[Webinar] Streamline your web hosting managementRegister Today

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 343
  • Last Modified:

VBScript: Elevated Account Audit

Hello Experts!

     Just curious if anyone has in their script repository a script that will go out and audit AD of all newly created administrator accounts.  I'd need the script to pull how many ADM accounts were created the week prior and as well as which permissions were assigned and what groups they belong to and then produce an output file such as .CSV reporting the findings.  Any help is GREATLY APPRECIATED!

1 Solution
Meir RivkinFull stack Software EngineerCommented:
function get-localadministrators {
    param ([string]$computername=$env:computername)
	$week = (Get-Date).AddDays(-7)
    $computername = $computername.toupper()
    $ADMINS = get-wmiobject -computername $computername -query "select * from win32_groupuser where GroupComponent=""Win32_Group.Domain='$computername',Name='administrators'""" | % {$_.partcomponent}

    foreach ($ADMIN in $ADMINS) {
                $admin = $admin.replace("\\$computername\root\cimv2:Win32_UserAccount.Domain=","") # trims the results for a user
                $admin = $admin.replace("\\$computername\root\cimv2:Win32_Group.Domain=","") # trims the results for a group
                $admin = $admin.replace('",Name="',"\")
                $admin = $admin.REPLACE("""","")#strips the last "
				$domainadmin = $admin.split("\")[0]
				$username = $admin.split("\")[1]
				$user = Get-ADUser $admin.split("\")[1] -Properties memberOf, whenCreated
				$whenCreated = $user.whenCreated
				if($week -ge $whenCreated) {
					$memberOf = $user.memberOf
					$groups = ($memberOf | Get-ADGroup | select -expand name) -join ","
	                $objOutput = New-Object PSObject -Property @{
	                    Machinename = $computername
	                    DomainName  = $domainadmin
	                    UserName = $username
						WhenCreated = $whenCreated
						MemberOf = $groups
	                }#end object
    }#end for

    return $objreport
}#end function

get-localadministrators | Export-Csv c:\temp\1.csv -NoTypeInformation

Open in new window

from http://andrewmorgan.ie/2011/06/10/retrieve-a-list-of-local-administrators-using-powershell/

Featured Post

Free tool for managing users' photos in Office 365

Easily upload multiple users’ photos to Office 365. Manage them with an intuitive GUI and use handy built-in cropping and resizing options. Link photos with users based on Azure AD attributes. Free tool!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now