Using Powershell...
Software that is installed on windows systems are recorded in the registry the HKEY_LOCAL_MACHINE hive in the SoftwareMicrosoftWindows CurrentVersionUninstall registry key.
Determine the number of software applications installed (number of subkeys in this key)
Output the name of each of the applications to the applications.txt file
Installed software can also be determined through WMI.
Use the Win32_Programs WMI object to determine how many applications are installed on the local system.
Explain why the number of installed applications determined by the Win32_product WMI object is less that the number of installed applications determined by reading the registry.
The Win32_NeworkProtocol, Win32_NetworkAdapter, Win32_NetworkAdapterConfiguration, and Win32_NetworkAdapterSetting WMI objects are used to extract information from a computer system concerning network protocol and adapters.
Use a WMI object to determine the number of network adapters installed in your system. Record the command and output.
Use a WMI object to output to screen the IP addresses assigned to the adapters. Record the command and the output of the command.
Use a WMI object to list the names of installed network protocols. Record the command.
Windows Security event logs can record successful and unsuccessful logon events. For Windows Vista, Windows 7 and Server2003, Event ID 4624 is "success logon" and Event ID 4625 is the "failed logon".
Issue a command that will show the most recent entry in the Windows security event log. Pipe this command to Get-member to view the properties and methods. Record the command.
Issue a command that will show the 100 most recent entries in the Windows security event log showing only those entries that were a successful logon event. Assign the output of this command to $LogonEvent. Record the command.
Issue a command that will show the Message of the first event recorded in $LogonEvent. Record the command
Note the Logon Type: line. Note that there are three unspecified characters between Logon Type: and its code number.
Logon Type Description
2 Interactive (logon at keyboard and screen of system)
3 Network (i.e. connection to shared folder on this computer from elsewhere on network)
4 Batch (i.e. scheduled task)
5 Service (Service startup)
7 Unlock (i.e. unattended workstation with password protected screen saver)
8 NetworkCleartext (Logon with credentials sent in the clear text.)
9 NewCredentials such as with RunAs or mapping a network drive with alternate credentials.
10 RemoteInteractive (Terminal Services, Remote Desktop or Remote Assistance)
11 CachedInteractive (logon with cached domain credentials such as when logging on to a laptop when away from the network)
Issue a command that will show the 100 most recent entries in the Windows security event log showing only those entries that were a successful logon event by Interactive logon. Assign the output of this command to $InteractiveLogon. Record the command. (Hint: use regular expressions and string comparison)
Using $InteractiveLogon, determine how many interactive logons occurred during the newest 100 Security log entries. Record the command used.