Sunday, April 3, 2011

Home /Active Directory /Microsoft /script /Windows / List Local Administrator Group Members on a Server – PowerShell Script

List Local Administrator Group Members on a Server – PowerShell Script

16 comments

I have updated one of my PowerShell Script  - List Group Members in Active Directory–PowerShell Script – to generate a report and send an email based on number of members in an Administrator group on a server.  I crated this script based on a question posted on the TechNet forum. 

Input – This script reads server names from an input file called Serves.csv

image

Output - It creates an output file called SGroupMemberDetails.csv which contains all server and group information. It also generate an email alert based on number of group members.  You can set this threshold value using $N variable.  

image

Here are the script details

image

Download – You can download the script from www.sivarajan.com.  I have uploaded on this TechNet Script library also. 

Updated script - http://portal.sivarajan.com/2011/10/search-ad-collect-local-admin-group.html

Filed under
Share X LinkedIn Facebook Email
SS

Santhosh Sivarajan

Microsoft MVP · Identity & Cybersecurity Architect

Santhosh has 30+ years of hands-on enterprise experience in Identity and Access Management, Microsoft Entra ID, Active Directory, Microsoft 365 and Zero Trust architecture. He is the author of two books on Windows Server and security, and leads consulting, assessments and training at SAG Business Group.

SAG Business Group LinkedIn Publications Work with Santhosh

16 comments:

I get this error when I run the script.

Exception calling "Invoke" with "2" argument(s): "Unknown error (0x80005000)"
At C:\Scripts\AdminGrps.ps1:19 char:33
+ $GMembers = $group.psbase.invoke <<<< ("Members")
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : DotNetMethodException

You cannot call a method on a null-valued expression.
At C:\Scripts\AdminGrps.ps1:20 char:39
+ $GMembers | ForEach-Object {$_.GetType <<<< ().InvokeMember("Name",'GetProperty', $null, $_, $null) | Out-File $GFile -encoding ASCII -append
+ CategoryInfo : InvalidOperation: (GetType:String) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull

You are getting the “You cannot call a method on a null-valued expression” error. Do you have Server Name in the input file - “C:\Scripts\Servers.csv” ?

Yes there are server names but not the fully qualified domain name.

You don’t need FQDN. You can use NetBIOS name. Do you have “ServerName” as the header in the input file?

Thanks, after adding the ServerName as header it ran successfully.

Good. Thanks for the update.

You can use “get-content” cmdlet with no header. Here is an example:

$SNames = get-content "C:\Scripts\Servers.txt"
foreach($SName in $SNames)
{
$SName
}

http://sivarajan.com/forum/viewthread.php?tid=59

Hi Santosh,
How you doing?

I need you assist. Recently i'm practise on Quest tools for the AD migration. There is any option that....

"the AD user details in bulk or selected users, with this tool we can standardize the usernames like firstname.surname.
Example: vbommidi to ven.bommidi in bulk and all AD account properties.
With this we can import user details to spread sheet, edit the spread sheet and export the spread sheet to AD. we have flexibility to roll back the AD.
We can select by OU, group, Departments and with query script."

Are you planning to rename the user account name during the migration? If so, take a look my following blog:

http://portal.sivarajan.com/2011/07/user-account-migration-and-merging-part.html

You can use an input file to achieve this.

Hi Santosh,
I saved this script in to text file and renamed it in to .ps1 then Created Servers.csv file giving ServerName in header of the file.
Now while running script from powershell, its not giving me any output file.
Server names are there in Servers.csv
What could be the problem

Santhosh, I hope you still monitor this. I am using this script, and getting an error.
New-Object : Constructor not found. Cannot find an appropriate constructor for type System.Net.Mail.Attachment.

I have removed the search AD section, I list the servers manually in servers.csv, it does find the server, shows it is DONE!
Collecting Admin info from server1..........Done!
then immediately errors:
New-Object : Constructor not found. Cannot find an appropriate constructor for type System.Net.Mail.Attach
At C:\scripts\Get-local-admins.ps1:56 char:29
+ $Attachment = New-Object <<<< System.Net.Mail.Attachment($GFile)
+ CategoryInfo : ObjectNotFound: (:) [New-Object], PSArgumentException
+ FullyQualifiedErrorId : CannotFindAppropriateCtor,Microsoft.PowerShell.Commands.NewObjectCommand

Exception calling "Add" with "1" argument(s): "Value cannot be null.
Parameter name: item"
At C:\scripts\Get-local-admins.ps1:57 char:34
+ $Emailmessage.Attachments.Add <<<< ($Attachment)
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : DotNetMethodException

Thanks!

