_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Switch. Only display found shares that the local user has access to.


_raw: Search computers in the specific AD Site name, wildcards accepted.


_raw: Search computers with a specific service pack, wildcards accepted.


_raw: Search computers with a specific operating system, wildcards accepted.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for computers,


_raw: Specifies an LDAP query string that is used to search for computer objects.


_raw: Specifies the domain to query for computers, defaults to the current domain.


_raw: in the domain returned by Get-DomainComputer.


_raw: If -ComputerName is not passed, the default behavior is to enumerate all machines


_raw: Specifies an array of one or more hosts to enumerate, passable on the pipeline.


_raw: enumeration, reverting after with Invoke-RevertToSelf.


_raw: Invoke-UserImpersonation is used to impersonate the specified user before


_raw: access to the given share. If -Credential is passed, then


_raw: [IO.Directory]::GetFiles() is used to check if the current user has read


_raw: machine with Get-NetShare. If -CheckShareAccess is passed, then


_raw: using Get-DomainComputer, and enumerates the available shares for each


_raw: This function enumerates all machines on the current (or specified) domain


_raw: Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetShare, New-ThreadedFunction


_raw: then only shares the current user has read access to are returned.


_raw: Searches for computer shares on the domain. If -CheckShareAccess is passed,


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-DomainUserEvent] Using threading with threads: $Threads"


_raw: Write-Verbose "[Find-DomainUserEvent] Target user found, returning early"


_raw: $Result = Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $StartTime, $EndTime, $MaxEvents, $TargetUsers, $Filter, $Credential


_raw: Write-Verbose "[Find-DomainUserEvent] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-DomainUserEvent] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-DomainUserEvent] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: if ($_."$Key" -notmatch $Filter[$Key]) {


_raw: Get-DomainUserEvent @DomainUserEventArgs | ForEach-Object {


_raw: $Keys = $Filter.Keys | Where-Object {($_ -ne 'Op') -and ($_ -ne 'Operator') -and ($_ -ne 'Operation')}


_raw: if (($Filter[$_] -match '&') -or ($Filter[$_] -eq 'and')) {


_raw: if (($_ -eq 'Op') -or ($_ -eq 'Operator') -or ($_ -eq 'Operation')) {


_raw: Get-DomainUserEvent @DomainUserEventArgs | Where-Object {$TargetUsers -contains $_.TargetUserName}


_raw: if ($Credential) { $DomainUserEventArgs['Credential'] = $Credential }


_raw: if ($MaxEvents) { $DomainUserEventArgs['MaxEvents'] = $MaxEvents }


_raw: if ($EndTime) { $DomainUserEventArgs['EndTime'] = $EndTime }


_raw: if ($StartTime) { $DomainUserEventArgs['StartTime'] = $StartTime }


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: Param($ComputerName, $StartTime, $EndTime, $MaxEvents, $TargetUsers, $Filter, $Credential)


_raw: # the host enumeration block we're using to enumerate all servers


_raw: throw '[Find-DomainUserEvent] No hosts found to enumerate'


_raw: Write-Verbose "[Find-DomainUserEvent] TargetComputers $TargetComputers"


_raw: Write-Verbose "[Find-DomainUserEvent] TargetComputers length: $($TargetComputers.Length)"


_raw: if ($TargetComputers -and ($TargetComputers -isnot [System.Array])) {


_raw: $TargetComputers = Get-DomainController @DCSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose "[Find-DomainUserEvent] Querying for domain controllers in domain: $Domain"


_raw: if ($PSBoundParameters['Credential']) { $DCSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $DCSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $DCSearcherArguments['Domain'] = $Domain }


_raw: # if not -ComputerName is passed, query the current (or target) domain for domain controllers


_raw: # build the set of computers to enumerate


_raw: $TargetUsers = Get-DomainGroupMember @GroupSearcherArguments | Select-Object -ExpandProperty MemberName


_raw: if ($PSBoundParameters['Credential']) { $GroupSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $GroupSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $GroupSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $GroupSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $GroupSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $GroupSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['UserSearchBase']) { $GroupSearcherArguments['SearchBase'] = $UserSearchBase }


_raw: if ($PSBoundParameters['UserDomain']) { $GroupSearcherArguments['Domain'] = $UserDomain }


_raw: # otherwise we're querying a specific group


_raw: elseif ($PSBoundParameters['UserGroupIdentity'] -or (-not $PSBoundParameters['Filter'])) {


_raw: $TargetUsers = Get-DomainUser @UserSearcherArguments | Select-Object -ExpandProperty samaccountname


_raw: if ($PSBoundParameters['UserIdentity'] -or $PSBoundParameters['UserLDAPFilter'] -or $PSBoundParameters['UserSearchBase'] -or $PSBoundParameters['UserAdminCount']) {


_raw: if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['UserAdminCount']) { $UserSearcherArguments['AdminCount'] = $UserAdminCount }


_raw: if ($PSBoundParameters['UserSearchBase']) { $UserSearcherArguments['SearchBase'] = $UserSearchBase }


_raw: if ($PSBoundParameters['UserLDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $UserLDAPFilter }


_raw: if ($PSBoundParameters['UserDomain']) { $UserSearcherArguments['Domain'] = $UserDomain }


_raw: if ($PSBoundParameters['UserIdentity']) { $UserSearcherArguments['Identity'] = $UserIdentity }


_raw: [Parameter(ParameterSetName = 'ComputerName', Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: instead of in a threaded manner, using the alternate credential.


_raw: through every domain controller in the current domain, enumerating each DC in serial


_raw: Find user events mathing the specified GUID AND the specified TargetLogonId, searching


_raw: Find-DomainUserEvent -Delay 1 -Filter @{'LogonGuid'='b8458aa9-b36e-eaa1-96e0-4551000fdb19'; 'TargetLogonId' = '10238128'; 'op'='&'}


_raw: $cred = Get-Credential testlab\administrator


_raw: Find user events on the primary.testlab.local system where the event matches


_raw: 'primary.testlab.local | Find-DomainUserEvent -Filter @{'IpAddress'='192.168.52.200|192.168.52.201'}


_raw: domain controller using the alternate credential


_raw: Search for any user events matching the user 'john' on the 'secondary.dev.testlab.local'


_raw: Find-DomainUserEvent -ComputerName 'secondary.dev.testlab.local' -UserIdentity 'john'


_raw: $cred = Get-Credential dev\administrator


_raw: Search for any user events matching domain admins on every DC in the current domain.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: Switch. Stop hunting after finding after finding a target user.


_raw: for connection to the target computer(s).


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Switch. Search for users users with '(adminCount=1)' (meaning are/were privileged).


_raw: If any other user specifications are set, then UserGroupIdentity is ignored.


_raw: Specifies a group identity to query for target users, defaults to 'Domain Admins.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for target users.


_raw: Specifies an LDAP query string that is used to search for target users.


_raw: Specifies the domain to query for users to search for, defaults to the current domain.


_raw: Specifies one or more user identities to search for.


_raw: The maximum number of events (per host) to retrieve. Default of 5000.


_raw: The [DateTime] object representing the end of when to collect events.


_raw: The [DateTime] object representing the start of when to collect events.


_raw: and is 'or' by default, meaning at least one clause matches instead of all.


_raw: The 'op|operator|operation' clause can have '&', '|', 'and', or 'or',


_raw: A hashtable of PowerView.LogonEvent properties to filter for.


_raw: Specifies a domain to query for domain controllers to enumerate.


_raw: Specifies an explicit computer name to retrieve events from.


_raw: the results based on the targeting criteria.


_raw: the logon events for each using Get-DomainUserEvent, and filters


_raw: (default of the local domain) using Get-DomainController, enumerates


_raw: Enumerates all domain controllers from the specified -Domain


_raw: Required Dependencies: Get-DomainUser, Get-DomainGroupMember, Get-DomainController, Get-DomainUserEvent, New-ThreadedFunction


_raw: Author: Lee Christensen (@tifkin_), Justin Warner (@sixdub), Will Schroeder (@harmj0y)


_raw: Finds logon events on the current (or remote domain) for the specified users.


