Usefull_scripts/RoserUsefull/EmergencyAccessRemote.ps1

$s = New-PSSession -ComputerName RPVDA03 -Credential pgeeraert

Invoke-Command -Session $s -ScriptBlock { Get-Culture }

Invoke-Command -Session $s -ScriptBlock { hostname }

#check services 
Invoke-Command -Session $s -ScriptBlock { get-service}

#check rdp services 
Invoke-Command -Session $s -ScriptBlock { get-service TermService }
#check rdp services 's dependants
Invoke-Command -Session $s -ScriptBlock { get-service TermService -DependentServices }
#restrat them
Invoke-Command -Session $s -ScriptBlock { Restart-service UmRdpService }
Invoke-Command -Session $s -ScriptBlock { Restart-service ServicesManager  }
Invoke-Command -Session $s -ScriptBlock { Restart-service TermService -force }

Invoke-Command -Session $s -ScriptBlock { start-service UmRdpService }
Invoke-Command -Session $s -ScriptBlock { start-service TermService  }
Invoke-Command -Session $s -ScriptBlock { start-service ServicesManager  }

#check LicenseManager services and dependants
Invoke-Command -Session $s -ScriptBlock { get-service LicenseManager  }

#restart LicenseManager
Invoke-Command -Session $s -ScriptBlock { Restart-service LicenseManager }

#get firewall profiles
Invoke-Command -Session $s -ScriptBlock { Get-NetFirewallProfile }

#disable firewall
Invoke-Command -Session $s -ScriptBlock {netsh advfirewall set allprofiles state off }
#checlk firewall
Invoke-Command -Session $s -ScriptBlock {netsh advfirewall show all}


#checlk firewall rules
Invoke-Command -Session $s -ScriptBlock {Get-NetFirewallServiceFilter -Service termservice | Get-NetFirewallRule}




#Open port 
Invoke-Command -Session $s -ScriptBlock {netsh advfirewall firewall add rule name="TCP Port 3389" dir=in action=allow protocol=TCP localport=3389}
Invoke-Command -Session $s -ScriptBlock {New-NetFirewallRule -DisplayName 'open rdp' -Profile 'Domain, Private, Public' -Direction Inbound -Action Allow -Protocol TCP -LocalPort 3389}


#check port 
Invoke-Command -Session $s -ScriptBlock {get-NetFirewallRule -LocalOnlyMapping}

#check port 
Invoke-Command -Session $s -ScriptBlock {netstat -ano | findStr "80"}

#check port 
Invoke-Command -Session $s -ScriptBlock {netstat -ano | findStr "3389"}

#check port 
Invoke-Command -Session $s -ScriptBlock {Get-NetTCPConnection -LocalPort 3389}

#check port 
Invoke-Command -Session $s -ScriptBlock {Get-NetFirewallPortFilter | Where-Object -Property LocalPort -EQ 3389}

#check blocked port 
Invoke-Command -Session $s -ScriptBlock {get-NetFirewallRule -Action Block}

#check NotConfigured port 
Invoke-Command -Session $s -ScriptBlock {get-NetFirewallRule -Action NotConfigured}

#Invoke-Command -Session $s -ScriptBlock {new-item \\roser.rosercloud.app\d$\temp\Pierre_emergency_rpvda03\firewallrules.txt }

#check connectivity remotely
Invoke-Command -Session $s -ScriptBlock {tnc rpvda03 -port 3389}

#check connectivity remotely
Invoke-Command -Session $s -ScriptBlock {telnet 127.0.0.1 3389}

#get GPO
Invoke-Command -Session $s -ScriptBlock {Get-GPO -All}

#get date
Invoke-Command -Session $s -ScriptBlock {date}

#Get recent entries from an event log on the local computer
Invoke-Command -Session $s -ScriptBlock {Get-EventLog -LogName System -Newest 50}

#Get recent entries from an event log on the local computer
Invoke-Command -Session $s -ScriptBlock {Get-EventLog -LogName Application -Newest 50}

#Get all events that include a specific word in the message
Invoke-Command -Session $s -ScriptBlock {Get-EventLog -LogName Application -Message *TermService*}


Invoke-Command -Session $s -ScriptBlock {Get-WinEvent -FilterHashTable @{LogName='Microsoft-Windows-TerminalServices-RDPClient/Operational'} | Select-Object $properties}

# determine the current RDP por
Invoke-Command -Session $s -ScriptBlock {Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber"}

# change the current RDP por
Invoke-Command -Session $s -ScriptBlock {
$portvalue=3389
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value $portvalue
}


#change the default port value 
Invoke-Command -Session $s -ScriptBlock {
$portvalue = 3389

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value $portvalue 

New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile 'Public' -Direction Inbound -Action Allow -Protocol TCP -LocalPort $portvalue 
New-NetFirewallRule -DisplayName 'RDPPORTLatest-UDP-In' -Profile 'Public' -Direction Inbound -Action Allow -Protocol UDP -LocalPort $portvalue
Restart-service UmRdpService 
Restart-service TermService -force 
tnc rpvda03 -port $portvalue
}

# ping 8.8.8.8
Invoke-Command -Session $s -ScriptBlock {ping 8.8.8.8}

Invoke-Command -Session $s -ScriptBlock {
$properties = @( @{n='TimeStamp';e={$_.TimeCreated}} @{n='LocalUser';e={$_.UserID}} @{n='Target RDP host';e={$_.Properties[1].Value}} ) Get-WinEvent -FilterHashTable @{LogName='Microsoft-Windows-TerminalServices-RDPClient/Operational';ID='1102'} | Select-Object $properties
}


Invoke-Command -Session $s -ScriptBlock {Get-WmiObject -Class Win32_Service -Filter "Name LIKE 'TermService'" }
Invoke-Command -Session $s -ScriptBlock {


$id = Get-WmiObject -Class Win32_Service -Filter "Name LIKE 'TermService'" | 
      Select-Object -ExpandProperty ProcessId
Get-WmiObject -Class Win32_Service -Filter "Name LIKE 'TermService'"
$process = Get-Process -Id $id
$process
#kill $process
}