Remove Kaspersky via CMD:
@echo off
@setlocal EnableDelayedExpansion
set KSU_GUID="x"
for /f "delims=" %%A in ('PowerShell -NoProfile -ExecutionPolicy Bypass -Command "get-wmiobject Win32_Product -filter \"name^='Kaspersky Software Updater'\" | select identifyingnumber"') do set "KSU_GUID=%%A"
echo %KSU_GUID%
if NOT %KSU_GUID% == "x" ( msiexec /x %KSU_GUID% /quiet /qn ) else ( echo Product not found. & exit /b 1)
if %errorlevel%==3010 set errorlevel=0Delete Windows Update Cache via PowerShell #1 (may cause issues if using WSUS as registry keys contain source - verify first!):
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\UA /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\WindowsUpdate\AU /f
Stop-Service -Name "wuauserv", "bits" -Force
Rename-Item "C:\Windows\SoftwareDistribution" "C:\Windows\SoftwareDistribution_backup" -Force
Start-Service -Name "wuauserv", "bits"
Delete Windows Update Cache via PowerShell #2 (may cause issues if using WSUS as registry keys contain source - verify first!):
Remove-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\UA" -Force
Remove-Item -Path "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\WindowsUpdate\AU" -Force
Stop-Service -Name wuauserv -Force
Stop-Service -Name bits -Force
Rename-Item -Path "C:\Windows\SoftwareDistribution" -NewName "SoftwareDistribution_backup_" -Force
Start-Service -Name wuauserv
Start-Service -Name bits
Start-Sleep -Seconds 5
Invoke-Expression "ping 127.0.0.1"
Start-Sleep -Seconds 5
$UpdateSession = New-Object -ComObject Microsoft.Update.Session
$UpdateSearcher = $UpdateSession.CreateUpdateSearcher()
$SearchResult = $UpdateSearcher.Search("IsInstalled=0")When was the last Windows Update installed via PowerShell:
(New-Object -ComObject Microsoft.Update.AutoUpdate).Results.LastSearchSuccessDate
Get version of a file via PowerShell:
(Get-ChildItem "C:\Temp\Example.exe").VersionInfo.FileVersion
Identify which user a service is running as via CMD (can be linked to multiple by separating with ';')
cmd.exe /c sc qc ServiceName | findstr SERVICE_START_NAME
#For multiple:
cmd.exe /c sc qc ServiceName1 | findstr SERVICE_START_NAME; cmd.exe /c sc qc ServiceName2 | findstr SERVICE_START_NAME
Read a specific registry value via CMD:
Get-ItemProperty -Path HKLM:\SOFTWARE\WOW6432Node\NODE\NODE -Name "ITEMNAME" | Select -Expand "ITEMNAME"
