Revise usage examples for PowerShell scripts

Updated usage examples for various PowerShell scripts in the README file to improve clarity and consistency.

Author: rolling-code

README.md

@@ -133,7 +133,6 @@ Notice the PowerShell user agent given we are using API calls from PS
 Notice the MFA requirement error description, as expected.
 ![Notice the MFA requirement](Azure%20Active%20Directory/docs/image-20250514-202748.png)
 
-Use like so:
 ```powershell
 .\get_az_token.ps1 -TenantId "xxx" -Username "you@foo.bar" -ClientId "yyy" -AcknowledgeAuthorizedTesting
 ```
@@ -158,7 +157,6 @@ Uses AADinternals to run Eight security checks on the tenant.
 Performs a read-only analysis of the user-assignment scope for Microsoft Entra Conditional Access policies. The script resolves direct and transitive group memberships, active supported directory roles, policy inclusions and exclusions, and policy state, then explains why each policy targets, excludes, or does not target the specified user.
 The script does not calculate whether every policy will trigger during a specific authentication attempt. Conditional Access runtime conditions such as cloud application, device compliance, platform, location, user or sign-in risk, client type, and authentication flow require the Conditional Access What If tool or sign-in-log evidence.
 
-Use like so:
 ```powershell
 .\get_policies.ps1 -UserPrincipalName "foo@contoso.com" -OutputCsv ".\ConditionalAccessUserTargeting.csv"
 ```
@@ -173,7 +171,6 @@ Microsoft Graph Command Line Tools must be granted. If not you will be prompted
 Demonstrates how a privileged Microsoft Graph administrator can programmatically create a user-specific delegated permission grant between a client service principal and Microsoft Graph, then assign the client application to the selected user. The delegated grant authorizes the application to call Microsoft Graph on behalf of that user, subject to the granted scopes and the user’s own effective permissions.
 This administrative workflow illustrates one mechanism that can be abused after a highly privileged identity or application is compromised. The script does not create a malicious application, perform consent phishing, obtain tokens, or independently bypass MFA. Because it modifies tenant consent and application assignments using highly privileged Graph permissions, it should be used only in an isolated lab or explicitly authorized administrative workflow.
 
-Use like so:
 ```powershell
 .\grant_consent_MSGraph.ps1  -ClientAppId "11111111-1111-1111-1111-111111111111"
 
@@ -187,7 +184,6 @@ Use like so:
 Sends an authorized email through Microsoft Graph using app-only client-credentials authentication and the Mail.Send application permission. The script accepts configurable sender, recipient, subject, and message-body values, reads the application secret from an environment variable, supports a dry-run mode, and returns detailed Microsoft Graph errors without printing or storing access tokens.
 The Entra application must have the Microsoft Graph Mail.Send application permission with administrator consent. Because this permission can provide broad mail-sending capability, Exchange Online App RBAC should be used to restrict the application to approved sender mailboxes. An HTTP 202 Accepted response confirms that Microsoft Graph accepted the message for processing, but does not guarantee final delivery.
 
-Use like so:
 ```powershell
 $secureSecret = Read-Host "Enter the application client secret" -AsSecureString
 
@@ -218,7 +214,6 @@ This read-only script audits Azure Storage accounts across all subscriptions acc
 
 This script consumes the container CSV generated by Get-AzureStorageAnonymousAccess.ps1 and performs unauthenticated curl.exe tests against each applicable Blob container. It checks anonymous container enumeration and can optionally validate exact-object access using a one-byte range request when the CSV contains an ExactBlobName column.
 
-Use like so:
 ```powershell
 .\Test-AzureBlobAnonymousEndpoints.ps1 -InputCsv "C:\Users\mario\StorageContainerPublicAccessDetails-20260730-003512.csv"
 ```
@@ -244,13 +239,14 @@ The script queries Microsoft Graph and therefore does not require a corporate ne
 ---
 ### `Get-DisabledUsersLicenses6.ps1`
 
-Scans the tenant for disabled Microsoft 365 users via Microsoft Graph and resolves their assigned licenses into readable names.
-Outputs a formatted table and optionally exports a CSV; preserves dry‑run behavior so no changes are made unless explicitly requested.
+Scans Microsoft Entra ID for disabled users who still have assigned Microsoft licenses and resolves license SKU identifiers into readable product names. The script exports one row per user-license assignment, distinguishes direct licensing from group-based licensing, identifies the assigning group, and records assignment state and errors.
+An optional per-user summary consolidates each disabled account’s licenses and assignment methods for easier license-reclamation review. The script is completely read-only and does not modify users, groups, or license assignments.
 
-Use like so:
-`Connect-MgGraph -Scopes "User.Read.All","Directory.Read.All" -UseDeviceAuthentication`
-
-`.\Get-DisabledUsersLicenses6.ps1 -ExportCsv .\disabled_licenses.csv`
+```powershell
+.\Get-DisabledUsersLicenses6.ps1 
+    -ExportCsv ".\DisabledUserLicenseDetails.csv" 
+    -SummaryCsv ".\DisabledUserLicenseSummary.csv"
+```
 
 ---
 ### `RemoveM365LicensesfromDisabledUsers3.ps1`
@@ -287,26 +283,27 @@ Prerequisites: An active Graph session (Connect-MgGraph) with User.ReadWrite.All
 
 All scripts rely on the **[Microsoft.Graph PowerShell SDK](https://learn.microsoft.com/powershell/microsoftgraph/overview)**  
 Before running the scripts, establish a Graph session with sufficient rights:
-Use like so:
-
-`.\list_all_applications2.ps1` Generates CSV files
+```powershell
+.\list_all_applications2.ps1 //Generates CSV files
 
-`.\BulkMultiPermExploitability2.ps1 -ScopeCsvPath ScopeBreakdown.csv` This parses previously generated CSV file
+.\BulkMultiPermExploitability2.ps1 -ScopeCsvPath ScopeBreakdown.csv //This parses previously generated CSV file
+```
 
 When you see "Problem!" this is how you dig deeper into the app details
+```powershell
+.\Profile-App.ps1 -TargetAppId dddddd-ba25-43c7-a710-cxxxx
 
-`.\Profile-App.ps1 -TargetAppId dddddd-ba25-43c7-a710-cxxxx` 
-
-`.\Audit-AppDelegationRisks.ps1 -TargetAppId dddddd-ba25-43c7-a710-cxxxx`
+.\Audit-AppDelegationRisks.ps1 -TargetAppId dddddd-ba25-43c7-a710-cxxxx
+```
 
----
 ### `Audit-AllUsersRolePerms.ps1`
 
 Tenant-wide audit of default user role permissions, privileged directory roles,  and high-privilege Azure RBAC assignments—highlighting only users who exceed the locked-down defaults.
 Must have Graph API permissions Policy.Read.All to use this script
 
-Use like so:
-`.\Audit-AllUsersRolePerms.ps1`
+```powershell
+.\Audit-AllUsersRolePerms.ps1
+```
 
 ---
 👉** automate creation of malicious-looking OAuth authorization flows (device‑code and consent URLs) used in consent‑phishing simulations **
@@ -330,15 +327,16 @@ Generates OAuth device‑code or authorization URLs and associated tracking arti
 Using Azure Hybrif Workers? Keep an eye on your Runbook without cikickety-clicking the portal.
 Will print out the Runbook logs.
 
-Use like so:
-`.\watch_X_job3.ps1 -ResourceGroupName 'XXX-Hybrid-Automation'  -AutomationAccountName 'XXX-Cybersecurity-Automation' -RunbookName pwned`
-
+```powershell
+.\watch_X_job3.ps1 -ResourceGroupName 'XXX-Hybrid-Automation'  -AutomationAccountName 'XXX-Cybersecurity-Automation' -RunbookName pwned
+```
 or
-
-`$job = Start-AzAutomationRunbook  -ResourceGroupName 'XXX-Hybrid-Automation'  -AutomationAccountName 'XXX-Cybersecurity-Automation'  -Name 'pwned'  -RunOn 'xxxGroup'`
-
-`.\watch_X_job3.ps1 -ResourceGroupName 'XXX-Hybrid-Automation'  -AutomationAccountName 'XXX-Cybersecurity-Automation' -RunbookName pwned -JobId $job.JobId`
-
+```powershell
+$job = Start-AzAutomationRunbook  -ResourceGroupName 'XXX-Hybrid-Automation'  -AutomationAccountName 'XXX-Cybersecurity-Automation'  -Name 'pwned'  -RunOn 'xxxGroup'
+```
+```powershell
+.\watch_X_job3.ps1 -ResourceGroupName 'XXX-Hybrid-Automation'  -AutomationAccountName 'XXX-Cybersecurity-Automation' -RunbookName pwned -JobId $job.JobId
+```
 
 ---
 ### `Inspect-AzWebAppSecurity-Consolidated.ps1`
@@ -352,8 +350,9 @@ Will check Web app for things like:
 - Defender
 - WAF etc...
 
-Use like so:
-`.\Inspect-AzWebAppSecurity-Consolidated.ps1 -SubscriptionId xxx -ResourceGroup "yyy" -AppName "zzz" `
+```powershell
+.\Inspect-AzWebAppSecurity-Consolidated.ps1 -SubscriptionId xxx -ResourceGroup "yyy" -AppName "zzz"
+```
 
 ---
 ### `Audit-NeverSucceedingMailForwardingRules.ps1`
@@ -374,8 +373,6 @@ It checks for things like:
 
 Useful for identifying stale mailbox rules, broken forwarding logic, and forwarding-related exfiltration risk. Microsoft documents that Inbox rules can forward or redirect mailbox messages, and Microsoft also warns that automatic forwarding can be abused after account compromise for data disclosure/exfiltration.
 
