Tuesday, 13 September 2016

Get Local Administrators using PowerShell

Copy & Paste the below powershell script in Windows Powershell

Function Get-LocalGroup  {

  [Cmdletbinding()]

  Param(

  [Parameter(ValueFromPipeline=$True, ValueFromPipelineByPropertyName=$True)]

  [String[]]$Computername =  $Env:COMPUTERNAME,

  [parameter()]

  [string[]]$Group

  )

  Begin {

  Function  ConvertTo-SID {

  Param([byte[]]$BinarySID)

  (New-Object  System.Security.Principal.SecurityIdentifier($BinarySID,0)).Value

}
        Function  Get-LocalGroupMember {

  Param  ($Group)

  $group.Invoke('members')  | ForEach {

  $_.GetType.Invoke().InvokeMember("Name",'GetProperty', $null, $_, $null)

  }

  }

  }

  Process  {

  ForEach  ($Computer in  $Computername) {

  Try  {

  Write-Verbose  "Connecting to $($Computer)"

  $adsi  = [ADSI]"WinNT://$Computer"

  If  ($PSBoundParameters.ContainsKey('Group')) {

  Write-Verbose  "Scanning for groups: $($Group -join ',')"

  $Groups  = ForEach  ($item in  $group) {                       

  $adsi.Children.Find($Item, 'Group')

  }

  } Else  {

  Write-Verbose  "Scanning all groups"

  $groups  = $adsi.Children | where {$_.SchemaClassName -eq  'group'}

  }

  If  ($groups) {

  $groups  | ForEach {

  [pscustomobject]@{

  Computername = $Computer

  Name = $_.Name[0]

  Members = ((Get-LocalGroupMember  -Group $_))  -join ', '

  SID = (ConvertTo-SID -BinarySID $_.ObjectSID[0])

  }

  }

  } Else  {

  Throw  "No groups found!"

  }

  } Catch  {

  Write-Warning  "$($Computer): $_"

  }

  }

  }

  }

Then, Mentioned the computer names which you want to get the users list from administrator groups and then save the txt file

In powershell ->  $Computers = Get-Content C:\Computers.txt

Then, using the below script, you can get the local admin users with format

Get-LocalGroup -Computername $computers -Group  Administrators | Select ComputerName, Name, Members | Format-Table -AutoSize





No comments:

Post a Comment