Now let's say that we wanted to simply look at the local logon details.
I can run psloggedon64, so I can press Enter here,
and it looks kind of similar to what we would have done
with the standard PowerShell cmdlets, but it gives us that same information.
I can also then, to make it more usable,
I can just say Out‑String, and Out‑String means it converts it to a string,
which means I could iterate values if needed.
If I wanted to, for example, go and get the logged on sessions currently,
I can then use the same syntax again, so loggedonsessions,
accept the eula, and then ‑nobanner,
and you can see I get the currently logged on sessions.
And they all look very much like CSV formats.
When they come out like this, we can really query and present that information.
Now we also have the ability to utilize what's called handle.exe.
Now handle.exe is quite a useful one.
It allows me to look at open files by the processes themselves.
So I can say handle.
Now, this one normally goes to town for quite some while.
But you can see you've got these DLLs that are loaded.
What's loaded them?
So PowerShell.exe has loaded all of these bits and pieces.
So that's always useful to see what's executing something.
What we can do is we can then start to convert that
information into whatever format we liked.
So, there you go, we've turned it around into a CSV format,
which means if we were doing a ForEach object,
we were able to iterate each of those properties.
So that syntax, and we just clear this here,
is as simple as saying, well, let's select the five top lines,
because sometimes the ‑nobanner option doesn't actually work,
so we need to count the rows and get rid of that top section,
and then we can convert as we need to.
And then that converts to a CSV.
Now what about if we wanted to look at Kerberos sessions?
Now in that instance, we can actually use a tool called klist.
Oops, I forgot that on the end.
Klist allows me to get a list of Kerberos tickets that might be available.
You'll see also we've got this kind of extra text.
So that would be one line, that would be a second line,
that would be a third line, that's a fourth line.
So we can start to remove specific lines.
Now of course, I don't have any Kerberos sessions, but we could utilize that.
Now, lastly,
what about if you wanted to get a list of the event
logs that might be available?
So I'm just going to paste some syntax here.
So we've got wmic, the nteventlog, so we're using an older way of grabbing it,
we're then telling it to get a list.
But this piece right here is the most important.
We're looking to format it in CSV.
So I'm going to press Enter here,
and you can see that right away this gives me the name of the machine,
the size of the log, what the log files are, Application,
Security, System, Windows PowerShell, where it is,
and the number of records.
So, that means I'm able to know which event log I would want to look at,
and then I can determine if I want to interrogate further,
because you may look at it and go, I don't need to get every single event log.
If the event log count is 0, then I don't need to get that.
Because even if it was, if it was one,
you would want to get it because it might have an option about the
event log being cleared or something like that.
But definitely things like the Windows PowerShell one,
the System one, which is just here,
you can see we've got 24.5 thousand here, 5.5 thousand here,
almost 6000, etc.
So it gives us a quick view of the event logs that are there,
the number of items, and then of course we can use Get‑WinEvent,
and we can go into the event log as needed.
So that was just a few examples of using just the supporting tools to
effectively get information that we wouldn't normally be able to get,
or it would take multiple iterations of PowerShell to get there,
and how we can consume that directly inside our PowerShell script.