使用本地管理员凭据检查/读取远程计算机上的注册表项值

时间:2019-06-27 11:42:27

标签: powershell powershell-4.0 powershell-remoting powershell-5.0 powershell-v6.0

如何在不在域中的计算机上检查注册表项值?

我认为我必须为此使用本地管理员凭据,但是我不知道如何

我尝试过:

Get-Wmiobject : Could not get objects from namespace root\default. Serwer RPC jest niedostępny. (Wyjątek od HRESULT: 0x800706BA) At line:12 char:8
+ $wmi = Get-Wmiobject -list "StdRegProv" -namespace root\default -Comp ...
+        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (:) [Get-WmiObject], COMException
    + FullyQualifiedErrorId : INVALID_NAMESPACE_IDENTIFIER,Microsoft.PowerShell.Commands.GetWmiObjectCommand You cannot call a method on a null-valued expression. At line:13 char:1
+ $value = $wmi.GetStringValue($HKEY_Local_Machine,$key,$valuename).sva ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull



__GENUS          : 2
__CLASS          : __PARAMETERS
__SUPERCLASS     : 
__DYNASTY        : __PARAMETERS
__RELPATH        : 
__PROPERTY_COUNT : 2
__DERIVATION     : {}
__SERVER         : 
__NAMESPACE      : 
__PATH           :  ReturnValue      : 6 uValue           :  PSComputerName   :

但是结果:

  # file with computer name
$computers = Get-Content F:\IT\!Set_NTP_Time\ReadRegistry\servers.txt | ?{$_ -notmatch "^#"};

#Registry Hives
[long]$HIVE_HKROOT = 2147483648
[long]$HIVE_HKCU = 2147483649
[long]$HIVE_HKLM = 2147483650
[long]$HIVE_HKU = 2147483651
[long]$HIVE_HKCC = 2147483653
[long]$HIVE_HKDD = 2147483654


# registry
$HKLM = 2147483650
$main = "Localmachine"
$keyPath = "System\CurrentControlSet\Services\W32Time"
$keyName = "Start"

#$computer ='.'
$reg = [WMIClass]"ROOT\DEFAULT:StdRegProv"
$Key = "W32Time"
#$Value = "HistoryBufferSize"
#$results = $reg.GetDWORDValue($HKEY_LOCAL_MACHINE, $Key, $keyName)
#"Current History Buffer Size: {0}" -f $results.uValue


<#
Param($computer)
$HKEY_Local_Machine = 2147483650 
$reg = [WMIClass]"\\$computer\ROOT\DEFAULT:StdRegProv"
$Key = "SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs"
$ValueName = "DEFWATCH_10"
$results = $reg.GetStringValue($HKEY_LOCAL_MACHINE, $Key, $ValueName)
write $results.sValue
#>

# credentials
$user = "admin"
$user1 = "admin1"
$password = "pass" | ConvertTo-SecureString -asPlainText -Force

# Start processing 
    foreach($computer in $computers) {
        $domain=$computer
        $username = $domain + "\" + $user
        $username1 = $domain + "\" + $user1
        $Credential = New-Object System.Management.Automation.PSCredential -ArgumentList $username,$password
        $Credential1 = New-Object System.Management.Automation.PSCredential -ArgumentList $username1,$password

     try {  
        if (($computer -eq "comp1") -or ($computer -eq "comp2") -or ($computer -eq "name_of_computer") -or ($computer -eq "other_computer")) {
            #$wmi = Get-Wmiobject -list "StdRegProv" -namespace root\default -Computername $computer -Credential $Credential1
            #$value = $wmi.GetStringValue($HKLM,$keyPath,$keyName).svalue
            #Write-Host -ForegroundColor DarkYellow $computer $value
            #$value = Invoke-Command -Scriptblock {Get-Item $HKLM,$keyPath,$keyName} -Computername $computer -Credential $Credential1
            $reg = Get-WmiObject -List -Namespace root\default -ComputerName $Computer -Credential $Credential1 | Where-Object {$_.Name -eq "StdRegProv"}
            #$HKLM = 2147483650
            #$value = $reg.GetStringValue($HKLM,$keyPath,$keyName).sValue
            $value = $reg.GetDWORDValue($HKEY_LOCAL_MACHINE, $Key, $keyName)
            Write-Host -ForegroundColor DarkYellow $computer $reg $value 

