Another day at the office..

Thanks to our friends who wrote the NotPetya worm, I received an email from our monitoring vendor to run reports to see if our machines are up-to-date on their patching.

Unfortunately their reporting tool doesn’t properly distinguish between Windows Server 2008 and Windows 2008 R2, as well as Windows 2012 and Windows 2012 R2.

Long story short,  I had to create 4 separate reports, telling me if I had or had not installed the proper KB item on each machine.

Because of this flaw I also had to join the reports and check the “Highlight Duplicates” option in Excel to see whether or not servers had their respective Hotfix installed (if the server had a duplicate entry, it meant that it didn’t have either the standard or R2 patch installed, meaning vulnerable).

Each report also came with a 3 row header with random junk that needed to be removed, so a simple Ctrl + A , Ctrl + C, Ctrl + V wouldn’t suffice.

PowerShell to the rescue!

I looked at the email from the vendor and went “Hell no, I’m not going to do that…” and opened up PowerShell ISE.

Having dumped the reports in the folder c:\Temp\NotPetya , I came up with the following script:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

>$Array = New-Object System.Collections.ArrayList

$Files = (Get-ChildItem "Y:\NotPetya\*" -Include '*.csv')

foreach ($File in $Files){
    $Csv = Get-Content -Path $File | Select-Object -Skip 3 | Out-String | ConvertFrom-Csv -Delimiter ','
    foreach ($Entry in $Csv){
        [void]$Array.Add($Entry)
    }
}

$Array | Group-Object Server | Where-Object {$_.Count -ge 2}

While the coding took a little bit longer, the execution was swift and perfect.

Happy scripting! 🙂