PowerShell Script to list a server's users, groups, permissions, etc

Question

I'm looking for a PowerShell script that will query and output all the local and AD users, service accounts, and groups on a given Windows servers. I need the script to recursively list the members of each group that has privileges on that server. I'm looking for a script that will give me a good starting point from which I can tailor it to my specific needs. Thanks.

Answer 1

I was bored on a lunch break so I made you this.

$strLocalMachine = $env:computername

$arrLocalGroups = Get-CimInstance -ClassName Win32_Group -filter "Domain = '$strLocalMachine'"
$arrDomainGroups = Get-CimInstance -ClassName Win32_Group -filter "Domain = '[YOUR DOMAIN NAME HERE]'"

ECHO ""
ECHO "Local Groups"
ECHO ""

foreach($objLocalGroup in $arrLocalGroups)
{
$groupname = $objLocalGroup.Name

$group = [ADSI]"WinNT://./$groupname"
ECHO "-----$($objLocalGroup.caption)-----"
@($group.Invoke("Members")) | foreach {$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)}
}


ECHO ""
ECHO "Domain Groups"
ECHO ""


foreach($objDomainGroup in $arrDomainGroups)
{
$groupname = $objDomainGroup.name

$groupmembers = Get-QADGroupMember $groupname
ECHO "-----$groupname-----"
foreach($entry in $groupmembers)
    {
    IF($entry.type -eq 'group')
        {
        Echo "$($entry.name)`n    GROUP MEMBERS"
        $subgroupmembers = Get-QADGroupMember $($entry.name)
        foreach($member in $subgroupmembers){ECHO "    $($member.name)"}
        }
    else{echo "$($entry.name)"}
    $entry = $null
    }
}

1. This has a dependency for the free Quest AD commandlets to enumerate the domain group memberships. You could amend it to do the same with the Microsoft AD cmdlets if you have installed RSAT or you run this on a DC.

2. I haven't tested this on multiple machines, so can't promise how well it will work beyond my test Win 7 box but this should be ok as long as you are running as domain admin.

3. I feel like the domain groups output is too high for my domain member PC. The command Get-CimInstance -ClassName Win32_Group -filter "Domain = '[YOUR DOMAIN NAME HERE]'"returned far more than I expected so YMMV, but if they are the correct groups then it should step through and list give you the member ships.

4. I can't work out how to identify if the members of the local groups are a user or Group I'm afraid. The line : @($group.Invoke("Members")) | foreach {$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)} should allow us to invokemember other than name, but I can't get it to work. If someone can clarify that for you you should be able to use that to list members of the local groups.

hope this helps.