evetsleep

getting users stats

Jan 30th, 2015
240
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. [CmdletBinding()]Param(
  2.     [Parameter()][switch]$EstimatedLogon
  3. )
  4.  
  5. function GetRealLogonDate{
  6.     [CmdletBinding()]
  7.     Param(
  8.         [Parameter(Mandatory=$true,
  9.                    Position=0)]
  10.         [String]$sAMAccountName,
  11.  
  12.         [Parameter(Mandatory=$true,
  13.            Position=1)]
  14.         [String]$Domain
  15.     )
  16.  
  17.     # Currenly not used, but may use some day.  The idea is to get the 'real' last logon time of an account
  18.     # before we apply a bogus to it.
  19.  
  20.     try{
  21.         $domainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain',$Domain)
  22.         $domainInfo    = [DirectoryServices.ActiveDirectory.Domain]::GetDomain($domainContext)
  23.     }
  24.     catch{
  25.         throw('Unable to connect to {0}: {1}' -f $Domain,$_.exception.message)    
  26.     }
  27.  
  28.     [array]$dcList = $domainInfo.DomainControllers | foreach { $_.name }
  29.     Write-Verbose -Message ('[GetRealLogonDate] Found {0} DCs in {1}' -f $dcList.count,$Domain)
  30.  
  31.     $queryBlock = {
  32.         Param(
  33.             [Parameter(Mandatory=$true,
  34.                        Position=0)]
  35.             [String]$sAMAccountName,
  36.  
  37.             [Parameter(Mandatory=$true,
  38.                Position=1)]
  39.             [String]$ComputerName
  40.         )
  41.  
  42.         $searcher = new-object System.DirectoryServices.DirectorySearcher([ADSI]"LDAP://$ComputerName")
  43.         $searcher.filter = "(&(objectClass=User)(lastlogon=*)(sAMAccountName=$sAMAccountName))"
  44.         [void]$searcher.PropertiesToLoad.Add('lastlogon')
  45.         try{
  46.             $userObj = $searcher.FindOne()
  47.         }
  48.         catch{
  49.             return $null
  50.         }
  51.  
  52.         Write-Output $(New-Object -TypeName PSObject -Property @{DC=$ComputerName;sAMAccountName=$sAMAccountName;LastLogon=[int64]$($userObj.Properties.lastlogon | Out-String).trim()})
  53.     }
  54.  
  55.     $queryQueue = New-Object System.Collections.ArrayList
  56.     for($i = 0; $i -lt $dcList.count; $i++){
  57.         Write-Verbose ('[GetRealLogonDate] Running jobs: {0}' -f (Get-Job -State Running).Count)
  58.         While( (Get-Job -State Running).Count -ge 10 ){
  59.             Start-Sleep -Seconds 3
  60.         }
  61.  
  62.         Write-Verbose ('[GetRealLogonDate] Starting job for {0}' -f $dcList[$i])
  63.         Start-Job -Name $dcList[$i] -ScriptBlock $queryBlock -ArgumentList $sAMAccountName,$dcList[$i] | Out-Null
  64.  
  65.         Get-Job -State Completed | Where { $_.Name -like "*.$Domain.*"} | Receive-Job -Wait -AutoRemoveJob | foreach { [void]$queryQueue.Add($_)}
  66.     }
  67.  
  68.     Write-Verbose ('[GetRealLogonDate] Waiting for running jobs to finish')
  69.     Get-Job | Wait-Job | Receive-Job -Wait -AutoRemoveJob | foreach { [void]$queryQueue.Add($_)}
  70.  
  71.     $log = 0
  72.     for($q = 0; $q -lt $queryQueue.count; $q++){
  73.         if($queryQueue[$q].LastLogon -like $null){continue}
  74.         if($queryQueue[$q].LastLogon -gt $log){$log = $queryQueue[$q].LastLogon}
  75.     }
  76.  
  77.     Write-Output $([datetime]::FromFileTime($log))
  78. }
  79.  
  80.  
  81. $users = Get-ADUser -Filter {Enabled -eq $true} -ResultSetSize 50000 -Properties displayName,description,PasswordLastSet,MemberOf,CanonicalName,LastLogonDate
  82. $UserReport = New-Object System.Collections.ArrayList
  83.  
  84. foreach ($u in $users){
  85.     if($EstimatedLogon){
  86.         $lastLogon = $u.LastLogonDate
  87.     }
  88.     else{
  89.         $lastLogon = GetRealLogonDate -sAMAccountName $u.sAMAccountName -Domain ($u.CanonicalName -split '/')[0]
  90.     }
  91.    
  92.     $UserObject = New-Object -TypeName PSObject -Property @{
  93.         sAMAccountName  = $u.sAMAccountName
  94.         displayName     = $u.displayName
  95.         description     = $u.description
  96.         LastLogon       = $lastlogon
  97.         PasswordLastSet = $u.PasswordLastSet
  98.         Memberships     = [string]::Join(';',($u.Memberof | foreach { ($_ -split ',')[0] -replace 'CN=' } | sort))
  99.     }
  100.    
  101.     [void]$UserReport.Add($UserObject)
  102. }
  103.  
  104. Write-Output $UserReport
Advertisement
Add Comment
Please, Sign In to add comment