Get Below Error when i run the script ...
=================================================
The term 'Fuction' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spe
lling of the name, or if a path was included, verify that the path is correct and try again.
At D:\AD-Scripts\Scripts\FindCompsADGroupMeb&Email\SearchAD_LocalAdmin_Send_Email.ps1:26 char:9
+ Fuction <<<< Search_LAdmin
+ CategoryInfo : ObjectNotFound: (Fuction:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException


Import-CSV "C:\Scripts\Servers.csv" | ForEach-Object {
$SName = $_.ServerName
Write-host -nonewline "Collecting Admin info from $SName...."
"Server Name - $SName" | Out-File $GFile -encoding ASCII -append
$group = [ADSI]("WinNT://$SName/Administrators,group")
$GMembers = $group.psbase.invoke("Members")
$GMembers | ForEach-Object {$_.GetType().InvokeMember("Name",'GetProperty', $null, $_, $null) | Out-File $GFile -encod
ing ASCII -append}
Write-host "Done!"
$GMembers = ""
}

Searchin AD....5207 Computer Objects Found
The term 'Search_LAdmin' is not recognized as the name of a cmdlet, function, script file, or operable program. Check t
he spelling of the name, or if a path was included, verify that the path is correct and try again.
At D:\AD-Scripts\Scripts\FindCompsADGroupMeb&Email\SearchAD_LocalAdmin_Send_Email.ps1:62 char:14
+ Search_LAdmin <<<<
+ CategoryInfo : ObjectNotFound: (Search_LAdmin:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException

New-Object : Constructor not found. Cannot find an appropriate constructor for type System.Net.Mail.Attachment.
At D:\AD-Scripts\Scripts\FindCompsADGroupMeb&Email\SearchAD_LocalAdmin_Send_Email.ps1:55 char:25
+ $Attachment = New-Object <<<< System.Net.Mail.Attachment($GFile)
+ CategoryInfo : ObjectNotFound: (:) [New-Object], PSArgumentException
+ FullyQualifiedErrorId : CannotFindAppropriateCtor,Microsoft.PowerShell.Commands.NewObjectCommand

Exception calling "Add" with "1" argument(s): "Value cannot be null.
Parameter name: item"
At D:\AD-Scripts\Scripts\FindCompsADGroupMeb&Email\SearchAD_LocalAdmin_Send_Email.ps1:56 char:30
+ $Emailmessage.Attachments.Add <<<< ($Attachment)
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : DotNetMethodException

Exception calling "Send" with "1" argument(s): "Failure sending mail."
At D:\AD-Scripts\Scripts\FindCompsADGroupMeb&Email\SearchAD_LocalAdmin_Send_Email.ps1:59 char:11
+ $SMTP.Send <<<< ($Emailmessage)
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : DotNetMethodException

Hi Santosh,

Sorry to ask as I am sure you are fed up with requests, but can this be modified to show you the domain that a potential users is a member of, if the user is a member of the local admins

Hi,

This is rohit. I am currently trying to add domain global group (Desktopgr) to my local group (Localgr).
Let me pricise this in more details:
I had a machine 2008 server (LDAPCLIENT, ip 10.112.252.222) in a domain (GermanTool.com).
I have a AD (Active directory) server (Vcenter, ip 10.112.252.218).
GermanTool.com is the only domain in the AD server.
The domain has many global group, one of it is 'Desktopgr'.
This group cntains user who can log in to any server in the domain through RDP.

From GUI server managment tool, I can add the Domain Global group (Desktopgr) to a member of computer local group (Localgr)
I have already login to the LDAPCLIENT machine as a domain user 'GermanTool\rohit' and password 'A#007'.


I have removed that group from Localgr. Now I try to write a Powershell script to work the same thing.
I am already logedin as a domain user to the LADPCLIENT machine and both t machine can be pinged from either side and both are in same

domain.


