Computer Enumeration Functions

Get-NetSession

Description

[MS-SRVS] Query session information for the local or a remote computer

Syntax

PV > Get-NetSession
-Computer       -ComputerName   -Count          -Hash           -OutFile        -Password
-Server         -SortBy         -TableView      -Username

Examples

PV > Get-NetSession -Computer DC01
PV > Get-NetSession -ComputerName DC01 -TableView
PV > Get-NetSession -Computer DC01 -Username admin -Password Secret123
PV > Get-NetSession -Computer DC01 -SortBy username -OutFile sessions.txt

Parameters

# With Argument
-Computer =
-ComputerName =
-Username =
-Password =
-Hash =
-SortBy =
-Server =
-OutFile =

# No Argument
-TableView =
-Count =

---

Get-NetShare

Description

Query open shares on the local or a remote computer

Syntax

PV > Get-NetShare
-Computer       -ComputerName   -Count          -OutFile        -Server         -TableView

Examples

PV > Get-NetShare -Computer DC01
PV > Get-NetShare -ComputerName DC01 -TableView
PV > Get-NetShare -Computer DC01 -OutFile shares.txt

Parameters

# With Argument
-Computer =
-ComputerName =
-Server =
-OutFile =

# No Argument
-TableView =
-Count =

---

Get-NetLoggedOn

Description

[MS-WKST] Query logged on users on the local or a remote computer

Syntax

PV > Get-NetLoggedOn
-Computer       -ComputerName   -Count          -Hash           -OutFile        -Password
-Server         -SortBy         -TableView      -Username

Examples

PV > Get-NetLoggedOn -Computer DC01
PV > Get-NetLoggedOn -ComputerName DC01 -TableView
PV > Get-NetLoggedOn -Computer DC01 -Username admin -Password Secret123
PV > Get-NetLoggedOn -Computer DC01 -SortBy username -OutFile loggedon.txt

Parameters

# With Argument
-Computer =
-ComputerName =
-Username =
-Password =
-Hash =
-SortBy =
-Server =
-OutFile =

# No Argument
-TableView =
-Count =

---

Get-RegLoggedOn

Description

Query logged on users from remote registry

Syntax

PV > Get-RegLoggedOn
-Computer       -ComputerName   -Count          -OutFile        -Server         -SortBy
-TableView

Examples

PV > Get-RegLoggedOn -Computer DC01
PV > Get-RegLoggedOn -ComputerName DC01 -TableView
PV > Get-RegLoggedOn -Computer DC01 -SortBy username -OutFile regloggedon.txt

Parameters

# With Argument
-Computer =
-ComputerName =
-SortBy =
-Server =
-OutFile =

# No Argument
-TableView =
-Count =

---

Get-NetComputerInfo

Description

Query computer system information via RPC

Syntax

PV > Get-NetComputerInfo
-Computer       -ComputerName   -Count          -Hash           -OutFile        -Password
-Server         -SortBy         -TableView      -Username

Examples

PV > Get-NetComputerInfo -Computer DC01
PV > Get-NetComputerInfo -ComputerName DC01 -TableView
PV > Get-NetComputerInfo -Computer DC01 -Username admin -Hash aad3b435b51404eeaad3b435b51404ee:abc123

Parameters

# With Argument
-Computer =
-ComputerName =
-Username =
-Password =
-Hash =
-SortBy =
-Server =
-OutFile =

# No Argument
-TableView =
-Count =

---

Get-NetTerminalSession

Description

[MS-TSTS] Query active terminal sessions on the local or a remote computer

Aliases

PV > qwinsta

Syntax

PV > Get-NetTerminalSession
-Computer       -ComputerName   -Count          -Hash           -OutFile        -Password
-Server         -SortBy         -TableView      -Username

Examples

PV > Get-NetTerminalSession -Computer DC01
PV > qwinsta -Computer DC01
PV > Get-NetTerminalSession -ComputerName DC01 -TableView
PV > Get-NetTerminalSession -Computer DC01 -Username admin -Password Secret123

Parameters

# With Argument
-Computer =
-ComputerName =
-Username =
-Password =
-Hash =
-SortBy =
-Server =
-OutFile =

# No Argument
-TableView =
-Count =

---

Remove-NetTerminalSession

Description

[MS-TSTS] Terminate a specific terminal session on a remote computer

Syntax

PV > Remove-NetTerminalSession
-Computer       -ComputerName   -Count          -Hash           -OutFile        -Password
-Server         -SessionId      -TableView      -Username

Examples

PV > Remove-NetTerminalSession -Computer DC01 -SessionId 2
PV > Remove-NetTerminalSession -ComputerName DC01 -SessionId 5 -Username admin -Password Secret123

Parameters

# With Argument
-Computer =
-ComputerName =
-SessionId =
-Username =
-Password =
-Hash =
-Server =
-OutFile =

# No Argument
-TableView =
-Count =

---

Get-NetProcess

Description

[MS-TSTS] Query running processes on a remote computer

Aliases

PV > tasklist

Syntax

PV > Get-NetProcess
-Computer       -ComputerName   -Count          -Hash           -Name           -OutFile
-Password       -Pid            -Server         -SortBy         -TableView      -Username

Examples

PV > Get-NetProcess -Computer DC01
PV > tasklist -Computer DC01
PV > Get-NetProcess -Computer DC01 -Name svchost
PV > Get-NetProcess -Computer DC01 -Pid 1234
PV > Get-NetProcess -Computer DC01 -TableView -SortBy name

Parameters

# With Argument
-Computer =
-ComputerName =
-Pid =
-Name =
-Username =
-Password =
-Hash =
-SortBy =
-Server =
-OutFile =

# No Argument
-TableView =
-Count =

Note: -Pid and -Name are mutually exclusive. Use one or the other to filter processes.

