24 lines
1.8 KiB
PowerShell
24 lines
1.8 KiB
PowerShell
$ErrorActionPreference = 'Continue'
|
|
Write-Output '=== MsiInstaller events today (install/uninstall history) ==='
|
|
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='MsiInstaller'; StartTime=(Get-Date).Date} -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.Message -match 'Syncro' } |
|
|
Sort-Object TimeCreated |
|
|
ForEach-Object { Write-Output ($_.TimeCreated.ToString('HH:mm:ss') + ' id=' + $_.Id + ' :: ' + (($_.Message -replace '\s+',' ').Substring(0,[math]::Min(160,$_.Message.Length)))) }
|
|
|
|
Write-Output '=== Syncro bootstrapper / agent logs ==='
|
|
$logDirs = @('C:\Windows\Temp','C:\ProgramData\Syncro','C:\ProgramData\Syncro\logs')
|
|
foreach ($d in $logDirs) {
|
|
Get-ChildItem $d -Filter '*ncro*' -ErrorAction SilentlyContinue | ForEach-Object { Write-Output ('FOUND: ' + $_.FullName + ' (' + $_.Length + 'b, ' + $_.LastWriteTime.ToString('HH:mm:ss') + ')') }
|
|
}
|
|
$bl = Get-ChildItem 'C:\Windows\Temp' -Filter 'Syncro*.log' -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1
|
|
if (-not $bl) { $bl = Get-ChildItem 'C:\ProgramData\Syncro' -Filter '*.log' -Recurse -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1 }
|
|
if ($bl) { Write-Output ('--- tail of ' + $bl.FullName + ' ---'); Get-Content $bl.FullName -Tail 40 }
|
|
|
|
Write-Output '=== Defender detections (last 24h) ==='
|
|
Get-MpThreatDetection -ErrorAction SilentlyContinue | Where-Object { $_.InitialDetectionTime -gt (Get-Date).AddDays(-1) } |
|
|
ForEach-Object { Write-Output ($_.InitialDetectionTime.ToString('HH:mm:ss') + ' ' + $_.ThreatID + ' res=' + ($_.Resources -join ';')) }
|
|
|
|
Write-Output '=== 3rd-party AV registered ==='
|
|
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue |
|
|
ForEach-Object { Write-Output ($_.displayName + ' state=' + $_.productState) }
|