So let's review what commands are available within the out‑of‑the‑box,
or the native,
PowerShell that will help us retrieve the specific
information in the categories that we talked about.
Well, first off, if we were to retrieve local users and groups,
then of course we have access to Get‑LocalUser,
Get‑LocalGroup, and then Get‑LocalGroupMember.
So, three very simple commands to help us get user and group information.
If we're looking for information from the workstation itself,
then we've used this in previous training where we can use
what's called the Get‑CimInstance and then pass it the
category or the object we're looking for.
So here we're looking for OperatingSystem details,
Processor, BIOS, LogicalDisk, and ComputerSystem.
So we can use that Get‑CimInstance object to retrieve details.
If we're trying to retrieve running services and processes,
we can also use the GetCimInstance again to get the Win32_Service and Process,
but then we also have two commands that are available out of the box,
just called Get‑Process and Get‑Service.
So we can call those as well.
If we're looking for network information,
once again our trusty CimInstance will give us network adapter details,
and then we have a set of commands that are available to us for
retrieving networking information such as the IP address,
what's in the DNS, who the networking neighbors are,
and the routes that it should take to get to things.
If we were looking for scheduled tasks and autoruns,
we're going to use the CimInstance commands.
They're the easiest ones to use to get startup commands and scheduled jobs.
If we're browsing around in the files and folders and sessions,
then we can use standard commands.
So Get‑ChildItem will get me objects that reside in a container,
SmbSession is going to be our current connected session.
So, if you were connected to a network share,
for example, that would then be listed.
And then we can use the Win32_Share to get a list of shares.
And then if we look at the event logs, we're going to use Get‑WinEvent.
So we have a whole set of out‑of‑the‑box capabilities.
None of these commands here are external to out‑of‑the‑box PowerShell.