---

Stop-NetProcess

Description

[MS-TSTS] Terminate a specific process on a remote computer

Aliases

PV > taskkill

Syntax

PV > Stop-NetProcess
-Computer       -ComputerName   -Count          -Hash           -Name           -OutFile
-Password       -Pid            -Server         -TableView      -Username

Examples

PV > Stop-NetProcess -Computer DC01 -Pid 1234
PV > taskkill -Computer DC01 -Pid 1234
PV > Stop-NetProcess -Computer DC01 -Name calc.exe
PV > Stop-NetProcess -Computer DC01 -Pid 5678 -Username admin -Password Secret123

Parameters

# With Argument
-Computer =
-ComputerName =
-Pid =
-Name =
-Username =
-Password =
-Hash =
-Server =
-OutFile =

# No Argument
-TableView =
-Count =

Note: One of -Pid or -Name is required. They are mutually exclusive.

---

Stop-Computer

Description

[MS-TSTS] Shutdown a remote computer

Aliases

PV > Shutdown-Computer

Syntax

PV > Stop-Computer
-Computer       -ComputerName   -Hash           -OutFile        -Password       -Server
-TableView      -Username

Examples

PV > Stop-Computer -Computer WKS01
PV > Shutdown-Computer -Computer WKS01
PV > Stop-Computer -Computer WKS01 -Username admin -Password Secret123

Parameters

# With Argument
-Computer =
-ComputerName =
-Username =
-Password =
-Hash =
-Server =
-OutFile =

# No Argument
-TableView =

---

Restart-Computer

Description

[MS-TSTS] Restart a remote computer

Aliases

PV > Reboot-Computer

Syntax

PV > Restart-Computer
-Computer       -ComputerName   -Hash           -OutFile        -Password       -Server
-TableView      -Username

Examples

PV > Restart-Computer -Computer WKS01
PV > Reboot-Computer -Computer WKS01
PV > Restart-Computer -Computer WKS01 -Username admin -Password Secret123

Parameters

# With Argument
-Computer =
-ComputerName =
-Username =
-Password =
-Hash =
-Server =
-OutFile =

# No Argument
-TableView =

---

Logoff-Session

Description

[MS-TSTS] Logoff a specific terminal session on a remote computer

Syntax

PV > Logoff-Session
-Computer       -ComputerName   -Count          -Hash           -OutFile        -Password
-Server         -SessionId      -TableView      -Username

Examples

PV > Logoff-Session -Computer DC01 -SessionId 2
PV > Logoff-Session -ComputerName DC01 -SessionId 3 -Username admin -Password Secret123

Parameters

# With Argument
-Computer =
-ComputerName =
-SessionId =
-Username =
-Password =
-Hash =
-Server =
-OutFile =

# No Argument
-TableView =
-Count =

---

Get-EventLog

Description

[MS-EVEN6] Query Windows Event Logs from a remote computer via RPC

Syntax

PV > Get-EventLog
-Channel        -Computer       -ComputerName   -Count          -EventId        -Export
-Hash           -LogonType      -MaxEvents      -NewestFirst    -NoWrap         -OutFile
-Password       -Raw            -Server         -SortBy         -TableView      -TargetUser
-Username

Examples

PV > Get-EventLog -Computer DC01
PV > Get-EventLog -Computer DC01 -EventId 4625 -MaxEvents 50
PV > Get-EventLog -Computer DC01 -Channel Security -TargetUser Administrator
PV > Get-EventLog -Computer DC01 -EventId 4624,4625 -LogonType 3,10
PV > Get-EventLog -Computer DC01 -Export events.evtx
PV > Get-EventLog -Computer DC01 -Raw -OutFile raw_events.txt

Parameters

# With Argument
-Computer =
-ComputerName =
-Channel = (default: Security)
-EventId = (default: 4624, accepts multiple comma-separated values)
-LogonType = (list of integers)
-TargetUser =
-MaxEvents = (default: 100)
-Username =
-Password =
-Hash =
-SortBy =
-Server =
-Export =
-OutFile =

# No Argument
-NewestFirst = (default: true)
-Raw =
-TableView =
-NoWrap =
-Count =

---

Get-EventLogChannel

Description

[MS-EVEN6] List event log channels on a remote computer with security product detection

Syntax

PV > Get-EventLogChannel
-Computer       -ComputerName   -Count          -Hash           -NoWrap         -OutFile
-Password       -Server         -SortBy         -TableView      -Username

