Komut kütüphanesi

Get-ChildItem Cert:\LocalMachine\My |
  Where-Object { $_.NotAfter -lt (Get-Date).AddDays(45) } |
  Select-Object Subject, NotAfter, Thumbprint | Sort-Object NotAfter

$sinir = (Get-Date).AddDays(-90)
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly |
  Get-ADUser -Properties LastLogonDate, whenCreated, Enabled |
  Where-Object { $_.Enabled -and $_.whenCreated -lt $sinir } |
  Export-Csv '.\pasif-hesaplar.csv' -NoTypeInformation -Encoding UTF8

$alan = 'ornek.com'
Resolve-DnsName $alan -Type TXT | Where-Object Strings -match 'v=spf1' | Select-Object -Expand Strings
Resolve-DnsName "_dmarc.$alan" -Type TXT | Select-Object -Expand Strings
Resolve-DnsName "selector1._domainkey.$alan" -Type CNAME, TXT -ErrorAction SilentlyContinue

ansible-playbook site.yml --check --diff |
  awk '/^changed:/ {print $2}' | tr -d '[]' | sort -u

Connect-MgGraph -Scopes Reports.Read.All
Get-MgReportTeamActivityDetail -Period D90 -OutFile teams-90.csv
Import-Csv teams-90.csv |
  Where-Object { [int]$_.'Active Users' -eq 0 } |
  Select-Object 'Team Name', 'Last Activity Date' |
  Sort-Object 'Last Activity Date'

Import-Csv .\cagrilar.csv |
  Where-Object { [datetime]$_.Tarih -gt (Get-Date).AddDays(-30) } |
  Group-Object Kullanici |
  Where-Object Count -gt 3 |
  Sort-Object Count -Descending |
  Select-Object Count, Name

systemctl --failed --no-legend | awk '{print $1}' | while read -r s; do
  echo "=== $s"
  journalctl -u "$s" -n 5 --no-pager -p err
done

ps -eo pid,user,rss,pmem,comm --sort=-rss | head -11

aws ec2 describe-snapshots --owner-ids self \
  --query "Snapshots[?StartTime<='2025-08-01'].{Id:SnapshotId, GB:VolumeSize, Tarih:StartTime, Not:Description}" \
  --output table

SELECT bekleyen.pid AS bekleyen_pid, bekleyen.query AS bekleyen_sorgu,
       engelleyen.pid AS engelleyen_pid, engelleyen.query AS engelleyen_sorgu
FROM pg_stat_activity bekleyen
JOIN pg_stat_activity engelleyen
  ON engelleyen.pid = ANY(pg_blocking_pids(bekleyen.pid))
WHERE cardinality(pg_blocking_pids(bekleyen.pid)) > 0;

Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus,
  @{n='KurtarmaAnahtari'; e={ ($_.KeyProtector | Where-Object KeyProtectorType -eq 'RecoveryPassword').Count }}

Get-MgSubscribedSku | Where-Object SkuPartNumber -like '*COPILOT*' |
  Select-Object SkuPartNumber, ConsumedUnits,
    @{n='Bos'; e={$_.PrepaidUnits.Enabled - $_.ConsumedUnits}}

$tpm = Get-Tpm
$sb  = try { Confirm-SecureBootUEFI } catch { 'BIOS/Legacy' }

[pscustomobject]@{
  TPM_Var      = $tpm.TpmPresent
  TPM_Etkin    = $tpm.TpmReady
  TPM_Surum    = (Get-CimInstance -Namespace root\cimv2\security\microsofttpm -ClassName Win32_Tpm).SpecVersion
  SecureBoot   = $sb
  RAM_GB       = [math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1GB)
}

gpresult /h "$env:TEMP\gpo-rapor.html" /f
Invoke-Item "$env:TEMP\gpo-rapor.html"

