22 Using someone else’s scripts
This chapter recognizes that most PowerShell users will borrow scripts from the internet and focuses on the practical skill of making someone else’s code your own. It uses intentionally imperfect, real‑world examples that may include techniques not yet covered, emphasizing a disciplined, line‑by‑line approach: identify and track variables, read help for unfamiliar commands, test small snippets safely (ideally in a VM), and avoid skipping any line you don’t understand. The goal is to quickly orient yourself in unfamiliar code, assess what it does, and decide where and how to tailor it for your environment.
The first example, Get-ADExistence, demonstrates a function that takes one or more computer names (including pipeline input) and checks Active Directory for corresponding computer accounts. Using the Begin/Process/End pattern, it loops through each name and wraps Get-ADComputer in a Try/Catch to distinguish “found” from “not found.” It compiles results into a hashtable, converts that into a custom object, and writes it to the pipeline, reporting the target name, whether the account is enabled, and whether it exists in AD. The walkthrough highlights how to read a parameter block, recognize pipeline behavior, and interpret Try/Catch/Finally flow, while prompting you to consider simple extensions such as writing results to text or CSV.
The lab script, Get-LastOn, investigates recent logon/logoff activity by querying the Security event log (commonly requiring Administrator rights). It parameterizes scope (computer name, maximum events, event IDs), filters for relevant records (for example, 4624 and 4647), and parses the message text to extract the account name and domain, building uniform objects with time, computer, ID, and domain for downstream sorting and deduplication. A noted issue (a blank computer column) and the invitation to predict potential errors reinforce the chapter’s method: read every line, use PowerShell help and examples, test thoughtfully, and adjust the script to suit your systems and requirements.
Lab answer
The script file seems to define two functions that won’t do anything until called. At the end of the script is a command, Get-LastOn, which is the same name as one of the functions, so we can assume that’s what is executed. Looking at that function, you can see that it has numerous parameter defaults, which explains why nothing else needs to be called. The comment-based help also explains what the function does. The first part of this function is using Get-WinEvent:
If this were a new cmdlet, we’d look at help and examples. The expression seems to be returning a user defined maximum of events. After looking at the help for Get-WinEvent we see that the parameter -MaxEvents will return the maximum number of events sorted from newest to oldest. Therefore or variable of $MaxEvents comes from a parameter and has a default value of 5000. These event logs are then filtered by Where-Object, looking for two event log values (event ID of 4627 and 4647), also from the parameter.
Next it looks like something is done with each event log in the foreach loop. Here’s a potential pitfall:
In the foreach loop, it looks like other variables are getting set. The first one is taking the event object and piping it to something called parseEventmessage. This doesn’t look like a cmdlet name, but we did see it as one of the functions. Jumping to it, we can see that it takes a message as a parameter and splits each one into an array. We might need to research the –Split operator.
Each line in the array is processed by another foreach loop. It looks like lines are split again, and there is a try/catch block to handle errors. Again, we might need to read up on that to see how it works. Finally, there is an if statement, where it appears that if the split-up strings are not empty, then a variable called $props is created as a hash table or associative array. This function would be much easier to decipher if the author had included some comments. Anyway, the parsing function ends by calling New-Object, another cmdlet to read up on.
This function’s output is then passed to the calling function. It looks like the same process is repeated to get $domain.
Oh, look, another hash table and New-Object, but by now we should understand what the function is doing. This is the final output from the function and hence the script.
Learn PowerShell in a Month of Lunches, Fourth Edition ebook for free