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-DomainProcess] Using threading with threads: $Threads"


_raw: Write-Verbose "[Find-DomainProcess] Target user found, returning early"


_raw: $Result = Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $TargetProcessName, $TargetUsers, $Credential


_raw: Write-Verbose "[Find-DomainProcess] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-DomainProcess] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-DomainProcess] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: elseif ($TargetUsers -Contains $Process.User) {


_raw: # if the session user is in the target list, display some output


_raw: if ($ProcessName -Contains $Process.ProcessName) {


_raw: # if we're hunting for a process name or comma-separated names


_raw: $Processes = Get-WMIProcess -ComputerName $TargetComputer -ErrorAction SilentlyContinue


_raw: $Processes = Get-WMIProcess -Credential $Credential -ComputerName $TargetComputer -ErrorAction SilentlyContinue


_raw: # and search for a specific process name


_raw: # try to enumerate all active processes on the remote host


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: Param($ComputerName, $ProcessName, $TargetUsers, $Credential)


_raw: # the host enumeration block we're using to enumerate all servers


_raw: $TargetUsers = Get-DomainGroupMember @GroupSearcherArguments | Select-Object -ExpandProperty MemberName


_raw: if ($PSBoundParameters['Credential']) { $GroupSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $GroupSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $GroupSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $GroupSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $GroupSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $GroupSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['UserSearchBase']) { $GroupSearcherArguments['SearchBase'] = $UserSearchBase }


_raw: if ($PSBoundParameters['UserDomain']) { $GroupSearcherArguments['Domain'] = $UserDomain }


_raw: $TargetUsers = Get-DomainUser @UserSearcherArguments | Select-Object -ExpandProperty samaccountname


_raw: elseif ($PSBoundParameters['UserIdentity'] -or $PSBoundParameters['UserLDAPFilter'] -or $PSBoundParameters['UserSearchBase'] -or $PSBoundParameters['UserAdminCount'] -or $PSBoundParameters['UserAllowDelegation']) {


_raw: $TargetProcessName = [String[]] @($TargetProcessName)


_raw: if ($TargetProcessName -isnot [System.Array]) {


_raw: throw '[Find-DomainProcess] No hosts found to enumerate'


_raw: Write-Verbose "[Find-DomainProcess] TargetComputers length: $($TargetComputers.Length)"


_raw: $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose '[Find-DomainProcess] Querying computers in the domain'


_raw: # first, build the set of computers to enumerate


_raw: if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['UserAdminCount']) { $UserSearcherArguments['AdminCount'] = $UserAdminCount }


_raw: if ($PSBoundParameters['UserSearchBase']) { $UserSearcherArguments['SearchBase'] = $UserSearchBase }


_raw: if ($PSBoundParameters['UserLDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $UserLDAPFilter }


_raw: if ($PSBoundParameters['UserDomain']) { $UserSearcherArguments['Domain'] = $UserDomain }


_raw: if ($PSBoundParameters['Domain']) { $UserSearcherArguments['Domain'] = $Domain }


_raw: if ($PSBoundParameters['UserIdentity']) { $UserSearcherArguments['Identity'] = $UserIdentity }


_raw: if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName }


_raw: if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack }


_raw: if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem }


_raw: if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter }


_raw: if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain }


_raw: if ($PSBoundParameters['Domain']) { $ComputerSearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Searches processes being run by 'domain admins' in the testlab.local using the specified alternate credentials.


_raw: Find-DomainProcess -Domain testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Searchings for instances of putty.exe running on the current domain.


_raw: Enumerates Windows 7 computers in dev.testlab.local and returns any processes being run by


_raw: Find-DomainProcess -UserAdminCount -ComputerOperatingSystem 'Windows 7*' -Domain dev.testlab.local


_raw: Searches for processes run by 'Domain Admins' by enumerating every computer in the domain.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: Switch. Stop hunting after finding after finding a target user.


_raw: for connection to the target domain and target systems.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Switch. Search for users users with '(adminCount=1)' (meaning are/were privileged).


_raw: If any other user specifications are set, then UserGroupIdentity is ignored.


_raw: Specifies a group identity to query for target users, defaults to 'Domain Admins.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for target users.


_raw: Specifies an LDAP query string that is used to search for target users.


_raw: Specifies the domain to query for users to search for, defaults to the current domain.


_raw: Specifies one or more user identities to search for.


_raw: Search for processes with one or more specific names.


_raw: Search computers in the specific AD Site name, wildcards accepted.


_raw: Search computers with a specific service pack, wildcards accepted.


_raw: Search computers with a specific operating system, wildcards accepted.


_raw: Switch. Search computer objects that have unconstrained delegation.


_raw: Specifies the LDAP source to search through for computers,


_raw: Specifies an LDAP query string that is used to search for computer objects.


_raw: Specifies the domain to query for computers, defaults to the current domain.


_raw: Specifies the domain to query for computers AND users, defaults to the current domain.


_raw: in the domain returned by Get-DomainComputer.


_raw: If -ComputerName is not passed, the default behavior is to enumerate all machines


_raw: Specifies an array of one or more hosts to enumerate, passable on the pipeline.


_raw: the underlying WMI commands used to enumerate the remote machines.


_raw: specified -ProcessName. If -Credential is passed, it is passed through to


_raw: searching for processes running under any target user contexts or with the


_raw: function enumerates any current processes running with Get-WMIProcess,


_raw: (default 'Domain Admins') with Get-DomainGroupMember. Then for each server the


_raw: using Get-DomainComputer, and queries the domain for users of a specified group


_raw: This function enumerates all machines on the current (or specified) domain


_raw: Required Dependencies: Get-DomainComputer, Get-DomainUser, Get-DomainGroupMember, Get-WMIProcess, New-ThreadedFunction


_raw: Thanks to @paulbrandau for the approach idea.


_raw: that match a particular user specification or process name.


_raw: Searches for processes on the domain using WMI, returning processes


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-DomainUserLocation] TargetComputers length: $($TargetComputers.Length)"


_raw: Write-Verbose "[Find-DomainUserLocation] Using threading with threads: $Threads"


_raw: Write-Verbose "[Find-DomainUserLocation] Target user found, returning early"


_raw: Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $TargetUsers, $CurrentUser, $Stealth, $LogonToken


_raw: Write-Verbose "[Find-DomainUserLocation] Enumerating server $Computer ($Counter of $($TargetComputers.Count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-DomainUserLocation] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-DomainUserLocation] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: $UserLocation | Add-Member Noteproperty 'LocalAdmin' $Null


_raw: $UserLocation | Add-Member Noteproperty 'LocalAdmin' $Admin.IsAdmin


_raw: $Admin = Test-AdminAccess -ComputerName $TargetComputer


_raw: # see if we're checking to see if we have local admin access on this machine


_raw: $UserLocation | Add-Member Noteproperty 'SessionFromName' $Null


_raw: $UserLocation | Add-Member Noteproperty 'SessionFrom' $Null


_raw: $UserLocation | Add-Member Noteproperty 'IPAddress' $IPAddress


_raw: $UserLocation | Add-Member Noteproperty 'ComputerName' $TargetComputer


_raw: $UserLocation | Add-Member Noteproperty 'UserName' $UserName


_raw: $UserLocation | Add-Member Noteproperty 'UserDomain' $UserDomain


_raw: $IPAddress = @(Resolve-IPAddress -ComputerName $TargetComputer)[0].IPAddress


_raw: if ( (-not $TargetUsers) -or ($TargetUsers -contains $UserName) -and ($UserName -notmatch '\$$')) {


_raw: if (($UserName) -and ($UserName.trim() -ne '')) {


_raw: $LoggedOn = Get-NetLoggedon -ComputerName $TargetComputer


_raw: # if we're not 'stealthy', enumerate loggedon users as well


_raw: $Admin = (Test-AdminAccess -ComputerName $CName).IsAdmin


_raw: $UserLocation | Add-Member NoteProperty 'SessionFromName' $Null


_raw: $UserLocation | Add-Member NoteProperty 'SessionFromName' $CnameDNSName


_raw: $CNameDNSName = [System.Net.Dns]::GetHostEntry($CName) | Select-Object -ExpandProperty HostName


_raw: # try to resolve the DNS hostname of $Cname


_raw: $UserLocation | Add-Member Noteproperty 'SessionFrom' $CName


_raw: $UserLocation | Add-Member Noteproperty 'UserDomain' $Null


_raw: if ( (-not $TargetUsers) -or ($TargetUsers -contains $UserName)) {


_raw: if (($UserName) -and ($UserName.Trim() -ne '') -and ($UserName -notmatch $CurrentUser) -and ($UserName -notmatch '\$$')) {


_raw: # make sure we have a result, and ignore computer$ sessions


_raw: if ($CName -and $CName.StartsWith('\\')) {


_raw: $Sessions = Get-NetSession -ComputerName $TargetComputer


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet


_raw: # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation


_raw: Param($ComputerName, $TargetUsers, $CurrentUser, $Stealth, $TokenHandle)


_raw: # the host enumeration block we're using to enumerate all servers


_raw: throw '[Find-DomainUserLocation] No users found to target'


_raw: if ((-not $ShowAll) -and ($TargetUsers.Length -eq 0)) {


_raw: Write-Verbose "[Find-DomainUserLocation] TargetUsers length: $($TargetUsers.Length)"


_raw: $TargetUsers = Get-DomainGroupMember @GroupSearcherArguments | Select-Object -ExpandProperty MemberName


_raw: if ($PSBoundParameters['Credential']) { $GroupSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $GroupSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $GroupSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $GroupSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $GroupSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $GroupSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['UserSearchBase']) { $GroupSearcherArguments['SearchBase'] = $UserSearchBase }


_raw: if ($PSBoundParameters['UserDomain']) { $GroupSearcherArguments['Domain'] = $UserDomain }


_raw: $TargetUsers = Get-DomainUser @UserSearcherArguments | Select-Object -ExpandProperty samaccountname


_raw: elseif ($PSBoundParameters['UserIdentity'] -or $PSBoundParameters['UserLDAPFilter'] -or $PSBoundParameters['UserSearchBase'] -or $PSBoundParameters['UserAdminCount'] -or $PSBoundParameters['UserAllowDelegation']) {


_raw: # get the current user so we can ignore it in the results


_raw: throw '[Find-DomainUserLocation] No hosts found to enumerate'


_raw: Write-Verbose "[Find-DomainUserLocation] TargetComputers length: $($TargetComputers.Length)"


_raw: $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose '[Find-DomainUserLocation] Querying for all computers in the domain'


_raw: if ($DomainControllers -isnot [System.Array]) { $DomainControllers = @($DomainControllers) }


_raw: $DomainControllers = Get-DomainController @DCSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: if ($PSBoundParameters['Credential']) { $DCSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $DCSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerDomain']) { $DCSearcherArguments['Domain'] = $ComputerDomain }


_raw: if ($PSBoundParameters['Domain']) { $DCSearcherArguments['Domain'] = $Domain }


_raw: Write-Verbose '[Find-DomainUserLocation] Querying for domain controllers'


_raw: # $ComputerName += Get-DomainDFSShare -Domain $Domain -Server $DomainController | ForEach-Object {$_.RemoteServerName}


_raw: # # TODO: fix the passed parameters to Get-DomainDFSShare


_raw: Write-Verbose '[Find-DomainUserLocation] Querying for DFS servers'


_raw: if ($FileServers -isnot [System.Array]) { $FileServers = @($FileServers) }


_raw: $FileServers = Get-DomainFileServer @FileServerSearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $FileServerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $FileServerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $FileServerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $FileServerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $FileServerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $FileServerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $FileServerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerDomain']) { $FileServerSearcherArguments['Domain'] = $ComputerDomain }


_raw: if ($PSBoundParameters['Domain']) { $FileServerSearcherArguments['Domain'] = $Domain }


_raw: Write-Verbose '[Find-DomainUserLocation] Querying for file servers'


_raw: $TargetComputerArrayList = New-Object System.Collections.ArrayList


_raw: Write-Verbose "[Find-DomainUserLocation] Stealth enumeration using source: $StealthSource"


_raw: # first, build the set of computers to enumerate


_raw: if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['UserAllowDelegation']) { $UserSearcherArguments['AllowDelegation'] = $UserAllowDelegation }


_raw: if ($PSBoundParameters['UserAdminCount']) { $UserSearcherArguments['AdminCount'] = $UserAdminCount }


_raw: if ($PSBoundParameters['UserSearchBase']) { $UserSearcherArguments['SearchBase'] = $UserSearchBase }


_raw: if ($PSBoundParameters['UserLDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $UserLDAPFilter }


_raw: if ($PSBoundParameters['UserDomain']) { $UserSearcherArguments['Domain'] = $UserDomain }


_raw: if ($PSBoundParameters['Domain']) { $UserSearcherArguments['Domain'] = $Domain }


_raw: if ($PSBoundParameters['UserIdentity']) { $UserSearcherArguments['Identity'] = $UserIdentity }


_raw: if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName }


_raw: if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack }


_raw: if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem }


_raw: if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter }


_raw: if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain }


_raw: if ($PSBoundParameters['Domain']) { $ComputerSearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('DFS', 'DC', 'File', 'All')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Searches for domain admin locations in the testlab.local using the specified alternate credentials.


_raw: Find-DomainUserLocation -Domain testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Enumerates Windows 7 computers in dev.testlab.local and returns user results for privileged


_raw: Find-DomainUserLocation -UserAdminCount -ComputerOperatingSystem 'Windows 7*' -Domain dev.testlab.local


_raw: Enumerates likely highly-trafficked servers, performs just session enumeration


_raw: Searches for 'Domain Admins' by enumerating every computer in the domain.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: 'DC' (domain controllers), 'File' (file servers), or 'All' (the default).


_raw: The source of target servers to use, 'DFS' (distributed file servers),


_raw: Switch. Only enumerate sessions from connonly used target servers.


_raw: Switch. Return all user location results instead of filtering based on target


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: Switch. Stop hunting after finding after finding a target user.


_raw: for connection to the target domain and target systems.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Switch. Check if the current user has local admin access to computers where target users are found.


_raw: Switch. Search for user accounts that are not marked as 'sensitive and not allowed for delegation'.


_raw: Switch. Search for users users with '(adminCount=1)' (meaning are/were privileged).


_raw: If any other user specifications are set, then UserGroupIdentity is ignored.


_raw: Specifies a group identity to query for target users, defaults to 'Domain Admins.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for target users.


_raw: Specifies an LDAP query string that is used to search for target users.


_raw: Specifies the domain to query for users to search for, defaults to the current domain.


_raw: Specifies one or more user identities to search for.


_raw: Search computers in the specific AD Site name, wildcards accepted.


_raw: Search computers with a specific service pack, wildcards accepted.


_raw: Search computers with a specific operating system, wildcards accepted.


_raw: Switch. Search computer objects that have unconstrained delegation.


_raw: Specifies the LDAP source to search through for computers,


_raw: Specifies an LDAP query string that is used to search for computer objects.


_raw: Specifies the domain to query for computers, defaults to the current domain.


_raw: Specifies the domain to query for computers AND users, defaults to the current domain.


_raw: in the domain returned by Get-DomainComputer.


_raw: If -ComputerName is not passed, the default behavior is to enumerate all machines


_raw: Specifies an array of one or more hosts to enumerate, passable on the pipeline.


_raw: before enumeration, reverting after with Invoke-RevertToSelf.


_raw: then Invoke-UserImpersonation is used to impersonate the specified user


_raw: enumeration is executed only against those servers. If -Credential is passed,


_raw: are enumerated with Get-DomainFileServer/Get-DomainController, and session


_raw: the filtered set. If -Stealth is specified, then likely highly-trafficed servers


_raw: displayed. If -ShowAll is specified, all results are displayed instead of


_raw: The found user list is compared against the target list, and any matches are


_raw: function enumerates any active user sessions with Get-NetSession/Get-NetLoggedon


_raw: (default 'Domain Admins') with Get-DomainGroupMember. Then for each server the


_raw: using Get-DomainComputer, and queries the domain for users of a specified group


_raw: This function enumerates all machines on the current (or specified) domain


_raw: Required Dependencies: Get-DomainFileServer, Get-DomainDFSShare, Get-DomainController, Get-DomainComputer, Get-DomainUser, Get-DomainGroupMember, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetSession, Test-AdminAccess, Get-NetLoggedon, Resolve-IPAddress, New-ThreadedFunction


_raw: Finds domain machines where specific users are logged into.


_raw: Write-Verbose "[New-ThreadedFunction] all threads completed"


_raw: for ($i=0; $i -lt $SleepSeconds; $i++) {


_raw: # cleanup- make sure we didn't miss anything


_raw: Write-Verbose "[New-ThreadedFunction] Waiting $SleepSeconds seconds for final cleanup..."


_raw: While (($Jobs | Where-Object { -not $_.Result.IsCompleted }).Count -gt 0)


_raw: # continuously loop through each job queue, consuming output as appropriate


_raw: Write-Verbose "[New-ThreadedFunction] Threads executing"


_raw: Result = $Method.Invoke($PowerShell, @($Null, [Management.Automation.PSDataCollection[Object]]$Output))


_raw: # kick off execution using the BeginInvok() method that allows queues


_raw: $Output = New-Object Management.Automation.PSDataCollection[Object]


_raw: $Null = $PowerShell.AddParameter($Param.Name, $Param.Value)


_raw: ForEach ($Param in $ScriptParameters.GetEnumerator()) {


_raw: $Null = $PowerShell.AddScript($ScriptBlock).AddParameter('ComputerName', $ComputerNamePartition)


_raw: # add the script block + arguments with the given computer partition


_raw: ForEach ($ComputerNamePartition in $ComputerNamePartitioned) {


_raw: Write-Verbose "[New-ThreadedFunction] Total number of threads/partitions: $Threads"


_raw: $List = New-Object System.Collections.ArrayList


_raw: if ($Threads -ge $ComputerName.Length) {


_raw: # partition all hosts from -ComputerName into $Threads number of groups


_raw: Write-Verbose "[New-ThreadedFunction] Total number of hosts: $($ComputerName.count)"


_raw: $ComputerName = $ComputerName | Where-Object {$_ -and $_.Trim()}


_raw: $Method = $M.MakeGenericMethod([Object], [Object])


_raw: if (($MethodParameters.Count -eq 2) -and $MethodParameters[0].Name -eq 'input' -and $MethodParameters[1].Name -eq 'output') {


_raw: ForEach ($M in [PowerShell].GetMethods() | Where-Object { $_.Name -eq 'BeginInvoke' }) {


_raw: # do some trickery to get the proper BeginInvoke() method that allows for an output queue


_raw: $Pool = [RunspaceFactory]::CreateRunspacePool(1, $Threads, $SessionState, $Host)


_raw: $SessionState.Commands.Add((New-Object -TypeName System.Management.Automation.Runspaces.SessionStateFunctionEntry -ArgumentList $Function.Name, $Function.Definition))


_raw: ForEach ($Function in (Get-ChildItem Function:)) {


_raw: # add Functions from current runspace to the InitialSessionState


_raw: if ($VorbiddenVars -NotContains $Var.Name) {


_raw: # add Variables from Parent Scope (current runspace) into the InitialSessionState


_raw: # these Variables are added by Runspace.Open() Method and produce Stop errors if you add them twice


_raw: # grab all the current variables for this runspace


_raw: #   functionality can be used by the threaded blocks


_raw: # import the current session state's variables and functions so the chained PowerView


_raw: # force a single-threaded apartment state (for token-impersonation stuffz)


_raw: # # $SessionState.ApartmentState = [System.Threading.Thread]::CurrentThread.GetApartmentState()


_raw: #   http://powershell.org/wp/forums/topic/invpke-parallel-need-help-to-clone-the-current-runspace/


_raw: [Parameter(Position = 1, Mandatory = $True)]


_raw: [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: # Helper used by any threaded host enumeration functions


_raw: $FoundFile = New-Object -TypeName PSObject -Property $FileParams


_raw: 'Owner' = $((Get-Acl $_.FullName).Owner)


_raw: if ($PSBoundParameters['CheckWriteAccess'] -and (-not (Test-Write -Path $_.FullName))) {


_raw: if ($PSBoundParameters['CreationTime'] -and ($_.CreationTime -lt $CreationTime)) {


_raw: if ($PSBoundParameters['LastWriteTime'] -and ($_.LastWriteTime -lt $LastWriteTime)) {


_raw: if ($LastAccessTime -and ($_.LastAccessTime -lt $LastAccessTime)) {


_raw: if ($PSBoundParameters['ExcludeFolders'] -and ($_.PSIsContainer)) {


_raw: Get-ChildItem @SearcherArguments | ForEach-Object {


_raw: Add-RemoteConnection -ComputerName $HostComputer -Credential $Credential


_raw: # map IPC$ to this computer if it's not already


_raw: if (-not $MappedComputers[$HostComputer]) {


_raw: $HostComputer = (New-Object System.Uri($TargetPath)).Host


_raw: if (($TargetPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) {


_raw: # short helper to check is the current user can write to a file


_raw: $SearcherArguments['Force'] = -not $PSBoundParameters['ExcludeHidden']


_raw: # find .exe's accessed within the last 7 days


_raw: $SearcherArguments['Include'] = @('*.doc', '*.docx', '*.xls', '*.xlsx', '*.ppt', '*.pptx')


_raw: $Include = @('*password*', '*sensitive*', '*admin*', '*login*', '*secret*', 'unattend*.xml', '*.vmdk', '*creds*', '*credential*', '*.config'),


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Find-InterestingFile -Credential $Cred -Path "\\PRIMARY.testlab.local\C$\Temp\"


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: search term set in the title and were accessed within the last week.


_raw: Returns any files on the remote path \\WINDOWS7\Users\ that have the default


_raw: Find-InterestingFile -Path "\\WINDOWS7\Users\" -LastAccessTime (Get-Date).AddDays(-7)


_raw: Returns any files on the local path C:\Backup\ that have the default


_raw: to connect to remote systems for file enumeration.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Only returns files the current user has write access to.


_raw: Switch. Exclude hidden files and folders from the search results.


_raw: Switch. Exclude folders from the search results.


_raw: Switch. Find .EXEs accessed within the last 7 days.


_raw: Switch. Search for office documents (*.doc*, *.xls*, *.ppt*)


_raw: Only return files with a CreationTime greater than this date value.


_raw: Only return files with a LastWriteTime greater than this date value.


_raw: Only return files with a LastAccessTime greater than this date value.


_raw: Only return files/folders that match the specified array of strings,


_raw: is used to temporarily map the remote share.


_raw: in search results. If -Credential is passed, Add-RemoteConnection/Remove-RemoteConnection


_raw: login and unattend*.xml). By default, hidden files/folders are included


_raw: specific keywords in the name (default of pass, sensitive, secret, admin,


_raw: This function recursively searches a given UNC path for files with


_raw: Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection


_raw: Searches for files on the given path that match a series of specified criteria.


_raw: Write-Verbose "[Get-WMIProcess] Error enumerating remote processes on '$Computer', access likely denied: $_"


_raw: $Process | Add-Member Noteproperty 'User' $Owner.User


_raw: $Process | Add-Member Noteproperty 'Domain' $Owner.Domain


_raw: $Process | Add-Member Noteproperty 'ProcessID' $_.ProcessID


_raw: $Process | Add-Member Noteproperty 'ProcessName' $_.ProcessName


_raw: $Process | Add-Member Noteproperty 'ComputerName' $Computer


_raw: Get-WMIobject @WmiArguments | ForEach-Object {


_raw: if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A PSCustomObject containing the remote process information.


_raw: Get-WMIProcess -ComputerName PRIMARY.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for cached RDP connections (also accepts IP addresses).


_raw: including the owners of the particular process.


_raw: Uses Get-WMIObject to enumerate all Win32_process instances on the local or remote machine,


_raw: Returns a list of processes and their owners on the local or remote machine.


_raw: Write-Warning "[Get-WMIRegMountedDrive] Error accessing $Computer, likely insufficient permissions or firewall rules on host: $_"


_raw: Write-Verbose "[Get-WMIRegMountedDrive] Error: $_"


_raw: $MountedDrive | Add-Member Noteproperty 'DriveUserName' $DriveUserName


_raw: $MountedDrive | Add-Member Noteproperty 'RemotePath' $RemotePath


_raw: $MountedDrive | Add-Member Noteproperty 'ProviderName' $ProviderName


_raw: $MountedDrive | Add-Member Noteproperty 'DriveLetter' $DriveLetter


_raw: $MountedDrive | Add-Member Noteproperty 'UserSID' $UserSID


_raw: $MountedDrive | Add-Member Noteproperty 'UserName' $UserName


_raw: $MountedDrive | Add-Member Noteproperty 'ComputerName' $Computer


_raw: if ($RemotePath -and ($RemotePath -ne '')) {


_raw: $DriveUserName = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'UserName').sValue


_raw: $RemotePath = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'RemotePath').sValue


_raw: $ProviderName = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'ProviderName').sValue


_raw: ForEach ($DriveLetter in $DriveLetters) {


_raw: $DriveLetters = ($Reg.EnumKey($HKU, "$UserSID\Network")).sNames


_raw: $UserName = ConvertFrom-SID -ObjectSid $UserSID


_raw: $UserName = ConvertFrom-SID -ObjectSid $UserSID -Credential $Credential


_raw: # extract out the SIDs of domain users in this hive


_raw: if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A PSCustomObject containing the ComputerName and mounted drive information.


_raw: Get-WMIRegMountedDrive -ComputerName PRIMARY.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns the saved network mounted drives for all machines in the domain.


_raw: Returns the saved network mounted drives for the WINDOWS2.testlab.local machine


_raw: Returns the saved network mounted drives for the local machine.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for mounted drive information (also accepts IP addresses).


_raw: Uses remote registry functionality to enumerate recently mounted network drives.


_raw: Note: This function requires administrative rights on the machine you're enumerating.


_raw: Returns information about saved network mounted drives for the local (or remote) machine.


_raw: $Net = New-Object -ComObject WScript.Network


_raw: Write-Verbose "Removing mounted drive at N:\"


_raw: Write-Warning "Error for GPO $ProcessedGPOName : $_"


_raw: $TaskXML | Set-Content -Encoding ASCII -Path "$TaskPath\ScheduledTasks.xml"


_raw: Throw "Scheduled task already exists at $TaskPath\ScheduledTasks.xml !"


_raw: $Null = New-Item -ItemType Directory -Force -Path $TaskPath


_raw: if (!$Force -and !$psCmdlet.ShouldContinue('Do you want to continue?',"Creating schtask at $TaskPath\ScheduledTasks.xml")) {


_raw: Remove-Item -Path "$TaskPath\ScheduledTasks.xml" -Force


_raw: if (!$Force -and !$psCmdlet.ShouldContinue('Do you want to continue?',"Removing schtask at $TaskPath\ScheduledTasks.xml")) {


_raw: Throw "Scheduled task doesn't exist at $TaskPath\ScheduledTasks.xml"


_raw: $TaskPath = $_.gpcfilesyspath + "\Machine\Preferences\ScheduledTasks\"


_raw: $Net.MapNetworkDrive("N:", $Path, $False, $Credential.UserName, $Credential.GetNetworkCredential().Password)


_raw: Write-Verbose "Mapping '$($_.gpcfilesyspath)' to network drive N:\"


_raw: # map a network drive as New-PSDrive/New-Item/etc. don't accept -Credential properly :(


_raw: Write-Verbose "Trying to weaponize GPO: $ProcessedGPOName"


_raw: $GPOs = Get-NetGPO -GPOname $GPOname -DisplayName $GPODisplayName -Domain $Domain -DomainController $DomainController -ADSpath $ADSpath -Credential $Credential


_raw: Write-Warning 'Either -GPOName or -GPODisplayName must be specified'


_raw: if (!$PSBoundParameters['GPOname'] -and !$PSBoundParameters['GPODisplayName']) {


_raw: # build the XML spec for our 'immediate' scheduled task


_raw: $TaskModifiedDate = (Get-Date (Get-Date).AddDays(-30) -Format u).trim("Z"),


_raw: [Parameter(ParameterSetName = 'Create', Mandatory = $True)]


_raw: Remove all schtasks from the 'SecurePolicy' GPO, skipping the confirmation prompt.


_raw: PS> New-GPOImmediateTask -GPODisplayName SecurePolicy -Remove -Force


_raw: push it out to the 'SecurePolicy' GPO, skipping the confirmation prompt.


_raw: Create an immediate schtask that executes the specified PowerShell arguments and


_raw: PS> New-GPOImmediateTask -TaskName Debugging -GPODisplayName SecurePolicy -CommandArguments '-c "123 | Out-File C:\Temp\debug.txt"' -Force


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Domain controller to reflect LDAP queries through.


_raw: The domain to query for the GPOs, defaults to the current domain.


_raw: The GPO display name to build the task for.


_raw: The displayed modified date for the task, defaults to 30 days ago.


_raw: The displayed author of the task, defaults to ''NT AUTHORITY\System'


_raw: The arguments to supply to the -Command being launched.


_raw: The command to execute with the task, defaults to 'powershell'


_raw: Name for the schtask to recreate. Required.


_raw: Builds an 'Immediate' schtask to push out through a specified GPO.


_raw: Write-Warning "[Get-WMIRegCachedRDPConnection] Error accessing $Computer, likely insufficient permissions or firewall rules on host: $_"


_raw: Write-Verbose "[Get-WMIRegCachedRDPConnection] Error: $_"


_raw: $FoundConnection | Add-Member Noteproperty 'UsernameHint' $UsernameHint


_raw: $FoundConnection | Add-Member Noteproperty 'TargetServer' $Server


_raw: $FoundConnection | Add-Member Noteproperty 'UserSID' $UserSID


_raw: $FoundConnection | Add-Member Noteproperty 'UserName' $UserName


_raw: $FoundConnection | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $UsernameHint = $Reg.GetStringValue($HKU, "$UserSID\Software\Microsoft\Terminal Server Client\Servers\$Server", 'UsernameHint').sValue


_raw: $ServerKeys = $Reg.EnumKey($HKU,"$UserSID\Software\Microsoft\Terminal Server Client\Servers").sNames


_raw: # pull out all the cached server info with username hints


_raw: $FoundConnection | Add-Member Noteproperty 'UsernameHint' $Null


_raw: $FoundConnection | Add-Member Noteproperty 'TargetServer' $TargetServer


_raw: $TargetServer = $Reg.GetStringValue($HKU, "$UserSID\Software\Microsoft\Terminal Server Client\Default", $Connection).sValue


_raw: # make sure this key is a cached connection


_raw: ForEach ($Connection in $ConnectionKeys) {


_raw: $ConnectionKeys = $Reg.EnumValues($HKU,"$UserSID\Software\Microsoft\Terminal Server Client\Default").sNames


_raw: # pull out all the cached RDP connections


_raw: $UserName = ConvertFrom-SID -ObjectSid $UserSID


_raw: $UserName = ConvertFrom-SID -ObjectSid $UserSID -Credential $Credential


_raw: # extract out the SIDs of domain users in this hive


_raw: if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A PSCustomObject containing the ComputerName and cached RDP information.


_raw: Get-WMIRegCachedRDPConnection -ComputerName PRIMARY.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns cached RDP information for all machines in the domain.


_raw: Returns the RDP connection client information for the WINDOWS2.testlab.local machine


_raw: Get-WMIRegCachedRDPConnection  -ComputerName WINDOWS2.testlab.local


_raw: Returns the RDP connection client information for the local machine.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for cached RDP connections (also accepts IP addresses).


_raw: "Windows Remote Desktop Connection Client" on a machine, separated by


_raw: Uses remote registry functionality to query all entries for the


_raw: Note: This function requires administrative rights on the machine you're enumerating.


_raw: Returns information about RDP connections outgoing from the local (or remote) machine.


_raw: Write-Warning "[Get-WMIRegLastLoggedOn] Error opening remote registry on $Computer. Remote registry likely not enabled."


_raw: $LastLoggedOn | Add-Member Noteproperty 'LastLoggedOn' $LastUser


_raw: $LastLoggedOn | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $LastUser = $Reg.GetStringValue($HKLM, $Key, $Value).sValue


_raw: # try to open up the remote registry key to grab the last logged on user


_raw: if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A PSCustomObject containing the ComputerName and last loggedon user.


_raw: Get-WMIRegLastLoggedOn -ComputerName PRIMARY.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns the last user logged onto all machines in the domain.


_raw: Returns the last user logged onto WINDOWS1


_raw: Returns the last user logged onto the local machine.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for remote registry values (also accepts IP addresses).


_raw: This function uses remote registry to enumerate the LastLoggedOnUser registry key


_raw: Note: This function requires administrative rights on the machine you're enumerating.


_raw: Returns the last user who logged onto the local (or a remote) machine.


_raw: Write-Warning "[Get-WMIRegProxy] Error enumerating proxy settings for $ComputerName : $_"


_raw: Write-Warning "[Get-WMIRegProxy] No proxy settings found for $ComputerName"


_raw: $Out | Add-Member Noteproperty 'Wpad' $Wpad


_raw: $Out | Add-Member Noteproperty 'AutoConfigURL' $AutoConfigURL


_raw: $Out | Add-Member Noteproperty 'ProxyServer' $ProxyServer


_raw: $Out | Add-Member Noteproperty 'ComputerName' $Computer


_raw: Write-Warning "[Get-WMIRegProxy] Error connecting to AutoConfigURL : $AutoConfigURL"


_raw: $Wpad = (New-Object Net.WebClient).DownloadString($AutoConfigURL)


_raw: if ($AutoConfigURL -and ($AutoConfigURL -ne '')) {


_raw: $AutoConfigURL = $RegProvider.GetStringValue($HKCU, $Key, 'AutoConfigURL').sValue


_raw: $ProxyServer = $RegProvider.GetStringValue($HKCU, $Key, 'ProxyServer').sValue


_raw: $Key = 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings'


_raw: $RegProvider = Get-WmiObject @WmiArguments


_raw: if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Outputs custom PSObjects with the ComputerName, ProxyServer, AutoConfigURL, and WPAD contents.


_raw: Accepts one or more computer name specification strings  on the pipeline (netbios or FQDN).


_raw: ComputerName            ProxyServer            AutoConfigURL         Wpad


_raw: Get-WMIRegProxy -Credential $Cred -ComputerName primary.testlab.local


_raw: $Cred = Get-Credential "TESTLAB\administrator"


_raw: WINDOWS1               http://primary.test...


_raw: ComputerName           ProxyServer            AutoConfigURL         Wpad


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the system to enumerate proxy settings on. Defaults to the local host.


_raw: It does this by enumerating settings from


_raw: on the local machine (default), or a machine specified with -ComputerName.


_raw: Enumerates the proxy server and WPAD specification for the current user


_raw: Enumerates the proxy server and WPAD conents for the current user.


_raw: $ComputerSite | Add-Member Noteproperty 'SiteName' ''


_raw: Write-Verbose "[Get-NetComputerSiteName] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $ComputerSite | Add-Member Noteproperty 'SiteName' $Sitename


_raw: $ComputerSite | Add-Member Noteproperty 'IPAddress' $IPAddress


_raw: $ComputerSite | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $Result = $Netapi32::DsGetSiteName($Computer, [ref]$PtrInfo)


_raw: $IPAddress = @(Resolve-IPAddress -ComputerName $Computer)[0].IPAddress


_raw: $Computer = [System.Net.Dns]::GetHostByAddress($Computer) | Select-Object -ExpandProperty HostName


_raw: # if we get an IP address, try to resolve the IP to a hostname


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A PSCustomObject containing the ComputerName, IPAddress, and associated Site name.


_raw: Get-NetComputerSiteName -ComputerName WINDOWS1.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns the sites for every machine in AD.


_raw: Returns the site for WINDOWS1.testlab.local.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to check the site for (also accepts IP addresses).


_raw: name of the site where a specified computer resides.


_raw: This function will use the DsGetSiteName Win32API call to look up the


_raw: Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf


_raw: Returns the AD site where the local (or a remote) machine resides.


_raw: $IsAdmin | Add-Member Noteproperty 'IsAdmin' $False


_raw: Write-Verbose "[Test-AdminAccess] Error: $(([ComponentModel.Win32Exception] $LastError).Message)"


_raw: $IsAdmin | Add-Member Noteproperty 'IsAdmin' $True


_raw: # if we get a non-zero handle back, everything was successful


_raw: $IsAdmin | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $Handle = $Advapi32::OpenSCManagerW("\\$Computer", 'ServicesActive', 0xF003F);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()


_raw: #   http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981(v=vs.85).aspx


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: the current user has local admin rights, along with the ComputerName added.


_raw: A PSCustomObject containing the ComputerName and 'IsAdmin' set to whether


_raw: Test-AdminAccess -ComputerName sqlserver -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns what machines in the domain the current user has access to.


_raw: Returns results indicating whether the current user has admin access to the 'sqlserver' host.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to check for local admin access (also accepts IP addresses).


_raw: has local administrator acess to the target.


_raw: a handle to the remote host. If this succeeds, the current user context


_raw: This function will use the OpenSCManagerW Win32API call to establish


_raw: Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf


_raw: 'Royce Davis "r3dy" <rdavis[at]accuvant.com>'


_raw: 'Thomas McCarthy "smilingraccoon" <smilingraccoon[at]gmail.com>'


_raw: 'Brandon McCann "zeknox" <bmccann[at]accuvant.com>'


_raw: Idea stolen from the local_admin_search_enum post module in Metasploit written by:


_raw: Tests if the current user has administrative access to the local (or a remote) machine.


