Find-Conficker

The Need:
I needed to search all servers in AD to check for the presence of a dll file dropped by the Conficker virus.


The Script:
#Find-Conficker.ps1
#Get the server list
$ServerList = @(get-qadcomputer -OSName "Windows Server*"); $Servers = $ServerList | foreach {$_.Name}; Write-host "These Servers will be checked" -fore green ; $Servers

#Ping Server
function Find-Infection{
$ping = gwmi -q "SELECT * FROM Win32_Pingstatus WHERE Address = '$serv'"
if($ping.statusCode -eq 0) { Write-Host "Checking $Serv Now" -fore Yellow;

#Check for File
gci -path \\$serv\c$\windows\system32 -filter *.dll -force | where { $_.attributes -eq "ReadOnly, Hidden, System, Archive" }
}
else { write-host "$serv is not responding" -for Red}
}
foreach ($serv in ($servers))
{
Find-Infection | select Length,Mode,FullName | ft -auto
}

Get-Mailboxes

The Need:
Today I wanted to quickly list all mailboxes on an Exchange 2003 server without going through the hassle of a million mouse clicks in ESM. This simple script was just what I needed. It prompts me for a server then lists the mailboxes and size going from largest to smallest.



The Script:
#A simple script to look at the mailboxes on an Exchange 2003 Server.
Function Get-Mailboxes {
$ExchServer = Read-Host "Which Exchange Server?"
gwmi -namespace root\microsoftexchangev2 Exchange_Mailbox -comp $ExchServer |
select Mailboxdisplayname,Size | sort size -Descending | Format-Table -Auto
}

Get-ServiceStatus

The Need:
This week I needed to check whether a particular service (ersvc) had stopped on a number of computers. I pulled all the windows 2000 and XP computers from AD into a text file (C:\Comps.txt) with the Get-QADComputer cmdlet, then pinged each computer first. If the computer was up the script ran the check on the service, if the computer was down it ignored it.

The only output I got was computers that were up that had the service installed but was stopped.



The Script:
$comps = (Get-Content C:\Comps.txt)
function Ping-Host
{$ping = gwmi -q "SELECT * FROM Win32_Pingstatus WHERE Address = '$comp'"
if($ping.statusCode -eq 0)
{$ersvc = gwmi win32_service -comp $comp | where { $_.name -eq "ersvc"}
if ($ersvc.state -eq "stopped")
{Write-Host PC: $comp Service: $ersvc.name State: $ersvc.state}}}
foreach ($comp in ($comps))
{ping-host}

Check-Uptime

The Need:
There are several occasions when I need to check the uptime on a number of servers.


The Script:
$Servers = Get-Content "c:\Servers.txt"
Function Check-Uptime {
forEach($Server in $Servers)
{
$wmi = gwmi Win32_OperatingSystem -comp $Server
$BootTime = $wmi.ConvertToDateTime($wmi.Lastbootuptime)
[TimeSpan]$Uptime = New-TimeSpan $BootTime $(get-date)
Write-host $Server :Uptime: " $Uptime.days "Days" $Uptime.hours "Hours" $uptime.minutes "Minutes" $uptime.seconds "Seconds"
}}
Check-Uptime