LOGIN Developer Blog

 
# Read all LOGINventory CmdLets from Registry and add them to the current session
cd HKLM:\SOFTWARE\Microsoft\PowerShell\1\PowerShellSnapIns
Get-ChildItem | where {$_.Name -like "*Login.Ventory.*"} | select Name | foreach {add-pssnapin $_.Name.SubString($_.Name.LastIndexOf('\')+1)}
 
# Create LOGINventory Drive change location
$d = new-psdrive -scope global -name LI -PSProvider LOGINventory -root ""
 
cd LI:\Assets
 
# perhaps you have to set the correct culture information for the Convert.ToDateTime-function of .NET
$CULTURE = New-Object System.Globalization.CultureInfo("de-DE")
function isBefore([int]$days, [string]$date)
{
   $scandate = [Convert]::ToDateTime($date, $CULTURE)
   [DateTime]::Compare([DateTime]::Now.AddDays($days).Date, $scandate.Date) -eq 1
}
 
get-LiResults | Where {isBefore -30 $_.scandatetime}

# Read Query-File-List
param([string]$file)
$queries = Get-Content $file
 
# Read all LOGINventory CmdLets from Registry and add them to the current session
cd HKLM:\SOFTWARE\Microsoft\PowerShell\1\PowerShellSnapIns
Get-ChildItem | where {$_.Name -like "*Login.Ventory.*"} | select Name | foreach {add-pssnapin $_.Name.SubString($_.Name.LastIndexOf('\')+1)}
 
# Create LOGINventory Drive change location
$d = new-psdrive -scope global -name LI -PSProvider LOGINventory -root ""
 
# Execute CSV-Export for each query
$queries | foreach {
	$path = $_.Split("|")[0];
	$target = $_.Split("|")[1];
 
	cd LI:\$path;
	Get-LiResults | Export-Csv $target;
}

Analyse\Samples\Stopped_Autorun_Services|C:\stoppedservices.csv
Analyse\Samples\Remote_Desktop_Users|C:\remoteusers.csv