CODEWITHSUNDEEP
windowspowershellcommand
Help
Help

Reputation: 181

Windows PowerShell 2 Command To Capture Local User Accounts In A Group

I am limited to PowerShell 2 and I have been trying to craft a command that lists the local user accounts within a group such as administrators. However, the crafted command also lists DC user accounts and I do not want this, is there a way to achieve this?

Crafted Command:

gwmi win32_group -filter 'Name="Administrators"'|%{$_.GetRelated('Win32_UserAccount')} | select Name

Upvotes: 1

Views: 1442

Answers (2)

Santiago Squarzon
Santiago Squarzon

Reputation: 61323

Supposing you have access to [adsi] type accelerator this should give you the members of local Administrators:

([adsi] "WinNT://$env:ComputerName,computer").Children.
    Find('Administrators').Invoke('Members').
    ForEach([adsi]).ForEach({
        $enabled = switch ($_.class) {
            User    { ('Enabled', 'Disabled')[[bool]($_.UserFlags.Value -band 2)] }
            Default { 'Not Applicable'}
        }

        [pscustomobject]@{
            Name    = $_.Name.Value
            Class   = $_.Class
            ADSPath = $_.ADSPath
            Enabled = $enabled
            Sid     = [System.Security.Principal.SecurityIdentifier]::new($_.ObjectSid[0], 0)
        }
    })

Upvotes: 2

postanote
postanote

Reputation: 16126

Why not just use the built-in OS tools from PowerShell and parse that output?

# Get all group names
net localgroup

# Get members of one group
net localgroup administrators


(net localgroup administrators) -replace 'The command completed successfully.|\-+' | Select-Object -Skip 4
# Results
<#
Administrator
...
#>

Old school is still a thing even from PowerShell.

As far as your PowerShell v2 (no longer supported, unnecessary risk issues, etc.). Firstly, really (if you have influence at all) you need to convince them to get off that.

;-}

Yet, with v2, do your command this way.

Full disclosure, I've not used v2 in years, so, had to re-enable it on one Win10 system to do this.

powershell -version 2.0 -nologo -noprofile

$PSVersionTable

# Results
<#
Name                           Value
----                           -----
CLRVersion                     2.0.50727.9151
BuildVersion                   6.1.7600.16385
PSVersion                      2.0
WSManStackVersion              2.0
PSCompatibleVersions           {1.0, 2.0}
SerializationVersion           1.1.0.1
PSRemotingProtocolVersion      2.1
#>


Get-wmiobject -Class Win32_OperatingSystem
# Results
<#
SystemDirectory : C:\WINDOWS\system32
Organization    :
BuildNumber     : 19042
RegisteredUser  : User001
SerialNumber    : 00330...
Version         : 10.0.19042
#>



Get-WmiObject win32_group -filter 'Name="Administrators"'
# Results
<#
Caption                      Domain        Name             SID
-------                       ------       ----             ---
w10labws001\Administrators   w10labws001   Administrators   S-1-5-...
#>


(Get-WmiObject win32_group -filter 'Name="Administrators"').GetRelated('Win32_UserAccount')
# Results
<#
AccountType : 512
Caption     : w10labws001\Administrator
Domain      : w10labws001
SID         : S-1-5-21...
FullName    :
Name        : Administrator

AccountType : 512
Caption     : w10labws001\User001
Domain      : w10labws001
SID         : S-1-5-21-...
FullName    :
Name        : User001
...
#>

Or

((Get-WmiObject win32_group -filter 'Name="Administrators"').GetRelated('Win32_UserAccount')).Name
# Results
<#
Administrator
...
#>

The above command works, as does your original one.

C:\>powershell -version 2.0 -nologo -noprofile
PS C:\> gwmi win32_group -filter 'Name="Administrators"'|%{$_.GetRelated('Win32_UserAccount')} | select Name
# Results
<#
Name
----
Administrator
...
#>

It just takes far longer to complete the job (results are shown, and then you have a very long pause before you can use the console/ISE again), than the net localgroup and or the way Santiago Squarzon is showing you.

Upvotes: 2

Related Questions