Question

我正在进行一次分配，希望获得具有X密码年龄的本地Windows管理员用户列表。为本地管理员用户和其他年龄段的用户提供以下功能。请帮我整合这些。

我有以下命令可以使用用户列表来获取特定组和主机名的详细信息。

Get-Content -Path "D:\Groups.txt" | ForEach-Object {
    Get-GroupMember -ComputerName (Get-Content -Path "D:\servers.txt") -LocalGroup $_
} | Export-Csv -Path D:\Getgroupmembers_$(Get-Date -Format ddMMyyyy).csv -NoTypeInformation

用户列表：

function Get-GroupMember {
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory=$true)]
        [Alias('Group')]
        [string]$LocalGroup,
        [Alias('CN','Computer')]
        [string[]]$ComputerName = '.'
    )

    foreach ($Computer in $ComputerName) {
        Write-Verbose "Checking membership of localgroup: '$LocalGroup' on $Computer"
        try {
            ([adsi]"WinNT://$Computer/$LocalGroup,group").psbase.Invoke('Members') | ForEach-Object {
                New-Object -TypeName PSCustomObject -Property @{
                    ComputerName = $Computer
                    LocalGroup   = $LocalGroup
                    Member       = $_.GetType().InvokeMember('Name', 'GetProperty', $null, $_, $null)
                }
            }
            Write-Verbose "Successfully checked membership of localgroup: '$LocalGroup' on $Computer"
        } catch {
            Write-Warning $_
        }
    }
}

要检查密码时代，我们可以使用下面的代码，我们需要使用一个命令集成这两个：

function Get-PwdAge {
    [CmdletBinding()]
    Param(
       [Parameter(Mandatory=$false,
            Position=1,
            ValueFromPipeline=$false,
            ValueFromPipelineByPropertyName=$false)]
        [String]$Usr,
        [Switch]$All
    ) 

    $filter = "(&(objectCategory=person)(objectClass=user)(name=$Usr))"
    if ($All) {
        $filter = '(&(objectCategory=person)(objectClass=user))'
    }
    $root = New-Object System.DirectoryServices.DirectoryEntry("LDAP://RootDSE")
    $searcher = New-Object System.DirectoryServices.DirectorySearcher $filter
    $SearchRoot = $root.defaultNamingContext
    $searcher.SearchRoot = "LDAP://CN=Users,$SearchRoot"
    $searcher.SearchScope = 'SubTree'
    $searcher.SizeLimit = 0
    $searcher.PageSize = 1000
    $searcher.FindAll() | ForEach-Object {
        $account = $_.GetDirectoryEntry()
        $pwdset = [DateTime]::FromFileTime($_.Properties.Item("pwdLastSet")[0])
        $age = (New-TimeSpan $pwdset).Days
        $info = 1 | Select-Object Name, Login, AgeInDays, LastSet
        $info.Name = $account.DisplayName[0]
        $info.Login = $account.SamAccountName[0]
        $info.AgeInDays = $age
        $info.LastSet = $pwdset
        $info
    }
}

Answer 1

   Param
  (
  [Parameter(Position=0,Mandatory=$false)]
  [ValidateNotNullorEmpty()]
  [Alias('cn')][String[]]$ComputerName=$Env:COMPUTERNAME,
  [Parameter(Position=1,Mandatory=$false)]
  [Alias('un')][String[]]$AccountName,
  [Parameter(Position=2,Mandatory=$false)]
  [Alias('cred')][System.Management.Automation.PsCredential]$Credential
  )
  $Obj = @()

  $now = Get-Date

  Foreach($Computer in $ComputerName)
{
If($Credential)
{
    $AllLocalAccounts = Get-WmiObject -Class Win32_UserAccount -Namespace "root\cimv2" `
    -Filter "LocalAccount='$True'" -ComputerName $Computer -Credential $Credential -ErrorAction Stop
 }
 else
{
    $AllLocalAccounts = Get-WmiObject -Class Win32_UserAccount -Namespace "root\cimv2" `
    -Filter "LocalAccount='$True'" -ComputerName $Computer -ErrorAction Stop
    }



$Obj = $AllLocalAccounts | ForEach-Object {

        $user = ([adsi]"WinNT://$computer/$($_.Name),user")
        $pwAge    = $user.PasswordAge.Value
        $maxPwAge = $user.MaxPasswordAge.Value
        $pwLastSet = $now.AddSeconds(-$pwAge)


     New-Object -TypeName PSObject -Property @{


       'Account Name'         = $_.Name
       'Disabled'             = $_.Disabled
       'Password Expires'     = $_.PasswordExpires
       'Password Last Set'    = $pwLastSet
       'Password Expiry Date' = $now.AddSeconds($maxPwAge - $pwAge)
       'Password Required'    = $_.PasswordRequired
       'Domain'               = $_.Domain  
       'Password Age'         = ($now - $pwLastSet).Days

     }
   }

 If($AccountName)
    {
    Foreach($Account in $AccountName)
    {
        $Obj|Where-Object{$_.Name -like "$Account"}
    }
  }
else
  {
    $Obj
  }
 }

获得密码年龄的本地管理员用户

1 个答案: