POSH Pull Local Admin Members and AD Nested Groups

###########################################################################
#
# NAME: Find All Local Admin users in Nested Groups
#
# AUTHOR:  Inquisitor_ForHire
#
# COMMENT: Not really intended to share, but I tried to clean it up...
#
# VERSION HISTORY:
# 1.0 6/16/2014 - Initial release
#
###########################################################################

## 	Things you need to change...
##	Line 23 - the $target variable but only if doing a single server...
##	Line 27 - $outfile variable to tell where you want to save the file
##	In Function Get-Groupdata, change the "DOM1, DOM2, DOM3, DOM4, and DOM5 references to the SHORTNAME of the domains you want to check.
##	Also change the corresponding -service argument of each command to map to a specific domain controller in each of those domains.
##	Uncomment Line 92 and 93 depending on if doing a single server, or pulling from AD.  Change line 92 as needed to work in your environment...
## 	If doing a pull from AD, uncomment line 219


$target = "Servername"


$date = Get-Date -Format MMddyyyy
$outfile = "E:\scripts\output\ADMIN_"+$target+"_$date.csv"


## this is the function that goes and grabs the local admin members
function get-localadministrators {
    param ([string]$computername=$env:computername)

    $computername = $computername.toupper()
    $ADMINS = get-wmiobject -computername $computername -query "select * from win32_groupuser where GroupComponent=""Win32_Group.Domain='$computername',Name='administrators'""" | % {$_.partcomponent}

    foreach ($ADMIN in $ADMINS) {
                $admin = $admin.replace("\\$computername\root\cimv2:Win32_UserAccount.Domain=","") # trims the results for a user
                $admin = $admin.replace("\\$computername\root\cimv2:Win32_Group.Domain=","") # trims the results for a group
                $admin = $admin.replace('",Name="',"\")
                $admin = $admin.REPLACE("""","")#strips the last "

                $objOutput = New-Object PSObject -Property @{
                    Machinename = $computername
                    Fullname = ($admin)
                    DomainName  =$admin.split("\")[0]
                    UserName = $admin.split("\")[1]
                }#end object

    $objreport+=@($objoutput)
    }#end for

    return $objreport
}#end function


function Get-Groupdata {
	param ([string]$groupname= "Administrators")


	IF ($groupname -like "DOM1*"){
	$DOMresults = Get-QADGroupMember $groupname -service 'DC001.eu.contoso.com' -Verbose
	$DOMresults
	}
		ELSEIF ($groupname -like "DOM2*"){
	$DOMresults = Get-QADGroupMember $groupname -service 'DC001.na.contoso.com' -Verbose
	$DOMresults
	}
	ELSEIF ($groupname -like "DOM3*"){
	$DOMresults = Get-QADGroupMember $groupname -service 'DC001.ap.contoso.com' -Verbose
	$DOMresults
	}
	ELSEIF ($groupname -like "DOM4*"){
	$DOMresults = Get-QADGroupMember $groupname -service 'DC001.la.contoso.com' -Verbose
	$DOMresults
	}
	ELSEIF ($groupname -like "DOM5*"){
	$DOMresults = Get-QADGroupMember $groupname -service 'DC001.other.contoso.com' -Verbose
	$DOMresults
	}
	ELSE {
	Write-Output "Skipping $groupname"
	}

}## End Function Get-Groupdata



#####
####	uncomment the $serverlist of your choice.... depending on if you're targeting one server or need to pull a list from AD.
#####
## Grab our list of servers to process from AD... be all inclusive.
#$serverlist = Get-ADComputer -Filter {OperatingSystem -like "*server*"} -SearchBase "OU=US,DC=na,DC=CONTOSO,DC=COM" -Server 'DC001.na.contoso.com'
$serverlist = Get-QADComputer $target

## Throwaway variable that's only used at the "top level"
$Admingroup = "LOCAL\Administrators"

## What to say when we can't process a machine
$failed = "Lookup Failed"

Foreach ($Computer in $serverlist)
{

#region ## L1 Processing
	## Reset the $localadmusers because I don't trust instancing...
	$localADMusers = $null
	## Go get the members of the Local Admin Group on the remote Computer
	$localADMusers = (get-localadministrators $Computer.name)

	## If the $localadmusers is empty, then we failed to contact the computer in question.
	IF ($localADMusers -eq $null){
	$comp = $Computer.name
	$oops = "$comp,$failed"
	$oops | Out-File $outfile -Append
	Write-Output $oops
	}	## End IF Statement


	## If it's not empty, list out the LOCALADMUSERS and dump them to the CSV File.
	ELSE{
	## Process LocalADMUsers
	$L1Members = $null
	$L1Members = $localADMusers
	$L1Members | Select MachineName, @{Name = "GroupName";Expression={$Admingroup}}, Username, FullName, DomainName | ConvertTo-Csv | Select -Skip 2 |  Out-File $outfile -Append
	}	## End Else Statement

