_raw: # do some trickery to get the proper BeginInvoke() method that allows for an output queue


_raw: $Pool = [RunspaceFactory]::CreateRunspacePool(1, $Threads, $SessionState, $Host)


_raw: $SessionState.Commands.Add((New-Object -TypeName System.Management.Automation.Runspaces.SessionStateFunctionEntry -ArgumentList $Function.Name, $Function.Definition))


_raw: ForEach ($Function in (Get-ChildItem Function:)) {


_raw: # add Functions from current runspace to the InitialSessionState


_raw: if ($VorbiddenVars -NotContains $Var.Name) {


_raw: # add Variables from Parent Scope (current runspace) into the InitialSessionState


_raw: # these Variables are added by Runspace.Open() Method and produce Stop errors if you add them twice


_raw: # grab all the current variables for this runspace


_raw: #   functionality can be used by the threaded blocks


_raw: # import the current session state's variables and functions so the chained PowerView


_raw: # force a single-threaded apartment state (for token-impersonation stuffz)


_raw: # # $SessionState.ApartmentState = [System.Threading.Thread]::CurrentThread.GetApartmentState()


_raw: #   http://powershell.org/wp/forums/topic/invpke-parallel-need-help-to-clone-the-current-runspace/


_raw: [Parameter(Position = 1, Mandatory = $True)]


_raw: [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: # Helper used by any threaded host enumeration functions


_raw: $FoundFile = New-Object -TypeName PSObject -Property $FileParams


_raw: 'Owner' = $((Get-Acl $_.FullName).Owner)


_raw: if ($PSBoundParameters['CheckWriteAccess'] -and (-not (Test-Write -Path $_.FullName))) {


_raw: if ($PSBoundParameters['CreationTime'] -and ($_.CreationTime -lt $CreationTime)) {


_raw: if ($PSBoundParameters['LastWriteTime'] -and ($_.LastWriteTime -lt $LastWriteTime)) {


_raw: if ($LastAccessTime -and ($_.LastAccessTime -lt $LastAccessTime)) {


_raw: if ($PSBoundParameters['ExcludeFolders'] -and ($_.PSIsContainer)) {


_raw: Get-ChildItem @SearcherArguments | ForEach-Object {


_raw: Add-RemoteConnection -ComputerName $HostComputer -Credential $Credential


_raw: # map IPC$ to this computer if it's not already


_raw: if (-not $MappedComputers[$HostComputer]) {


_raw: $HostComputer = (New-Object System.Uri($TargetPath)).Host


_raw: if (($TargetPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) {


_raw: # short helper to check is the current user can write to a file


_raw: $SearcherArguments['Force'] = -not $PSBoundParameters['ExcludeHidden']


_raw: # find .exe's accessed within the last 7 days


_raw: $SearcherArguments['Include'] = @('*.doc', '*.docx', '*.xls', '*.xlsx', '*.ppt', '*.pptx')


_raw: $Include = @('*password*', '*sensitive*', '*admin*', '*login*', '*secret*', 'unattend*.xml', '*.vmdk', '*creds*', '*credential*', '*.config'),


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Find-InterestingFile -Credential $Cred -Path "\\PRIMARY.testlab.local\C$\Temp\"


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: search term set in the title and were accessed within the last week.


_raw: Returns any files on the remote path \\WINDOWS7\Users\ that have the default


_raw: Find-InterestingFile -Path "\\WINDOWS7\Users\" -LastAccessTime (Get-Date).AddDays(-7)


_raw: Returns any files on the local path C:\Backup\ that have the default


_raw: to connect to remote systems for file enumeration.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Only returns files the current user has write access to.


_raw: Switch. Exclude hidden files and folders from the search results.


_raw: Switch. Exclude folders from the search results.


_raw: Switch. Find .EXEs accessed within the last 7 days.


_raw: Switch. Search for office documents (*.doc*, *.xls*, *.ppt*)


_raw: Only return files with a CreationTime greater than this date value.


_raw: Only return files with a LastWriteTime greater than this date value.


_raw: Only return files with a LastAccessTime greater than this date value.


_raw: Only return files/folders that match the specified array of strings,


_raw: is used to temporarily map the remote share.


_raw: in search results. If -Credential is passed, Add-RemoteConnection/Remove-RemoteConnection


_raw: login and unattend*.xml). By default, hidden files/folders are included


_raw: specific keywords in the name (default of pass, sensitive, secret, admin,


_raw: This function recursively searches a given UNC path for files with


_raw: Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection


_raw: Searches for files on the given path that match a series of specified criteria.


_raw: Write-Verbose "[Get-WMIProcess] Error enumerating remote processes on '$Computer', access likely denied: $_"


_raw: $Process | Add-Member Noteproperty 'User' $Owner.User


_raw: $Process | Add-Member Noteproperty 'Domain' $Owner.Domain


_raw: $Process | Add-Member Noteproperty 'ProcessID' $_.ProcessID


_raw: $Process | Add-Member Noteproperty 'ProcessName' $_.ProcessName


_raw: $Process | Add-Member Noteproperty 'ComputerName' $Computer


_raw: Get-WMIobject @WmiArguments | ForEach-Object {


_raw: if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A PSCustomObject containing the remote process information.


_raw: Get-WMIProcess -ComputerName PRIMARY.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for cached RDP connections (also accepts IP addresses).


_raw: including the owners of the particular process.


_raw: Uses Get-WMIObject to enumerate all Win32_process instances on the local or remote machine,


_raw: Returns a list of processes and their owners on the local or remote machine.


_raw: Write-Warning "[Get-WMIRegMountedDrive] Error accessing $Computer, likely insufficient permissions or firewall rules on host: $_"


_raw: Write-Verbose "[Get-WMIRegMountedDrive] Error: $_"


_raw: $MountedDrive | Add-Member Noteproperty 'DriveUserName' $DriveUserName


_raw: $MountedDrive | Add-Member Noteproperty 'RemotePath' $RemotePath


_raw: $MountedDrive | Add-Member Noteproperty 'ProviderName' $ProviderName


_raw: $MountedDrive | Add-Member Noteproperty 'DriveLetter' $DriveLetter


_raw: $MountedDrive | Add-Member Noteproperty 'UserSID' $UserSID


_raw: $MountedDrive | Add-Member Noteproperty 'UserName' $UserName


_raw: $MountedDrive | Add-Member Noteproperty 'ComputerName' $Computer


_raw: if ($RemotePath -and ($RemotePath -ne '')) {


_raw: $DriveUserName = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'UserName').sValue


_raw: $RemotePath = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'RemotePath').sValue


_raw: $ProviderName = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'ProviderName').sValue


_raw: ForEach ($DriveLetter in $DriveLetters) {


_raw: $DriveLetters = ($Reg.EnumKey($HKU, "$UserSID\Network")).sNames


_raw: $UserName = ConvertFrom-SID -ObjectSid $UserSID


_raw: $UserName = ConvertFrom-SID -ObjectSid $UserSID -Credential $Credential


_raw: # extract out the SIDs of domain users in this hive


_raw: if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A PSCustomObject containing the ComputerName and mounted drive information.


_raw: Get-WMIRegMountedDrive -ComputerName PRIMARY.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns the saved network mounted drives for all machines in the domain.


_raw: Returns the saved network mounted drives for the WINDOWS2.testlab.local machine


_raw: Returns the saved network mounted drives for the local machine.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for mounted drive information (also accepts IP addresses).


_raw: Uses remote registry functionality to enumerate recently mounted network drives.


_raw: Note: This function requires administrative rights on the machine you're enumerating.


_raw: Returns information about saved network mounted drives for the local (or remote) machine.


_raw: Write-Warning "[Get-WMIRegCachedRDPConnection] Error accessing $Computer, likely insufficient permissions or firewall rules on host: $_"


_raw: Write-Verbose "[Get-WMIRegCachedRDPConnection] Error: $_"


_raw: $FoundConnection | Add-Member Noteproperty 'UsernameHint' $UsernameHint


_raw: $FoundConnection | Add-Member Noteproperty 'TargetServer' $Server


_raw: $FoundConnection | Add-Member Noteproperty 'UserSID' $UserSID


_raw: $FoundConnection | Add-Member Noteproperty 'UserName' $UserName


_raw: $FoundConnection | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $UsernameHint = $Reg.GetStringValue($HKU, "$UserSID\Software\Microsoft\Terminal Server Client\Servers\$Server", 'UsernameHint').sValue


_raw: $ServerKeys = $Reg.EnumKey($HKU,"$UserSID\Software\Microsoft\Terminal Server Client\Servers").sNames


_raw: # pull out all the cached server info with username hints


_raw: $FoundConnection | Add-Member Noteproperty 'UsernameHint' $Null


_raw: $FoundConnection | Add-Member Noteproperty 'TargetServer' $TargetServer


_raw: $TargetServer = $Reg.GetStringValue($HKU, "$UserSID\Software\Microsoft\Terminal Server Client\Default", $Connection).sValue


_raw: # make sure this key is a cached connection


_raw: ForEach ($Connection in $ConnectionKeys) {


_raw: $ConnectionKeys = $Reg.EnumValues($HKU,"$UserSID\Software\Microsoft\Terminal Server Client\Default").sNames


_raw: # pull out all the cached RDP connections


_raw: $UserName = ConvertFrom-SID -ObjectSid $UserSID


_raw: $UserName = ConvertFrom-SID -ObjectSid $UserSID -Credential $Credential


_raw: # extract out the SIDs of domain users in this hive


_raw: if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A PSCustomObject containing the ComputerName and cached RDP information.


