Could not find a script that will enumerate all servers from AD (or specific OU) and give me a centralized CSV output of all the members of the servers local administrators group.
So I wrote one...
The script also enumerate groups members and indicate if the object is a user / computer or group (and then write the group name).
The script also check if the server is reachable and if you can connect via WMI, if nor indicates it in the output.
Console output is available.
Enjoy.
========================================
import-module ActiveDirectory
cls
$array = @()
$test2 = ""
#get local admin function
function get-localadmin {
param ($strcomputer)
$admins = Get-WmiObject win32_groupuser –computer $strcomputer -EV Err -EA SilentlyContinue
$admins = $admins |? {$_.groupcomponent –like '*"Administrators"'}
$admins |% {
$_.partcomponent –match “.+Domain\=(.+)\,Name\=(.+)$” > $nul
$matches[1].trim('"') + “\” + $matches[2].trim('"')
}
}
#list all servers to proccess [replace this with your OU structure]
$Comp = Get-ADComputer -SearchBase 'OU=Servers,dc=domain,dc=
#run on each server
foreach ($ADServer in $Comp) {
#Test if the server is responsive
$test = Test-Connection -computername $ADServer -Count 1 -Quiet
Write-Host "`nProccessing " $ADServer "..." -NoNewLine
If ($test -eq "True") {
#run the WMI command and catch errors
Try { $FnLocalAdmins = get-localadmin $ADServer }
Catch {
Write-Host " WMI error`n"
$test2 = "Error"
$Properties = @{Server=$ADServer;Admin="WMI Error";Type="Error"}
$Newobject = New-Object PSObject -Property $Properties
$array += $newobject
}
foreach ($Admins in $FnLocalAdmins) {
#split the username form the domain or server
$split = $Admins.Split('\')
$domain = $split[0]
$usr = $split[1]
#Check if the object is local or domain based [Replace this with your domain name]
If ($domain -eq "YOUR_DOMAIN") {
$u = Get-ADObject -Filter {samaccountname -eq $usr} -Properties objectClass
#check if the object is user, computer or group
Switch ($u.objectclass) {
User {
$Properties = @{Server=$ADServer;Admin=$usr;
$Newobject = New-Object PSObject -Property $Properties
$array += $newobject
;
Computer {
$Properties = @{Server=$ADServer;Admin=$usr;
$Newobject = New-Object PSObject -Property $Properties
$array += $newobject
;
Group {
$g = get-adgroupmember $usr -recursive
foreach ($groupuser in $G) {
$Properties = @{Server=$ADServer;Admin=$
$Newobject = New-Object PSObject -Property $Properties
$array += $newobject }
;break}
Default {
$Properties = @{Server=$ADServer;Admin=$usr;
$Newobject = New-Object PSObject -Property $Properties
$array += $newobject
;break}
}
}
Else {
$Properties = @{Server=$ADServer;Admin=$usr;
$Newobject = New-Object PSObject -Property $Properties
$array += $newobject
}
}
#write back to the console that all went ok
If ($test2 -eq "Error") {$test2 = ""} Else {
Write-Host " OK"
$test2 = "" }
}
Else {
Write-Host " Unreachable`n" -NoNewLine
$Properties = @{Server=$ADServer;Admin="
$Newobject = New-Object PSObject -Property $Properties
$array += $newobject
}
}
#export the results to a csv file
$array | export-csv -Path "D:\Scripts\Server\Output\