Examples

PV > Get-EventLogChannel -Computer DC01
PV > Get-EventLogChannel -ComputerName DC01 -TableView
PV > Get-EventLogChannel -Computer DC01 -OutFile channels.txt

Parameters

# With Argument
-Computer =
-ComputerName =
-Username =
-Password =
-Hash =
-SortBy =
-Server =
-OutFile =

# No Argument
-TableView =
-NoWrap =
-Count =

---

Get-EventLogPublisher

Description

[MS-EVEN6] List event log publishers on a remote computer with security product detection

Syntax

PV > Get-EventLogPublisher
-Computer       -ComputerName   -Count          -Hash           -NoWrap         -OutFile
-Password       -Server         -SortBy         -TableView      -Username

Examples

PV > Get-EventLogPublisher -Computer DC01
PV > Get-EventLogPublisher -ComputerName DC01 -TableView
PV > Get-EventLogPublisher -Computer DC01 -OutFile publishers.txt

Parameters

# With Argument
-Computer =
-ComputerName =
-Username =
-Password =
-Hash =
-SortBy =
-Server =
-OutFile =

# No Argument
-TableView =
-NoWrap =
-Count =

---

Get-NetService

Description

[MS-SCMR] Query running services on the local or a remote computer

Syntax

PV > Get-NetService
-Computer       -ComputerName   -Count          -IsRunning      -IsStopped      -Name
-OutFile        -SortBy         -TableView

Examples

PV > Get-NetService -Computer DC01
PV > Get-NetService -Computer DC01 -Name Spooler
PV > Get-NetService -Computer DC01 -IsRunning
PV > Get-NetService -Computer DC01 -IsStopped -TableView
PV > Get-NetService -Computer DC01 -SortBy name -OutFile services.txt

Parameters

# With Argument
-Computer =
-ComputerName =
-Name =
-SortBy =
-OutFile =

# No Argument
-IsRunning =
-IsStopped =
-TableView =
-Count =

Note: -IsRunning and -IsStopped are mutually exclusive.

---

Start-NetService

Description

[MS-SCMR] Start a specific service on a remote computer

Syntax

PV > Start-NetService
-Computer       -Name

Examples

PV > Start-NetService -Computer DC01 -Name Spooler

Parameters

# With Argument
-Computer = (required)
-Name = (required)

---

Stop-NetService

Description

[MS-SCMR] Stop a specific service on a remote computer

Syntax

PV > Stop-NetService
-Computer       -Name

Examples

PV > Stop-NetService -Computer DC01 -Name Spooler

Parameters

# With Argument
-Computer = (required)
-Name = (required)

---

Remove-NetService

Description

[MS-SCMR] Delete a specific service on a remote computer

Syntax

PV > Remove-NetService
-Computer       -Name

Examples

PV > Remove-NetService -Computer DC01 -Name EvilSvc

Parameters

# With Argument
-Computer = (required)
-Name = (required)

---

Add-NetService

Description

[MS-SCMR] Create a new service on a remote computer

Syntax

PV > Add-NetService
-Computer       -DelayedStart   -DisplayName    -ErrorControl   -Name           -Password
-Path           -ServiceStartName               -ServiceType    -StartType

Examples

PV > Add-NetService -Computer DC01 -Name TestSvc -DisplayName "Test Service" -Path "C:\Windows\System32\cmd.exe"
PV > Add-NetService -Computer DC01 -Name MySvc -DisplayName "My Service" -Path "C:\svc.exe" -StartType auto

Parameters

# With Argument
-Computer = (required)
-Name = (required)
-DisplayName = (required)
-Path = (required)
-Password =
-ServiceType =
-StartType =
-DelayedStart =
-ErrorControl =
-ServiceStartName =

---

Set-NetService

Description

[MS-SCMR] Modify an existing service on a remote computer

Syntax

PV > Set-NetService
-Computer       -DelayedStart   -DisplayName    -ErrorControl   -Name           -Password
-Path           -ServiceStartName               -ServiceType    -StartType

Examples

PV > Set-NetService -Computer DC01 -Name TestSvc -Path "C:\Windows\System32\calc.exe"
PV > Set-NetService -Computer DC01 -Name TestSvc -DisplayName "Updated Service" -StartType disabled

Parameters

# With Argument
-Computer = (required)
-Name = (required)
-DisplayName =
-Path =
-Password =
-ServiceType =
-StartType =
-DelayedStart =
-ErrorControl =
-ServiceStartName =

---

Remove-NetSession

Description

[MS-SRVS] Kill a specific network session on a remote computer

Syntax

PV > Remove-NetSession
-Computer       -Count          -Hash           -OutFile        -Password       -Server
-TargetSession  -Username

Examples

PV > Remove-NetSession -Computer DC01 -TargetSession "\\10.10.10.5"
PV > Remove-NetSession -Computer DC01 -TargetSession "\\10.10.10.5" -Username admin -Password Secret123

Parameters

# With Argument
-Computer = (required)
-TargetSession = (required)
-Username =
-Password =
-Hash =
-Server =
-OutFile =

# No Argument
-Count =