-Use like so:
-
 ```powershell
 .\Audit-NeverSucceedingMailForwardingRules.ps1 -OutputDirectory . -IncludeReviewWarnings
 ```
@@ -399,8 +396,6 @@ This script is useful for identifying stale, orphaned, or risky Teams that may n
 
 The script does **not** delete, archive, or modify any Teams.
 
-Use like so:
-
 ```powershell
 .\Review-TeamsLifecycleCleanupCandidates.ps1
 ```
@@ -435,8 +430,6 @@ This script is useful for reviewing stale B2B/guest accounts before disabling or
 
 The script does **not** block, delete, or modify users.
 
-Use like so:
-
 ```powershell
 .\Report-InactiveGuestUsers-150Days.ps1
 ```
@@ -447,8 +440,9 @@ Use like so:
 
 Audits Active Directory permissions for a given user and all the groups they belong to, within a specified LDAP container. It reports every Access Control Entry (ACE) that grants the user or their groups any rights on objects under the search base.
 
-Use like so:
-`.\ad_object_permissions3.ps1 -Username "XXX\mcontestabile" -Domain "DC=YYYYYY,DC=net"`
+```powershell
+.\ad_object_permissions3.ps1 -Username "XXX\mcontestabile" -Domain "DC=YYYYYY,DC=net"
+```
 
 Each row in the output indicates a single permission grant:
 - ObjectDN
@@ -467,8 +461,9 @@ Keep an eye out for anything that shows
 
 Audits explicit ACLs for a single account under a given AD container. It dumps every Access Control Entry (ACE) on objects beneath your search base where the ACE’s IdentityReference exactly matches the provided username.
 
-Use like so:
-`.\delegated_rights.ps1 -Username "XXX\mcontestabile" -Domain "DC=YYYYYY,DC=net"`
+```powershell
+.\delegated_rights.ps1 -Username "XXX\mcontestabile" -Domain "DC=YYYYYY,DC=net"
+```
 
 ---
 ### `servers_get_smb.ps1`
@@ -493,8 +488,9 @@ Lists members of the local Administrators group on the machine where the script
 
 Tests AD accounts for blank or username-equal passwords and reports results.
 
-Use like so:
-`.\check_blank_password_users.ps1 -DomainFqdn domain.net`
+```powershell
+.\check_blank_password_users.ps1 -DomainFqdn domain.net
+```
 
 ---
 ### `check_PSSession_blank_passwords2.ps1`
@@ -516,8 +512,9 @@ For each domain joined computer, use WMI to check SMB settings.
 
 Finds enabled Active Directory users inactive for a specified number of days (default: 180), excluding the built-in Administrator account.
 
-Use like so:
-`.\inactive_users.ps1`
+```powershell
+.\inactive_users.ps1
+```
 
 ---
 ### `is_ldap_signing_enabled.ps1` (Requires PS version 7)
@@ -538,10 +535,12 @@ Audits permissions on an Active Directory user object.
 - Outputs a table showing who holds the right, what object type it applies to, the kind of rights, and whether it’s Allow or Deny.
 Use this to verify special delegation or extended rights granted to a user against their own AD object.
 
-Use like so:
-`.\replicate_permissions.ps1 -UserName "XXX\yyy"`
-
-`.\replicate_permissions.ps1 -UserName "mario@xxx.net"`
+```powershell
+.\replicate_permissions.ps1 -UserName "XXX\yyy"
+```
+```powershell
+.\replicate_permissions.ps1 -UserName "mario@xxx.net"
+```
 
 ---
 ### `replicated_rights2.ps1`
@@ -552,16 +551,18 @@ Identifies which AD objects include access control entries (ACEs) granting the t
 - WriteProperty
 - ExtendedRight
 
-Use like so:
-`.\replicated_rights2.ps1 -UserAccountName 'XXX\krbtgt' -SearchBase 'DC=xxx,DC=yyy' -Verbose`
+```powershell
+.\replicated_rights2.ps1 -UserAccountName 'XXX\krbtgt' -SearchBase 'DC=xxx,DC=yyy' -Verbose
+```
 
 ---
 ### `setNoPreauth.ps1`
 
 Provides a controlled way to disable Kerberos pre-authentication for an Active Directory user by flipping a single bit in their userAccountControl attribute. It also gives you clear visibility into which flags are set on that user object both before and after the change. Modifying the userAccountControl attribute in Active Directory isn’t something a standard domain user can do by default. You'll get "Exception calling "SetInfo" with "0" argument(s): "Access is denied."
 
