Find Remote Logon Computer IP with Event Viewer or PowerShell

At times, it is necessary to find the IP address of a computer that logs onto a Domain Controller or another server. This may be required, for instance, if a user is getting constantly locked out after changing their password, and they cannot recall which computer is being used to access a service or application on their behalf.

Many IT administrators are unaware of where to find this crucial piece of information. A Google search may not yield a specific result that is easy to locate, so I'm here to share some tips with you.

Open Event Viewer,
Go to Applications and Services Logs - Microsoft - Windows - TerminalServices-RemoteConnectionManager - Operational


 

 

 

 

If you click on it, you will easily see this IP information.

 

 

 

 

 

Using PowerShell, it is possible to find both the user who is currently logged in and the IP address of their computer:

===START===

#=Find Currently Logged On User + IP=#

$CurrentUsers = quser
$CurrentUsers = $CurrentUsers[1..$CurrentUsers.Length] | % {$_.trim().Split(" ")[0].Replace(">", "")}

$Events = Get-WinEvent -FilterHashtable @{
    Logname   = 'Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational'
    ID        = 1149
    StartTime = (Get-Date).AddDays(-31)    
}
$EventObjects = @()
$Events | % {
    $EventXML = [xml]$_.ToXml()
    $obj = New-Object -TypeName PSObject -Property @{
        Username  = $EventXML.Event.UserData.EventXML.Param1
        IP        = $EventXML.Event.UserData.EventXML.Param3
        Timestamp = [datetime]$EventXML.Event.System.TimeCreated.SystemTime
    }
    $EventObjects += $obj
}

$CurrentSessions = $CurrentUsers | ForEach-Object {
    $EventObjects | Sort-Object -Property Timestamp -Descending | Where-Object Username -eq $_ | Select-Object -First 1
}

$CurrentSessions | Select-Object Username, IP, Timestamp

====END====

 

VMWare Snapshot with PowerShell

 Get-VM VLAD2020 | New-Snapshot -Name "DEMO" -Description "Created $(Get-Date)" -Quiesce -Memory –RunAsync

It took me about a minute. For about a 40 seconds the VM was freezed, but this is the most comprehensive way of snapshotting that gives reliable results in restoring VMs.

Slow working computer

If your computer is running slow, here are some steps to follow:

1. Check for and clean temporary files.
2. Check your RAM and add more if necessary.
3. Check your CPU and add more if necessary.
4. Update VMware Tools.
5. Upgrade VM Compatibility.
6. Check for any pending Windows updates and install them.
7. Scan your computer for spyware and viruses.
8. Remove any unnecessary add-ins in your applications.
9. Check for any outdated programs.
10. Restart your computer (the most obvious and often effective step for Windows computers).
11. Check the size and number of files on your desktop, as many large files can slow down your computer.
12. Ensure that there is enough free space on your hard drive.
13. Check if your firmware is updated.

These steps will help you identify and fix some of the common reasons for slow computer performance.

Here are the explained steps to follow:

1. Check the temporary folder by entering %TEMP% in the search bar, Run dialog box, or Command Prompt.
2. Delete files in C:\Windows\temp
3. Delete files in C:\Windows\Logs\CBS If you're unable to delete the CBS.log file, stop the TrustedInstaller service, delete CBS.log, and then start the service again. Alternatively, you can end the task with the same name.
4. If these steps are not sufficient, you can use the free CleanUp program available at this link: http://stevengould.org/downloads/cleanup/CleanUp40.exe
5. Adding more RAM and CPU is much easier to do on a virtual machine. To diagnose the issue, open the Task Manager, go to the Performance tab, and run the problematic application or file to see what happens.
6. Updating VMware Tools and upgrading VM Compatibility are necessary for VMWare virtual machines only.
7. Check for pending Windows updates that may be waiting to install and restart your computer.
8. Spyware and viruses can often cause slow performance, so run a virus scan to check for any infections.
9. Outdated programs may not be fully compatible with newer computers and may need to be updated.
10. Cleaning temporary files and restarting the computer can often help.
11. Having too many files on the desktop can slow down the computer, so consider moving them to another location.
12. Low disk space can cause severe performance issues, so ensure that there is enough free space on your hard drive.
13. Updating firmware may also help improve performance, especially on new computers.

These are the most common causes of slow-running computers. For more advanced issues, advanced tools like those from the Sysinternals site (author Mark Russinovich) may be needed. Additionally, slow network or defective hardware can also cause slow performance, but we will not be discussing these external cases in this article.

Export printers with IP - PowerShell

Sometimes we need to know IP of all printers on a print server, but default Printers view doesn't have it.
Even if you try to add fields in the View - Add/Remove Columns... it is not there.

So we have no choice not to use our old friend PowerShell.

-=-=-=-=START-=-=-=-=-=-=-=-

$printserver = "Printserver-Name" 

Get-WMIObject -class Win32_Printer -computer $printserver  Select Name,DriverName,PortName  Export-CSV -path 'C:\All-Printers.csv'

-=-=-=-=END-=-=-=-=-=-=-=-

How to оpen PDF in Adobe Reader instead in IE

Sometimes PDF files are been opened in Internet Explorer while we want them open in Adobe Reader. 