_raw: Get-WMIRegCachedRDPConnection -ComputerName PRIMARY.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns cached RDP information for all machines in the domain.


_raw: Returns the RDP connection client information for the WINDOWS2.testlab.local machine


_raw: Get-WMIRegCachedRDPConnection  -ComputerName WINDOWS2.testlab.local


_raw: Returns the RDP connection client information for the local machine.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for cached RDP connections (also accepts IP addresses).


_raw: "Windows Remote Desktop Connection Client" on a machine, separated by


_raw: Uses remote registry functionality to query all entries for the


_raw: Note: This function requires administrative rights on the machine you're enumerating.


_raw: Returns information about RDP connections outgoing from the local (or remote) machine.


_raw: Write-Warning "[Get-WMIRegLastLoggedOn] Error opening remote registry on $Computer. Remote registry likely not enabled."


_raw: $LastLoggedOn | Add-Member Noteproperty 'LastLoggedOn' $LastUser


_raw: $LastLoggedOn | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $LastUser = $Reg.GetStringValue($HKLM, $Key, $Value).sValue


_raw: # try to open up the remote registry key to grab the last logged on user


_raw: if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A PSCustomObject containing the ComputerName and last loggedon user.


_raw: Get-WMIRegLastLoggedOn -ComputerName PRIMARY.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns the last user logged onto all machines in the domain.


_raw: Returns the last user logged onto WINDOWS1


_raw: Returns the last user logged onto the local machine.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for remote registry values (also accepts IP addresses).


_raw: This function uses remote registry to enumerate the LastLoggedOnUser registry key


_raw: Note: This function requires administrative rights on the machine you're enumerating.


_raw: Returns the last user who logged onto the local (or a remote) machine.


_raw: Write-Warning "[Get-WMIRegProxy] Error enumerating proxy settings for $ComputerName : $_"


_raw: Write-Warning "[Get-WMIRegProxy] No proxy settings found for $ComputerName"


_raw: $Out | Add-Member Noteproperty 'Wpad' $Wpad


_raw: $Out | Add-Member Noteproperty 'AutoConfigURL' $AutoConfigURL


_raw: $Out | Add-Member Noteproperty 'ProxyServer' $ProxyServer


_raw: $Out | Add-Member Noteproperty 'ComputerName' $Computer


_raw: Write-Warning "[Get-WMIRegProxy] Error connecting to AutoConfigURL : $AutoConfigURL"


_raw: $Wpad = (New-Object Net.WebClient).DownloadString($AutoConfigURL)


_raw: if ($AutoConfigURL -and ($AutoConfigURL -ne '')) {


_raw: $AutoConfigURL = $RegProvider.GetStringValue($HKCU, $Key, 'AutoConfigURL').sValue


_raw: $ProxyServer = $RegProvider.GetStringValue($HKCU, $Key, 'ProxyServer').sValue


_raw: $Key = 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings'


_raw: $RegProvider = Get-WmiObject @WmiArguments


_raw: if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Outputs custom PSObjects with the ComputerName, ProxyServer, AutoConfigURL, and WPAD contents.


_raw: Accepts one or more computer name specification strings  on the pipeline (netbios or FQDN).


_raw: ComputerName            ProxyServer            AutoConfigURL         Wpad


_raw: Get-WMIRegProxy -Credential $Cred -ComputerName primary.testlab.local


_raw: $Cred = Get-Credential "TESTLAB\administrator"


_raw: WINDOWS1               http://primary.test...


_raw: ComputerName           ProxyServer            AutoConfigURL         Wpad


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the system to enumerate proxy settings on. Defaults to the local host.


_raw: It does this by enumerating settings from


_raw: on the local machine (default), or a machine specified with -ComputerName.


_raw: Enumerates the proxy server and WPAD specification for the current user


_raw: Enumerates the proxy server and WPAD conents for the current user.


_raw: $ComputerSite | Add-Member Noteproperty 'SiteName' ''


_raw: Write-Verbose "[Get-NetComputerSiteName] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $ComputerSite | Add-Member Noteproperty 'SiteName' $Sitename


_raw: $ComputerSite | Add-Member Noteproperty 'IPAddress' $IPAddress


_raw: $ComputerSite | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $Result = $Netapi32::DsGetSiteName($Computer, [ref]$PtrInfo)


_raw: $IPAddress = @(Resolve-IPAddress -ComputerName $Computer)[0].IPAddress


_raw: $Computer = [System.Net.Dns]::GetHostByAddress($Computer) | Select-Object -ExpandProperty HostName


_raw: # if we get an IP address, try to resolve the IP to a hostname


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A PSCustomObject containing the ComputerName, IPAddress, and associated Site name.


_raw: Get-NetComputerSiteName -ComputerName WINDOWS1.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns the sites for every machine in AD.


_raw: Returns the site for WINDOWS1.testlab.local.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to check the site for (also accepts IP addresses).


_raw: name of the site where a specified computer resides.


_raw: This function will use the DsGetSiteName Win32API call to look up the


_raw: Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf


_raw: Returns the AD site where the local (or a remote) machine resides.


_raw: $IsAdmin | Add-Member Noteproperty 'IsAdmin' $False


_raw: Write-Verbose "[Test-AdminAccess] Error: $(([ComponentModel.Win32Exception] $LastError).Message)"


_raw: $IsAdmin | Add-Member Noteproperty 'IsAdmin' $True


_raw: # if we get a non-zero handle back, everything was successful


_raw: $IsAdmin | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $Handle = $Advapi32::OpenSCManagerW("\\$Computer", 'ServicesActive', 0xF003F);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()


_raw: #   http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981(v=vs.85).aspx


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: the current user has local admin rights, along with the ComputerName added.


_raw: A PSCustomObject containing the ComputerName and 'IsAdmin' set to whether


_raw: Test-AdminAccess -ComputerName sqlserver -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns what machines in the domain the current user has access to.


_raw: Returns results indicating whether the current user has admin access to the 'sqlserver' host.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to check for local admin access (also accepts IP addresses).


_raw: has local administrator acess to the target.


_raw: a handle to the remote host. If this succeeds, the current user context


_raw: This function will use the OpenSCManagerW Win32API call to establish


_raw: Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf


_raw: 'Royce Davis "r3dy" <rdavis[at]accuvant.com>'


_raw: 'Thomas McCarthy "smilingraccoon" <smilingraccoon[at]gmail.com>'


_raw: 'Brandon McCann "zeknox" <bmccann[at]accuvant.com>'


_raw: Idea stolen from the local_admin_search_enum post module in Metasploit written by:


_raw: Tests if the current user has administrative access to the local (or a remote) machine.


