Системный Администратор Windows

AuditPol /set /subcategory:"Logon" /success:enable /failure:enable
AuditPol /set /subcategory:"Logoff" /success:enable
AuditPol /set /subcategory:"Special Logon" /success:enable
AuditPol /set /subcategory:"Logon with explicit credentials" /success:enable /failure:enable

AuditPol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable

$serviceName = "Имя_сервиса"
$svc = Get-Service -Name $serviceName

if ($svc.Status -eq "Running") {
    $process = Get-WmiObject Win32_Service | Where-Object { $_.Name -eq $serviceName }
    if ($process.ProcessId -ne 0) {
        Write-Host "Сервис запущен с PID $($process.ProcessId). Перезапускаем..."
        Restart-Service -Name $serviceName -Force
    } else {
        Write-Host "PID не найден. Возможна проблема – проверь вручную!"
    }
} else {
    Write-Host "Сервис не запущен. Статус: $($svc.Status)"
}

Get-WinEvent -FilterHashtable @{
    LogName = 'Security';
    Id = 4624;
    StartTime = (Get-Date).AddDays(-1)
} | ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        AccountName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq "TargetUserName"} | Select-Object -ExpandProperty '#text'
        IPAddress   = $xml.Event.EventData.Data | Where-Object {$_.Name -eq "IpAddress"} | Select-Object -ExpandProperty '#text'
        LogonType   = $xml.Event.EventData.Data | Where-Object {$_.Name -eq "LogonType"} | Select-Object -ExpandProperty '#text'
    }
} | Where-Object { $_.AccountName -ne "ANONYMOUS LOGON" -and $_.LogonType -eq "10" } | Sort-Object TimeCreated

Get-NetTCPConnection -State Established | Where-Object { $_.RemoteAddress -ne '127.0.0.1' } | 
Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess | 
Sort-Object -Property RemoteAddress

Get-NetTCPConnection -State Established | 
Where-Object { $_.RemoteAddress -ne '127.0.0.1' } |
ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        RemoteAddress = $_.RemoteAddress
        RemotePort    = $_.RemotePort
        LocalPort     = $_.LocalPort
        ProcessName   = $proc.ProcessName
        PID           = $_.OwningProcess
    }
} | Sort-Object RemoteAddress

Get-Process | Sort-Object -Property Handles -Descending | Select-Object -First 10

Get-NetTCPConnection | Group-Object -Property OwningProcess | Sort-Object Count -Descending | Select-Object -First 10

Get-Process | Sort-Object -Property Handles -Descending | Select-Object -First 10

gpupdate /force

Invoke-GPUpdate -Computer "ИмяКомпьютера" -RandomDelayInMinutes 0

Get-ADComputer -Filter * -SearchBase "OU=Computers,DC=domain,DC=local" | ForEach-Object {
    Invoke-GPUpdate -Computer $_.Name -RandomDelayInMinutes 0 -AsJob
}