+", "").Trim()
        if ($logonValue -match "Never") {
            return "Never"
        }
        else {
            # Attempt to parse the logon value as a DateTime.
            try {
                $dt = [DateTime]::Parse($logonValue)
                return $dt
            }
            catch {
                return $logonValue
            }
        }
    }
    else {
        return "Unknown"
    }
}

# Retrieve local user accounts.
try {
    $localUsers = Get-LocalUser
} catch {
    Write-Error "Failed to retrieve local users. Ensure this is run on a supported version of Windows with appropriate permissions."
    exit
}

# Prepare an array to store the audit results.
$result = @()

foreach ($user in $localUsers) {
    $userName = $user.Name
    $lastLogon = Get-LastLogonNetUser -UserName $userName

    $result += [PSCustomObject]@{
        Name      = $userName
        Enabled   = $user.Enabled
        LastLogon = $lastLogon
    }
}

# Output the results in a formatted table.
$result | Format-Table -AutoSize