Get-NetTCPConnection -State Listen |
  Select-Object LocalAddress, LocalPort,
    @{n='Surec'; e={ (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName }},
    OwningProcess | Sort-Object LocalPort

dsregcmd /status | Select-String 'AzureAdJoined|DomainJoined|WorkplaceJoined|TenantName|MdmUrl'

# Kayıtlı yönetim sunucusu ve son eşitleme
Get-ScheduledTask -TaskPath '\Microsoft\Windows\EnterpriseMgmt\*' -EA 0 |
  Get-ScheduledTaskInfo | Select-Object TaskName, LastRunTime, LastTaskResult

(netsh wlan show networks mode=bssid) -match 'Kanal|Channel' |
  ForEach-Object { ($_ -split ':')[1].Trim() } |
  Group-Object |
  Sort-Object Count -Descending |
  Format-Table Name, Count -AutoSize

Get-MpThreatDetection |
  Sort-Object InitialDetectionTime -Descending |
  Select-Object -First 20 InitialDetectionTime, ThreatID, Resources

Get-DhcpServerv4ScopeStatistics -ComputerName dhcp01 |
  Select-Object ScopeId, AddressesFree, AddressesInUse, PercentageInUse |
  Sort-Object PercentageInUse -Descending

Get-Mailbox -ResultSize Unlimited |
  Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress } |
  Select-Object DisplayName, PrimarySmtpAddress, ForwardingSmtpAddress,
                DeliverToMailboxAndForward

ss -tulpnH | awk '{print $1, $5, $7}' | sort -u

du -xh --max-depth=3 / 2>/dev/null | sort -rh | head -10

Get-PhysicalDisk | ForEach-Object {
  $r = $_ | Get-StorageReliabilityCounter -EA 0
  [pscustomobject]@{
    Disk = $_.FriendlyName; Saglik = $_.HealthStatus
    AsinmaYuzde = $r.Wear; Sicaklik = $r.Temperature
    OkunamayanHata = $r.ReadErrorsUncorrected
  }
} | Format-Table -AutoSize

powercfg /batteryreport /output "$env:TEMP\pil.html"

# Yalnızca iki sayı gerekiyorsa
Get-CimInstance -Namespace root/WMI -Class BatteryStaticData |
  Select-Object DeviceName, DesignedCapacity
Get-CimInstance -Namespace root/WMI -Class BatteryFullChargedCapacity |
  Select-Object FullChargedCapacity

Get-DnsClientServerAddress -AddressFamily IPv4 |
  Select-Object -ExpandProperty ServerAddresses -Unique | ForEach-Object {
    $s = Measure-Command { Resolve-DnsName microsoft.com -Server $_ -EA 0 }
    [pscustomobject]@{ Sunucu = $_; MS = [int]$s.TotalMilliseconds }
  } | Sort-Object MS

curl -s "$PROM/api/v1/query?query=sort_desc(
  count_over_time(ALERTS{alertstate=\"firing\"}[30d])
)" | jq -r '.data.result[] | "\(.value[1])\t\(.metric.alertname)"' | head -15

$dosya = "$env:TEMP\paylasim-olcum.csv"
$simdi = Get-SmbShare | Where-Object Special -eq $false | ForEach-Object {
  [pscustomobject]@{
    Ad = $_.Name
    GB = [math]::Round((Get-ChildItem $_.Path -Recurse -File -EA 0 |
          Measure-Object Length -Sum).Sum / 1GB, 2)
  }
}
if (Test-Path $dosya) {
  $onceki = Import-Csv $dosya
  $simdi | ForEach-Object {
    $e = $onceki | Where-Object Ad -eq $_.Ad
    if ($e) { "{0}: +{1} GB" -f $_.Ad, [math]::Round($_.GB - [double]$e.GB, 2) }
  }
}
$simdi | Export-Csv $dosya -NoTypeInformation

# Son alanın $request_time olduğu varsayılır
awk '{ t[$7] += $NF; n[$7]++ }
     END { for (u in t) printf "%8.3f  %6d  %s\n", t[u]/n[u], n[u], u }' \
    /var/log/nginx/access.log |
  sort -rn | head -20