-Use like so:
-`.\setNoPreauth.ps1 "LDAP://CN=Mario Contestabile,OU=blahblah,OU=bloop,DC=xxx,DC=yyy"`
+```powershell
+.\setNoPreauth.ps1 "LDAP://CN=Mario Contestabile,OU=blahblah,OU=bloop,DC=xxx,DC=yyy"
+```
 
 ---
 ### `AD_Audit_Script.ps1` (Requires PowerSploit! Ergo better to use in PowerShell 5.1 (just run powershell.exe -Version 5.1).)
@@ -573,8 +574,9 @@ Creates a report file for you.
 
 Audit powerful rights over GPOs. Inactive accounts are shown in red.
 
-Use like so:
-`.\GpoAclAudit.ps1 -DomainName xxx.net`
+```powershell
+.\GpoAclAudit.ps1 -DomainName xxx.net
+```
 
 ---
 ### `GetUsersAndTheirManagedByMachines.ps1`
@@ -627,18 +629,19 @@ This is a great tool to uncover secrets on a LAN. Corporations unknowingly share
       3. Private Keys
       4. Etc...a whole lot more
 
-Use like:
-`.\lan_audit_full2.ps1 "\\somedc.somedomain.net\UNCName\Any Folders" audit_report.csv`
+```powershell
+.\lan_audit_full2.ps1 "\\somedc.somedomain.net\UNCName\Any Folders" audit_report.csv
+```
 
 ---
 ### `CheckWritableAttributesADUsers.py|.ps1`
 
 The Python svcript uses strictly LDAP3 to enumerate the AD users (use the -dc-ip parameter to specify your Domain Controller IP).
 Then it will attempt to write "temp" to attributes to determine if any is writeable.
 Although not the most elegent solution - it works! It will write a users.cvs file, which should only contain your own AD account-any others are worhty of ivestigation!
-Use like so:
-
-`python3 CheckWritableAttributesADUsers.py DOMAIN/mcontestabile:'XXX' -dc-ip 1.2.3.4`
+```powershell
+python3 CheckWritableAttributesADUsers.py DOMAIN/mcontestabile:'XXX' -dc-ip 1.2.3.4
+```
 
 The PowerShell version does the same thing - but with a twist.
 Firstly, it will try to use ADWS first before falling back to LDAP.
@@ -712,27 +715,33 @@ Run this from where we have some "security filtering" in place and get a good id
 ---
 ### `Base64Tool.ps1`
 
-Use like so:
-
-`.\Base64Tool.ps1 -InputString 'SGVsbG8gV29ybGQh'`
-
-(Equivalent to `[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SABlAGwAbABvACAAVwBvAHIAbABkACEA'))`)
-
-`.\Base64Tool.ps1 -InputString 'Hello World!' -Encode`
+```powershell
+.\Base64Tool.ps1 -InputString 'SGVsbG8gV29ybGQh'
+```
 
-(Equivalent to `[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Hello World!'))`)
+Equivalent to 
+```powershell
+[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SABlAGwAbABvACAAVwBvAHIAbABkACEA'))
+.\Base64Tool.ps1 -InputString 'Hello World!' -Encode
+```
+Equivalent to 
+```powershell
+[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Hello World!'))
+```
 
 ---
 ### `domains2ipsipv4Only.ps1`
 
 Given a list of domain will provide DNS info. I use it in combination with the domains in a tenant to get info on them (is it on wix, aws, etc..)
 
-Use like so, first get domains from tenant:
-`az rest --method GET --uri "https://graph.microsoft.com/v1.0/domains" --headers "Content-Type=application/json" --query "value[].{Name:id,IsVerified:isVerified,AuthType:authenticationType}" -o table > all_domains.txt`
-
+First get domains from tenant:
+```powershell
+az rest --method GET --uri "https://graph.microsoft.com/v1.0/domains" --headers "Content-Type=application/json" --query "value[].{Name:id,IsVerified:isVerified,AuthType:authenticationType}" -o table > all_domains.txt
+```
 Results piped to all_domains.txt which we will feed into the script like so:
-
-`.\domains2ipsipv4Only.ps1 -InputPath all_domains.txt -OutputPath ips.txt`
+```powershell
+.\domains2ipsipv4Only.ps1 -InputPath all_domains.txt -OutputPath ips.txt
+```
 
 ---
 ### `DisableWindowsDefender.ps1`
@@ -759,7 +768,9 @@ Set interface metrics for physical adapters only.
 - Use -Trial to preview planned changes without applying them
 
 Use like so to see what changes it will perform without applying them:
-`.\SetAdaptorMetricWired_Highest.ps1 -Trial`
+```powershell
+.\SetAdaptorMetricWired_Highest.ps1 -Trial
+```
 
 ---
 ### `Check-ModularDS.ps1`