        } else { 

            #$wmi = Get-Wmiobject -list "StdRegProv" -namespace root\default -Computername $computer -Credential $Credential
            #$value = $wmi.GetStringValue($HKLM,$keyPath,$keyName).svalue
            #Write-Host -ForegroundColor DarkYellow $computer $value
            #$value = Invoke-Command -Scriptblock {Get-Item $HKLM,$keyPath,$keyName} -Computername $computer -Credential $Credential
            $reg = Get-WmiObject -List -Namespace root\default -ComputerName $Computer -Credential $Credential | Where-Object {$_.Name -eq "StdRegProv"}
            #$HKLM = 2147483650
            #$value = $reg.GetStringValue($HKLM,$keyPath,$keyName).sValue 
            $value = $reg.GetDWORDValue($HKEY_LOCAL_MACHINE, $Key, $keyName)
            Write-Host -ForegroundColor DarkYellow $computer $reg $value

        }
        <#
        if($value -eq 2)
        {
        Write-Host -ForegroundColor DarkYellow $computer "YES" 
        } else {
        Write-Host -ForegroundColor Red $computer "NO"
        }
        #>
        } catch {
        Write-Host -ForegroundColor Red "$computer access denied.$_";
    }
}

所以我尝试了其他东西

{{1}}

此脚本的结果

  

comp1 \ COMP1 \ ROOT \ default:StdRegProv System.Management.ManagementBaseObject

     

comp2 \ COMP2 \ ROOT \ default:StdRegProv System.Management.ManagementBaseObject

     

comp3 \ COMP3 \ ROOT \ default:StdRegProv System.Management.ManagementBaseObject

2 个答案:

答案 0 :(得分:0)

就我个人而言,由于我习惯使用Powershell远程处理从远程计算机收集信息,因此我将按照以下步骤进行操作:

  1. 建立远程PS会话
  2. 在远程计算机上运行脚本
  3. 利润

因此,在您的情况下,类似于(如果您正在 HKLM:\ SYSTEM \ CurrentControlSet \ Services \ LanmanServer \ Parameters 中检索名为 DiskSpaceThreshold 的值)

$user = "admin"
$password = "pass" | ConvertTo-SecureString -asPlainText -Force
$computer = "computer"
$domain=$computer
        $username = $domain + "\" + $user
        $Credential = New-Object System.Management.Automation.PSCredential -ArgumentList $username,$password

$session = New-PSSession $computer -Credential $Credential
$r = Invoke-Command -Session $session -ScriptBlock { Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters -Name "DiskSpaceThreshold" }
Remove-PSSession $session

Write-Host $r.DiskSpaceThreshold

答案 1 :(得分:0)

尝试从 P-L 用户帖子

运行脚本的效果
New-PSSession : [computer] Connecting to remote server computer failed with the following error message : WinRM cannot process the
 request. The following error with errorcode 0x80090311 occurred while using Kerberos authentication: There are currently no
 logon servers available to service the logon request.  
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or use HTT
PS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. For more information, see 
the about_Remote_Troubleshooting Help topic.
At line:9 char:12
+ $session = New-PSSession $computer -Credential $Credential
+            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [New-PSSession], PSRemotingTran 
   sportException
    + FullyQualifiedErrorId : AuthenticationFailed,PSSessionOpenFailed
Invoke-Command : Cannot validate argument on parameter 'Session'. The argument is null or empty. Provide an argument that is
 not null or empty, and then try the command again.
At line:10 char:30
+ $r = Invoke-Command -Session $session -ScriptBlock { Get-ItemProperty -Path HKLM ...
+                              ~~~~~~~~
    + CategoryInfo          : InvalidData: (:) [Invoke-Command], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.InvokeCommandCommand

Remove-PSSession : Cannot validate argument on parameter 'Id'. The argument is null. Provide a valid value for the argument,
 and then try running the command again.
At line:11 char:18
+ Remove-PSSession $session
+                  ~~~~~~~~
    + CategoryInfo          : InvalidData: (:) [Remove-PSSession], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.RemovePSSessionCommand

用户名和密码都很好。