PowerShell - server local admins reporting from a list of servers

user_17527560 0
Viewed 1386

Beginner question. We only grant access to servers by AD group. We need to report who has admin access to a list of Windows servers. My auditor likes my Server Admins script however she also wants to know the group members first, last name. I don't need to use the ADGroupMember script, if there is a better way.

If someone could point me in the right direction that will be great. It's important I understand so I can do it myself next time : )

Thanks in advance

$computers = Get-content "c:\scripts\servers.txt"
ForEach ($Line In $computers)

{
  #write-host $Line
 Invoke-command -ComputerName $line -ScriptBlock { net localgroup administrators}  | Get-ADGroupMember -Identity "$_????what goes here????" |%{get-aduser $_.SamAccountName | select userPrincipalName } | out-file "c:\scripts\'$line'LocalAdmin.txt"
 }

This script works great but does not list out group members first, lastname

$computers = Get-content "c:\scripts\servers.txt"
ForEach ($Line In $computers)

{
  #write-host $Line
 Invoke-command -ComputerName $line -ScriptBlock { net localgroup administrators}  | out-file "c:\scripts\'$line'LocalAdmin.txt"
 }
powershell
2 Answers

If you really need information about the users in the local Administrators group, you can use the cmdlets from the PSv5.1+ Microsoft.PowerShell.LocalAccounts module.

However, note that local accounts just have a single .FullName property, not separate first and last name ones. Also, this property may or may not be filled in:

Invoke-Command -ComputerName (Get-Content c:\scripts\servers.txt) -ScriptBlock {
  Get-LocalGroupMember -Group Administrators | 
    Where-Object ObjectClass -eq User |
      Select-Object Sid | 
        Get-LocalUser
} |
  Sort-Object PSComputerName | 
    Select-Object PSComputerName, Name, FullName

If domain users are among the group's members and you do need separate first and last name information, pipe to Get-ADUser instead of to Get-LocalUser - you can distinguish users by their source (where they are defined) via the .PrincipalSource property, available on the output objects from Get-LocalGroupMember from Window 10 / Windows Server 2016.

user_453750

An alternative to mklement0's helpful answer, somewhat old school, using [adsi]:

$servers = Get-Content c:\scripts\servers.txt

Invoke-Command -ComputerName $servers -ScriptBlock {
    $adsi = [adsi]"WinNT://$env:COMPUTERNAME,computer"
    $adsi.PSBase.Children.Find('Administrators').PSBase.Invoke('members') |
    ForEach-Object {
        $Name    = $_.GetType().InvokeMember('Name','GetProperty',$null,$_,$null)
        $class   = $_.GetType().InvokeMember('Class','GetProperty',$null,$_,$null)
        $adspath = $_.GetType().InvokeMember('ADSPath','GetProperty',$null,$_,$null)
        $sid = [System.Security.Principal.SecurityIdentifier]::new(
            $_.GetType().InvokeMember('objectsid','GetProperty',$null,$_,$null),0
        ).Value
    
        [pscustomobject]@{
            Name = $Name
            Class = $Class
            Path = $adspath -replace '^WinNT://'
            SecurityIdentifier = $sid
        }
    } | Sort-Object Class -Descending
} | Where-Object Class -EQ User
user_153395440
Related