# Kod dağılımı
awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn

# 5xx üreten adresler, çoktan aza
awk '$9 ~ /^5/ {print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20

gcloud compute instances list --filter="status=RUNNING" \
  --format="table(name, zone.basename(), machineType.basename(), status)"

curl -sSI https://ornek.com |
  grep -iE 'strict-transport|content-security|x-content-type|x-frame|referrer-policy|server|x-powered-by'

# Dizin listesi açık mı
curl -s -o /dev/null -w '%{http_code}\n' https://ornek.com/assets/

Get-WinEvent -ComputerName (netdom query fsmo) -FilterHashtable @{
  LogName = 'Security'; Id = 4740
} -MaxEvents 10 |
  Select-Object TimeCreated,
    @{ n = 'Hesap';  e = { $_.Properties[0].Value } },
    @{ n = 'Kaynak'; e = { $_.Properties[1].Value } }

az disk list --query "[?diskState=='Unattached'].{Ad:name, Grup:resourceGroup, GB:diskSizeGb, Katman:sku.name}" -o table

Get-VMReplication |
  Select-Object VMName, State, Health, LastReplicationTime |
  Sort-Object Health, LastReplicationTime

netsh wlan show wlanreport

# Rapor buraya yazılır:
# C:\ProgramData\Microsoft\Windows\WlanReport\wlan-report-latest.html

netsh wlan show interfaces

# Yalnızca karar veren satırlar
netsh wlan show interfaces |
  Select-String 'SSID|BSSID|Radyo|Radio|Kanal|Channel|Sinyal|Signal|Alma|Receive|İletim|Transmit'

kubectl get pods -A -o json |
  jq -r '.items[] | select(.spec.containers[].resources.requests == null) |
    "\(.metadata.namespace)/\(.metadata.name)"'

Get-MgIdentityConditionalAccessPolicy |
  Select-Object DisplayName, State, ModifiedDateTime |
  Sort-Object State, DisplayName

Connect-MgGraph -Scopes AuditLog.Read.All, User.Read.All
$sinir = (Get-Date).AddDays(-90)
Get-MgUser -All -Property DisplayName,UserPrincipalName,SignInActivity,AssignedLicenses |
  Where-Object { $_.AssignedLicenses.Count -gt 0 -and
                 $_.SignInActivity.LastSignInDateTime -lt $sinir } |
  Select-Object DisplayName, UserPrincipalName,
    @{ n = 'SonGiris'; e = { $_.SignInActivity.LastSignInDateTime } }

Get-Printer |
  Select-Object Name, DriverName, PortName, Shared, Published |
  Sort-Object DriverName | Format-Table -AutoSize

# Sürücüye göre kaç yazıcı var
Get-Printer | Group-Object DriverName | Sort-Object Count -Descending |
  Select-Object Count, Name

watch -n1 'iw dev wlan0 link | grep -E "Connected to|SSID|signal|tx bitrate"'

# Tek seferlik özet
nmcli -f IN-USE,SSID,BSSID,CHAN,SIGNAL,RATE dev wifi list

# NVMe
sudo nvme smart-log /dev/nvme0n1 | grep -E 'percentage_used|data_units_written|media_errors'

# SATA / SAS
sudo smartctl -A /dev/sda |
  grep -E 'Reallocated|Wear_Leveling|Total_LBAs_Written|Media_Wearout|Temperature'

sudo profiles status -type enrollment

netsh wlan show profile name="AgAdi" key=clear | Select-String 'Key Content|Anahtar İçeriği'

Connect-MgGraph -Scopes 'UserAuthenticationMethod.Read.All'
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
  Where-Object { -not $_.IsMfaRegistered } |
  Select-Object UserPrincipalName, UserDisplayName |
  Sort-Object UserPrincipalName

