{"id":4857,"date":"2016-02-10T10:58:50","date_gmt":"2016-02-10T15:58:50","guid":{"rendered":"http:\/\/jdhitsolutions.com\/blog\/?p=4857"},"modified":"2016-02-10T10:58:50","modified_gmt":"2016-02-10T15:58:50","slug":"getting-local-user-accounts-the-powershell-way","status":"publish","type":"post","link":"https:\/\/jdhitsolutions.com\/blog\/powershell\/4857\/getting-local-user-accounts-the-powershell-way\/","title":{"rendered":"Getting Local User Accounts the PowerShell Way"},"content":{"rendered":"

It seems I'm always seeing requests and problems on getting local user accounts using PowerShell.\u00a0 However, even though we are at PowerShell 5.0,\u00a0 Microsoft has never released a set of cmdlets for managing local user accounts. So many of us have resorted to creating our own tools. I now have my latest iteration of a function to get local user account information from remote computers.<\/p>\n

The function takes a shortcut of sorts by using the ADSI type accelerator to connect to a remote computer. This is the same technique we used back in the VBScript days. However, this technique isn't conducive to alternate credentials and requires legacy protocols like RPC and DCOM.\u00a0 But that isn't necessarily an issue as I'll show you in a few minutes.<\/p>\n

The function connects to the remote computer and then uses some COM object voodoo, to enumerate local account information. By default, the command will list all user accounts.<\/p>\n

\"image\"<\/a><\/p>\n

Or you can specify a single user account name.<\/p>\n

\"image\"<\/a><\/p>\n

The function accepts pipeline input making it easy to check multiple servers at once.<\/p>\n

import-csv s:\\computers.csv | get-localuser Administrator | Select Computername,User,Enabled,PasswordAgeDays<\/pre>\n
\"image\"<\/a><\/p>\n
On important note: if you query a domain controller you will get domain accounts.<\/p>\n
Remember I mentioned this command uses legacy protocols. One alternative is to use PowerShell remoting and Invoke-Command<\/a>. First, create the necessary PSSessions, using alternate credentials if necessary.<\/p>\n
$s = new-pssession -computer chi-core01,chi-web02,chi-fp02<\/pre>\n
Then get the function's scriptblock.<\/p>\n
$sb = ${function:Get-localuser}<\/pre>\n
Now you can use this with Invoke-Command:<\/p>\n
invoke-command -scriptblock $sb -session $s -hidecomputername | select * -exclude RunspaceID | out-gridview -title \"Local\"\r\n<\/pre>\n
\"image\"<\/a><\/p>\n
Or query for a specify account:<\/p>\n
invoke-command -scriptblock $sb -session $s -hidecomputername -ArgumentList Administrator<\/pre>\n
\"image\"<\/a><\/p>\n
You can find the complete script, which includes an alias on Github.<\/p>\n