MaxKozlov

function Get-TextEncoding ($Encoding) {
		switch -regex ($Encoding) {
			'default' {
				[System.Text.Encoding]::Default
			}
			'utf8' {
				[System.Text.Encoding]::UTF8
			}
			'oem' {
				[System.Text.Encoding]::GetEncoding(
					(Get-Culture).TextInfo.OEMCodePage
				)
			}
			'ansi' {
				[System.Text.Encoding]::GetEncoding(
					(Get-Culture).TextInfo.ANSICodePage
				)
			}
			'^\d+$' {
				[System.Text.Encoding]::GetEncoding([int]$Encoding)
			}
			default {
				[System.Text.Encoding]::GetEncoding($Encoding)
			}
		}
}
function Convert-TextEncoding {
param (
	[Parameter(ValueFromPipeline=$true,Position=0)]
	[String[]]$InputObject,
	[Parameter(Mandatory=$true,Position=1)]
	[string]$FromEncoding,
	[Parameter(Mandatory=$true,Position=2)]
	[string]$ToEncoding
)
BEGIN {
	try {
		$FE = Get-TextEncoding $FromEncoding
		$TE = Get-TextEncoding $ToEncoding
	}
	catch {
		throw
	}
}
PROCESS{
	foreach ($s in $InputObject) {
		if ($s) {
			$TE.GetString($FE.GetBytes($s))
		}
		else {
			$s
		}
	}
}
}

Invoke-Command -ComputerName $Computer { net user } | 
    Convert-TextEncoding -FromEncoding 1251 -ToEncoding 866

• No seek penalty - работает из под любого юзера
  
• Nominal media rotation rate - только с админскими правами
  

Invoke-Command -ScriptBlock { cmd /c "chcp 65001 && ipconfig /all" } -ComputerName ...

$Computername = 'xxx'
Get-CimInstance Win32_Group -filter "LocalAccount='True' and SID='S-1-5-32-555'" -ComputerName $Computername |
Select-Object PSComputername,Name,@{Name="Members";Expression={
  (Get-CimAssociatedInstance -InputObject $_ -ResultClassName Win32_UserAccount).Name
}}

$Computername = 'xxx'
Get-WMIObject Win32_Group -filter "LocalAccount='True'and SID='S-1-5-32-555'" -ComputerName $Computername|
  Select-Object PSComputername,Name,@{Name="Members";Expression={
   $_.GetRelated("Win32_UserAccount").Name
}}

function Get-LocalGroupMember {
param(
	[Parameter(ValueFromPipeline=$false, Position=0)]
	[string[]]$GroupName = 'Administrators',
	[Parameter(ValueFromPipeline=$true)]
	[string[]]$ComputerName = '.'
)
PROCESS {
	foreach ($computer in $ComputerName) {
		foreach ($group in $GroupName) {
			$grp = [ADSI]"WinNT://$computer/$group,group"
			Write-Verbose ('Group: ' + $grp.Path) # test for existance
			$members = @($grp.psbase.Invoke("Members"))
			if ($members) {
				$members | Foreach-Object {
					$name = $_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)
					$class = $_.GetType().InvokeMember("Class", 'GetProperty', $null, $_, $null)
					$parent = $_.GetType().InvokeMember("Parent", 'GetProperty', $null, $_, $null) -replace 'WinNT://' -replace '.*/'
					'' | Select-Object @{n='Class';e={$class}},@{n='Domain';e={$parent}},@{n='Name';e={$name}}
				}
			}
		}
	}
}
}

Get-LocalGroupMember -ComputerName MySuperServer -GroupName 'Пользователи удаленного рабочего стола',  'Remote Desktop Users'

$global:log = New-Object System.Collections.ArrayList
$testobj = New-Object -TypeName System.Diagnostics.EventLog
$testobj.Log = "Security"
Register-ObjectEvent -InputObject $testobj -EventName EntryWritten -Action {
  param($sender, $e)
  [void]$global:log.Add([PSCustomObject]@{Sender = $sender; Args = $e })
}

# Смотреть потом события в переменной
$global:log

[Windows.Graphics.Capture.GraphicsCaptureSession, Windows.Graphics.Capture, ContentType=WindowsRuntime] | Out-Null
[Windows.Graphics.Capture.GraphicsCaptureSession]::IsBorderRequired = $true

$folders = Get-ChildItem -Path C:\  -Directory -Recurse | ForEach-Object {
  [PSCustomObject]@{
    Path=$_.FullName
    Count=$_.FullName | Get-ChildItem -File | Measure-Object | Select-Object -ExpandProperty Count
  }
} | Sort-Object Count -Descending
# Посмотреть потом первый десяток:
$folders | Select -First 10

$Error.Clear()
Get-ChildItem C:\ -Recurse -ErrorAction Continue | Out-Null
$err = $Error | ForEach-Object { $_.TargetObject }

$err | Set-Content -Path d:\Path_without_access.txt -Encoding UTF8