Update custom attributes with replace option in powershell

Little Background:- 

   

    There was request from client to segregate the different types of account exists in the customer internal domain. It may be difficult if those accounts are not defined already with their type of usage for example : Daily user normal account, Administrative account, Workstation Administrator and Shared accounts. 

    So, we decided clean-up and setup procedure to update the "EmployeeType" attribute for all the users.. 

    As a initial step, we have exported all the enabled accounts and add new column named Employeetype. 

By naming convention, we could different account types and update the new column. 

Once it's completed, we prepare the Input file with header "Username" & AccountType"

Before processing, I take note of the existing employeetype for given user in input file. 

Sample cmdlet for easy reference: 

 Import-csv .\Userslist.csv | Foreach-object {Get-Aduser -Identity $_.Username -property Employeetype | select Name,Samaccountname,employeetype}

After executing the script :- 

# *****************Start of Script ********************

# Make sure that input CSV file have header like Username, AccountType

#Preparing the parameter input file

Param (

[Parameter(Mandatory=$True)]

[string]$InputFile

)

# Preparing the Log file naming format ( Default stored in same place where script is executed )

$logdate = (Get-Date -Format yyyyMMdd-hh-mm)

$log= $logdate+"_EmployeeType_Update"+".log"

# Importing Active Directory Module & Getting Logged on Domain Name information

Import-Module ActiveDirectory

# Looping through the each line of user from the Input file

ForEach ($Eachline in (Import-csv $InputFile)){

    $Sam = $Eachline.Username

    $Acctype = $Eachline.AccountType

  

  $ADUser = Get-ADUser -Filter {SamAccountName -eq $sam}

 

if ( $ADuser -ne $null )

{

  

  Set-aduser $ADUser -replace @{Employeetype="$Acctype"} -Verbose

  

  $Info= "EmployeeType field updated for $ADUser.Samaccountname"

  $Info | out-file -Append $log

  

}

else

{

$info="$Sam ID not found in Domain. Please recheck"

$info | out-file -Append $log

}

}

# *****************END of Script ********************

Local Administrator Group Membership Listing for multiple servers

Little Background:

Hello , 

It's kind of already weekend started... :) but suddenly remembered that I missed to post the items which I worked on earlier. So, here is the request that I received as part of my work. 

         I was assigned a project to do the clean-up of local administrator group membership to be restricted through GPO. So, here is the tasks that we plan to do .

                     1) Who all are in the current local administrator group membership

                    2)  What is the strategy that need to be followed to move the locally assigned principals  to domain group

                    3) How to assign the domain group to the Local administrator group on each server ? 

 We mainly discuss about the line item 1, in this post ... please skip the mind from the other items listed above for now, I will try to cover them in my next blog, probably during another pleasant weekend ;)


 Main Topic:-

How to generate a report of local administrator group membership of listed computers  ?

I know there are plenty of scripts already available in the internet for this task, but why did I build this script ???
               It's because, just for learning the POWERSHELL SCRIPTING. I understood one point is that unless you start working with POWERSHELL SCRIPTING in real-time scenarios, you won't get chance to work at no time. So, utilize whenever, we get chance.

Script Logic used:- 

                 1) Use the ADSI method to get the information about the group membership
                 2) The output is not formatted like we wanted, so here is where the splitting, Joining works starts
                 3) I have added the Test-connection method , just to validate that computer is reachable or not.
                4) Included the logging for each processing, so that we can cross check if something not correct.
                5) Always, I stick to rules of working with input file method as much as needed. This is just to avoid any BIG mistake during the testing / Production and it will give possibility to touch only listed items. 

Script Content :- 

Copy from below starting "# " to the end

# Script  to pull the Local administrator group list from the remote computers
# Input file should contain the server / workstation names one on each line.
# Example: .\Ladmin_Listing_Latest.ps1 -inputfile ".\serversList.txt"
# Make sure that you have the serverslist.txt file exist in the same folder where the script exist, otherwise, you need to provide
# the full path of the input file.
# Author : Murugan Natarajan
# Email  : murugan.natarajan@outlook.com
# Script created date: 7/5/3/2021
# Disclaimer: Script provided as is without any warranty, please use it with your own risk.


param(
[Parameter(Mandatory=$True)]
[String]$Inputfile='.\ServersList.txt'
)

$logdate = (Get-Date -Format ddMMyyyy-hh-mm)
$FinalLog= ".\$($logdate)_LocalAdmin_List.csv"

Foreach ( $SName in (Get-Content $inputfile) ) {

        $Message= " " # Adding empty line for each item processing
        $Message | Out-File $FinalLog -Append
       
        If (Test-Connection $SName -Count 1 -Quiet -ErrorAction SilentlyContinue) {


$group = [ADSI]("WinNT://$SName/Administrators,group") 
$GMembers = $group.psbase.invoke("Members")
$Liste=$GMembers | ForEach-Object {$_.GetType().InvokeMember("ADspath",'GetProperty', $null, $_, $null) -replace ('WinNT://DOMAIN/' + $Sname + '/'), '' -replace ('WinNT://DOMAIN/', 'DOMAIN\') -replace ('WinNT://', '') }# | Out-File $FinalLog -append

#

foreach ( $object in $Liste ){

$Message="$sname,$object"
$message | Out-File $FinalLog -Append

}
}
    else{

        $Message="$SName,Problematic server"
        $message | Out-File $FinalLog -Append
    }

}

#   Script line ends here

Important note: Please make sure that you specify the input file before executing the script, it won't harm, instead it will prompt to provide the full path for the input file because the parameter is made as mandatory.


Tail note: Hello everyone, I have written this blog on my experience, if you find any mistake, please leave comment. I will correct it.

Next topics to cover:- 

   2) GPO method to restrict the Local administrator group membership
   3)  Automate the basic groups needed for this scenario.