_raw: Write-Verbose "[Get-NetRDPSession] Error opening the Remote Desktop Session Host (RD Session Host) server for: $ComputerName"


_raw: Write-Verbose "[Get-NetRDPSession] Error: $(([ComponentModel.Win32Exception] $LastError).Message)"


_raw: $Null = $Wtsapi32::WTSFreeMemoryEx(2, $ppSessionInfo, $pCount)


_raw: $RDPSession | Add-Member Noteproperty 'SourceIP' $SourceIP


_raw: $Info2 = $NewIntPtr2 -as $WTS_CLIENT_ADDRESS


_raw: $NewIntPtr2 = New-Object System.Intptr -ArgumentList $Offset2


_raw: Write-Verbose "[Get-NetRDPSession] Error: $(([ComponentModel.Win32Exception] $LastError2).Message)"


_raw: $Result2 = $Wtsapi32::WTSQuerySessionInformation($Handle, $Info.SessionID, 14, [ref]$ppBuffer, [ref]$pBytesReturned);$LastError2 = [Runtime.InteropServices.Marshal]::GetLastWin32Error()


_raw: #   https://msdn.microsoft.com/en-us/library/aa383861(v=vs.85).aspx


_raw: # query for the source client IP with WTSQuerySessionInformation


_raw: $RDPSession | Add-Member Noteproperty 'State' $Info.State


_raw: $RDPSession | Add-Member Noteproperty 'ID' $Info.SessionID


_raw: $RDPSession | Add-Member Noteproperty 'UserName' "$($Info.pDomainName)\$($Info.pUserName)"


_raw: $RDPSession | Add-Member Noteproperty 'UserName' "$($Info.pUserName)"


_raw: # if a domain isn't returned just use the username


_raw: if ($(-not $Info.pDomainName) -or ($Info.pDomainName -eq '')) {


_raw: $RDPSession | Add-Member Noteproperty 'SessionName' $Info.pSessionName


_raw: $RDPSession | Add-Member Noteproperty 'ComputerName' $Computer


_raw: # if no hostname returned, use the specified hostname


_raw: $RDPSession | Add-Member Noteproperty 'ComputerName' $Info.pHostName


_raw: $Info = $NewIntPtr -as $WTS_SESSION_INFO_1


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: # work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -ne 0) -and ($Offset -gt 0)) {


_raw: # locate the offset of the initial intPtr


_raw: $Result = $Wtsapi32::WTSEnumerateSessionsEx($Handle, [ref]1, 0, [ref]$ppSessionInfo, [ref]$pCount);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()


_raw: # get information on all current sessions


_raw: # if we get a non-zero handle back, everything was successful


_raw: # open up a handle to the Remote Desktop Session host


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A PSCustomObject representing a combined WTS_SESSION_INFO_1 and WTS_CLIENT_ADDRESS structure,


_raw: Get-NetRDPSession -ComputerName sqlserver -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns active RDP/terminal sessions on all domain controllers.


_raw: Returns active RDP/terminal sessions on the 'sqlserver' host.


_raw: Returns active RDP/terminal sessions on the local host.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for active sessions (also accepts IP addresses).


_raw: Win32API calls to query a given RDP remote service for active sessions and originating


_raw: This function will execute the WTSEnumerateSessionsEx and WTSQuerySessionInformation


_raw: Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf


_raw: can successfully execute this functionality on a remote target.


_raw: Note: only members of the Administrators or Account Operators local group


_raw: Returns remote desktop/session information for the local (or a remote) machine.


_raw: Write-Verbose "[Get-RegLoggedOn] Error opening remote registry on '$ComputerName' : $_"


_raw: $RegLoggedOnUser | Add-Member Noteproperty 'UserSID' $_


_raw: $RegLoggedOnUser | Add-Member Noteproperty 'UserName' $UserName


_raw: $RegLoggedOnUser | Add-Member Noteproperty 'UserDomain' $UserDomain


_raw: $RegLoggedOnUser | Add-Member Noteproperty 'ComputerName' "$ComputerName"


_raw: $UserName, $UserDomain = $UserName.Split('@')


_raw: $UserName = ConvertFrom-SID -ObjectSID $_ -OutputType 'DomainSimple'


_raw: $Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('Users', "$ComputerName")


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: actively logged on user, with the ComputerName added.


_raw: A PSCustomObject including the UserDomain/UserName/UserSID of each


_raw: Get-RegLoggedOn -ComputerName sqlserver -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns users actively logged on all domain controllers.


_raw: Returns users actively logged onto the 'sqlserver' host.


_raw: Returns users actively logged onto the local host.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for remote registry values (also accepts IP addresses).


_raw: required (NetWkstaUserEnum requires remote admin access).


_raw: using the NetWkstaUserEnum API (Get-NetLoggedon) of less user privileges


_raw: Adapted technique from Sysinternal's PSLoggedOn script. Benefit over


_raw: logged on users SID and then attempt and reverse it.


_raw: This function will query the HKU registry values to retrieve the local


_raw: Required Dependencies: Invoke-UserImpersonation, Invoke-RevertToSelf, ConvertFrom-SID


_raw: machine you're enumerating, but remote registry must be enabled.


_raw: Note: This function requires only domain user rights on the


_raw: through enumeration of remote registry keys.


_raw: Returns who is logged onto the local (or a remote) machine


_raw: Write-Verbose "[Get-NetSession] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $Session | Add-Member Noteproperty 'ComputerName' $Computer


_raw: # return all the sections of the structure - have to do it this way for V2


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: for ($i = 0; ($i -lt $EntriesRead); $i++) {


_raw: # work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -eq 0) -and ($Offset -gt 0)) {


_raw: # locate the offset of the initial intPtr


_raw: $Result = $Netapi32::NetSessionEnum($Computer, '', $UserName, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: the CName/UserName/Time/IdleTime for each session, with the ComputerName added.


_raw: A PSCustomObject representing a WKSTA_USER_INFO_1 structure, including


_raw: Get-NetSession -ComputerName sqlserver -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns active sessions on all domain controllers.


_raw: Returns active sessions on the 'sqlserver' host.


_raw: Returns active sessions on the local host.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for sessions (also accepts IP addresses).


_raw: This function will execute the NetSessionEnum Win32API call to query


_raw: Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf


_raw: Returns session information for the local (or a remote) machine.


_raw: Write-Verbose "[Get-NetLoggedon] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $LoggedOn | Add-Member Noteproperty 'ComputerName' $Computer


_raw: # return all the sections of the structure - have to do it this way for V2


_raw: $Info = $NewIntPtr -as $WKSTA_USER_INFO_1


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: for ($i = 0; ($i -lt $EntriesRead); $i++) {


_raw: # work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -eq 0) -and ($Offset -gt 0)) {


_raw: # locate the offset of the initial intPtr


_raw: $Result = $Netapi32::NetWkstaUserEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: the UserName/LogonDomain/AuthDomains/LogonServer for each user, with the ComputerName added.


_raw: A PSCustomObject representing a WKSTA_USER_INFO_1 structure, including


_raw: Get-NetLoggedon -ComputerName sqlserver -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns all logged on users for all computers in the domain.


_raw: Returns users actively logged onto the 'sqlserver' host.


_raw: Returns users actively logged onto the local host.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for logged on users (also accepts IP addresses).


_raw: a given host for actively logged on users.


_raw: This function will execute the NetWkstaUserEnum Win32API call to query


_raw: Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf


_raw: Note: administrative rights needed for newer Windows OSes.


_raw: Returns users logged on the local (or a remote) machine.


_raw: Write-Verbose "[Get-NetShare] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $Share | Add-Member Noteproperty 'ComputerName' $Computer


_raw: # return all the sections of the structure - have to do it this way for V2


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: for ($i = 0; ($i -lt $EntriesRead); $i++) {


_raw: # work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -eq 0) -and ($Offset -gt 0)) {


_raw: # locate the offset of the initial intPtr


_raw: $Result = $Netapi32::NetShareEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: the name/type/remark for each share, with the ComputerName added.


_raw: A PSCustomObject representing a SHARE_INFO_1 structure, including


_raw: Get-NetShare -ComputerName sqlserver -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns all shares for all computers in the domain.


_raw: Returns active shares on the 'sqlserver' host


_raw: Returns active shares on the local host.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for shares (also accepts IP addresses).


_raw: a given host for open shares. This is a replacement for "net share \\hostname".


_raw: This function will execute the NetShareEnum Win32API call to query


_raw: Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf


_raw: Returns open shares on the local (or a remote) machine.


