Powershell Usage

I have a requirement to report usage of Powershell on our endpoints. I was expecting that Bigfix Inventory would have this information since Powershell is such a key application for usage and security.

It turns out that Powershell.exe is located in c:\Windows\System23 which is not scanned by BFI, and according to the BFI documentation will cause issues if it is not excluded.

I worked around this shortcoming of BFI by getting the usage from Bigfix by creating an analysis.

if exists application usage summary "powershell.exe" then (((last time seen of it - now) / day * -1), name of it, total run counts of it, image paths of it) of instances of application usage summaries "powershell.exe" as string else "never used"
3 Likes