Windows command line:

C:\> tasklist /FI "modules eq vstoee.dll"

PowerShell

PS C:\> Get-Process | ? { $_.Modules -like "*(vstoee.dll)*" }

Here is a PowerShell script to read the Last Write Time for a registry key.

Usage:

Get-RegKeyLastWriteTime.ps1 <Key> <SubKey>

Example:

Get-RegKeyLastWriteTime.ps1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion

Output:

Key                         LastWriteTime
—-                         ——————-
AdminDebug                  10/28/2009 7:50:51 PM
App Management              7/14/2009 4:41:12 AM
App Paths                   1/22/2010 2:07:18 PM
Applets                     7/14/2009 4:41:12 AM
Audio                       7/14/2009 4:41:12 AM
Authentication              7/14/2009 4:41:12 AM
BitLocker                   7/14/2009 4:41:12 AM
...

Get-RegKeyLastWriteTime.ps1 Script:

param (	[string] $Key, [string] $SubKey )

switch ($Key) {
    "HKCR" { $searchKey = 0x80000000} #HK Classes Root
    "HKCU" { $searchKey = 0x80000001} #HK Current User
    "HKLM" { $searchKey = 0x80000002} #HK Local Machine
    "HKU"  { $searchKey = 0x80000003} #HK Users
    "HKCC" { $searchKey = 0x80000005} #HK Current Config
    default {
        #throw "Invalid Key. Use one of the following options HKCR, HKCU, HKLM, HKU, HKCC"
    }
}

$KEYQUERYVALUE = 0x1
$KEYREAD = 0x19
$KEYALLACCESS = 0x3F

$sig1 = @'
[DllImport("advapi32.dll", CharSet = CharSet.Auto)]
  public static extern int RegOpenKeyEx(
    int hKey,
    string subKey,
    int ulOptions,
    int samDesired,
    out int hkResult);
'@
$type1 = Add-Type -MemberDefinition $sig1 -Name Win32Utils `
    -Namespace RegOpenKeyEx -Using System.Text -PassThru

$sig2 = @'
[DllImport("advapi32.dll", EntryPoint = "RegEnumKeyEx")]
extern public static int RegEnumKeyEx(
    int hkey,
    int index,
    StringBuilder lpName,
    ref int lpcbName,
    int reserved,
    int lpClass,
    int lpcbClass,
    out long lpftLastWriteTime);
'@
$type2 = Add-Type -MemberDefinition $sig2 -Name Win32Utils `
    -Namespace RegEnumKeyEx -Using System.Text -PassThru

$sig3 = @'
[DllImport("advapi32.dll", SetLastError=true)]
public static extern int RegCloseKey(
    int hKey);
'@
$type3 = Add-Type -MemberDefinition $sig3 -Name Win32Utils `
    -Namespace RegCloseKey -Using System.Text -PassThru

$hKey = new-object int
$result = $type1::RegOpenKeyEx($searchKey, $SubKey, 0, $KEYREAD, [ref] $hKey)

#initialize variables
$builder = New-Object System.Text.StringBuilder 1024
$index = 0
$length = [int] 1024
$time = New-Object Long

#234 means more info, 0 means success. Either way, keep reading
while ( 0,234 -contains $type2::RegEnumKeyEx($hKey, $index++, `
    $builder, [ref] $length, $null, $null, $null, [ref] $time) )
{
    #create output object
    $o = "" | Select Key, LastWriteTime
    $o.Key = $builder.ToString()
    $o.LastWriteTime = (Get-Date $time).AddYears(1600)
    $o

    #reinitialize for next time through the loop
    $length = [int] 1024
    $builder = New-Object System.Text.StringBuilder 1024
}

$result = $type3::RegCloseKey($hKey);

Just open up a cmd.exe and change the ip range..