Get-MgSubscribedSku | Select-Object SkuPartNumber,
  @{n='Alinan'; e={$_.PrepaidUnits.Enabled}}, ConsumedUnits,
  @{n='Bos'; e={$_.PrepaidUnits.Enabled - $_.ConsumedUnits}} | Sort-Object Bos -Descending

Resolve-DnsName ornek.com -Type MX |
  Sort-Object Preference |
  Select-Object Preference, NameExchange |
  Format-Table -AutoSize

# Adların gerçekten çözülüp çözülmediğini de doğrulayın
(Resolve-DnsName ornek.com -Type MX).NameExchange |
  ForEach-Object { Resolve-DnsName $_ -Type A -EA 0 | Select-Object Name, IPAddress }

Get-WinEvent -LogName Security -MaxEvents 200 -FilterXPath @"
*[System[EventID=4624] and EventData[Data[@Name='AuthenticationPackageName']='NTLM']]
"@ | ForEach-Object {
  $x = [xml]$_.ToXml()
  [pscustomobject]@{
    Zaman   = $_.TimeCreated
    Hesap   = ($x.Event.EventData.Data | Where-Object Name -eq 'TargetUserName').'#text'
    Kaynak  = ($x.Event.EventData.Data | Where-Object Name -eq 'WorkstationName').'#text'
  }
} | Group-Object Hesap | Sort-Object Count -Descending

Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 0 |
  Out-Null  # önbelleği tazeler
Get-ADUser -Filter { Enabled -eq $true } -Properties PasswordLastSet |
  Where-Object { $_.PasswordLastSet -lt (Get-Date).AddDays(-365) } |
  Select-Object Name, SamAccountName, PasswordLastSet |
  Sort-Object PasswordLastSet

Test-NetConnection sunucu01 -Port 443 -InformationLevel Detailed

# Erişilebilirlik
Test-NetConnection posta.ornek.com -Port 25

# STARTTLS ve sertifika (openssl gerekir)
openssl s_client -starttls smtp -connect posta.ornek.com:25 -servername posta.ornek.com < /dev/null 2>/dev/null |
  openssl x509 -noout -subject -issuer -dates

SELECT schemaname, relname, n_live_tup, n_dead_tup,
       round(n_dead_tup * 100.0 / NULLIF(n_live_tup + n_dead_tup, 0), 1) AS olu_yuzde,
       last_autovacuum
FROM pg_stat_user_tables
WHERE n_dead_tup > 1000
ORDER BY olu_yuzde DESC NULLS LAST
LIMIT 20;

$rdp = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'
$sid = (Get-CimInstance Win32_Service -Filter "Name='TermService'").ProcessId

[pscustomobject]@{
  Port       = (Get-ItemProperty "$rdp\WinStations\RDP-Tcp").PortNumber
  RdpKapali  = [bool](Get-ItemProperty $rdp).fDenyTSConnections
  NLA        = [bool](Get-ItemProperty "$rdp\WinStations\RDP-Tcp").UserAuthentication
  Dinleniyor = (Get-NetTCPConnection -State Listen -EA 0 |
                 Where-Object OwningProcess -eq $sid).LocalPort
}

robocopy "D:\Kaynak" "\\yedek01\Hedef" /MIR /L /NJH /NJS /NDL /XD "System Volume Information"

Get-SmbServerConfiguration | Select-Object RequireSecuritySignature, EnableSMB1Protocol, EncryptData

kubectl get events -A --field-selector type=Warning \
  --sort-by='.lastTimestamp' | tail -30

SELECT d.name AS veritabani,
       MAX(CASE WHEN b.type = 'D' THEN b.backup_finish_date END) AS son_tam,
       MAX(CASE WHEN b.type = 'L' THEN b.backup_finish_date END) AS son_gunluk
FROM sys.databases d
LEFT JOIN msdb.dbo.backupset b ON b.database_name = d.name
WHERE d.database_id > 4
GROUP BY d.name
ORDER BY son_tam;

