Question

我有一个脚本，我认为这是能够为计算机上的所有用户获取IE历史记录的最佳方式。我的问题是它对我以外的用户不起作用，因为我在尝试打开文件夹时收到权限错误。有没有人有任何想法如何解决权限问题？

我在Windows 2012r2计算机上运行此脚本，而且我是该框的管理员。

谢谢！

function Get-History 
{
    param
    (
        [string]$userName
    )

$shell = New-Object -ComObject Shell.Application 

if($username)
{
    $users = $username
}
else
{
    $users = Get-ChildItem C:\Users
}

if((([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")))
{
    Foreach($user in $users)
    {
        $user = Split-Path $user -leaf
        try
        {
            $ErrorActionPreference = 'Stop'
            $hist = $shell.NameSpace("C:\Users\$user\AppData\Local\Microsoft\Windows\History") 
        }
        catch
        {
            continue
        }
        $folder = $hist.Self 
        #$folder.Path

            if($hist){
            $hist.Items() | foreach { 
                #""; ""; $_.Name 
                 if ($_.IsFolder) { 
                     $siteFolder = $_.GetFolder 
                     $siteFolder.Items() | foreach { 
                        $site = $_ 
                        #""; $site.Name 
                        if ($site.IsFolder) { 
                            $pageFolder  = $site.GetFolder 
                            $pageFolder.Items() | foreach { 
                                $url = $pageFolder.GetDetailsOf($_,0) 
                                $date =  $pageFolder.GetDetailsOf($_,2) 
                                #"$user`: $date visited $url"  

                                #Write-Output ("$user,$date,`"$url`"" | ConvertFrom-Csv)

                                New-Object -TypeName PSObject -Property @{
                                                                          user=$user;
                                                                          date = $date;
                                                                          url = $url
                                                                          }
                            } 
                        } 
                     } 
                 } 
            }
        }    

    }
}
else
{
    Write-Host "Not Admin"
}
}

如果我只运行小片段：

$shell = New-Object -ComObject Shell.Application            
$hist = $shell.NameSpace("C:\Users\MyOwnUsername\AppData\Local\Microsoft\Windows\History")

然后我成功地将$ hist变量指定为System .__ ComObject

但如果我跑：

$shell = New-Object -ComObject Shell.Application            
$hist = $shell.NameSpace("C:\Users\SomeOtherUser\AppData\Local\Microsoft\Windows\History")

我明白了：

Exception calling "NameSpace" with "1" argument(s): "Unspecified error (Exception from HRESULT: 0x80004005 (E_FAIL))"
At line:3 char:1
+ $hist = $shell.NameSpace("C:\Users\SomeOtherUser\AppData\Local\Microsoft\Windows\History ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : ComMethodTargetInvocation

完全披露：在this blog post

对脚本进行了轻微修改

Answer 1

我从未解决过权限问题。我改变策略使用Nirsoft的BrowsingHistoryViewer。

$execPath = "C:\BrowsingHistoryView.exe"

$computers = 'computer1','computer2','computer3','computer4'

$outPath = "c:\"

$computers | 
    ForEach-Object{ `
        Start-Process $execPath `
            -argumentList "/HistorySource 3", 
                          "/HistorySourceFolder ""\\$_\c$\Users""",
                          "/scomma ""$outpath\history_$_.txt"""
    }

IE历史记录其他用户的权限

1 个答案: