PowerShell刪除7day log

$Today = Get-Date

$Days = “-7”

$TargetFolder = “D:\Temp”

$LastWrite = $Today.AddDays($Days)

Get-ChildItem $TargetFolder -Recurse | Where {!$_.PSIsContainer}| where {$_.LastWriteTime -le "$LastWrite"} | Remove-Item

PowerShell 字串處理範例 (Replace & Split)

------ntstat -no後，去掉前面四行，將空白變成,，再依,或:切割欄位，再取出第  4 欄 (dip)
netstat -no|select -skip 4|%{$_ -replace ' {2,}',','}|%{$a=$_ -split {$_ -eq "," -or $_ -eq ":"};$a[4]}|Group-Object |Format-Table name,count
netstat -no|select -skip 4|%{$_ -replace ' {2,}',','}|%{$a=$_ -split {$_ -eq "," -or $_ -eq ":"};$a[4]}|Group|FT name,count
netstat -no|select -skip 4|%{$_ -replace ' {2,}',','}|%{$a=$_ -split {$_ -eq "," -or $_ -eq ":"};$a[4]}|Group|select name,count

powershell 查詢登入的user

查詢登入的user

Get-WinEvent -FilterHashtable @{LogName="Security"; ID=4624} -computer 127.0.0.1 -MaxEvents 15 | Select-Object -Property @{n="SubjectUserName";expression={$_.properties[5].value}}

確認powershell有沒有開啟權限

:確認powershell有沒有開啟
@echo off
@for /f %%a IN ('powershell -command "get-executionpolicy"') do set CheckPS=%%a
echo %CheckPS%
@IF %CheckPS% == RemoteSigned (
        echo "PowerSell is remotesigned"
) ELSE (
        echo "PowerSell not's remotesigned"
        powershell -command "set-executionpolicy remotesigned"
)

:執行PowerShell Script

powershell -command "& .\AlertMail.ps1 -Param1 %List%"