_raw: Write-Verbose "[Get-NetLocalGroupMember] Error for $Computer : $_"


_raw: #             $Member | Add-Member Noteproperty 'LastLogin' ''


_raw: #             $Member | Add-Member Noteproperty 'LastLogin' ( $LocalUser.LastLogin[0])


_raw: #         $Member | Add-Member Noteproperty 'Disabled' $(($LocalUser.UserFlags.value -band 2) -eq 2)


_raw: #         # UAC flags of 0x2 mean the account is disabled


_raw: #         $Member | Add-Member Noteproperty 'UserFlags' ( $LocalUser.UserFlags[0] )


_raw: #         $Member | Add-Member Noteproperty 'PwdExpired' ( $LocalUser.PasswordExpired[0] -eq '1')


_raw: #         $Member | Add-Member Noteproperty 'PwdLastSet' ( (Get-Date).AddSeconds(-$LocalUser.PasswordAge[0]))


_raw: #         $Member | Add-Member Noteproperty 'LastLogin' ''


_raw: #         $Member | Add-Member Noteproperty 'Disabled' ''


_raw: #         $Member | Add-Member Noteproperty 'UserFlags' ''


_raw: #         $Member | Add-Member Noteproperty 'PwdExpired' ''


_raw: #         $Member | Add-Member Noteproperty 'PwdLastSet' ''


_raw: #     $Member | Add-Member Noteproperty 'Description' ($LocalUser.Description)


_raw: #     $Member | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalUser.InvokeGet('ObjectSID'),0)).Value)


_raw: #     # translate the binary sid to a string


_raw: #     $Member | Add-Member Noteproperty 'UserFlags' ''


_raw: #     $Member | Add-Member Noteproperty 'PwdExpired' ''


_raw: #     $Member | Add-Member Noteproperty 'PwdLastSet' ''


_raw: #             $Member | Add-Member Noteproperty 'LastLogin' ''


_raw: #             $Member | Add-Member Noteproperty 'LastLogin' $LocalUser.InvokeGet('LastLogin')


_raw: #     $Member | Add-Member Noteproperty 'Disabled' ''


_raw: #     $Member | Add-Member Noteproperty 'Description' ''


_raw: $Member | Add-Member Noteproperty 'IsDomain' $MemberIsDomain


_raw: $Member | Add-Member Noteproperty 'IsGroup' $IsGroup


_raw: $Member | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalUser.InvokeGet('ObjectSID'),0)).Value)


_raw: $Member | Add-Member Noteproperty 'AccountName' $Name


_raw: $Name = $AdsPath.Substring($AdsPath.IndexOf('/')+1).Replace('/', '\')


_raw: if(([regex]::Matches($AdsPath, '/')).count -eq 1) {


_raw: $IsGroup = ($LocalUser.SchemaClassName -like 'group')


_raw: $AdsPath = $LocalUser.InvokeGet('AdsPath').Replace('WinNT://', '')


_raw: $Member | Add-Member Noteproperty 'GroupName' $GroupName


_raw: $Member | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $GroupProvider.psbase.Invoke('Members') | ForEach-Object {


_raw: # otherwise we're using the WinNT service provider


_raw: Write-Verbose "[Get-NetLocalGroupMember] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $_ | Add-Member Noteproperty 'IsDomain' 'UNKNOWN'


_raw: $_ | Add-Member Noteproperty 'IsDomain' $False


_raw: $_ | Add-Member Noteproperty 'IsDomain' $True


_raw: $MachineSid = $MachineSid.Substring(0, $MachineSid.LastIndexOf('-'))


_raw: $MachineSid = $Members | Where-Object {$_.SID -match '.*-500' -or ($_.SID -match '.*-501')} | Select-Object -Expand SID


_raw: # try to extract out the machine SID by using the -500 account as a reference


_raw: $Member | Add-Member Noteproperty 'IsGroup' $IsGroup


_raw: $IsGroup = $($Info.lgrmi2_sidusage -eq 'SidTypeGroup')


_raw: $Member | Add-Member Noteproperty 'SID' $SidString


_raw: $Member | Add-Member Noteproperty 'MemberName' $Info.lgrmi2_domainandname


_raw: Write-Verbose "[Get-NetLocalGroupMember] Error: $(([ComponentModel.Win32Exception] $LastError).Message)"


_raw: $Result2 = $Advapi32::ConvertSidToStringSid($Info.lgrmi2_sid, [ref]$SidString);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()


_raw: $Info = $NewIntPtr -as $LOCALGROUP_MEMBERS_INFO_2


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: for ($i = 0; ($i -lt $EntriesRead); $i++) {


_raw: # Work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -eq 0) -and ($Offset -gt 0)) {


_raw: # locate the offset of the initial intPtr


_raw: $Result = $Netapi32::NetLocalGroupGetMembers($Computer, $GroupName, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)


_raw: # if we're using the Netapi32 NetLocalGroupGetMembers API call to get the local group information


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated group property fields from WinNT results.


_raw: Custom PSObject with translated group property fields from API results.


_raw: primary.tes... Administrators TESTLAB\Dom... S-1-5-21-89...           True          False


_raw: primary.tes... Administrators TESTLAB\Ent... S-1-5-21-89...           True          False


_raw: primary.tes... Administrators TESTLAB\loc... S-1-5-21-89...          False          False


_raw: primary.tes... Administrators TESTLAB\Adm... S-1-5-21-89...          False          False


_raw: ComputerName   GroupName      MemberName     SID                   IsGroup       IsDomain


_raw: Get-NetLocalGroupMember -ComputerName primary.testlab.local | ft


_raw: WINDOWS1       Users          TESTLAB\Dom... S-1-5-21-89...           True        UNKNOWN


_raw: WINDOWS1       Users          WINDOWS1\lo... S-1-5-21-25...          False        UNKNOWN


_raw: WINDOWS1       Users          NT AUTHORIT... S-1-5-11                False          False


_raw: WINDOWS1       Users          NT AUTHORIT... S-1-5-4                 False          False


_raw: WINDOWS1       IIS_IUSRS      NT AUTHORIT... S-1-5-17                False          False


_raw: WINDOWS1       Guests         WINDOWS1\Guest S-1-5-21-25...          False          False


_raw: WINDOWS1       Administrators TESTLAB\har... S-1-5-21-89...          False           True


_raw: WINDOWS1       Administrators TESTLAB\Dom... S-1-5-21-89...           True           True


_raw: WINDOWS1       Administrators WINDOWS1\lo... S-1-5-21-25...          False          False


_raw: WINDOWS1       Administrators WINDOWS1\Ad... S-1-5-21-25...          False          False


_raw: Get-NetLocalGroup | Get-NetLocalGroupMember | ft


_raw: Get-NetLocalGroupMember -Method winnt | ft


_raw: for connection to a remote machine. Only applicable with "-Method WinNT".


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: The collection method to use, defaults to 'API', also accepts 'WinNT'.


_raw: The local group name to query for users. If not given, it defaults to "Administrators".


_raw: Specifies the hostname to query for sessions (also accepts IP addresses).


_raw: to be used instead, which returns a larger amount of information.


_raw: will be used (for speed). Specifying "-Method WinNT" causes the WinNT service provider


_raw: current, or remote, machine. By default, the Win32 API call NetLocalGroupGetMembers


_raw: This function will enumerate the members of a specified local group  on the


_raw: Required Dependencies: PSReflect, Convert-ADName


_raw: Enumerates members of a specific local group on the local (or remote) machine.


_raw: $Group | Add-Member Noteproperty 'Comment' ($LocalGroup.InvokeGet('Description'))


_raw: $Group | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalGroup.InvokeGet('objectsid'),0)).Value)


_raw: $Group | Add-Member Noteproperty 'GroupName' ($LocalGroup.InvokeGet('Name'))


_raw: $Group | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $ComputerProvider.psbase.children | Where-Object { $_.psbase.schemaClassName -eq 'group' } | ForEach-Object {


_raw: # otherwise we're using the WinNT service provider


_raw: Write-Verbose "[Get-NetLocalGroup] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $LocalGroup | Add-Member Noteproperty 'Comment' $Info.lgrpi1_comment


_raw: $LocalGroup | Add-Member Noteproperty 'GroupName' $Info.lgrpi1_name


_raw: $LocalGroup | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $Info = $NewIntPtr -as $LOCALGROUP_INFO_1


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: for ($i = 0; ($i -lt $EntriesRead); $i++) {


_raw: # Work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -eq 0) -and ($Offset -gt 0)) {


_raw: # locate the offset of the initial intPtr


_raw: $Result = $Netapi32::NetLocalGroupEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)


_raw: # if we're using the Netapi32 NetLocalGroupEnum API call to get the local group information


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated group property fields from WinNT results.


_raw: Custom PSObject with translated group property fields from API results.


_raw: primary.testlab.local         Backup Operators              Backup Operators can overr...


_raw: primary.testlab.local         Print Operators               Members can administer dom...


_raw: primary.testlab.local         Guests                        Guests have the same acces...


_raw: primary.testlab.local         Users                         Users are prevented from m...


_raw: primary.testlab.local         Administrators                Administrators have comple...


_raw: ComputerName                  GroupName                     Comment


_raw: WINDOWS1               Cryptographic Opera... S-1-5-32-569          Members are author...


_raw: WINDOWS1               Backup Operators       S-1-5-32-551          Backup Operators c...


_raw: WINDOWS1               Administrators         S-1-5-32-544          Administrators hav...


_raw: ComputerName           GroupName              GroupSID              Comment


_raw: WINDOWS1                      Cryptographic Operators       Members are authorized to ...


_raw: WINDOWS1                      Backup Operators              Backup Operators can overr...


_raw: WINDOWS1                      Administrators                Administrators have comple...


_raw: for connection to a remote machine. Only applicable with "-Method WinNT".


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: The collection method to use, defaults to 'API', also accepts 'WinNT'.


_raw: Specifies the hostname to query for sessions (also accepts IP addresses).


_raw: SIDs along with the group names and descriptions/comments.


_raw: causes the WinNT service provider to be used instead, which returns group


_raw: call NetLocalGroupEnum will be used (for speed). Specifying "-Method WinNT"


_raw: local groups on the current, or remote, machine. By default, the Win32 API


_raw: This function will enumerate the names and descriptions for the


_raw: Enumerates the local groups on the local (or remote) machine.