#endregion ## L1 Processing



#Region ## L2 Processing
## Level 2 Processing
Foreach ($L1 in $L1Members)
{
$L2Members = $null
$L2Members = Get-Groupdata $L1.Fullname
$L2Members | Select SamAccountName, Domain | FL
$L2Members | Select @{Name = "MachineName";Expression={$Computer.name}}, @{Name = "GroupName";Expression={$L1.username}}, SamAccountname, NTAccountName, Domain, Name | ConvertTo-Csv | Select -Skip 2 |  Out-File $outfile -Append

## Level 3 Processing
Foreach ($L2 in $L2Members)
{
$L3Members = $null
$L3Members = Get-Groupdata $L2.NTAccountname
$L3Members | Select SamAccountName, Domain, Username, NTAccountname | FL
$L3Members | Select @{Name = "MachineName";Expression={$Computer.name}}, @{Name = "GroupName";Expression={$L2.name}}, SamAccountname, NTAccountName, Domain, Name | ConvertTo-Csv | Select -Skip 2 |  Out-File $outfile -Append

## Level 4 Processing
Foreach ($L3 in $L3Members)
{
$L4Members = $null
$L4Members = Get-Groupdata $L3.NTAccountname
$L4Members | Select SamAccountName, Domain, Username, NTAccountname | FL
$L4Members | Select @{Name = "MachineName";Expression={$Computer.name}}, @{Name = "GroupName";Expression={$L3.name}}, SamAccountname, NTAccountName, Domain, Name | ConvertTo-Csv | Select -Skip 2 |  Out-File $outfile -Append

## Level 5 Processing
Foreach ($L4 in $L4Members)
{
$L5Members = $null
$L5Members = Get-Groupdata $L4.NTAccountname
$L5Members | Select SamAccountName, Domain, Username, NTAccountname | FL
$L5Members | Select @{Name = "MachineName";Expression={$Computer.name}}, @{Name = "GroupName";Expression={$L4.name}}, SamAccountname, NTAccountName, Domain, Name | ConvertTo-Csv | Select -Skip 2 |  Out-File $outfile -Append

##Level 6 Processing
Foreach ($L5 in $L5Members)
{
$L6Members = $null
$L6Members = Get-Groupdata $L5.NTAccountname
$L6Members | Select SamAccountName, Domain, Username, NTAccountname | FL
$L6Members | Select @{Name = "MachineName";Expression={$Computer.name}}, @{Name = "GroupName";Expression={$L5.name}}, SamAccountname, NTAccountName, Domain, Name | ConvertTo-Csv | Select -Skip 2 |  Out-File $outfile -Append

##Level 7 Processing
Foreach ($L6 in $L6Members)
{
$L7Members = $null
$L7Members = Get-Groupdata $L6.NTAccountname
$L7Members | Select SamAccountName, Domain, Username, NTAccountname | FL
$L7Members | Select @{Name = "MachineName";Expression={$Computer.name}}, @{Name = "GroupName";Expression={$L6.name}}, SamAccountname, NTAccountName, Domain, Name | ConvertTo-Csv | Select -Skip 2 |  Out-File $outfile -Append

##Level 8 Processing
Foreach ($L7 in $L7Members)
{
$L8Members = $null
$L8Members = Get-Groupdata $L7.NTAccountname
$L8Members | Select SamAccountName, Domain, Username, NTAccountname | FL
$L8Members | Select @{Name = "MachineName";Expression={$Computer.name}}, @{Name = "GroupName";Expression={$L7.name}}, SamAccountname, NTAccountName, Domain, Name | ConvertTo-Csv | Select -Skip 2 |  Out-File $outfile -Append

##Level 9 Processing
Foreach ($L8 in $L8Members)
{
$L9Members = $null
$L9Members = Get-Groupdata $L8.NTAccountname
$L9Members | Select SamAccountName, Domain, Username, NTAccountname | FL
$L9Members | Select @{Name = "MachineName";Expression={$Computer.name}}, @{Name = "GroupName";Expression={$L8.name}}, SamAccountname, NTAccountName, Domain, Name | ConvertTo-Csv | Select -Skip 2 |  Out-File $outfile -Append

##Level 10 Processing
Foreach ($L9 in $L9Members)
{
$L10Members = $null
$L10Members = Get-Groupdata $L9.NTAccountname
$L10Members | Select SamAccountName, Domain, Username, NTAccountname | FL
$L10Members | Select @{Name = "MachineName";Expression={$Computer.name}}, @{Name = "GroupName";Expression={$L9.name}}, SamAccountname, NTAccountName, Domain, Name | ConvertTo-Csv | Select -Skip 2 |  Out-File $outfile -Append


}	## End Foreach $L9 in $L9Members
}	## End Foreach $L8 in $L8Members
}	## End Foreach $L7 in $L7Members
}	## End Foreach $L6 in $L6Members
}	## End Foreach $L5 in $L5Members
}	## End Foreach $L4 in $L4Members
}	## End Foreach $L3 in $L3Members
}	## End Foreach $L2 in $L2Members
}	## End Foreach $L1 in $L1Members
#endregion ## All Level Processing



}## End FOREACH $Computer in $serverlist


## Wrap it up and add Headers to the data...
$final = Import-Csv $outfile -Header "MachineName", "SourceGroupName", "Username", "FullName", "DomainName", "FriendlyName"

$final | Export-Csv $outfile -NoTypeInformation