_raw: Write-Verbose "[Get-NetRDPSession] Error opening the Remote Desktop Session Host (RD Session Host) server for: $ComputerName"


_raw: Write-Verbose "[Get-NetRDPSession] Error: $(([ComponentModel.Win32Exception] $LastError).Message)"


_raw: $Null = $Wtsapi32::WTSFreeMemoryEx(2, $ppSessionInfo, $pCount)


_raw: $RDPSession | Add-Member Noteproperty 'SourceIP' $SourceIP


_raw: $Info2 = $NewIntPtr2 -as $WTS_CLIENT_ADDRESS


_raw: $NewIntPtr2 = New-Object System.Intptr -ArgumentList $Offset2


_raw: Write-Verbose "[Get-NetRDPSession] Error: $(([ComponentModel.Win32Exception] $LastError2).Message)"


_raw: $Result2 = $Wtsapi32::WTSQuerySessionInformation($Handle, $Info.SessionID, 14, [ref]$ppBuffer, [ref]$pBytesReturned);$LastError2 = [Runtime.InteropServices.Marshal]::GetLastWin32Error()


_raw: #   https://msdn.microsoft.com/en-us/library/aa383861(v=vs.85).aspx


_raw: # query for the source client IP with WTSQuerySessionInformation


_raw: $RDPSession | Add-Member Noteproperty 'State' $Info.State


_raw: $RDPSession | Add-Member Noteproperty 'ID' $Info.SessionID


_raw: $RDPSession | Add-Member Noteproperty 'UserName' "$($Info.pDomainName)\$($Info.pUserName)"


_raw: $RDPSession | Add-Member Noteproperty 'UserName' "$($Info.pUserName)"


_raw: # if a domain isn't returned just use the username


_raw: if ($(-not $Info.pDomainName) -or ($Info.pDomainName -eq '')) {


_raw: $RDPSession | Add-Member Noteproperty 'SessionName' $Info.pSessionName


_raw: $RDPSession | Add-Member Noteproperty 'ComputerName' $Computer


_raw: # if no hostname returned, use the specified hostname


_raw: $RDPSession | Add-Member Noteproperty 'ComputerName' $Info.pHostName


_raw: $Info = $NewIntPtr -as $WTS_SESSION_INFO_1


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: # work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -ne 0) -and ($Offset -gt 0)) {


_raw: # locate the offset of the initial intPtr


_raw: $Result = $Wtsapi32::WTSEnumerateSessionsEx($Handle, [ref]1, 0, [ref]$ppSessionInfo, [ref]$pCount);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()


_raw: # get information on all current sessions


_raw: # if we get a non-zero handle back, everything was successful


_raw: # open up a handle to the Remote Desktop Session host


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A PSCustomObject representing a combined WTS_SESSION_INFO_1 and WTS_CLIENT_ADDRESS structure,


_raw: Get-NetRDPSession -ComputerName sqlserver -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns active RDP/terminal sessions on all domain controllers.


_raw: Returns active RDP/terminal sessions on the 'sqlserver' host.


_raw: Returns active RDP/terminal sessions on the local host.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for active sessions (also accepts IP addresses).


_raw: Win32API calls to query a given RDP remote service for active sessions and originating


_raw: This function will execute the WTSEnumerateSessionsEx and WTSQuerySessionInformation


_raw: Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf


_raw: can successfully execute this functionality on a remote target.


_raw: Note: only members of the Administrators or Account Operators local group


_raw: Returns remote desktop/session information for the local (or a remote) machine.


_raw: Write-Verbose "[Get-RegLoggedOn] Error opening remote registry on '$ComputerName' : $_"


_raw: $RegLoggedOnUser | Add-Member Noteproperty 'UserSID' $_


_raw: $RegLoggedOnUser | Add-Member Noteproperty 'UserName' $UserName


_raw: $RegLoggedOnUser | Add-Member Noteproperty 'UserDomain' $UserDomain


_raw: $RegLoggedOnUser | Add-Member Noteproperty 'ComputerName' "$ComputerName"


_raw: $UserName, $UserDomain = $UserName.Split('@')


_raw: $UserName = ConvertFrom-SID -ObjectSID $_ -OutputType 'DomainSimple'


_raw: $Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('Users', "$ComputerName")


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: actively logged on user, with the ComputerName added.


_raw: A PSCustomObject including the UserDomain/UserName/UserSID of each


_raw: Get-RegLoggedOn -ComputerName sqlserver -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns users actively logged on all domain controllers.


_raw: Returns users actively logged onto the 'sqlserver' host.


_raw: Returns users actively logged onto the local host.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for remote registry values (also accepts IP addresses).


_raw: required (NetWkstaUserEnum requires remote admin access).


_raw: using the NetWkstaUserEnum API (Get-NetLoggedon) of less user privileges


_raw: Adapted technique from Sysinternal's PSLoggedOn script. Benefit over


_raw: logged on users SID and then attempt and reverse it.


_raw: This function will query the HKU registry values to retrieve the local


_raw: Required Dependencies: Invoke-UserImpersonation, Invoke-RevertToSelf, ConvertFrom-SID


_raw: machine you're enumerating, but remote registry must be enabled.


_raw: Note: This function requires only domain user rights on the


_raw: through enumeration of remote registry keys.


_raw: Returns who is logged onto the local (or a remote) machine


_raw: Write-Verbose "[Get-NetSession] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $Session | Add-Member Noteproperty 'ComputerName' $Computer


_raw: # return all the sections of the structure - have to do it this way for V2


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: for ($i = 0; ($i -lt $EntriesRead); $i++) {


_raw: # work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -eq 0) -and ($Offset -gt 0)) {


_raw: # locate the offset of the initial intPtr


_raw: $Result = $Netapi32::NetSessionEnum($Computer, '', $UserName, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: the CName/UserName/Time/IdleTime for each session, with the ComputerName added.


_raw: A PSCustomObject representing a WKSTA_USER_INFO_1 structure, including


_raw: Get-NetSession -ComputerName sqlserver -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns active sessions on all domain controllers.


_raw: Returns active sessions on the 'sqlserver' host.


_raw: Returns active sessions on the local host.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for sessions (also accepts IP addresses).


_raw: This function will execute the NetSessionEnum Win32API call to query


_raw: Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf


_raw: Returns session information for the local (or a remote) machine.


_raw: Write-Verbose "[Get-NetLoggedon] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $LoggedOn | Add-Member Noteproperty 'ComputerName' $Computer


_raw: # return all the sections of the structure - have to do it this way for V2


_raw: $Info = $NewIntPtr -as $WKSTA_USER_INFO_1


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: for ($i = 0; ($i -lt $EntriesRead); $i++) {


_raw: # work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -eq 0) -and ($Offset -gt 0)) {


_raw: # locate the offset of the initial intPtr


_raw: $Result = $Netapi32::NetWkstaUserEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: the UserName/LogonDomain/AuthDomains/LogonServer for each user, with the ComputerName added.


_raw: A PSCustomObject representing a WKSTA_USER_INFO_1 structure, including


_raw: Get-NetLoggedon -ComputerName sqlserver -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns all logged on users for all computers in the domain.


_raw: Returns users actively logged onto the 'sqlserver' host.


_raw: Returns users actively logged onto the local host.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for logged on users (also accepts IP addresses).


_raw: a given host for actively logged on users.


_raw: This function will execute the NetWkstaUserEnum Win32API call to query


_raw: Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf


_raw: Note: administrative rights needed for newer Windows OSes.


_raw: Returns users logged on the local (or a remote) machine.


_raw: Write-Verbose "[Get-NetShare] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $Share | Add-Member Noteproperty 'ComputerName' $Computer


_raw: # return all the sections of the structure - have to do it this way for V2


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: for ($i = 0; ($i -lt $EntriesRead); $i++) {


_raw: # work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -eq 0) -and ($Offset -gt 0)) {


_raw: # locate the offset of the initial intPtr


_raw: $Result = $Netapi32::NetShareEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: the name/type/remark for each share, with the ComputerName added.


_raw: A PSCustomObject representing a SHARE_INFO_1 structure, including


_raw: Get-NetShare -ComputerName sqlserver -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns all shares for all computers in the domain.


_raw: Returns active shares on the 'sqlserver' host


_raw: Returns active shares on the local host.


_raw: for connection to the remote system using Invoke-UserImpersonation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the hostname to query for shares (also accepts IP addresses).


_raw: a given host for open shares. This is a replacement for "net share \\hostname".


_raw: This function will execute the NetShareEnum Win32API call to query


_raw: Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf


_raw: Returns open shares on the local (or a remote) machine.


