Final Week for OnDemand Special Offer: iPad mini, Surface Go 2, or Take $300 Off thru 9/30


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

Windows PowerShell for Auditors

  • Wednesday, September 06, 2017 at 10:00 PM EDT (2017-09-07 02:00:00 UTC)
  • Clay Risenhoover

You can now attend the webcast using your mobile device!



PowerShell has been around for more than a decade, and is now the Microsoft-preferred tool for performing Windows administration. Its also a very capable platform for developing audit evidence during reviews of Active Directory domains and Windows servers and workstations.

In this webcast, we will cover the basics of running PowerShell commands, discuss techniques for using PowerShell as part of the audit process in Windows environments, and view a number of examples of using PowerShell for solving real-world audit problems.

The topic of this webcast is adapted as a sample of the many important audit tools and techniques covered in the SANS course AUD507: Auditing & Monitoring Networks, Perimeters & Systems.

Speaker Bio

Clay Risenhoover

Clay is the president of Risenhoover Consulting, Inc., an IT management consulting firm based in Durant, Oklahoma. Founded in 2003, RCI provides IT audit and IT management consulting services to clients in multiple sectors. Clay's past experience includes positions in software development, technical training, LAN and WAN operations, and IT management in both the private and public sector. He is a SANS Certified Instructor, certified public accountant, has a master's degree in computer science and holds a number of technical and security certifications, including GPEN, GWEB, GSSP-NET, GSNA, CISA, CISM, CEH and CISSP.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.