1. Make Adobe Reader default.

2. Disable IE integration.

3. IE - General - "Open pop-ups in a new windows".

4. Add a site to local trusted sites.

I managed to work at Metropolinet, while I got this knowledge (thanks to Kseniya).

Export PST from Exchange2010 - PowerShell

 cls

<# PST Export from Exchange2010 with PowerShell #
Use on Exchange2010 or workstation with Exchange2010 tools installed #>

Set-ExecutionPolicy Bypass -force

$UserCredential = Get-Credential

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://Exchange2010.Domain.local/PowerShell/ -Authentication Kerberos -Credential $UserCredential

Import-PSSession $Session

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010

# Add-ADGroupMember Administrators -Members "Exchange Trusted Subsystem"

# New-RoleGroup -Name “Exchange Mailbox Import Export” -Roles “Mailbox Import Export” -Members "Domain\Administrators" -Display Name”Exchange Mailbox Import Export”

$Mailbox = ""

$PSTname = ""

$DirPath = ""

$JoinedPath = ""

$Mailbox = "User@milgam.co.il"

$PSTname = "$Mailbox.pst"

$DirPath = "\\X.X.X.X\$Mailbox\"

$FilePath = Join-Path $DirPath -ChildPath $PSTname

# New-Item -ItemType Directory -Path $DirPath # (= MD $PSTPath)

ii $DirPath

New-MailboxExportRequest -Mailbox $Mailbox -FilePath $FilePath

# Get-MailboxExportRequest -status Completed | Remove-MailboxExportRequest # for clearing purposes

<#

If you get error "New-MailboxExportRequest : Unable to open PST file" you can give the
COMPUTER that you run this script from write permissions on the share/folder $DirPath.
Also it may be lack of permissions for "Exchange Trusted Subsystem".
#>

Windows System Commands 1.7 (extended ver.)

 

Page 1

System Info

Whoami – returns the user’s login name

Hostname – returns the computer name

Msconfig – GUI for configuring boot, services, startup…

Msinfo32 – GUI for info, including remote computers

Systeminfo – CLI tool for info
Net config workstation – CLI for host/user/domain/OS info…

=Last restart/power on date=

net statistics workstation # For CMD

net stats work | find "Stat" # For CMD

net stats work | select-string "Stat" # PoSH

Get-CimInstance -ClassName win32_operatingsystem | select csname, lastbootuptime

systeminfo | Select-String "System Boot Time" # PoSH

systeminfo | find "Boot Time" # CMD

Sysdm.cpl – System properties (old way)

Win+Pause – System window (new way)

Echo %username% logged on %computername% at %date%
Echo %username% logged on %computername >> \\server\share\file
Remote commands

Mstsc /v:Server /admin (/console)

Psexec \\Server CMD - CLI remote connection
Change logon /Enable – execute after Psexec
Change logon /Query – execute after Psexec

Processes, Services, Sessions
=Services=
Sc queryex servicename – finds PID of an installed service
Sc config servicename start= disabled - change service startup type
Sc config servicename start= auto - change service startup type

=Processes=

Taskkill /pid PID /F – kills a process by PID
Taskkill /t /IM processname /F – kills a process with its children (/t)
Tasklist /svc /fo list | more – shows all processes on a computer

Tasklist | findstr processname  – finds PID of a started process

Taskkill /FI "memusage gt 102400" /F – kills RAM processes <100mb

=Sessions=

Query session /SERVER:server – queries sessions for PID
Quser /SERVER:server – queries sessions + info of a user’s logon time
Reset session PID /SERVER:server – kills session by PID
Rwinsta PID /SERVER:server – kills session by PID
Logoff PID /SERVER:server – kills session by PID
For /F "Tokens=*" %a in (Servers.txt) Do Logoff – kills the number
of sessions with a text file

NTFS Permissions
takeown /f D:\test /A /R /D Y – grants ownership to the Admins group (/A) recursively (/R) with Yes answer (/D Y). Can use UNC path.
iCacls D:\test /setowner "Administrators" /T /C – grants ownership
iCacls D:\test /grant Administrators:(OI)(CI)M /F /T /C – Modify prm
iCacls D:\test /remove "Administrators" /T /C – removes user recurs.
‘Previous commands’ | find /I “denied” >> C:\err.log – makes log file

Windows Update troubleshooting
Wuauclt /resetauthorization /detectnow /updatenow
Net stop wuauserv => del C:\Windows\SoftwareDistribution => start
Netsh winhttp reset proxy
WSReset.exe – clears & resets Windows Store cache on Win8.1/10

Network
=Basic commands=
Firewall local state - netsh advfirewall show allprofiles
Firewall remote state (PoSH) - Invoke-Command -ComputerName [ComputerName] -ScriptBlock {netsh advfirewall show allprofiles}
Allow WMI (PoSH)- netsh firewall set service RemoteAdmin enable
Tracert hostname – traces path by given IP
Pathping hostname – traces path by given IP + localhost + statistics