_raw: Write-Verbose "[Get-NetLocalGroupMember] Error for $Computer : $_"


_raw: #             $Member | Add-Member Noteproperty 'LastLogin' ''


_raw: #             $Member | Add-Member Noteproperty 'LastLogin' ( $LocalUser.LastLogin[0])


_raw: #         $Member | Add-Member Noteproperty 'Disabled' $(($LocalUser.UserFlags.value -band 2) -eq 2)


_raw: #         # UAC flags of 0x2 mean the account is disabled


_raw: #         $Member | Add-Member Noteproperty 'UserFlags' ( $LocalUser.UserFlags[0] )


_raw: #         $Member | Add-Member Noteproperty 'PwdExpired' ( $LocalUser.PasswordExpired[0] -eq '1')


_raw: #         $Member | Add-Member Noteproperty 'PwdLastSet' ( (Get-Date).AddSeconds(-$LocalUser.PasswordAge[0]))


_raw: #         $Member | Add-Member Noteproperty 'LastLogin' ''


_raw: #         $Member | Add-Member Noteproperty 'Disabled' ''


_raw: #         $Member | Add-Member Noteproperty 'UserFlags' ''


_raw: #         $Member | Add-Member Noteproperty 'PwdExpired' ''


_raw: #         $Member | Add-Member Noteproperty 'PwdLastSet' ''


_raw: #     $Member | Add-Member Noteproperty 'Description' ($LocalUser.Description)


_raw: #     $Member | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalUser.InvokeGet('ObjectSID'),0)).Value)


_raw: #     # translate the binary sid to a string


_raw: #     $Member | Add-Member Noteproperty 'UserFlags' ''


_raw: #     $Member | Add-Member Noteproperty 'PwdExpired' ''


_raw: #     $Member | Add-Member Noteproperty 'PwdLastSet' ''


_raw: #             $Member | Add-Member Noteproperty 'LastLogin' ''


_raw: #             $Member | Add-Member Noteproperty 'LastLogin' $LocalUser.InvokeGet('LastLogin')


_raw: #     $Member | Add-Member Noteproperty 'Disabled' ''


_raw: #     $Member | Add-Member Noteproperty 'Description' ''


_raw: $Member | Add-Member Noteproperty 'IsDomain' $MemberIsDomain


_raw: $Member | Add-Member Noteproperty 'IsGroup' $IsGroup


_raw: $Member | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalUser.InvokeGet('ObjectSID'),0)).Value)


_raw: $Member | Add-Member Noteproperty 'AccountName' $Name


_raw: $Name = $AdsPath.Substring($AdsPath.IndexOf('/')+1).Replace('/', '\')


_raw: if(([regex]::Matches($AdsPath, '/')).count -eq 1) {


_raw: $IsGroup = ($LocalUser.SchemaClassName -like 'group')


_raw: $AdsPath = $LocalUser.InvokeGet('AdsPath').Replace('WinNT://', '')


_raw: $Member | Add-Member Noteproperty 'GroupName' $GroupName


_raw: $Member | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $GroupProvider.psbase.Invoke('Members') | ForEach-Object {


_raw: # otherwise we're using the WinNT service provider


_raw: Write-Verbose "[Get-NetLocalGroupMember] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $_ | Add-Member Noteproperty 'IsDomain' 'UNKNOWN'


_raw: $_ | Add-Member Noteproperty 'IsDomain' $False


_raw: $_ | Add-Member Noteproperty 'IsDomain' $True


_raw: $MachineSid = $MachineSid.Substring(0, $MachineSid.LastIndexOf('-'))


_raw: $MachineSid = $Members | Where-Object {$_.SID -match '.*-500' -or ($_.SID -match '.*-501')} | Select-Object -Expand SID


_raw: # try to extract out the machine SID by using the -500 account as a reference


_raw: $Member | Add-Member Noteproperty 'IsGroup' $IsGroup


_raw: $IsGroup = $($Info.lgrmi2_sidusage -eq 'SidTypeGroup')


_raw: $Member | Add-Member Noteproperty 'SID' $SidString


_raw: $Member | Add-Member Noteproperty 'MemberName' $Info.lgrmi2_domainandname


_raw: Write-Verbose "[Get-NetLocalGroupMember] Error: $(([ComponentModel.Win32Exception] $LastError).Message)"


_raw: $Result2 = $Advapi32::ConvertSidToStringSid($Info.lgrmi2_sid, [ref]$SidString);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()


_raw: $Info = $NewIntPtr -as $LOCALGROUP_MEMBERS_INFO_2


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: for ($i = 0; ($i -lt $EntriesRead); $i++) {


_raw: # Work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -eq 0) -and ($Offset -gt 0)) {


_raw: # locate the offset of the initial intPtr


_raw: $Result = $Netapi32::NetLocalGroupGetMembers($Computer, $GroupName, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)


_raw: # if we're using the Netapi32 NetLocalGroupGetMembers API call to get the local group information


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated group property fields from WinNT results.


_raw: Custom PSObject with translated group property fields from API results.


_raw: primary.tes... Administrators TESTLAB\Dom... S-1-5-21-89...           True          False


_raw: primary.tes... Administrators TESTLAB\Ent... S-1-5-21-89...           True          False


_raw: primary.tes... Administrators TESTLAB\loc... S-1-5-21-89...          False          False


_raw: primary.tes... Administrators TESTLAB\Adm... S-1-5-21-89...          False          False


_raw: ComputerName   GroupName      MemberName     SID                   IsGroup       IsDomain


_raw: Get-NetLocalGroupMember -ComputerName primary.testlab.local | ft


_raw: WINDOWS1       Users          TESTLAB\Dom... S-1-5-21-89...           True        UNKNOWN


_raw: WINDOWS1       Users          WINDOWS1\lo... S-1-5-21-25...          False        UNKNOWN


_raw: WINDOWS1       Users          NT AUTHORIT... S-1-5-11                False          False


_raw: WINDOWS1       Users          NT AUTHORIT... S-1-5-4                 False          False


_raw: WINDOWS1       IIS_IUSRS      NT AUTHORIT... S-1-5-17                False          False


_raw: WINDOWS1       Guests         WINDOWS1\Guest S-1-5-21-25...          False          False


_raw: WINDOWS1       Administrators TESTLAB\har... S-1-5-21-89...          False           True


_raw: WINDOWS1       Administrators TESTLAB\Dom... S-1-5-21-89...           True           True


_raw: WINDOWS1       Administrators WINDOWS1\lo... S-1-5-21-25...          False          False


_raw: WINDOWS1       Administrators WINDOWS1\Ad... S-1-5-21-25...          False          False


_raw: Get-NetLocalGroup | Get-NetLocalGroupMember | ft


_raw: Get-NetLocalGroupMember -Method winnt | ft


_raw: for connection to a remote machine. Only applicable with "-Method WinNT".


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: The collection method to use, defaults to 'API', also accepts 'WinNT'.


_raw: The local group name to query for users. If not given, it defaults to "Administrators".


_raw: Specifies the hostname to query for sessions (also accepts IP addresses).


_raw: to be used instead, which returns a larger amount of information.


_raw: will be used (for speed). Specifying "-Method WinNT" causes the WinNT service provider


_raw: current, or remote, machine. By default, the Win32 API call NetLocalGroupGetMembers


_raw: This function will enumerate the members of a specified local group  on the


_raw: Required Dependencies: PSReflect, Convert-ADName


_raw: Enumerates members of a specific local group on the local (or remote) machine.


_raw: $Group | Add-Member Noteproperty 'Comment' ($LocalGroup.InvokeGet('Description'))


_raw: $Group | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalGroup.InvokeGet('objectsid'),0)).Value)


_raw: $Group | Add-Member Noteproperty 'GroupName' ($LocalGroup.InvokeGet('Name'))


_raw: $Group | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $ComputerProvider.psbase.children | Where-Object { $_.psbase.schemaClassName -eq 'group' } | ForEach-Object {


_raw: # otherwise we're using the WinNT service provider


_raw: Write-Verbose "[Get-NetLocalGroup] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $LocalGroup | Add-Member Noteproperty 'Comment' $Info.lgrpi1_comment


_raw: $LocalGroup | Add-Member Noteproperty 'GroupName' $Info.lgrpi1_name


_raw: $LocalGroup | Add-Member Noteproperty 'ComputerName' $Computer


_raw: $Info = $NewIntPtr -as $LOCALGROUP_INFO_1


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: for ($i = 0; ($i -lt $EntriesRead); $i++) {


_raw: # Work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -eq 0) -and ($Offset -gt 0)) {


_raw: # locate the offset of the initial intPtr


_raw: $Result = $Netapi32::NetLocalGroupEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle)


_raw: # if we're using the Netapi32 NetLocalGroupEnum API call to get the local group information


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated group property fields from WinNT results.


_raw: Custom PSObject with translated group property fields from API results.


_raw: primary.testlab.local         Backup Operators              Backup Operators can overr...


_raw: primary.testlab.local         Print Operators               Members can administer dom...


_raw: primary.testlab.local         Guests                        Guests have the same acces...


_raw: primary.testlab.local         Users                         Users are prevented from m...


_raw: primary.testlab.local         Administrators                Administrators have comple...


_raw: ComputerName                  GroupName                     Comment


_raw: WINDOWS1               Cryptographic Opera... S-1-5-32-569          Members are author...


_raw: WINDOWS1               Backup Operators       S-1-5-32-551          Backup Operators c...


_raw: WINDOWS1               Administrators         S-1-5-32-544          Administrators hav...


_raw: ComputerName           GroupName              GroupSID              Comment


_raw: WINDOWS1                      Cryptographic Operators       Members are authorized to ...


_raw: WINDOWS1                      Backup Operators              Backup Operators can overr...


_raw: WINDOWS1                      Administrators                Administrators have comple...


_raw: for connection to a remote machine. Only applicable with "-Method WinNT".


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: The collection method to use, defaults to 'API', also accepts 'WinNT'.