Get-WBSummary | Select-Object LastSuccessfulBackupTime, LastBackupResultHR, NextBackupTime

function Say-Spf($alan, $derinlik = 0) {
  if ($derinlik -gt 10) { return 99 }
  $kayit = ((Resolve-DnsName $alan -Type TXT -EA 0).Strings -match '^v=spf1')
  if (-not $kayit) { return 0 }
  $sayi = 0
  foreach ($p in ($kayit -split ' ')) {
    if ($p -match '^(include:|redirect=)(.+)$') { $sayi += 1 + (Say-Spf $Matches[2] ($derinlik+1)) }
    elseif ($p -match '^(a|mx|ptr|exists)') { $sayi += 1 }
  }
  $sayi
}
Say-Spf 'ornek.com'

$alan = 'ornek.com'
$secici = 'selector1'   # DKIM seçicisi sağlayıcıya göre değişir

'SPF   : ' + ((Resolve-DnsName $alan -Type TXT).Strings -match '^v=spf1')
'DMARC : ' + ((Resolve-DnsName "_dmarc.$alan" -Type TXT -EA 0).Strings -match '^v=DMARC1')
'DKIM  : ' + ((Resolve-DnsName "$secici._domainkey.$alan" -Type TXT,CNAME -EA 0).Strings -join '')

$h = 'www.ornek.com'
foreach ($p in 'Tls12', 'Tls13') {
  $c = [Net.Sockets.TcpClient]::new($h, 443)
  $s = [Net.Security.SslStream]::new($c.GetStream())
  try { $s.AuthenticateAsClient($h, $null, [Net.SecurityProtocolType]::$p, $false); "$p : kabul" }
  catch { "$p : ret" }
  finally { $s.Dispose(); $c.Dispose() }
}

sudo ss -tlnp | awk '/sshd/ {print $4, $6}'

# Tüm arayüzlere açılmış olanlar (0.0.0.0 veya [::]) incelenmeli
sudo ss -tlnp | awk '/sshd/ && ($4 ~ /^0\.0\.0\.0:/ || $4 ~ /^\[::\]:/) {print}'

quser /server:sunucu01

'sunucu01','sunucu02','sunucu03' | ForEach-Object {
  Get-CimInstance Win32_LogicalDisk -ComputerName $_ -Filter "DriveType=3" |
    Select-Object @{ n='Sunucu'; e={ $_.SystemName } }, DeviceID,
      @{ n='BosGB'; e={ [math]::Round($_.FreeSpace/1GB,1) } },
      @{ n='Bos%';  e={ [math]::Round($_.FreeSpace/$_.Size*100,1) } }
} | Sort-Object 'Bos%' | Format-Table -AutoSize

'ornek.com', 'panel.ornek.com' | ForEach-Object {
  $t = [Net.Sockets.TcpClient]::new($_, 443)
  $s = [Net.Security.SslStream]::new($t.GetStream(), $false, { $true })
  $s.AuthenticateAsClient($_)
  $b = [Security.Cryptography.X509Certificates.X509Certificate2]$s.RemoteCertificate
  [pscustomobject]@{ Alan = $_; Bitis = $b.NotAfter; KalanGun = ($b.NotAfter - (Get-Date)).Days }
  $s.Dispose(); $t.Close()
}

kubectl get pods -A --sort-by='.status.containerStatuses[0].restartCount' \
  -o custom-columns='AD:.metadata.name,AD ALANI:.metadata.namespace,RESTART:.status.containerStatuses[0].restartCount,DURUM:.status.phase' \
  | tail -20

Stop-Service Spooler -Force
Remove-Item "$env:SystemRoot\System32\spool\PRINTERS\*" -Force -EA 0
Start-Service Spooler

# Önce neyin takıldığına bakmak isterseniz
Get-Printer | Get-PrintJob -EA 0 | Select-Object PrinterName, Id, DocumentName, JobStatus

