Получение информации из Active Directory с PowerShell, часть 1.

И снова здравствуйте.

Вот так мы все обходили стороной возможности Powershell в получении информации из домена. Не было необходимости. Но работая над формированием очередного списка хостов у меня накопились свои записки PS1-вызовов. Ну хватит, пора к делу. Поехали. Как добавить модуль ActiveDirectory в свою PS вы уже знаете.

Что мы имеем в распоряжении для сбора информации смотрим так:
Get-Command -Module ActiveDirectory | where {$_.Name -like 'Get-*'}


Так добываем информацию по группам:
#GROUP ##################################################################

:Get Group with 0 members
get-ADGroup -filter "members -notlike '*' -AND GroupScope -eq 'Universal'" -SearchBase "OU=Groups, OU=Employees, DC=forza, DC=local" | Select Name, Group*
get-ADGroup -filter * | where {-Not ($_ | get-adgroupmember)} | Select Name

:Get Members of Group
Get-ADGroupMember "Domain Admins"
Get-ADGroupMember "Администраторы домена" | sort objectClass

Get-ADGroupMember "Администраторы" | sort objectClass,Enabled
Get-ADGroupMember "Группа администрирования"

:Get Users for Remoted desktop service
Get-ADGroup -filter 'Name -like "Пользователи удаленного*"'
Get-ADGroupMember "Пользователи удаленного рабочего стола" | Select name

:Ad-Remove group
Remove-ADGroup OldSkullGroup
Add-ADGroup NewSkillGroup

А так добываем информацию по пользователям:
#USER ####################################################################



:Get inactive users
Get-ADUser -filter "Enabled -eq 'False'" | sort objectClass
Get-ADUser -filter "Enabled -eq 'False'" | Select Name
Get-ADUser -filter "Enabled -eq 'False'" | Select DistinguishedName

:Get users which were blocked 180 days ago
Get-ADUser -Filter "Enabled -eq '$false' -and Modified -lt '$((Get-Date).AddDays(-180))'"

:Get Groups of current User
get-ADUser GOGA -property MemberOf
get-ADUser -identity GOGA -property *

:Users without EmailAddress
get-ADUser -Filter {EmailAddress -notlike "*forza.com.ua"} -Properties EmailAddress | ft Name,EmailAddress
get-ADUser -Filter {EmailAddress -notlike "*"} -Properties EmailAddress | ft Name,EmailAddress

:Add-Remove user
Remove-ADUser Myname
Add-ADUser Myname

:Unlock user
Unlock-ADAccount Myname

:On-off User OR Host
Disable-ADAccount Myname
Enable-ADAccount Myname

:Add-remove user to group
Add-ADGroupMember "Group" -Member "Myname"
Remove-ADGroupMember "Group" -Member "Myname"

:recopy groups from 2nd to 1st
Get-ADUser -Identity 2nd -Properties memberof | Select-Object -ExpandProperty memberof | Add-ADGroupMember -Members 1st

:Users which were created during last 24hrs
$lastday = ((Get-Date).AddDays(-1))
$filename = Get-Date -Format yyyy.MM.dd
$exportcsv="d:\new_AD_users_" + $filename + ".csv"
Get-ADUser -filter {(whencreated -ge $lastday)} | Export-csv -path $exportcsv

А так добываем информацию по хостам:
#HOST ######################################################################

:Get inactive computers
Get-ADComputer -filter "Enabled -eq 'False'" | Select Name

:Get Canonical name of current Host
get-ADComputer Hostname -property DistinguishedName

:Get hosts which were inactive from NY
get-ADComputer -filter "Passwordlastset -lt '1/1/2018'" -properties * | Select name, passwordlastset

$cutoff=(Get-Date "1/1/2018").ToFileTime()
Get-ADComputer -Filter "(lastlogontimestamp -lt $cutoff) -or (lastlogontimestamp -notlike '*')" -property * | Select Name,LastlogonTimestamp,PasswordLastSet

