: Timdle PS scriptem zjistis aspon kdy bylo nastaveni sluzby naposledy zmeneno. Zjistit kdo/co uz je slozitejsi a jestli nemas sysmon logy z dane doby, tak to bude asi nedohledatelne.
Add-Type @"
using System; using System.Text; using System.Runtime.InteropServices;
public class RegTime {
[DllImport("advapi32.dll", CharSet=CharSet.Unicode)]
public static extern int RegQueryInfoKey(
Microsoft.Win32.SafeHandles.SafeRegistryHandle hKey, StringBuilder cls, ref uint cbCls,
IntPtr rsv, out uint sub, out uint maxSub, out uint maxCls, out uint vals,
out uint maxValName, out uint maxVal, out uint secDesc, out long lastWrite);
}
"@
$k = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SYSTEM\CurrentControlSet\Services\dcsvc')
$cb=[uint32]1024; $sb=[Text.StringBuilder]::new(1024); $t=0L
$n=0u;[void][RegTime]::RegQueryInfoKey($k.Handle,$sb,[ref]$cb,[IntPtr]::Zero,[ref]$n,[ref]$n,[ref]$n,[ref]$n,[ref]$n,[ref]$n,[ref]$n,[ref]$t)
[DateTime]::FromFileTime($t).ToLocalTime()