_raw: Specifies the hostname to query for sessions (also accepts IP addresses).


_raw: SIDs along with the group names and descriptions/comments.


_raw: causes the WinNT service provider to be used instead, which returns group


_raw: call NetLocalGroupEnum will be used (for speed). Specifying "-Method WinNT"


_raw: local groups on the current, or remote, machine. By default, the Win32 API


_raw: This function will enumerate the names and descriptions for the


_raw: Enumerates the local groups on the local (or remote) machine.


_raw: # WinNT, WMI, remote registry, or API calls


_raw: # Functions that enumerate a single host, either through


_raw: $_ | Add-Member Noteproperty 'GPODisplayName' $GPO.displayname


_raw: $_ | Add-Member Noteproperty 'GPOName' $GPO.name


_raw: Get-GptTmpl @ParseArgs | ForEach-Object {


_raw: if ($PSBoundParameters['Credential']) { $ParseArgs['Credential'] = $Credential }


_raw: $GptTmplPath = $GPO.gpcfilesyspath + "\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf"


_raw: # grab the GptTmpl.inf file and parse it


_raw: $GPOResults = Get-DomainGPO @SearcherArguments


_raw: elseif (($Policy -eq 'DomainController') -or ($Policy -eq 'DC')) {


_raw: if ($PSBoundParameters['Credential']) { $ConvertArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $ConvertArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Ouputs a hashtable representing the parsed GptTmpl.inf file.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns the policy for the dev.testlab.local domain controller.


_raw: Get-DomainPolicyData -Policy DC -Domain dev.testlab.local


_raw: Parses any GptTmpl.infs found for any policies in the current domain.


_raw: Returns the default domain policy for the dev.testlab.local domain.


_raw: Returns the default domain policy for the current domain.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Otherwise queries for the particular GPO name or GUID.


_raw: Extract 'Domain', 'DC' (domain controller) policies, or 'All' for all policies.


_raw: The domain to query for default policies, defaults to the current domain.


_raw: domain or a specified domain/domain controller using Get-DomainGPO.


_raw: Returns the default domain policy or the domain controller policy for the current


_raw: Required Dependencies: Get-DomainGPO, Get-GptTmpl, ConvertFrom-SID


_raw: domain or a specified domain/domain controller.


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPOType' $GPOGroup.GPOType


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPOPath' $GPOGroup.GPOPath


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPOGuid' $GPOGroup.GPOName


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPODisplayName' $GPOGroup.GPODisplayName


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'IsGroup' $IsGroup


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ObjectSID' $_


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ObjectName' $Object.samaccountname


_raw: $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ComputerName' $Computer.dnshostname


_raw: $GPOComputerLocalGroupMember = New-Object PSObject


_raw: $Object = Get-DomainObject @CommonArguments -Identity $_


_raw: $GPOGuids | Get-DomainGPOLocalGroup @CommonArguments | Sort-Object -Property GPOName -Unique | ForEach-Object {


_raw: # process any GPO local group settings from the GPO GUID set


_raw: Select-String -InputObject $_.gplink -Pattern '(\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1}' -AllMatches | ForEach-Object {$_.Matches | Select-Object -ExpandProperty Value }


_raw: $GPOGuids += Get-DomainSite @CommonArguments -Identity $ComputerSite -LDAPFilter '(gplink=*)' | ForEach-Object {


_raw: if ($ComputerSite -and ($ComputerSite -notmatch 'Error')) {


_raw: $ComputerSite = (Get-NetComputerSiteName -ComputerName $Computer.dnshostname).SiteName


_raw: Write-Verbose "Enumerating the sitename for: $($Computer.dnshostname)"


_raw: # extract any GPOs linked to this computer's site through gpLink


_raw: $GPOGuids += Get-DomainOU @CommonArguments -SearchBase $OUName -LDAPFilter '(gplink=*)' | ForEach-Object {


_raw: # extract any GPOs linked to this computer's OU through gpLink


_raw: throw "[Get-DomainGPOComputerLocalGroupMapping] Computer $ComputerIdentity not found. Try a fully qualified host name."


_raw: $Computers = Get-DomainComputer @CommonArguments -Identity $ComputerIdentity -Properties 'distinguishedname,dnshostname'


_raw: if ($PSBoundParameters['Credential']) { $CommonArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $CommonArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $CommonArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $CommonArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $CommonArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $CommonArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $CommonArguments['Domain'] = $Domain }


_raw: [ValidateSet('Administrators', 'S-1-5-32-544', 'RDP', 'Remote Desktop Users', 'S-1-5-32-555')]


_raw: [Parameter(Mandatory = $True, ParameterSetName = 'OUIdentity')]


_raw: [Alias('ComputerName', 'Computer', 'DistinguishedName', 'SamAccountName', 'Name')]


_raw: [Parameter(Position = 0, ParameterSetName = 'ComputerIdentity', Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Get-DomainGPOComputerLocalGroupMapping -Credential $Cred -ComputerIdentity SQL.testlab.local


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Finds users who have RDP rights over WINDOWS4 through GPO correlation.


_raw: Get-DomainGPOComputerLocalGroupMapping -Domain dev.testlab.local -ComputerName WINDOWS4.dev.testlab.local -LocalGroup RDP


_raw: Finds users who have local admin rights over WINDOWS3 through GPO correlation.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain to enumerate GPOs for, defaults to the current domain.


_raw: or a custom local SID. Defaults to local 'Administrators'.


_raw: Can be "Administrators" (S-1-5-32-544), "RDP/Remote Desktop Users" (S-1-5-32-555),


_raw: The local group to check access against.


_raw: GUID (e.g. 8a9ba22a-8977-47e6-84ce-8c26af4e1e6a) for the OU to identity GPO local group mappings for.


_raw: An OU name (e.g. TestOU), DistinguishedName (e.g. OU=TestOU,DC=testlab,DC=local), or


_raw: or a dns host name (e.g. windows10.testlab.local) for the computer to identity GPO local group mappings for.


_raw: A SamAccountName (e.g. WINDOWS10$), DistinguishedName (e.g. CN=WINDOWS10,CN=Computers,DC=testlab,DC=local),


_raw: Otherwise, if -OUIdentity is supplied, the same process is executed to find linked GPOs and


_raw: return the results. This will return the domain objects that are members of the specified


_raw: each resulting GPO group, resolve the resulting user/group name to a full AD object and


_raw: enumerate all linked GPOs and associated local group settings with Get-DomainGPOLocalGroup. For


_raw: Get-NetComputerSiteName and retrieve all sites object Get-DomainSite. For those results, attempt to


_raw: determine the OU the computer is a part of. Then resolve the computer's site name with


_raw: If a -ComputerIdentity is specified, retrieve the complete computer object, attempt to


_raw: are in the specified local group for a target machine through GPO correlation.


_raw: This function is the inverse of Get-DomainGPOUserLocalGroupMapping, and finds what users/groups


_raw: Required Dependencies: Get-DomainComputer, Get-DomainOU, Get-NetComputerSiteName, Get-DomainSite, Get-DomainGPOLocalGroup


_raw: local group for the machine through GPO correlation.


_raw: Takes a computer (or GPO) object and determines what users/groups are in the specified


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ComputerName' $_.siteobjectbl


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ContainerName' $_.distinguishedname


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOType' $GPOType


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOPath' $GPOPath


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOGuid' $GPOGuid


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'GPODisplayName' $GPOname


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'Domain' $Domain


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'IsGroup' $IsGroup


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectSID' $Object.objectsid


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectName' $Object.samaccountname


_raw: $GPOLocalGroupMapping = New-Object PSObject


_raw: $Object = Get-DomainObject @CommonArguments -Identity $TargetSid -Properties 'samaccounttype,samaccountname,distinguishedname,objectsid'


_raw: ForEach ($TargetSid in $TargetObjectSIDs) {


_raw: Get-DomainSite @CommonArguments -Properties 'siteobjectbl,distinguishedname' -GPLink $GPOGuid | ForEach-Object {


_raw: # find any sites that have this GPO linked through gpLink


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ComputerName' $OUComputers


_raw: $GPOLocalGroupMapping | Add-Member Noteproperty 'ContainerName' $_.Properties.distinguishedname


_raw: if ($OUComputers -isnot [System.Array]) {$OUComputers = @($OUComputers)}


_raw: $OUComputers = Get-DomainComputer @CommonArguments -Properties 'dnshostname' -SearchBase $_.Path | Select-Object -ExpandProperty dnshostname


_raw: $OUComputers = Get-DomainComputer @CommonArguments -Properties 'dnshostname,distinguishedname' -SearchBase $_.Path | Where-Object {$_.distinguishedname -match ($Filters.Value)} | Select-Object -ExpandProperty dnshostname