C:\>FOR /L %x in (1,1,255) do ping -n 1 192.168.2.%x | find /I "reply" >> c:\temp\pingresult.txt

The above command uses a FOR loop to ping each device and looks for "Reply" in the output. If there is a "Reply" then the host is up.. Results will be written to C:\temp\pingresults.txt

Or the PowerShell version:

C:\> 1..255 | foreach-object { (new-object System.Net.Networkinformation.Ping).Send("192.168.2.$_") } | where-object {$_.Status -eq "success"} | select Address

Address
——-
192.168.2.1
192.168.2.5
192.168.2.10
192.168.2.11
192.168.2.12

At first glance the results are very similar and you would think, "Why all the extra typing? The second command is 2.5 times longer!" The big difference between the standard windows command line and powershell is that the latter uses objects, which gives a lot of power…in our shell. Not let’s see how it works…

In the above command the range operator (..) generates a list of the numbers 1 through 255. The cool thing is you don’t have to use just a single range, you can string them together like this (1..5),7,(9..10) which would give you the numbers 1-10 skipping 6 and 8.

foreach-object { (new-object System.Net.Networkinformation.Ping).Send("10.10.10.$_") }

The foreach-object takes the numbers fed into the pipeline and operates on them one at a time. First, it creates a new ping object and then calls the send method. The parameter given to the send method is a string concatenation of 10.10.10. and the number from $_, which is the "current pipeline object." The $_ variable in our example will contain the numbers 1-255.

where-object {$_.Status -eq "success"}

The output of the send method is the PingReply object which contains a status. We can filter the results only successful pings reply objects will be sent further down the pipeline.

Select Address
Finally, all we care about is the address so that is the only piece we have displayed.

Now that we know how it works, let’s pimp out our powershell version.

First, we don’t have to just use a contiguous set of numbers. If we wanted to scan all ip address before 10.10.10.100, after 10.10.10.200 and 10.10.10.155 we could use this:
(1..99),(200..255),155 | foreach-object ….
We can use the results to feed into other commands. You can ping sweep an entire subnet and have it automatically do an nslookup, attempt to list the contents of the c$ share, and tell you that you are doing a good job (a little positive reinforcement never hurts).

PS C:\>1..255 | foreach-object { (new-object System.Net.Networkinformation.Ping).Send("10.10.10.$_") } | where-object {$_.Status -eq "success"} | foreach-object { nslookup $_; gci "\\$($_.Address)\c$"; echo "Good Job" }

The ping sweep can be sped up by setting a timeout value (in milliseconds). In the example below we set the timeout value to 100ms.

… (new-object System.Net.Networkinformation.Ping).Send("10.10.10.$_", 100) …

In PowerShell v.2, remote access is available only to users who hold local administrator privileges. So, even if you do have appropriate remote access to a machine, , you cannot remotely access the system if you are not an Admin. This is not a technical limitation, though, just a safe default. You should use this line to change it :

Set-PSSessionConfiguration -Name Microsoft.PowerShell -showSecurityDescriptorUI

One easy way of creating lists of PC names or IP address ranges etc is a simple pipeline like this:

1..40 | Foreach-Object { ‘PC-W7-A{0:000}’ -f $_ }

Use the -f operator to format the number. In this example, it will always be three-digit.

‘Tom’, ‘Chris’, ‘Judy’, ‘Alan’ | Sort-Object

Input can come from a different command. If you’d like to get seven random lottery numbers, you should try this:

1..49 | Get-Random -Count 7 | Sort-Object

You’ll find that when you feed complex objects into Sort-Object, you should specify the object property you want to sort on (or else Sort-Object will pick one by itself):

Get-ChildItem $env:windir | Sort-Object Length

Here are some more examples:

Get-HotFix | Sort-Object InstalledOn

Get-ComputerRestorePoint | Sort-Object Description

Let’s start with some easy stuff..

Get the number of Public Folders

Get-PublicFolder -Recurse | Measure-Object

Get the sum / number of Mails / Object in all Public Folders

Get-PublicFolderStatistics | Measure-Object -Property ItemCount -Sum

Get the number of Mailboxes

Get-Mailbox | Measure-Object

Get the number of sent messages / emails within a date range

Get-MessageTrackingLog -Start "29.11.2009" -End "30.12.2009" -ResultSize Unlimited | Measure-Object

Ok, the goal is to have a 1gb large dummy file ..

first we declare a string variable called file:

PS C:\> $file = "$env:temp\dummyFile.txt"

no we create on object of type Io.File
PS C:\> $objFile = [io.file]::Create($file)

on the object, we call the void SetLength parameterized with 1gb 
PS C:\> $objFile.SetLength(1gb)

no we call the close method and the file is written
PS C:\> $objFile.Close()

using get-item $file we list the file we just created:

PS C:\> Get-Item $file Directory: C:\Users\<removed>\AppData\Local\Temp

Mode                LastWriteTime     Length Name
----                -------------     ------ ----
-a---        13.03.2010     14:07 1073741824 dummyFile.txt

PS C:\>

Ok, finally we can call an ii (Invoke-Item) to open the Path where the dummyFile resides in Windows Explorer.

