Solved

Retrieve Local Admins via Powershell

Posted on 2015-02-02
7
77 Views
Last Modified: 2015-02-02
Hey guys, i'd like a script to run to retrieve the list of local Administrators of a group of servers but only match certain users.

So something like

(Get-WMIObject Win32_Group | Where-Object { $_.Name –eq ‘Administrators’ }).GetRelated() | Where-Object { $_.__CLASS –eq “Win32_UserAccount” –or $_.__CLASS –eq “Win32_Group” } | Select-Object __CLASS,Caption,SID


But have a where-object that includes a certain user (just so we can identify if a user has local admin to any server.

Thanks for your help :)
0
Comment
Question by:Terellion
  • 3
  • 2
  • 2
7 Comments
 
LVL 11

Expert Comment

by:Tej Pratap Shukla ~Dexter
ID: 40583654
Hi..

Follow the link for script to retrive local admins

http://andrewmorgan.ie/2011/06/retrieve-a-list-of-local-administrators-using-powershell/

Thanks
Dexter
0
 

Author Comment

by:Terellion
ID: 40583684
Hi there, thanks for that. Do you know how to filter this down though so it only shows certain users?
0
 
LVL 11

Expert Comment

by:Tej Pratap Shukla ~Dexter
ID: 40583687
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 
LVL 40

Assisted Solution

by:Subsun
Subsun earned 500 total points
ID: 40583713
To find whether a user is member of a local admin group you can use following function..
Function Get-localadmin ($Comp,$User){
$group =[ADSI]"WinNT://$Comp/Administrators"
$Member = @($group.psbase.Invoke("Members")) | % {
	 $_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)
	} |?{$_ -eq $User}
 If ($Member){
	  New-Object PSObject -Property @{
	  Server = $Comp
	  Member = "Yes"
	  }
  }Else{
  New-Object PSObject -Property @{
  Server = $Comp
  Member = "No"
  }
  }
 }

Open in new window

So to check against single server
Get-localadmin -Comp ServerA -User UserA 

Open in new window

To check against a list of servers..
GC Server.txt | %{
Get-localadmin -Comp $_ -User UserA
}

Open in new window

0
 

Author Comment

by:Terellion
ID: 40583718
Hi Subsun, thats brilliant! Is there a way to only show the ones that say Member - Yes? Thanks!
0
 
LVL 40

Accepted Solution

by:
Subsun earned 500 total points
ID: 40583725
Function usage is same as shown in above comment..
Function Get-localadmin ($Comp,$User){
$group =[ADSI]"WinNT://$Comp/Administrators"
$Member = @($group.psbase.Invoke("Members")) | % {
	 $_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)
	} |?{$_ -eq $User}
 If ($Member){
	  New-Object PSObject -Property @{
	  Server = $Comp
	  Member = "Yes"
	  }
  }
 }

Open in new window

0
 

Author Comment

by:Terellion
ID: 40583732
That is absolutely superb, works a treat THANK YOU! :)
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

How to sign a powershell script so you can prevent tampering, and only allow users to run authorised Powershell scripts
This article will help you understand what HashTables are and how to use them in PowerShell.
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now