This course is obviously about PowerShell, but here are a few additional
tools you may find useful to follow along with this course. First, let's
talk a little bit about the star of the show.
In this course, we're going to use a few different flavors of
PowerShell, so let's talk through each of them. After doing a quick
search of the term PowerShell on your Windows machine,
we will be presented with a few options. And no,
not all PowerShell is created equally.
You need to pay attention to the version. Windows PowerShell was introduced
about 16 years ago and is only available on Windows machines. Still
functional, but as you can see, it is sitting tight at version 5.1 with some
minor updates for security fixes still. If you're just starting out or only
working in a Windows environment,
this will work just fine to get you moving. The ISE is the Integrated
Scripting Environment, and you may think by the name this is perfect for
what this course is all about, scripting. ISE was introduced in version 2 of
PowerShell, which came out at about the same time as Windows 7 and Server
2008 to give you a little reference.
The white section at the top is where you drop your code. The blue bottom
is the execution. This UI format of the tool provides on‑the‑fly debugger
and a runtime of only selected code. But note, this is based on Windows
PowerShell, not PowerShell 7.
The menu along the right are all the available functions that can be
dropped into the scripts, a nice visual reminder of what's available. If
you're going to go this route though, it is often recommended that you
instead get a tool like Visual Studio Code and configure it to run as
similar to PowerShell ISE. I may run a few demos in here just to show
you this option, but this course,
we're just going to focus mainly on the scripts themselves and not dive too
deep into forcing the use of a tool, other than to call out which scripts
require which versions of PowerShell. Finally,
PowerShell 7. Note, this is showing version 7.3.2, and the
edition is Core versus the Desktop edition Windows PowerShell
shows. PowerShell 7 is now open source, multi‑platform, and can run on Windows,
Linux, and even Mac operating systems.
One tool to be used across your entire environment,
regardless of the operating systems you support.
This is a desktop application and not the same as the Microsoft Store
PowerShell app. Although pretty much the same, there are a few minor
limitations around data storage. To get PowerShell 7,
I'm going to go to the github.com/PowerShell/PowerShell/releases. On this page,
you will see the latest version available.
Probably not the same version that you see on the screen here in this course,
but that's okay. As you scroll down, you will see
the other versions of PowerShell,
but for right now, I'm just going to go back to the latest version,
and under the Assets heading I can choose the right file I need for
the operating system I'm working off of. In this case, the Windows
MSI file for a 64‑bit machine.
One important note. Regardless of the version used,
most of the scripts use operating system‑level functions.
Be sure to select this option when starting the tool; otherwise, you'll
receive a few errors you weren't expecting. The demos we will be running
through will be on how to set up active defense measures of your laptops and
servers inside your organization's network.
I have downloaded VirtualBox and set up a free trial of Windows 10
connected to Windows 2019 domain controller.
I have the networks bridged with the laptop I am running the setup on.
My laptop will play the role of a compromised device in demos that
require this so that I can show you what these scripts can potentially
do to protect your environment.
If you have any questions on how to set this up,
I've included a PDF with the exercise files that
will walk you through all of this.
All right, so that is all the setup for now.
Let's dig into the PowerShell scripts.
The best defense is a good offense.
Let's trick the criminals at their own game