Code correction

V1.41_final

Update NetCap1.41.ps1

Minor Update

Added connection to login.microsoftonline.com as a test and marker at the start and end of the network trace

Function update v1.4

Added auto elevation to script

Function position update 1.31

Fixed the file names from the etl and the netstat txt to have the same name so they are easily associated.

Added version

Function position update 1.1

Added code to remove any lingering Net capture sessions before created a new one.

Initial release version 1.0

Initial release version

Function position update 1.3

Moved Start-NetEventSession -Name NetCap42 to after the user hits ENTER to start the trace. Previously the trace was starting before we flushed the caches

Adding new line to flush ALL Kerberos tickets on the machine - Get-WmiObject Win32_LogonSession | Where-Object {$.AuthenticationPackage -ne 'NTLM'} | ForEach-Object {klist.exe purge -li ([Convert]::ToString($.LogonId, 16))} - Muath Deeb

Moving the resolver cache and Kerberos flush to just after starting the network trace so we can pick up this traffic

Added a Netstat -anob output file to corrlate the PID in the trace note to an executable