I run the script I wrote but getting error as:

Exception calling "Add" with "1" argument(s): "Access is denied.
"
At C:\script\a.ps1:44 char:20
+ $LocalGroup.Add <<<< ($DomainGroup.Path)
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvokeTI


The Script is given bellow:

#######################################################################
<#
File: Add2LocalGroup.ps1
Purpose: Example of adding a Domain group to a Local group
Author: Rohit Basu
Date: 12/05/2013
#>



#Get List of Servers from Flat TXT file
$Servers = Get-Content Servers.txt


#GermanTool
#"LDAP://ldap.company.com:389/$($dn)"
#$credn = New-Object -TypeName System.DirectoryServices.DirectoryEntry("LDAP://10.112.252.218:389/GermanTool","rohit","A#007")


#Initaliaze the Domain Group Object
$DomainGroup = [ADSI]"WinNT://10.112.252.218/Desktopgr,Group"

#$DomainGroup = "$credn/Globalgroup,Group"

#Name the LogFile and Initialize it
$LogFile = ".\Logs\ServerLog.txt"
New-Item $LogFile -type file -force

ForEach ($Server in $Servers) #Loop through each server
{
$Server
$Server>>$LogFile


#Get Local Group object
$LocalGroup = [ADSI]"WinNT://$Server/Localgr,Group"

"Hi This is to see Localgroup">>$LogFile
$LocalGroup.Path>>$LogFile
"Hi This is to see Globalgroup">>$LogFile
$DomainGroup.Path>>$LogFile


#Assign DomainGroup to LocalGroup
$LocalGroup.Add($DomainGroup.Path)

#Determine if command was successful
If (!$?) #Add failed
{
$Server + " fail: " + $Error[0]>>$LogFile
"">>$LogFile
}
Else #Add succeeded
{
$Server + " success">>$LogFile
"">>$LogFile
$Server + " success"
}
}
#####################################################

The Servers.txt file contains one Ip: 10.112.252.222

Hello Santhosh, I have got a requirement from auditors, half of which is fulfilled by your script, Many thanks for the same. Could you please help me further?
Requirement:-
1. take input of server names in .csv file
2. give all given server's local administrators group members (with type & domain as well e.g., type as in user/group)
3. take groups one by one and search in AD for it's further members & provide the same(recursive/circular query) in csv format.
example-
server1 > member of "administrators" are following
user1, group1
Take group1 and make a search in AD for it's further members (and so on....) which could be as follows:-
subgrp1, subgrp2, user2
Take subgrp1 and find it's members
Take subgrp2 and find it's members
So kindly help me with this extended requirement (the script should provide a tree like structure as output). Thanks in advance.

Post a Comment

Popular Posts
Workstation Trust Relationship Issue Issue: You receive the following error message, when you try to login to the domain.  The security database on the server does not have ... ADMT Service Account - Permission and Configuration The ADMT service account needs to have proper permission in source and target domains.  You don’t need to use 2 separate accounts.  You can ... My First Peek into Microsoft Exchange 2010 By Santhosh Sivarajan Before I really dive into Exchange 2010, I thought I would install and play with it first. I took some screen shots and notes during the ins... ObjectSID and Active Directory What is an objectSID in Active Directory? When a new object is created in Active Directory, Domain Controller assigns a unique value used ... AD Group Report - List Group Members in Active Directory–PowerShell Script Updated Script - http://portal.sivarajan.com/2011/10/search-ad-collect-local-admin-group.html Script #1 This script... Add Users to a Group–PowerShell Script Purpose – Add users to a group from an input file – PowerShell V2 Script.  Input file – Input file (Users.csv) contains samAccountName in... User Account Migration and Merging – Part I (ADMT) Part I - User Account Migration and Merging Using ADMT Part II - User Account Migration and Merging Using QMM pre-creating user account ... User Account Migration and Merging – Part II (Quest Migration Manager) Part I - User Account Migration and Merging Using ADMT Part II - User Account Migration and Merging Using QMM Pre-creating user account in... Delete Stale or Inactive Computer Accounts from Active Directory Here is an easy way to identify and delete inactive or stale computers in an Active Directory environment.  Using the dsquery command you c... Converting PowerShell (PS1) to EXE / Standalone Application As we know, there many applications available to convert a PowerShell file to a standalone executable file.  Based on my experience, PowerSh...