_raw: Get-DomainOU @CommonArguments -Raw -Properties 'name,distinguishedname' -GPLink $GPOGuid | ForEach-Object {


_raw: # find any OUs that have this GPO linked through gpLink


_raw: # if the * wildcard was used, set the targets to all GPO members so everything it output


_raw: $GPOgroups | Where-Object {$_} | ForEach-Object {


_raw: } | Sort-Object -Property GPOName -Unique


_raw: if ( ($TargetSIDs[0] -eq '*') -or ($TargetSIDs -Contains $GPOgroup.GroupSID) ) {


_raw: if ( ($GPOgroup.GroupMemberOf -contains $TargetLocalSID) ) {


_raw: # if the group is a 'memberof' the group we're looking for, check GroupSID against the targt SIDs


_raw: if ( ($TargetSIDs[0] -eq '*') -or ($TargetSIDs -Contains $_) ) {


_raw: $GPOgroup.GroupMembers | Where-Object {$_} | ForEach-Object {


_raw: if ($GPOgroup.GroupSID -match $TargetLocalSID) {


_raw: # if the locally set group is what we're looking for, check the GroupMembers ('members') for our target SID


_raw: $GPOgroups = Get-DomainGPOLocalGroup @CommonArguments -ResolveMembersToSIDs | ForEach-Object {


_raw: Write-Verbose "[Get-DomainGPOUserLocalGroupMapping] Effective target domain SIDs: $TargetSIDs"


_raw: Write-Verbose "[Get-DomainGPOUserLocalGroupMapping] Target localgroup SID: $TargetLocalSID"


_raw: $TargetSIDs += Get-DomainGroup @CommonArguments -Properties 'objectsid' -MemberIdentity $TargetSid | Select-Object -ExpandProperty objectsid


_raw: Write-Verbose "[Get-DomainGPOUserLocalGroupMapping] Enumerating nested group memberships for: '$TargetSid'"


_raw: Throw "[Get-DomainGPOUserLocalGroupMapping] Unable to retrieve SID for identity '$Identity'"


_raw: $TargetSIDs += Get-DomainObject @CommonArguments -Identity $Identity | Select-Object -Expand objectsid


_raw: if ($PSBoundParameters['Credential']) { $CommonArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $CommonArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $CommonArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $CommonArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $CommonArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $CommonArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $CommonArguments['Domain'] = $Domain }


_raw: [ValidateSet('Administrators', 'S-1-5-32-544', 'RDP', 'Remote Desktop Users', 'S-1-5-32-555')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: group memberships they're a part of through GPO correlation.


_raw: A custom PSObject containing any target identity information and what local


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Find all computers that dfm user has local administrator rights to in


_raw: Get-DomainGPOUserLocalGroupMapping -Identity dfm -Domain dev.testlab.local


_raw: of the local administrators group on target machines.


_raw: Find all user/group -> machine relationships where the user/group is a member


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain to enumerate GPOs for, defaults to the current domain.


_raw: or a custom local SID. Defaults to local 'Administrators'.


_raw: Can be "Administrators" (S-1-5-32-544), "RDP/Remote Desktop Users" (S-1-5-32-555),


_raw: The local group to check access against.


_raw: for the user/group to identity GPO local group mappings for.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: If no user/group is specified, all user/group -> machine mappings discovered through


_raw: 6.  querying for all computers under the given OUs or sites


_raw: 5.  enumerating all OUs and sites and applicable GPO GUIs are


_raw: to enumerate all GPO the user is effectively applied with


_raw: 4.  matching the target SID list to the queried GPO SID list


_raw: 3.  pulling all GPOs that set 'Restricted Groups' or Groups.xml by calling


_raw: and extracting all target SIDs to build a target SID list


_raw: 2.  enumerating all groups the user/group is a current part of


_raw: 1.  resolving the user/group to its proper SID


_raw: the user/group has local admin (or RDP) rights to.


_raw: Takes a user/group name and optional domain, and determines the computers in the domain


_raw: Required Dependencies: Get-DomainGPOLocalGroup, Get-DomainObject, Get-DomainComputer, Get-DomainOU, Get-DomainSite, Get-DomainGroup


_raw: local group, all through GPO correlation. If no user/group is specified, all


_raw: Enumerates the machines where a specific domain user/group is a member of a specific


_raw: $_ | Add-Member Noteproperty 'GPOType' 'GroupPolicyPreferences'


_raw: $_ | Add-Member Noteproperty 'GPOName' $GPOName


_raw: $_ | Add-Member Noteproperty 'GPODisplayName' $GPODisplayName


_raw: $MemberSID = ConvertTo-SID -Domain $Domain -ObjectName $Member


_raw: if ($PSBoundParameters['Domain']) { $ConvertToArguments['Domain'] = $Domain }


_raw: $ConvertToArguments = @{'ObjectName' = $Groupname}


_raw: # if the resulting member is username and not a SID, attempt to resolve it


_raw: if ($Member -and ($Member.Trim() -ne '')) {


_raw: Get-GroupsXML @ParseArgs | ForEach-Object {


_raw: # now try to the parse group policy preferences file (Groups.xml) if it exists


_raw: $GPOGroup | Add-Member Noteproperty 'GroupMembers' $Membership.Value.Members


_raw: $GPOGroup | Add-Member Noteproperty 'GroupMemberOf' $Membership.Value.Memberof


_raw: $GPOGroup | Add-Member Noteproperty 'GroupSID' $GroupSID


_raw: $GPOGroup | Add-Member Noteproperty 'GroupName' $GroupName


_raw: $GPOGroup | Add-Member Noteproperty 'Filters' $Null


_raw: $GPOGroup | Add-Member Noteproperty 'GPOType' 'RestrictedGroups'


_raw: $GPOGroup | Add-Member Noteproperty 'GPOPath' $GPOPath


_raw: $GPOGroup | Add-Member Noteproperty 'GPOName' $GPOName


_raw: $GPOGroup | Add-Member Noteproperty 'GPODisplayName' $GPODisplayName


_raw: $GroupSID = ConvertTo-SID @ConvertToArguments


_raw: elseif ($Groupname -match 'Remote Desktop') {


_raw: if ($Groupname -match 'Administrators') {


_raw: if ($GroupName -and ($GroupName.Trim() -ne '')) {


_raw: $GroupName = ConvertFrom-SID -ObjectSID $GroupSID @ConvertArguments


_raw: if ($GroupSID -and ($GroupSID.Trim() -ne '')) {


_raw: # if the SID is already resolved (i.e. begins with *) try to resolve SID to a name


_raw: if ($Membership -and $Membership.Key -and ($Membership.Key -match '^\*')) {


_raw: ForEach ($Membership in $Memberships.GetEnumerator()) {


_raw: if ($MembershipValue -isnot [System.Array]) {$MembershipValue = @($MembershipValue)}


_raw: $MemberSID = ConvertTo-SID @ConvertToArguments


_raw: if ($PSBoundParameters['Domain']) { $ConvertToArguments['Domain'] = $Domain }


_raw: $ConvertToArguments = @{'ObjectName' = $Member}


_raw: if ($Member -and ($Member.Trim() -ne '')) {


_raw: # if the resulting member is username and not a SID, attempt to resolve it


_raw: $MembershipValue = $Membership.Value | Where-Object {$_} | ForEach-Object { $_.Trim('*') } | Where-Object {$_}


_raw: $Group, $Relation = $Membership.Key.Split('__', $SplitOption) | ForEach-Object {$_.Trim()}


_raw: ForEach ($Membership in $Inf.'Group Membership'.GetEnumerator()) {


_raw: # parse the members/memberof fields for each entry


_raw: if ($Inf -and ($Inf.psbase.Keys -contains 'Group Membership')) {


_raw: # first parse the 'Restricted Groups' file (GptTmpl.inf) if it exists


_raw: if ($PSBoundParameters['Credential']) { $ParseArgs['Credential'] = $Credential }


_raw: $ParseArgs =  @{ 'GptTmplPath' = "$GPOPath\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf" }


_raw: Get-DomainGPO @SearcherArguments | ForEach-Object {


_raw: if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity }


_raw: if ($PSBoundParameters['Credential']) { $ConvertArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $ConvertArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $ConvertArguments['Domain'] = $Domain }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $Domain }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Return any GPO-set groups for the GPO with the given display name.


_raw: Return any GPO-set groups for the GPO with the given name/GUID.


_raw: and resolve any members to their domain SIDs.


_raw: Returns all local groups set by GPO along with their members and memberof,


_raw: Returns all local groups set by GPO along with their members and memberof.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Switch. Indicates that any member names should be resolved to their domain SIDs.


