Parsing Sophos Web Filtering logs

By YellowOnline on Monday 25 July 2016 22:36 - Comments are closed
Category: Powershell, Views: 1.817

Yes, Sophos appliances are unix based and unix admins just love grep. At least, that seems to be Sophos' idea when looking at the logs a UTM produces.

The Powershell equivalent would be Find-String, but what if I want a readable overview instead of looking for a specific string? I need exactly that tonight, because I had to find something but didn't know what I was looking for. Hence this quick and dirty script to turn a Sophos Web Filtering Log into an object and subsequently into a CSV.


Read more »

Export Distribution Group Members... also with Exchange 2003

By YellowOnline on Thursday 7 April 2016 09:46 - Comments (12)
Category: Powershell, Views: 2.004

You need a file with all the users in a specific distribution group? Nowadays Exchange has cmdlets to do this. In Exchange 2003, however, things were rather complicated. Because my environment is still 2003, I made this function to do exactly that.

This snippet also allows for members from different subdomains.


Read more »

Converting AD UserAccountControl to its properties with Powershell

By YellowOnline on Wednesday 25 November 2015 12:03 - Comments are closed
Category: Powershell, Views: 2.582

The human way to translate these is usually to look at the largest decimal value the given value fits in and repeat that process for the remainder (say, 11 would be 8 HOMEDIR_REQUIRED + 2 ACCOUNTDISABLE + 1 SCRIPT). After trying for one hour to put that into code, and miserably failing, I went for another approach that no human would use but is actually very easy for a computer.


Read more »

Powershell: Check MAC Address in range

By YellowOnline on Friday 18 September 2015 14:23 - Comments (6)
Category: Powershell, Views: 2.784

This tiny script will check if a MAC address falls within a valid range. I hope you'll never need it, but I did (thank you VMware for restricting MAC Address ranges across ESX versions...).

It's a monster (isn't line 12 lovely?), I know. Suggestions to do this more elegantly - regex comes to mind - are welcome of course.

PowerShell:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
Function Validate-MACRange ($MACaddressToValidate)
    {
    $ValidRangeFrom = '00:50:56:00:00:00'
    $ValidRangeTo   = '00:50:56:3F:FF:FF'
    $a = $MACaddressToValidate.Replace("-",":").Split(":")
    $b = $ValidRangeFrom.Replace("-",":").Split(":")
    $c = $ValidRangeTo.Replace("-",":").Split(":")
    $i = 0
    $Valid = $True
    Do
        {
        If ($([int]"0x$($a[$i])" -GE [int]"0x$($b[$i])") -And ([int]"0x$($a[$i])" -LE [int]"0x$($c[$i])") -EQ $False){$Valid = $False}
        $i++
        }
    Until ($i -EQ 6)
    Return $Valid;
    }


Het monstertje leeft...

Edit
Here's another approach that is faster (thanks dugo & even more erwin80):

PowerShell:
1
2
3
4
5
6
7
8
9
10
Function Validate-MACRange2 ($MACaddressToValidate) 
    {
    $ValidRangeFrom = '00:50:56:00:00:00'
    $ValidRangeTo   = '00:50:56:3F:FF:FF'
    $a = [long] ("0x"+$MACaddressToValidate.Replace(":","").Replace("-",""))
    $b = [long] ("0x"+$ValidRangeFrom.Replace(":","").Replace("-",""))
    $c = [long] ("0x"+$ValidRangeTo.Replace(":","").Replace("-",""))
    $Valid = $a -GE $b -AND $a -LE $c
    Return $Valid;
    }



The first method took 4456 ticks, the second 2807. Quite a difference.

Powershell: Copying new and modified files only

By YellowOnline on Thursday 10 September 2015 14:45 - Comments (6)
Category: Powershell, Views: 3.227

Here's a quick function for people like me who work in environments without ROBOCOPY (yes, it's possible). Obviously this doesn't really compare to Robust File Copy, but it allows you to at least copy new and modified files only without dependencies.


PowerShell:
1
2
3
4
5
6
7
Function NotExactlyRobocopy ($SourceFolder, $TargetFolder)
    {
    $SourceFiles = @(Get-ChildItem -Path $SourceFolder)
    $TargetFiles = @(Get-ChildItem -Path $TargetFolder)
    $Update = Compare-Object $SourceFiles $TargetFiles -Property FullName, LastWriteTime, Length | Where-Object {$_.SideIndicator -EQ "<=" }
    $Update | ForEach-Object { Copy-Item -Path $_.Fullname -Destination $TargetFolder} 
    }



Disclaimer: Only tested with the -WhatIf switch that I removed from the code. Use at own risk.

It isn't recursive yet and doesn't take care of system files or hidden files, simply because I didn't need those when writing this. I'll make it better version tommorrow, but at least it gives you an idea of how to do it (adding parameters to Copy-Item isn't exactly hard).