# Tüm oturumlar: Disc durumundakiler kopmuş ama hâlâ açık
quser /server:SUNUCU

# Yalnızca kopmuş olanlar
(quser /server:SUNUCU) -match 'Disc'

# Kimliği gözle doğruladıktan sonra tek tek kapatın
logoff 3 /server:SUNUCU

terraform plan -refresh-only -detailed-exitcode -no-color |
  grep -E '^\s+[~+-]' | head -40

$t = Get-Tpm
$sb = try { Confirm-SecureBootUEFI } catch { 'UEFI degil' }
[pscustomobject]@{
  TpmVar     = $t.TpmPresent
  TpmEtkin   = $t.TpmReady
  Surum      = (Get-CimInstance -Namespace root/CIMV2/Security/MicrosoftTpm -Class Win32_Tpm).SpecVersion
  SecureBoot = $sb
  AcilisKipi = $env:firmware_type
}

$hedef = "\\yedek01\gpo\$(Get-Date -Format 'yyyy-MM-dd')"
New-Item -ItemType Directory -Path $hedef -Force | Out-Null
Backup-GPO -All -Path $hedef -Comment "Haftalık otomatik yedek"

Get-VM | Get-VMSnapshot |
  Where-Object { $_.CreationTime -lt (Get-Date).AddDays(-30) } |
  Select-Object VMName, Name, CreationTime,
    @{ n = 'BoyutGB'; e = { [math]::Round((Get-Item $_.Path).Length / 1GB, 2) } } |
  Sort-Object CreationTime

Get-VM | Get-VMSnapshot |
  Select-Object VMName, Name, CreationTime, ParentSnapshotName |
  Sort-Object CreationTime

SELECT r.session_id, r.status, r.wait_type, r.total_elapsed_time / 1000 AS saniye,
       DB_NAME(r.database_id) AS veritabani, t.text AS sorgu
FROM sys.dm_exec_requests r
CROSS APPLY sys.dm_exec_sql_text(r.sql_handle) t
WHERE r.session_id > 50 AND r.total_elapsed_time > 5000
ORDER BY r.total_elapsed_time DESC;

winget upgrade --all --include-unknown --accept-source-agreements --accept-package-agreements

curl -s "$PROM/api/v1/query?query=up==0" |
  jq -r '.data.result[] | "\(.metric.job)\t\(.metric.instance)"'

Get-WinEvent -FilterHashtable @{
  LogName = 'Microsoft-Windows-Backup'; Id = 4, 5, 8, 9, 17, 22, 49
} -MaxEvents 20 |
  Select-Object TimeCreated, Id,
    @{ n = 'Sonuc'; e = { if ($_.Id -in 4, 5) { 'Başarılı' } else { 'Hata' } } },
    @{ n = 'Mesaj'; e = { $_.Message.Split("`n")[0] } }

$sunucular = Get-ADComputer -Filter { OperatingSystem -like '*Server*' } |
  Select-Object -ExpandProperty Name
Invoke-Command -ComputerName $sunucular -ErrorAction SilentlyContinue -ScriptBlock {
  $b = Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'
  if ($b) { $env:COMPUTERNAME }
}

Get-LocalGroupMember -Group 'Administrators' |
  Select-Object Name, ObjectClass, PrincipalSource |
  Format-Table -AutoSize

# Filo genelinde
'PC01','PC02' | ForEach-Object {
  Invoke-Command -ComputerName $_ -ScriptBlock { Get-LocalGroupMember Administrators } -EA 0 |
    Select-Object PSComputerName, Name, PrincipalSource
}

Get-LocalGroupMember -Group 'Administrators' |
  Select-Object Name, PrincipalSource, ObjectClass

ping -f -l 1472 8.8.8.8

$hedef = (Invoke-RestMethod https://api.ipify.org)
3389, 22, 5985, 5986, 445, 623 | ForEach-Object {
  $s = Test-NetConnection $hedef -Port $_ -WarningAction SilentlyContinue
  [pscustomobject]@{ Port = $_; Acik = $s.TcpTestSucceeded }
} | Format-Table -AutoSize