update

Cleanup-SystemPath.ps1

@@ -1,6 +1,12 @@
-## Get contents of SYSTEM PATH environment variable
+## Source the tools script if it isn't already available
+If ( !($MSPName) ) { . $([Scriptblock]::Create((New-Object Net.WebClient).DownloadString('https://dev.emberkom.com/emberkom/management-scripts/raw/branch/master/Tools.ps1'))) }
+
+## Set the name of the log file
+$LogName = 'Cleanup-SystemPath'
+
+## Get contents of SYSTEM PATH environment variable
 $REG_ENVVAR = 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment'
-$CURRENT_PATH = (Get-Itemproperty -Path $REG_ENVVAR -Name Path).Path
+$CURRENT_PATH = (Get-ItemProperty -Path $REG_ENVVAR -Name Path).Path
 $NEW_PATH = $null
 $REMOVE_PATH =$null
 
@@ -19,6 +25,18 @@ Foreach ( $path in $CURRENT_PATH.Split(";") )
     }
 }
 
-Write-Output "Removed Paths:`n`r${REMOVE_PATH}"
+Log "Removed Paths:`n`r${REMOVE_PATH}" -Name $LogName
 
-Set-ItemProperty -Path $REG_ENVVAR -Name Path -Value $NEW_PATH
+Try { Set-ItemProperty -Path $REG_ENVVAR -Name Path -Value $NEW_PATH }
+Catch
+{
+    $_.Exception.Message | Log -Error -Name $LogName
+    Log "Failed to cleanup system path, using original values" -Error -Name $LogName
+    Try { Set-ItemProperty -Path $REG_ENVVAR -Name Path -Value $CURRENT_PATH }
+    Catch
+    {
+        $_.Exception.Message | Log -Error -Name $LogName
+        Log "This is not good... !! DO NOT RESTART UNTIL SYSTEM PATH IS FIXED !!" -Error -Name $LogName
+        Exit
+    }
+}

Cleanup-SystemTempFiles.ps1

@@ -1,4 +1,10 @@
-## Path to the system temp folder
+## Source the tools script if it isn't already available
+If ( !($MSPName) ) { . $([Scriptblock]::Create((New-Object Net.WebClient).DownloadString('https://dev.emberkom.com/emberkom/management-scripts/raw/branch/master/Tools.ps1'))) }
+
+## Set the name of the log file
+$LogName = 'Cleanup-SystemTempFiles'
+
+## Path to the system temp folder
 $SysTemp = "${Env:SystemRoot}\TEMP"
 
 ## When deleting temp files en masse, only delete files/folders older than the number of days specified here
@@ -8,13 +14,13 @@ $TimeDelta = New-TimeSpan -Days $OlderThan
 ## Only run this section if we have administrative privileges
 If ( IsAdmin )
 {
-    Write-Output "Running with administrative privileges"
+    Log "Running with administrative privileges" -Name $LogName
 
     ## Remove all *.evtx files from $SysTemp
     $EventLogs = Get-ChildItem -Path "${SysTemp}\*" -File -Filter *.evtx
     If ( $EventLogs )
     {
-        Write-Output "Deleting all event logs from ${SysTemp}"
+        Log "Deleting all event logs from ${SysTemp}" -Name $LogName
         ForEach ( $EventLog in $EventLogs ) { Remove-Item $EventLog -Force -ErrorAction SilentlyContinue }
     }
 
@@ -22,7 +28,7 @@ If ( IsAdmin )
     $MiscLogs = Get-ChildItem -Path "${SysTemp}\*" -File -Include "${Env:COMPUTERNAME}-*.log", "AppxErrorReport_*.txt"
     If ( $MiscLogs )
     {
-        Write-Output "Deleting misc logs from ${SysTemp}"
+        Log "Deleting misc logs from ${SysTemp}" -Name $LogName
         ForEach ( $MiscLog in $MiscLogs ) { Remove-Item $MiscLog -Force -ErrorAction SilentlyContinue }
     }
     
@@ -30,7 +36,7 @@ If ( IsAdmin )
     $CBSLogs = Get-ChildItem -Path "${Env:SystemRoot}\Logs\CBS\*" -File -Include "CbsPersist_*.log", "CbsPersist_*.cab"
     If ( $CBSLogs )
     {
-        Write-Output "Deleting archived CBS logs from ${Env:SystemRoot}\Logs\CBS"
+        Log "Deleting archived CBS logs from ${Env:SystemRoot}\Logs\CBS" -Name $LogName
         ForEach ( $CBSLog in $CBSLogs ) { Remove-Item $CBSLog -Force -ErrorAction SilentlyContinue }
         
