Additional Script Updates

This commit is contained in:
Andrew Amason
2025-05-19 15:19:36 -04:00
parent ec2b22290a
commit 9c8438d7d1
136 changed files with 1595 additions and 0 deletions

View File

@@ -0,0 +1,32 @@
# Detection Script: Detect_UserProfiles.ps1
# Define the size threshold in MB
$sizeThresholdMB = 500
# Get all user profiles
$userProfiles = Get-WmiObject -Class Win32_UserProfile | Where-Object { $_.Special -eq $false }
# Initialize flag for non-compliance
$nonCompliant = $false
foreach ($profile in $userProfiles) {
# Check if the profile is corrupted
if ($profile.Status -ne 0) {
Write-Output "Corrupted profile detected: $($profile.LocalPath)"
$nonCompliant = $true
}
# Check if the profile size exceeds the threshold
$profileSizeMB = [math]::Round((Get-ChildItem -Path $profile.LocalPath -Recurse | Measure-Object -Property Length -Sum).Sum / 1MB, 2)
if ($profileSizeMB -gt $sizeThresholdMB) {
Write-Output "Profile size exceeds threshold: $($profile.LocalPath) - Size: $profileSizeMB MB"
$nonCompliant = $true
}
}
if ($nonCompliant) {
exit 1
} else {
Write-Output "All user profiles are compliant."
exit 0
}

View File

@@ -0,0 +1,26 @@
# Remediation Script: Remediate_UserProfiles.ps1
# Define the size threshold in MB
$sizeThresholdMB = 500
# Get all user profiles
$userProfiles = Get-WmiObject -Class Win32_UserProfile | Where-Object { $_.Special -eq $false }
foreach ($profile in $userProfiles) {
# Check if the profile is corrupted
if ($profile.Status -ne 0) {
# Remove corrupted profile
Remove-WmiObject -InputObject $profile
Write-Output "Removed corrupted profile: $($profile.LocalPath)"
}
# Check if the profile size exceeds the threshold
$profileSizeMB = [math]::Round((Get-ChildItem -Path $profile.LocalPath -Recurse | Measure-Object -Property Length -Sum).Sum / 1MB, 2)
if ($profileSizeMB -gt $sizeThresholdMB) {
# Remove large profile
Remove-WmiObject -InputObject $profile
Write-Output "Removed large profile: $($profile.LocalPath) - Size: $profileSizeMB MB"
}
}
Write-Output "User profile remediation tasks completed."