=Checking MAC address=
Getmac – shows MAC address of a local computer
Getmac /s server – MAC address of a remote computer
Ping Server (then) Arp -a – MAC address of a remote computer
=DNS commands=

Nslookup computer – DNS info about some host (external command)
> server 4.4.8.8 – changes DNS server to be used (internal command)
Nslookup –q=MX <host> <DNS server> – changes default record type
Dnscmd server /statistics > D:\filename – DNS info
Telnet install 
Telnet install Cmd - Pkgmgr /iu:"TelnetClient"
PowerShell - Install-WindowsFeature -name Telnet-Client
DISM /online /Enable-Feature /FeatureName:TelnetClient

Netstat commands

Netstat – shows open TCP ports in the form of server:port
Netstat -a – adds UDP ports
Netstat -o – shows PID (not in Win2000)
Netstat -b – displays involved EXE files
Netstat -ao – shows TCP/UDP ports and PIDs 
Netstat –n 5 – shows output every 5 seconds
Netstat –a | find "135" – shows process that listens on port 135 
Netstat –a | find "established" – shows established process
(possible parameters: listening/established/time_wait/close_wait) 
Netstat –ao | find “192.168” – shows processes with PID

Netsh commands
Netsh winsock reset – resets IP stack
Netsh int ip reset anyfile.txt – resets IP stack
Netsh advf set allp state off – disable FW with CMD
Netsh interface tcp show global – general TCP info
Netsh –r interface ip show interfaces – local info about net interfaces
Netsh –r server interface ip show interfaces – remote interfaces info

=Solving network speed problems=

Netsh interface tcp show global
(Look for "Receive Window Auto-Tuning Level". You should see normal.)
Netsh interface tcp set global autotuning=disabled
Netsh interface tcp set global autotuning=normal
Netsh interface tcp set global rss=disabled
Netsh interface tcp set global rss=enabled

Active Directory
Repadmin /showrepl – shows AD replication
Repadmin /syncall Server.dom.com – activates AD replication
Ldp.exe – GUI view on Active Directory
Set logonserver – DC authenticated the *User*
Echo %logonserver% – DC authenticated the *User*

Nltest /query /SERVER:server – queries netlogon service status
Nltest /SERVER:server /finduser:username – user Domain & DC Nltest /DCLIST:Domain – list of DCs in Domain

Nltest /DSGETDC:Domain –  DC authenticated the *Computer*

Exchange Server (Powershell)
=Show all organizational databases=

Get-MailboxDatabase –STATUS
Get-MailboxDatabase –STATUS | format-table name,mounted,backupinprogress,onlinemaintenanceprogress

Get-MailboxDatabase – STATUS | select servername,name,databasesize
Get-MailboxDatabase – STATUS | select servername,name,databasesize | Sort-Object Name -Descending
Get-MailboxDatabase – STATUS | select servername,name,databasesize | Sort-Object DatabaseSize –Descending

=Show databases on the particular Exchange Server=

Get-MailboxDatabase –SERVER servername
Get-MailboxDatabase –SERVER servername –Status | format-table name,mounted,backupinprogress
Get-MailboxDatabaseCopyStatus –SERVER  servername

=Check status of the particular database=
Get-MailboxDatabase dbname

=Check the date of Exchange Last Full Backup=

Get-MailboxServer | Get-MailboxDatabaseCopyStatus | ft name,latestfull*
Get-MailboxDatabase –SERVER server  -status | fl name, *fullbackup

=Product key=
Entering a product key (GUI) - Slui
Entering a product key (CMD) - slmgr -ipk XXXXX-XXXXX
Check activating status - slmgr /xpr
Check license status - slmgr /dli

=How to add Windows Backup feature=
Import-Module ServerManager ; Add-WindowsFeature Backup

Additional commands

=Enable Remoting=
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
=Enable LUA UAC from CMD (reboot)=

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f

=Add computer to domain (PoSH)=
Add-Computer -DomainName DOM.Local -Credential DOM\Admin -restart -force

=Check CMD status =
sc.exe query lanmanworkstation (should only show MRxSmb20)

=Enable SMBv1 with CMD=

dism /online /enable-feature /featurename:SMB1Protocol-Server

=ENABLE SMB1 with PoSH=

Enable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol-Client" -All

=Disable SMBv1 CMD=

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc.exe config mrxsmb10 start= disabled

=Uninstall app with CMD=
wmic product get description | findstr /C:"Unlocker"
wmic product where "description='Unlocker' " uninstall

or enter to wmic
wmic
product get name
product where name="Unlocker" call uninstall (needs exact name)

=Syncing computer time with DC=

w32tm /config /syncfromflags:domhier /update
Then run:
net stop w32time
net start w32time

=Delete files by date=

forfiles –p C:\Share\ -s –m *.* -d -1 –c “CMD /C del /Q /F /s @path” –