Converting a Powershell ADUC query to VBS - powershell

So, I have a Powershell script that I use to see if usernames in an array are Smartcard Enabled. A lot of the scripts that are used to automate my company use VBS. Unfortunately my VBS is VERY rusty and I need to convert this powershell into VBS so my lead programmer can use it in a larger script. The script is below. I am leaving out the ADUC Hierarchy for my company's safety. It will be written in the code as "OU=,DC=" Thanks for the assist.
$Array="C:\UserNames.csv"
ForEach($Name in $Array)
{
Get-ADUser -SearchBase "OU=,DC=" -Filter * -Properties * | Where {$_.CN -like "*$Name*"} | Where {$_.SmartcardLogonRequired -eg %False} | Select SamAccountName,GivenName,Surname,SmartcardLogonRequired
}


Turns out he didn't actually want this translated. He needed the UserAccountControl Code for SMARTCARD_REQUIRED (262144). Well, I can scrap the last 3 days of work. Thanks for the comments.

Related

Export more than 1000 rows in Powershell

I am trying to access some data about Unified Groups using PowerShell.
Get-UnifiedGroup | ? {$_.AccessType -eq "Public"}
This is the command I am using, however I am also trying to export this data to CSV.
So the command becomes
Get-UnifiedGroup | ? {$_.AccessType -eq "Public"} | Export-Csv c:\temp\azureadusers.csv
But it only displays first 1000 results in the csv file and I am trying to get all of the data. I am new to PowerShell so I am still learning this.
How can I achieve this?

you may want too look at the -Filter Parameter too. It's always a good thing to filter as far left as possible. Mostly because it's free Performance gain.
-Filter {AccessType -eq "Public"}

Ldap filter for multiple Ou's Powershell

Hello guys still pretty new to Powershell and never worked with Ldap -filter before so i have a question. Is it possible to get AD-User's out of mulitple Ou's with one Ldap filter?
OU=D5,OU=Standard,OU=User,OU=1,DC=test,DC=for-me,DC=nl
OU=D3,OU=Standard,OU=User,OU=1,DC=test,DC=for-me,DC=nl
OU=G2,OU=General,OU=User,OU=1,DC=test,DC=for-me,DC=nl
OU=C6,OU=Expired,OU=User,OU=1,DC=test,DC=for-me,DC=nl
Im sorry i have not even a Code example but nothing i've tried came near to what i want.
Im open for tipps, hints, ideas etc. Thanks already.

You cannot make the OU part of the LDAP filter. But you can make an OU the base of your search and issue multiple searches.
# an array of OUs, this could also be achieved with e.g. $OUs = Get-Content 'some_file.txt'
$OUs = #(
"OU=D5,OU=Standard,OU=User,OU=1,DC=test,DC=for-me,DC=nl"
"OU=D3,OU=Standard,OU=User,OU=1,DC=test,DC=for-me,DC=nl"
"OU=G2,OU=General,OU=User,OU=1,DC=test,DC=for-me,DC=nl"
"OU=C6,OU=Expired,OU=User,OU=1,DC=test,DC=for-me,DC=nl"
)
foreach ($ou in $OUs) {
Get-ADUser -SearchBase $ou
}

Well it is not an LDAP Query and might be suspicious in a very large environment, but normally I suggest use the filter options of Powershell like below:
Get-ADUser -Filter * | Where-Object { $_.DistinguishedName.split(",",2)[1] -in
"OU=D5,OU=Standard,OU=User,OU=1,DC=test,DC=for-me,DC=nl",
"OU=D3,OU=Standard,OU=User,OU=1,DC=test,DC=for-me,DC=nl",
"OU=G2,OU=General,OU=User,OU=1,DC=test,DC=for-me,DC=nl",
"OU=C6,OU=Expired,OU=User,OU=1,DC=test,DC=for-me,DC=nl"
}

pipelined Powershell cmdlet showing partial result?

I am writing some C# program that executes PowerShell script.
I have the following line
Get-Mailbox -ResultSize:unlimited |
Get-MailboxPermission |
Where {($_.IsInherited -eq $false) -and !($_.user -like "S-1*") -and !($_.user -like "NT A*") } |
select identity,user,#{n="objectid";e={(get-recipient -identity $_.user).ExternalDirectoryObjectId}}
basically it finds all mailbox permissions and retrieves corresponding ExternalDirectoryObjectId (which is same as Azure ObjectID)
The issue here is that the result returned is different from different machines. I would get all identity, user values, but for expression values that are in bold above, will only start to show up half way through the execution.
for example on computer x
Identity|User|objectid
user1 |userA|
user2 |userA|
user2 |userB|
... |... |
user10|userC|
user11|userC|<objectID1>
user11|userD|<objectID2>
I noticed that on fast computer the objectIDs start showing up late, on slower computers it starts showing up early, however execution times are different.
How do I modify this so that objectGuid is retrieved for all entries? Why is pipelining not waiting until the calculated property objectID is properly retrieved?
If I write a short PowerShell script and use for loops for each mboxpermissions and retrieve them one by one, all of those objectGuids are retrievable. But it's slow.
Thanks for help and Please give me any suggestions!

Get-ADComputer Lastlogondate / Lastlogon

I'm currently asking myself if it is possible to determine the last logon time of any user of a computer object which is connected to an active directory?
I need to find out when any user was logged onto a specific computer which is still online, communicating with the domain but was not in use in the last X days by any user.
I've already tried the following queries:
get-adcomputer $computername -Properties lastlogon | select
#{Name="lastLogon";Expression={[datetime]::FromFileTime($_.'lastLogon')}}
AND
get-adcomputer za31testvmrobin -Properties lastlogondate
I'm expecting the timestamp of the last logondate of a user on a computer object.
Hope you can help me.

I somehow figured it out with help from #boxdog . Thanks for that.
Here is the Powershell Code in one line:
Get-EventLog -LogName Security -InstanceId 4624 -ComputerName $computer |
`where {$_.Message -match "Kontoname: USERNAME" -and
`$_.Message -match "Anmeldetyp: 2" } | select -First 1)
Kontoname = Accountname
Anmeldetyp = Logontype (2 means interactive from console with keyboard & mouse)
The tabulator is needed. You can also use wildcards like an asterisk.
I could not find an easier way to get it working. Therefor I had to use the comparison operator "match" to find a string with which I could search within the Message property of the Eventlog.
Unfortunately searching takes some time. Via remote it takes up to 5 minutes each computer which is quiet unsatisfying.
Maybe someone has another solution which is faster or knows a way to work parallel, actually I don't really know how to do that, because I'm getting content with
get-content c:\data\input.txt
Thanks in advance

Powershell script to update Active Directory attribute

I have limited exposure to Powershell so I need some help.
I have a CSV file with just the SamAccounName. I would like to use powershell to import that file and update the employeeID attribute with the sammaccountname value. The import is the easy part:
$users = Import-Csv c:\filename.csv
Using the file to update the employeeid attribute is what I need help with. Thanks in advance for your help.

There is some great documentation about this here so you can get a good idea about this: https://technet.microsoft.com/en-us/library/ee617215.aspx
With RSAT Running you need to Import the AD Cmdlet's Import-Module ActiveDirectory
Once this is done you are starting to head down the appropriate path, try working with the following:
Import-CSV $csvFile | forEach { Set-ADUser $_.SamAccountName -EmployeeID $_.SamAccountName -WhatIf }
This can go much further, have a look at the top link instead of copying and pasting this code as you don't want to make error on this. But there should be enough information here to get you up and running.
Note the '-WhatIf' in the above code means PoSh will tell you what will happen rather than making it happen.