_raw: A display name (e.g. 'Test GPO'), DistinguishedName (e.g. 'CN={F260B76D-55C8-46C5-BEF1-9016DD98E272},CN=Policies,CN=System,DC=testlab,DC=local'),


_raw: Get-GroupsXML and those memberships are returned as well.


_raw: section data is processed if present. Any found Groups.xml files are parsed with


_raw: GptTmpl.inf files found, the file is parsed with Get-GptTmpl and any 'Group Membership'


_raw: group membership is set through Group Policy Preferences groups.xml files. For any


_raw: arguments, and for each GPO checks if 'Restricted Groups' are set with GptTmpl.inf or


_raw: First enumerates all GPOs in the current/target domain using Get-DomainGPO with passed


_raw: Required Dependencies: Get-DomainGPO, Get-GptTmpl, Get-GroupsXML, ConvertTo-SID, ConvertFrom-SID


_raw: or Group Policy preferences. Also return their user membership mappings, if they exist.


_raw: Returns all GPOs in a domain that modify local group memberships through 'Restricted Groups'


_raw: Write-Verbose "[Get-DomainGPO] Error disposing of the Results object: $_"


_raw: $GPO = Convert-LDAPProperty -Properties $_.Properties


_raw: Write-Verbose "[Get-DomainGPO] Error calculating gpcfilesyspath for: $($GPO.distinguishedname)"


_raw: $GPO | Add-Member Noteproperty 'gpcfilesyspath' $gpcfilesyspath


_raw: $GPODomain = $GPODN.SubString($GPODN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: if ($PSBoundParameters['SearchBase'] -and ($SearchBase -Match '^GC://')) {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: else { $Results = $GPOSearcher.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $GPOSearcher.FindOne() }


_raw: Write-Verbose "[Get-DomainGPO] filter string: $($GPOSearcher.filter)"


_raw: Write-Verbose "[Get-DomainGPO] Using additional LDAP filter: $LDAPFilter"


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: $GuidByteString = (-Join (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object {$_.ToString('X').PadLeft(2,'0')})) -Replace '(..)','\$1'


_raw: elseif ($IdentityInstance -match '{.*}') {


_raw: Write-Warning "[Get-DomainGPO] Unable to retrieve domain searcher for '$IdentityDomain'"


_raw: $GPOSearcher = Get-DomainSearcher @SearcherArguments


_raw: Write-Verbose "[Get-DomainGPO] Extracted domain '$IdentityDomain' from '$IdentityInstance'"


_raw: $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname


_raw: if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {


_raw: if ($IdentityInstance -match 'LDAP://|^CN=.*') {


_raw: $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')


_raw: $Identity | Where-Object {$_} | ForEach-Object {


_raw: Get-DomainObject @SearcherArguments | ForEach-Object {


_raw: # use the gplink as an ADS path to enumerate all GPOs for the computer


_raw: $GPOAdsPaths | Where-Object {$_ -and ($_ -ne '')} | ForEach-Object {


_raw: else { $SearcherArguments.Remove('Properties') }


_raw: if ($OldProperties) { $SearcherArguments['Properties'] = $OldProperties }


_raw: # restore the old properites to return, if set


_raw: Write-Verbose "[Get-DomainGPO] GPOAdsPaths: $GPOAdsPaths"


_raw: $_.gplink.split('][') | ForEach-Object {


_raw: # extract any GPO links for this particular domain the computer is a part of


_raw: $GPOAdsPaths += Get-DomainObject @SearcherArguments | ForEach-Object {


_raw: # find any GPOs linked to the user/computer's domain


_raw: # extract any GPO links for this particular site the computer is a part of


_raw: $GPOAdsPaths += Get-DomainSite @SearcherArguments | ForEach-Object {


_raw: if($ComputerSite -and ($ComputerSite -notlike 'Error*')) {


_raw: $ComputerSite = (Get-NetComputerSiteName -ComputerName $TargetComputerName).SiteName


_raw: # find all the GPOs linked to the computer's site


_raw: # if this OU has GPO inheritence disabled, break so additional OUs aren't processed


_raw: # inheritance not marked as disabled yet


_raw: # if inheritance has already been disabled and this GPO is set as "enforced"


_raw: # extract any GPO links for this particular OU the computer is a part of


_raw: $GPOAdsPaths += Get-DomainOU @SearcherArguments | ForEach-Object {


_raw: # find all the GPOs linked to the user/computer's OUs


_raw: Write-Verbose "[Get-DomainGPO] object OUs: $ObjectOUs"


_raw: $ObjectOUs += $ObjectDN.split(',') | ForEach-Object {


_raw: # extract all OUs the target user/computer is a part of


_raw: Write-Verbose "[Get-DomainGPO] User '$UserIdentity' not found!"


_raw: $User = Get-DomainUser @SearcherArguments -FindOne | Select-Object -First 1


_raw: Write-Verbose "[Get-DomainGPO] Computer '$ComputerIdentity' not found!"


_raw: $Computer = Get-DomainComputer @SearcherArguments -FindOne | Select-Object -First 1


_raw: if ($PSBoundParameters['ComputerIdentity'] -or $PSBoundParameters['UserIdentity']) {


_raw: $GPOSearcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: The raw DirectoryServices.SearchResult object, if -Raw is enabled.


_raw: Custom PSObject with translated GPO property fields.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Get-DomainGPO -LDAPFilter '(!primarygroupid=513)' -Properties samaccountname,lastlogon


_raw: Return the GPOs with the name of "{F260B76D-55C8-46C5-BEF1-9016DD98E272}" and the display


_raw: Returns all GPOs applied windows1.testlab.local


_raw: Return all GPOs for the testlab.local domain


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Return all GPO objects applied to a given user identity (name, SID, DistinguishedName, etc.).


_raw: Return all GPO objects applied to a given computer identity (name, dnsname, DistinguishedName, etc.).


_raw: A display name (e.g. 'Test GPO'), DistinguishedName (e.g. 'CN={F260B76D-55C8-46C5-BEF1-9016DD98E272},CN=Policies,CN=System,DC=testlab,DC=local'),


_raw: a particular machine, use -ComputerName X.


_raw: the current domain are returned. To enumerate all GPOs that are applied to


_raw: "-Properties samaccountname,usnchanged,...". By default, all GPO objects for


_raw: matching the criteria. To only return specific properties, use


_raw: LDAP filter based on targeting/filter parameters, and searches for all objects


_raw: Builds a directory searcher object using Get-DomainSearcher, builds a custom


_raw: Required Dependencies: Get-DomainSearcher, Get-DomainComputer, Get-DomainUser, Get-DomainOU, Get-NetComputerSiteName, Get-DomainSite, Get-DomainObject, Convert-LDAPProperty


_raw: Return all GPOs or specific GPO objects in AD.


_raw: $MappedPaths.Keys | ForEach-Object { Remove-RemoteConnection -Path $_ }


_raw: Write-Verbose "[Get-GroupsXML] Error parsing $TargetGroupsXMLPath : $_"


_raw: $GroupsXML | Add-Member Noteproperty 'GroupMembers' $Members


_raw: $GroupsXML | Add-Member Noteproperty 'GroupMemberOf' $Null


_raw: $GroupsXML | Add-Member Noteproperty 'GroupSID' $GroupSID


_raw: $GroupsXML | Add-Member Noteproperty 'GroupName' $GroupName


_raw: $GroupsXML | Add-Member Noteproperty 'Filters' $Filters


_raw: $GroupsXML | Add-Member Noteproperty 'GPOPath' $TargetGroupsXMLPath


_raw: if ($Members -isnot [System.Array]) { $Members = @($Members) }


_raw: New-Object -TypeName PSObject -Property @{'Type' = $_.LocalName;'Value' = $_.name}


_raw: $Filters = $_.filters.GetEnumerator() | ForEach-Object {


_raw: # extract out any/all filters...I hate you GPP


_raw: $Members = $_.Properties.members | Select-Object -ExpandProperty Member | Where-Object { $_.action -match 'ADD' } | ForEach-Object {


_raw: # extract out members added to this group


_raw: $GroupSID = ConvertTo-SID -ObjectName $Groupname


_raw: $GroupSID = ConvertTo-SID -ObjectName $Groupname -Credential $Credential


_raw: elseif ($Groupname -match 'Remote Desktop') {


_raw: if ($Groupname -match 'Administrators') {


_raw: # extract the localgroup sid for memberof


_raw: $GroupsXMLcontent | Select-Xml "/Groups/Group" | Select-Object -ExpandProperty node | ForEach-Object {


_raw: # process all group properties in the XML


_raw: [XML]$GroupsXMLcontent = Get-Content -Path $GroupsXMLPath -ErrorAction Stop


_raw: Add-RemoteConnection -Path $SysVolPath -Credential $Credential


_raw: # map IPC$ to this computer if it's not already


_raw: $SysVolPath = "\\$((New-Object System.Uri($GroupsXMLPath)).Host)\SYSVOL"


_raw: if (($GroupsXMLPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) {


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the groups.xml file path name to parse.