_raw: # WinNT, WMI, remote registry, or API calls


_raw: # Functions that enumerate a single host, either through


_raw: $_ | Add-Member Noteproperty 'GPODisplayName' $GPO.displayname


_raw: $_ | Add-Member Noteproperty 'GPOName' $GPO.name


_raw: Get-GptTmpl @ParseArgs | ForEach-Object {


_raw: if ($PSBoundParameters['Credential']) { $ParseArgs['Credential'] = $Credential }


_raw: $GptTmplPath = $GPO.gpcfilesyspath + "\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf"


_raw: # grab the GptTmpl.inf file and parse it


_raw: $GPOResults = Get-DomainGPO @SearcherArguments


_raw: elseif (($Policy -eq 'DomainController') -or ($Policy -eq 'DC')) {


_raw: if ($PSBoundParameters['Credential']) { $ConvertArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $ConvertArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Obfuscate']) {$SearcherArguments['Obfuscate'] = $Obfuscate }


_raw: if ($PSBoundParameters['SSL']) { $SearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Ouputs a hashtable representing the parsed GptTmpl.inf file.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns the policy for the dev.testlab.local domain controller.


_raw: Get-DomainPolicyData -Policy DC -Domain dev.testlab.local


_raw: Parses any GptTmpl.infs found for any policies in the current domain.


_raw: Returns the default domain policy for the dev.testlab.local domain.


_raw: Returns the default domain policy for the current domain.


_raw: Switch. Obfuscate the resulting LDAP filter string using hex encoding.


_raw: Switch. Use SSL for the connection to the LDAP server.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Otherwise queries for the particular GPO name or GUID.


_raw: Extract 'Domain', 'DC' (domain controller) policies, or 'All' for all policies.


_raw: The domain to query for default policies, defaults to the current domain.


_raw: domain or a specified domain/domain controller using Get-DomainGPO.


_raw: Returns the default domain policy or the domain controller policy for the current


_raw: Required Dependencies: Get-DomainGPO, Get-GptTmpl, ConvertFrom-SID


_raw: domain or a specified domain/domain controller.


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPOType' $GPOGroup.GPOType


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPOPath' $GPOGroup.GPOPath


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPOGuid' $GPOGroup.GPOName


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPODisplayName' $GPOGroup.GPODisplayName


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'IsGroup' $IsGroup


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ObjectSID' $_


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ObjectName' $Object.samaccountname


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ComputerName' $Computer.dnshostname


_raw: $GPOComputerLocalGroupMember = New-Object PSObject


_raw: $Object = Get-DomainObject @CommonArguments -Identity $_


_raw: $GPOGuids | Get-DomainGPOLocalGroup @CommonArguments | Sort-Object -Property GPOName -Unique | ForEach-Object {


_raw: # process any GPO local group settings from the GPO GUID set


_raw: Select-String -InputObject $_.gplink -Pattern '(\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1}' -AllMatches | ForEach-Object {$_.Matches | Select-Object -ExpandProperty Value }


_raw: $GPOGuids += Get-DomainSite @CommonArguments -Identity $ComputerSite -LDAPFilter '(gplink=*)' | ForEach-Object {


_raw: if ($ComputerSite -and ($ComputerSite -notmatch 'Error')) {


_raw: $ComputerSite = (Get-NetComputerSiteName -ComputerName $Computer.dnshostname).SiteName


_raw: Write-Verbose "Enumerating the sitename for: $($Computer.dnshostname)"


_raw: # extract any GPOs linked to this computer's site through gpLink


_raw: $GPOGuids += Get-DomainOU @CommonArguments -SearchBase $OUName -LDAPFilter '(gplink=*)' | ForEach-Object {


_raw: # extract any GPOs linked to this computer's OU through gpLink


_raw: throw "[Get-DomainGPOComputerLocalGroupMapping] Computer $ComputerIdentity not found. Try a fully qualified host name."


_raw: $Computers = Get-DomainComputer @CommonArguments -Identity $ComputerIdentity -Properties 'distinguishedname,dnshostname'


_raw: if ($PSBoundParameters['Credential']) { $CommonArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $CommonArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $CommonArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $CommonArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $CommonArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $CommonArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $CommonArguments['Domain'] = $Domain }


_raw: [ValidateSet('Administrators', 'S-1-5-32-544', 'RDP', 'Remote Desktop Users', 'S-1-5-32-555')]


_raw: [Parameter(Mandatory = $True, ParameterSetName = 'OUIdentity')]


_raw: [Alias('ComputerName', 'Computer', 'DistinguishedName', 'SamAccountName', 'Name')]


_raw: [Parameter(Position = 0, ParameterSetName = 'ComputerIdentity', Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Get-DomainGPOComputerLocalGroupMapping -Credential $Cred -ComputerIdentity SQL.testlab.local


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Finds users who have RDP rights over WINDOWS4 through GPO correlation.


_raw: Get-DomainGPOComputerLocalGroupMapping -Domain dev.testlab.local -ComputerName WINDOWS4.dev.testlab.local -LocalGroup RDP


_raw: Finds users who have local admin rights over WINDOWS3 through GPO correlation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain to enumerate GPOs for, defaults to the current domain.


_raw: or a custom local SID. Defaults to local 'Administrators'.


_raw: Can be "Administrators" (S-1-5-32-544), "RDP/Remote Desktop Users" (S-1-5-32-555),


_raw: The local group to check access against.


_raw: GUID (e.g. 8a9ba22a-8977-47e6-84ce-8c26af4e1e6a) for the OU to identity GPO local group mappings for.


_raw: An OU name (e.g. TestOU), DistinguishedName (e.g. OU=TestOU,DC=testlab,DC=local), or


_raw: or a dns host name (e.g. windows10.testlab.local) for the computer to identity GPO local group mappings for.


_raw: A SamAccountName (e.g. WINDOWS10$), DistinguishedName (e.g. CN=WINDOWS10,CN=Computers,DC=testlab,DC=local),


_raw: Otherwise, if -OUIdentity is supplied, the same process is executed to find linked GPOs and


_raw: return the results. This will return the domain objects that are members of the specified


_raw: each resulting GPO group, resolve the resulting user/group name to a full AD object and


_raw: enumerate all linked GPOs and associated local group settings with Get-DomainGPOLocalGroup. For


_raw: Get-NetComputerSiteName and retrieve all sites object Get-DomainSite. For those results, attempt to


_raw: determine the OU the computer is a part of. Then resolve the computer's site name with


_raw: If a -ComputerIdentity is specified, retrieve the complete computer object, attempt to


_raw: are in the specified local group for a target machine through GPO correlation.


_raw: This function is the inverse of Get-DomainGPOUserLocalGroupMapping, and finds what users/groups


_raw: Required Dependencies: Get-DomainComputer, Get-DomainOU, Get-NetComputerSiteName, Get-DomainSite, Get-DomainGPOLocalGroup


_raw: local group for the machine through GPO correlation.


_raw: Takes a computer (or GPO) object and determines what users/groups are in the specified


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ComputerName' $_.siteobjectbl


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ContainerName' $_.distinguishedname


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOType' $GPOType


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOPath' $GPOPath


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOGuid' $GPOGuid


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'GPODisplayName' $GPOname


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'Domain' $Domain


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'IsGroup' $IsGroup


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectSID' $Object.objectsid


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectName' $Object.samaccountname


_raw: $GPOLocalGroupMapping = New-Object PSObject


_raw: $Object = Get-DomainObject @CommonArguments -Identity $TargetSid -Properties 'samaccounttype,samaccountname,distinguishedname,objectsid'


_raw: ForEach ($TargetSid in $TargetObjectSIDs) {


_raw: Get-DomainSite @CommonArguments -Properties 'siteobjectbl,distinguishedname' -GPLink $GPOGuid | ForEach-Object {


_raw: # find any sites that have this GPO linked through gpLink


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ComputerName' $OUComputers


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ContainerName' $_.Properties.distinguishedname


_raw: if ($OUComputers -isnot [System.Array]) {$OUComputers = @($OUComputers)}


_raw: $OUComputers = Get-DomainComputer @CommonArguments -Properties 'dnshostname' -SearchBase $_.Path | Select-Object -ExpandProperty dnshostname


_raw: $OUComputers = Get-DomainComputer @CommonArguments -Properties 'dnshostname,distinguishedname' -SearchBase $_.Path | Where-Object {$_.distinguishedname -match ($Filters.Value)} | Select-Object -ExpandProperty dnshostname


_raw: Get-DomainOU @CommonArguments -Raw -Properties 'name,distinguishedname' -GPLink $GPOGuid | ForEach-Object {


_raw: # find any OUs that have this GPO linked through gpLink


_raw: # if the * wildcard was used, set the targets to all GPO members so everything it output


_raw: $GPOgroups | Where-Object {$_} | ForEach-Object {


_raw: } | Sort-Object -Property GPOName -Unique


_raw: if ( ($TargetSIDs[0] -eq '*') -or ($TargetSIDs -Contains $GPOgroup.GroupSID) ) {


_raw: if ( ($GPOgroup.GroupMemberOf -contains $TargetLocalSID) ) {


_raw: # if the group is a 'memberof' the group we're looking for, check GroupSID against the targt SIDs


_raw: if ( ($TargetSIDs[0] -eq '*') -or ($TargetSIDs -Contains $_) ) {


_raw: $GPOgroup.GroupMembers | Where-Object {$_} | ForEach-Object {


_raw: if ($GPOgroup.GroupSID -match $TargetLocalSID) {


_raw: # if the locally set group is what we're looking for, check the GroupMembers ('members') for our target SID