:Get hosts which were inactive during last 90 days
$date_with_offset= (Get-Date).AddDays(-90)
Get-ADComputer -Properties LastLogonDate -Filter {LastLogonDate -lt $date_with_offset } | Sort LastLogonDate | FT Name, LastLogonDate -Autosize
Get-ADComputer -Properties LastLogonDate -Filter {(LastLogonDate -lt $date_with_offset) -and (Enabled -eq 'True')} | Sort LastLogonDate | FT Name, LastLogonDate -Autosize


:Get host and his timestamps
Get-ADComputer -filter "Name -eq 'АROМA'" -Properties * | select name,@{Name="LastLogon";Expression={[datetime]::FromFileTime($_.Lastlogontimestamp)}},passwordlastset

:Get OS servers and servicepack
Get-ADComputer -Filter "OperatingSystem -like '*Server*'" -properties OperatingSystem,OperatingSystemServicePack | Select Name,Op* | format-list

:Look out for quantity of server OS or No
Get-ADComputer -filter "(Name -like 'MYHOST-*') -and (OperatingSystem -notlike '*Server*')" | Select Name
Get-ADComputer -filter "(Name -like 'MYHOST-*') -and (OperatingSystem -like '*Server*')" | Select Name

:Noname OS
Get-ADComputer -filter  "OperatingSystem -notlike '*'" -properties OperatingSystem | Select Name,OperatingSystem

:Get last logon for host
Get-ADComputer -identity Hostname -Properties * | FT Name, LastLogonDate -Autosize

:Add-Remove host
Remove-ADComputer Hostname
Add-ADComputer Hostname

####################################################################
Не забываем что все результаты можно красиво уложить в файлик.
Достаточно в конце команды добавить что-то типа:
..| Format-Table -AutoSize C:\Script\server_system.txt
или
..| Export-CSV All-Windows.csv -NoTypeInformation -Encoding UTF8

А это разминка. Выборка определенных событий из домена.
:Account policy audit
требует предварительного включения аудита входов в локальной политике контроллера домена!
4724 - аn attempt was made to reset an account’s password (сброс пароля пользователя администратором)
4723 - аn attempt was made to change an account’s password (смена пароля самим пользователем)

(Get-ADComputer -SearchBase ‘OU=Domain Controllers,DC=forza,DC=local’ -Filter *).Name | foreach {
Get-WinEvent -ComputerName $_ -FilterHashtable @{LogName="Security";ID=4724 }| Foreach {
$event = [xml]$_.ToXml()
if($event)
{
$Time = Get-Date $_.TimeCreated -UFormat "%Y-%m-%d %H:%M:%S"
$AdmUser = $event.Event.EventData.Data[4]."#text"
$User = $event.Event.EventData.Data[0]."#text"
$dc = $event.Event.System.computer
write-host “Admin ” $AdmUser “ reset password to ” $User “ on ” $dc “ “ $Time
  }
 }
}

$time = (get-date) - (new-timespan -hour 24)
Get-WinEvent -FilterHashtable @{LogName="Security";ID=4723;StartTime=$Time}| Foreach {
$event = [xml]$_.ToXml()
if($event)
{
$Time = Get-Date $_.TimeCreated -UFormat "%Y-%m-%d %H:%M:%S"
$NewUser = $event.Event.EventData.Data[0]."#text"
$ADGroup = $event.Event.EventData.Data[2]."#text"
$AdminUser = $event.Event.EventData.Data[6]."#text"
$dc = $event.Event.System.computer
$Time + “|” + $ADGroup + “| ” + $NewUser + “| ” + $AdminUser
 }
}

Ну-ка, кто заблокировал аккаунт?
:Who is this Account blocked?
Username = ‘username1’
$Pdce = (Get-AdDomain).PDCEmulator
$GweParams = @{
‘Computername’ = $Pdce
‘LogName’ = ‘Security’
‘FilterXPath’ = "*[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$Username']]"
}
$Events = Get-WinEvent @GweParams
$Events | foreach {$_.Properties[1].value + ' ' + $_.TimeCreated}

Увидимся.