So let's go straight onto the machine,
and we're going to create a PowerShell script,
which will first retrieve local computer information,
it will then query networking information,
it will then export current event log entries,
and then we will create a readable document of that
information instead of it being just exported files.
One of the main reasons for using PowerShell is really down to its automation.
The ability to retrieve information and to output information
in a way without actually having to necessarily touch the
machine or be remote connectivity.
So what we'll do is we're going to focus on creating an output,
a script that will retrieve information.
So I'm first going to just go into my C: drive here,
and I'm going to create a PSFolder,
which will just be my output directory that I want to utilize.
So what we're going to do is we're going to create a script that is
going to retrieve specific information for us from the machine that
we run it on. So in this instance, it will just be this machine.
So I can say Trainer, and then it's called PS,
actually, it was PSFolder all along, so let's just do that.
Let me just make sure that's populated, location PSFolder.
Okay perfect.
So that means we have a location to put stuff into.
And then what we'll do is we'll start to retrieve information.
Now the first thing I want to do is create a variable called desktop.
And you may remember, we touched on something called CimInstance,
which is a PowerShell cmdlet made for retrieving information from a machine,
and you specify a specific class name.
So in this instance, we're going to use what's called the Win32_Desktop,
just need to do an underscore here, so the ClassName is Win32_Desktop.
And if I just do that, what does it give us?
Well, if I click desktop, it gives me information,
some basic settings, if the screensaver is enabled,
etc., so that retrieves a set of information.
Now we can go a little bit further here and we could say bios, CimInstance.
We could change the ClassName, and it would just be Win32_BIOS,
which I'm going to put in capitals here,
and then I can say $bios.
And then you can see I'm using a virtual machine,
and it's VMware, and it's an INTEL platform.
So, now it starts to show specific information.
So, of course, from here, we can then start to retrieve further information,
so I'm going to add a few little bits and pieces here,
so I'm going to paste the longer one here.
This is going to be the processor information.
I'm also going to go ahead and bring in the manufacturer information,
so this will bring back more about Microsoft Windows
and some of the VMware capabilities.
I'm also going to go in and say hotfixes because I want
to know what hotfixes are installed.
I also want to get some operating system information as well, like so.
And then what we'll do is we'll do a list of services that are
currently running as well, so combining some of these things
together that we've already done.
So, for example, when we say services,
it's going to list all the services that we looked at last time.
So I created a few variables, what I can do now is
start to create this kind of log file.
So I'm first off going to create a variable called report,
and I'm going to populate it with that.
So if I just do $report, you'll see it's going to be C:\PSFolder,
and it's called Report.log.
Then at this point, we're going to use something called New‑Item.
So I'm going to say New‑Item, and then I'm going to say it's the report,
so it's going to create me the log file.
I'm going to specify what kind of Type it is,
and at this point, I'm going to say I need it to be a File,
and then the Value I'm going to give it is I'm just
going to call it PowerShell Report, like so.
So now that's going to create it.
So if I go into my folder,
you can see it's created the Report file with the title of PowerShell Report,
but nothing in there.
So it's generated an empty container that's going to be,
obviously, expecting information to be put in.
So what I'm going to do here is I'm going to say Add‑Content,
which is a PowerShell option, and I'm going to say,
I would like to Add‑Content to the report to the $report variable.
I'm then going to do like this, and I'll call it Desktop,
and then I'll do a few more of those, like so.
I'll then repeat that process,
but this time what I'll do is say put the desktop information in there.
Okay, so let's go back to the file here,
open up Report, and all of a sudden, you'll see we've got the Desktop option,
and we've got some values that have now showed up, so what we can
start to do is start to structure the information that we would
like to see in this specific file.
Now, of course, if I wanted to do it all in one go and look for certain things,
I could just grab,
now I'm actually going to go into the file here and just
delete some stuff out for a second.
Let's go in, everything we just put in there,
so let's just get rid of that, like so.
File, Save, so it's empty, and then I'm just going to paste a big chunk.
So what you can see is it's the same thing as before.
We're going to say get me the desktop information,
put it in Desktop Details, get me a Bios Details,
get me the Processor Details, and put all that in that file.
At that point, that file becomes ready for us to view,
and you can see that we've got sections in here,
so Manufacture Details. Let me just zoom into this
and make this a little bit bigger, zoom in and zoom in.
So you can see it's captured, I'm going to change that to Word Wrap as well,
and it's put all that information inside this readable,
readable document,
which is just a log file at this point, but it could be a Word document,
it could be a CSV file, it could be whatever we need it to be.
So it's as simple as capturing the information that we want
and then adding that directly to that file.
So let's say we wanted to add some of the network
details that we looked at previously, so things like the network adapter,
then we could add that into the equation.
So we could simply go back here, I'm going to add another Add‑Content,
which will be here, like so,
so that's going to add me a new section called Network Details.
And then in that networking details,
we can then go through and add whatever we want to from the networking piece,
for example.
So, where we were able to query specific pieces of network information,
so maybe the network adapters, maybe event logs,
whatever it would be, we could capture that information.
So I'm going to go in and say, let's just do Add,
well, I'll tell you what, let's just create me a variable first,
let's call it network, and we'll do that, okay,
and then we'll do Add‑Content to the report. And then at this point,
I'm just going to say network.
If I now go back to that file, go right towards the bottom here,
you'll see we now have Network Details,
and it shows me my network adapters that have been added, so we can
continue to modify and adjust this as needed.
Now,
the most important thing that we can do here is we could save
all of that script as a specific script and then execute all
of those commands in one go, but do it remotely as well.
So the advantage here of writing the script is to put all of the
commands together that we wish to utilize and then to go ahead
and re‑execute it as we need to against either local machines or
remote machines as needed.
But this was a very simple example of how to do that,
it's just combining all of these pieces together and then
creating some kind of format that we can read.
And obviously, this is an easy option, it's just a report file as a log file,
you could create a HTML file, you could create all kinds of different things.