PowerShell script Archives

Winsage

July 21, 2025

Managing Windows Firewall Rules with PowerShell, Part 3: Creating a Baseline

The text discusses managing Windows firewall rules using PowerShell, particularly focusing on exporting firewall rules to a CSV file and comparing current configurations against a baseline. A PowerShell script is provided that retrieves all existing firewall rules, compiles their details into custom objects, and exports them to a CSV file. Another script is designed to compare a baseline CSV file of firewall rules with a current CSV file, checking for changes in various fields and identifying deleted rules. The script outputs any modifications found and notes if a rule has been deleted. It also mentions potential enhancements for handling new rules and duplicate rule names.

Winsage

July 13, 2025

These PowerShell scripts make it easy to migrate Windows installs

A PowerShell script developed by GitHub user Anduin2017 allows users to create a new Windows 11 installation on an empty physical drive while retaining access to files and applications from the existing installation. The process requires running the script in an elevated PowerShell window, providing inputs such as the location of the empty drive and the edition of Windows to install from an ISO file. Users can continue using their PC during the installation, and upon completion, they can choose between the existing and new installations upon reboot. To set up necessary applications, users can customize PowerShell modules using a sample install.ps1 file from the GitHub project. This method is particularly beneficial for users relying on cloud storage solutions like OneDrive, as it allows for a refreshed operating system with minimal downtime and easy access to data. The streamlined approach is designed for users who frequently encounter Windows issues and need clean installations, enabling rapid replication of a base system with essential programs.

Winsage

June 25, 2025

Building a Windows Storage Dashboard, Part 2: Collecting Historical Data

The process of gathering historical data for a Windows storage dashboard involves two steps: creating a PowerShell script to collect and save the data, and configuring the Windows Task Scheduler to run this script at set intervals. The script collects data on file system drives using the Get-PSDrive cmdlet, creating a custom PowerShell object with columns for Timestamp, Drive, UsedGB, FreeGB, and TotalGB, which is then exported to a CSV file. The script specifies the CSV file path, appends new data without overwriting existing data, and excludes type information from the header. The generated CSV file includes a header row and records for each drive with their respective usage statistics.

Winsage

June 9, 2025

If you deleted that mysterious Windows file Microsoft told you not to, there’s a new script to restore it

The 'inetpub' folder, which appears on system drives (C:) after the April 2025 security update for Windows 10 and 11, is essential for protecting users against the security vulnerability CVE-2025-21204. This vulnerability involves improper link resolution before file access and can allow an authorized attacker to escalate privileges. Although the folder may seem empty and Internet Information Services (IIS) might not be in use, its deletion can compromise the effectiveness of the security patch, exposing systems to vulnerabilities. Microsoft recommends using a PowerShell script to restore the folder if deleted, rather than recreating it through IIS, which may add unwanted system folders.

Winsage

June 9, 2025

Microsoft: Remedy for security vulnerability due to deleted “inetpub” folder

A recent Microsoft security update has created a new folder named "inetpub" on Windows systems, which is essential for system security. If users delete this folder, it can lead to significant vulnerabilities. Microsoft has released a Powershell script, Set-InetpubFolderAcl.ps1, to restore the "inetpub" folder and set the correct permissions. Systems that installed the April security update (KB5055528) must take immediate action if the "inetpub" directory is missing. The script also updates access rights for the "DeviceHealthAttestation" directory, if it exists. Administrative rights are required to run the script. This issue was highlighted by IT security researcher Kevin Beaumont, who noted that deleting the "inetpub" folder could disrupt the installation of future security updates.

Winsage

June 6, 2025

Microsoft shares script to restore inetpub folder you shouldn’t delete

Microsoft has released a PowerShell script to help restore the C:Inetpub folder, which is crucial for addressing a high-severity privilege escalation vulnerability associated with Windows Process Activation. The folder's unexpected appearance after the April 2025 Windows security updates led some users to delete it, inadvertently exposing their systems to vulnerabilities. Microsoft emphasizes that the folder should not be deleted, as it is integral to the security framework, regardless of whether Internet Information Services (IIS) is active. The script allows administrators to recreate the folder with the correct permissions and access control settings.

Winsage

June 6, 2025

Microsoft Issues Critical Windows Update—Do Not Delete This

Users may face a significant vulnerability related to a Windows update from April 2025, particularly concerning the "inetpub" folder, which is essential for the security of Windows 11 systems. Microsoft clarified that this folder, linked to Internet Information Services (IIS) and necessary for hosting capabilities, should not be deleted. If users have removed the folder, they must restore it to address the security patch for CVE-2025-21204, as its absence can lead to risks such as privilege escalation and unauthorized access. Microsoft has provided a PowerShell script to restore the folder without enabling IIS, and users are advised to follow specific commands to execute the fix. However, many users may not take action, leaving their systems vulnerable.

Winsage

June 6, 2025

Your Windows PC might be at risk if you deleted the “inetpub” folder, but there’s a fix

Windows users have encountered a new "inetpub" folder on their primary drive after the April 2025 Patch Tuesday update. This folder is empty and occupies no storage space, but many users have deleted it out of concern. Microsoft has stated that the folder is part of a security patch for vulnerability CVE-2025-21204 and should not be removed, as it is linked to Internet Information Services (IIS). Users can restore the folder using a PowerShell script if they have deleted it. The folder addresses a security flaw related to improper link resolution that could allow local attackers to manipulate files. Instructions for restoring the folder include running PowerShell as Administrator, allowing signed scripts, downloading a specific script, and applying the fix.

Tech Optimizer

June 5, 2025

Fake DocuSign and Gitcode sites are tricking victims into downloading malware – here’s what you need to know

Researchers at DomainTools Investigations (DTI) have identified counterfeit websites mimicking platforms like DocuSign and Gitcode, designed to lure users into downloading malware, specifically a remote access trojan (RAT). These fraudulent sites use tactics such as fake CAPTCHA prompts to enhance credibility and prompt users to download malicious software disguised as necessary updates. The operation employs a multi-stage downloader PowerShell script, reminiscent of older scams that alarmed users with popups about virus infections. Users are advised to be cautious with unfamiliar websites and verify the authenticity of download prompts.

Winsage

May 21, 2025

New Windows Server 2025 Attack Compromises Any Active Directory User

A significant security flaw, named BadSuccessor, has been discovered in Windows Server 2025, posing a serious risk to Active Directory users. This privilege escalation vulnerability allows attackers to compromise any user in Active Directory and is alarmingly easy to exploit, requiring only basic permissions on any organizational unit. Currently, no patch is available for this vulnerability. In 91% of environments examined, users outside the domain admins group had the necessary permissions to execute the attack. The exploit leverages the delegated Managed Service Account (dMSA) feature, enabling attackers to take control of any principal within the domain. Microsoft has rated the vulnerability as moderate severity and plans to address it in a future update, noting that elevated user permissions are required for successful exploitation. Organizations are advised to identify and eliminate unnecessary permissions to mitigate potential threats.