     }
@@ -39,29 +45,29 @@ If ( IsAdmin )
     $OldTempFiles = Get-ChildItem -Path $SysTemp | Where { $_.LastWriteTime -lt ((Get-Date) - $TimeDelta) }
     If ( $OldTempFiles )
     {
-        Write-Output "Deleting all temp files not modified in ${OlderThan} day(s) from ${SysTemp}"
+        Log "Deleting all temp files not modified in ${OlderThan} day(s) from ${SysTemp}" -Name $LogName
         ForEach ( $OldTempFile in $OldTempFiles ) { Remove-Item $OldTempFile -Force -Recurse -ErrorAction SilentlyContinue }
     }
 
     ## Turn off system hibernation if it's in use
     If ( Test-Path "${Env:SystemDrive}\hiberfil.sys" )
     {
-        Write-Output "Turning off system hibernation"
+        Log "Turning off system hibernation" -Name $LogName
         Try { Start-Process "powercfg" -ArgumentList "-h off" -Wait }
-        Catch { Write-Output $_.Exception.Message }
+        Catch { $_.Exception.Message | Log -Error -Name $LogName }
     }
 }
 
 ## Only run this section if we don't have administrative privileges
 Else
 {
-    Write-Output "Running without administrative privileges"
+    Log "Running without administrative privileges"
 
     ## Remove all system temp files older than 7 days
     $OldTempFiles = Get-ChildItem -Path $Env:TEMP | Where { $_.LastWriteTime -lt ((Get-Date) - $TimeDelta) }
     If ( $OldTempFiles )
     {
-        Write-Output "Deleting all temp files not modified in ${OlderThan} day(s) from ${Env:TEMP}"
+        Log "Deleting all temp files not modified in ${OlderThan} day(s) from ${Env:TEMP}" -Name $LogName
         ForEach ( $OldTempFile in $OldTempFiles ) { Remove-Item $OldTempFile -Force -Recurse -ErrorAction SilentlyContinue }
     }
 }

Create-LocalAdmin.ps1

@@ -1,5 +1,9 @@
-#Requires -Version 5.1
+## Source the tools script if it isn't already available
+If ( !($MSPName) ) { . $([Scriptblock]::Create((New-Object Net.WebClient).DownloadString('https://dev.emberkom.com/emberkom/management-scripts/raw/branch/master/Tools.ps1'))) }
 
+#Requires -Version 5.1
+Function Create-LocalAdmin
+{
 param(
     [Parameter(Mandatory=$true)][string]$Username,
     [Parameter(Mandatory=$true)][string]$Password,
@@ -8,22 +12,22 @@ param(
 )
 $LogName = $MyInvocation.MyCommand
 Log "Securing supplied password" -Name $LogName
-Try { $Password = ConvertTo-SecureString $Password -AsPlainText -Force }
+Try { $SecurePassword = ConvertTo-SecureString $Password -AsPlainText -Force ; $Password = $null }
 Catch { $_.Exception.Message | Log -Error -Name $LogName ; Exit }
 If ( IsAdmin )
 {
     If ( $(Get-CimInstance -ClassName Win32_OperatingSystem -Property ProductType | Select-Object -ExpandProperty ProductType) -ne "2" )
     {
-        If ( $(Get-LocalUser -Name $User -ErrorAction SilentlyContinue) )
+        If ( $(Get-LocalUser -Name $Username -ErrorAction SilentlyContinue) )
         {
             Log "Updating user: ${Username}" -Name $LogName
-            Try { Get-LocalUser -Name $Username | Set-LocalUser -Password $Password -FullName $FullName -Description $Description -AccountNeverExpires -PasswordNeverExpires -UserMayNotChangePassword }
+            Try { Set-LocalUser -Name $Username -Password $SecurePassword -FullName $FullName -Description $Description -AccountNeverExpires -PasswordNeverExpires $true }
             Catch { $_.Exception.Message | Log -Error -Name $LogName ; Exit }
         }
         Else
         {
             Log "Creating user: ${Username}" -Name $LogName
-            Try { New-LocalUser -Name $Username -Password $Password -FullName $FullName -Description $Description -AccountNeverExpires -PasswordNeverExpires -UserMayNotChangePassword }
+            Try { New-LocalUser -Name $Username -Password $SecurePassword -FullName $FullName -Description $Description -AccountNeverExpires -PasswordNeverExpires $true }
             Catch { $_.Exception.Message | Log -Error -Name $LogName ; Exit }
         }
         If ( !($(Get-LocalGroupMember -Group "Administrators" -Member $Username -ErrorAction SilentlyContinue)) )
@@ -33,10 +37,10 @@ If ( IsAdmin )
             Catch { $_.Exception.Message | Log -Error -Name $LogName ; Exit }
         }
     }
-    Else { Log "The local user account ""${User}"" cannot be created on a domain controller" -Name $LogName }
+    Else { Log "The local user account ""${Username}"" cannot be created on a domain controller" -Name $LogName }
 }
-Else { Log "Cannot create a local user account without administrative privileges" -Name $LogName }
+Else { Log "Cannot create a local administrator account without administrative privileges" -Name $LogName }
 
+## TODO: Hide account from logon screen
 #Get-ChildItem "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"
-
+}
-#[Environment]::Is64BitProcess