To get the Path from a File, we can use Get-ChildItem (Get-ChildItems returns a FileInfo Object/Class). This object has a DirectoryName Property.

We declare an Object $path

$path = Get-ChildItem $file

Finally we call the mentioned ii (Invoke-Item) to open the path in Windows Explorer.

ii $path.DirectoryName

The complete Script

$file = "$env:temp\dummyFile.txt"
$objFile = [io.file]::Create($file)
$objFile.SetLength(1gb)
$objFile.Close()
$path = Get-ChildItem $file
ii $path.DirectoryName

If you have jobs that need to execute regularly, you can manage them with a PowerShell script and make it a scheduled task:

To create a scheduled task do.

schtasks /CREATE /TN CheckHealthScript /TR "powershell.exe -noprofile -executionpolicy Unrestricted -file %public%\checkhealth.ps1" /IT /RL HIGHEST /SC DAILY

To get a list of scheduled tasks / enumerate scheduled tasks do:

schtasks /query

Links

Running PowerShell Scripts as Scheduled Task

About Scheduled Tasks on MSDN

About Scheduled Tasks on Technet

Script to enumerate / list scheduled tasks on a list of servers..

$Version="v8.4.28 Aaron Dodd"
$Description="Generate CSV of scheduled tasks in the environment"

#------------------------------------------------------------------------------
# Process tasks
#------------------------------------------------------------------------------
ForEach ($Server in $ServerList) {
schtasks /QUERY /S $Server.Name /FO CSV /V > $TempReport
$TempCsv += Import-Csv $TempReport
}
Remove-Item $TempReport
$TempCsv | Export-Csv $FinalReport -notype
#----------------------------------------------------------------

found here => http://blog.geekpoet.net/2008/04/powershell-script-to-report-on-all.html

Now, we don’t need all the file, but all the files with a specific extension. We’ll use the Where-Object to achieve this. Well if you do Get-ChildItem you’ll get something like:

PS D:\DEMO> Get-ChildItem

    Directory: D:\DEMO

Mode                LastWriteTime     Length Name
—-                ————-     —— —-
d—-        19.02.2010     13:16            DEMO Folder
-a—        19.02.2010     13:17         18 someFile.ext

PS D:\DEMO>

So, how to get only files with a specific extension? Easy, using Get-Member we can list all properties of Get-ChildItem.

PS D:\DEMO> Get-ChildItem | Get-Member

   TypeName: System.IO.DirectoryInfo

Name                      MemberType     Definition
—-                      ———-     ———-
Mode                      CodeProperty   System.String Mode{get=Mode;}
Create                    Method         System.Void Create(System.Security.AccessControl.DirectorySecurity director…
…
…
Extension                 Property       System.String Extension {get;}
FullName                  Property       System.String FullName {get;}
…
…

PS D:\DEMO>

When we want to search for a specific File Type, the Extension Property comes in very handy.

So, to get a list of all, let’s say *.tmp files recursively, we’ll write:

PS D:\DEMO> Get-ChildItem -Rec | Where {$_.Extension -match "tmp"}

    Directory: D:\DEMO

Mode                LastWriteTime     Length Name
—-                ————-     —— —-
-a—        19.02.2010     13:22         12 demo.tmp

    Directory: D:\DEMO\DEMO Folder

Mode                LastWriteTime     Length Name
—-                ————-     —— —-
-a—        19.02.2010     13:22         12 dem32.tmp
-a—        19.02.2010     13:22         12 demo2.tmp

PS D:\DEMO>

Now, let’s delete all of these *.tmp files using Remove-Item

PS D:\DEMO> Get-ChildItem -Rec | Where {$_.Extension -match "tmp"} | Remove-Item

and they are all gone!