_raw: the files are parsed, and the connection is destroyed later with Remove-RemoteConnection.


_raw: Add-RemoteConnection is used to mount \\TARGET\SYSVOL with the specified creds,


_raw: Parses a groups.xml into a custom object. If -Credential is passed,


_raw: Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection, ConvertTo-SID


_raw: Helper to parse a groups.xml file path into a custom object.


_raw: $MappedPaths.Keys | ForEach-Object { Remove-RemoteConnection -Path $_ }


_raw: Write-Verbose "[Get-GptTmpl] Error parsing $TargetGptTmplPath : $_"


_raw: $Contents = Get-IniContent -Path $TargetGptTmplPath -ErrorAction Stop


_raw: $Contents | Add-Member Noteproperty 'Path' $TargetGptTmplPath


_raw: $Contents = Get-IniContent -Path $TargetGptTmplPath -OutputObject -ErrorAction Stop


_raw: Write-Verbose "[Get-GptTmpl] Parsing GptTmplPath: $TargetGptTmplPath"


_raw: $TargetGptTmplPath += '\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf'


_raw: if (-not $TargetGptTmplPath.EndsWith('.inf')) {


_raw: Add-RemoteConnection -Path $SysVolPath -Credential $Credential


_raw: # map IPC$ to this computer if it's not already


_raw: $SysVolPath = "\\$((New-Object System.Uri($GptTmplPath)).Host)\SYSVOL"


_raw: if (($GptTmplPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) {


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Ouputs a hashtable representing the parsed GptTmpl.inf file.


_raw: Parse the default domain policy .inf for dev.testlab.local using alternate credentials.


_raw: Get-GptTmpl -Credential $Cred -GptTmplPath "\\dev.testlab.local\sysvol\dev.testlab.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf"


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Parse the GptTmpl.inf policy for the GPO with display name of 'testing'.


_raw: Parse the default domain policy .inf for dev.testlab.local


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Output a custom PSObject instead of a hashtable.


_raw: Specifies the GptTmpl.inf file path name to parse.


_raw: the files are parsed, and the connection is destroyed later with Remove-RemoteConnection.


_raw: Add-RemoteConnection is used to mount \\TARGET\SYSVOL with the specified creds,


_raw: is constructed and assumed to be the parse target. If -Credential is passed,


_raw: GPO object is passed, GPOPATH\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf


_raw: Parses a GptTmpl.inf into a custom hashtable using Get-IniContent. If a


_raw: Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection, Get-IniContent


_raw: Helper to parse a GptTmpl.inf policy file path into a hashtable.


_raw: $DFSshares | Sort-Object -Property ('RemoteServerName','Name') -Unique


_raw: $DFSshares += Get-DomainDFSShareV2 @SearcherArguments


_raw: $DFSshares += Get-DomainDFSShareV1 @SearcherArguments


_raw: $DFSshares | Sort-Object -Unique -Property 'RemoteServerName'


_raw: Write-Warning "[Get-DomainDFSShare] Get-DomainDFSShareV2 error : $_"


_raw: Write-Verbose "[Get-DomainDFSShare] Error disposing of the Results object: $_"


_raw: Write-Verbose "[Get-DomainDFSShare] Get-DomainDFSShareV2 error in parsing target : $_"


_raw: New-Object -TypeName PSObject -Property @{'Name'="$DFSroot$ShareName";'RemoteServerName'=$Target.split('\')[2]}


_raw: $DFSshares += $xml.targets.ChildNodes | ForEach-Object {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: $DFSsearcher = Get-DomainSearcher @PSBoundParameters


_raw: Write-Warning "[Get-DomainDFSShare] Get-DomainDFSShareV1 error : $_"


_raw: New-Object -TypeName PSObject -Property @{'Name'=$Properties.name[0];'RemoteServerName'=$_}


_raw: # \\null\TestNameSpace\folder\.DFSFolderLink so we do actually want to match


_raw: # If a folder doesn't have a redirection it will have a target like


_raw: Write-Verbose "[Get-DomainDFSShare] Get-DomainDFSShareV1 error disposing of the Results object: $_"


_raw: Write-Verbose "[Get-DomainDFSShare] Get-DomainDFSShareV1 error in parsing DFS share : $_"


_raw: New-Object -TypeName PSObject -Property @{'Name'=$Properties.name[0];'RemoteServerName'=$_.split('\')[2]}


_raw: $DFSshares += $RemoteNames | ForEach-Object {


_raw: $object_list += New-Object -TypeName PSObject -Property $dfs_pkt_properties


_raw: $share_name_end = $share_name_start + $share_name_size - 1


_raw: $share_name_start = $share_name_size_end + 1


_raw: $share_name_size_end = $share_name_size_start + 1


_raw: $share_name_size_start = $server_name_end + 1


_raw: $server_name_end = $server_name_start + $server_name_size - 1


_raw: $server_name_start = $server_name_size_end + 1


_raw: $server_name_size_end = $server_name_size_start + 1


_raw: $server_name_size_start = $target_type_end + 1


_raw: $target_type_end = $target_type_start + 3


_raw: $target_type_start = $target_state_end + 1


_raw: $target_state_end = $target_state_start + 3


_raw: $target_state_start = $target_time_stamp_end + 1


_raw: # FILETIME again or special if priority rank and priority class 0


_raw: $target_time_stamp_end = $target_time_stamp_start + 7


_raw: $target_time_stamp_start = $target_entry_size_end + 1


_raw: $target_entry_size_end = $target_entry_size_start + 3


_raw: $target_count_end = $target_count_start + 3


_raw: $referral_ttl_end = $referral_ttl_start + 3


_raw: $referral_ttl_start = $reserved_blob_end + 1


_raw: $reserved_blob_end = $reserved_blob_start + $reserved_blob_size - 1


_raw: $reserved_blob_start = $reserved_blob_size_end + 1


_raw: $reserved_blob_size_end = $reserved_blob_size_start + 3


_raw: $reserved_blob_size_start = $dfs_targetlist_blob_end + 1


_raw: $dfs_targetlist_blob_end = $dfs_targetlist_blob_start + $dfs_targetlist_blob_size - 1


_raw: $dfs_targetlist_blob_start = $dfs_targetlist_blob_size_end + 1


_raw: $dfs_targetlist_blob_size_end = $dfs_targetlist_blob_size_start + 3


_raw: $dfs_targetlist_blob_size_start = $version_end + 1


_raw: # Parse rest of DFSNamespaceRootOrLinkBlob here


_raw: $version_start = $comment_timestamp_end  + 1


_raw: $comment_timestamp_end = $comment_timestamp_start + 7


_raw: $comment_timestamp_start = $state_timestamp_end + 1


_raw: $state_timestamp_end = $state_timestamp_start + 7


_raw: $state_timestamp_start = $prefix_timestamp_end + 1


_raw: $prefix_timestamp = $blob_data[$prefix_timestamp_start..$prefix_timestamp_end] #dword lowDateTime #dword highdatetime


_raw: $prefix_timestamp_end = $prefix_timestamp_start + 7


_raw: $prefix_timestamp_start = $comment_end + 1


_raw: $comment_end = $comment_start + $comment_size - 1


_raw: $comment_size_end = $comment_size_start + 1


_raw: $short_prefix_end = $short_prefix_start + $short_prefix_size - 1


_raw: $short_prefix_start = $short_prefix_size_end + 1


_raw: $short_prefix_size_end = $short_prefix_size_start + 1


_raw: $short_prefix_size_start = $prefix_end + 1


_raw: $prefix_end = $prefix_start + $prefix_size - 1


_raw: $prefix_size_end = $prefix_size_start + 1


_raw: $prefix_size_start = $root_or_link_guid_end + 1


_raw: $guid = New-Object Guid(,$root_or_link_guid) # should match $guid_str


_raw: # Parse DFSNamespaceRootOrLinkBlob object. Starts with variable length DFSRootOrLinkIDBlob which we parse first...


_raw: $blob_data_end = $blob_data_start + $blob_data_size - 1


_raw: $blob_data_start = $blob_data_size_end + 1


_raw: $blob_data_size_end = $blob_data_size_start + 3


_raw: $blob_data_size_start = $blob_name_end + 1


_raw: $blob_name_end = $blob_name_start + $blob_name_size - 1


_raw: $blob_name_start = $blob_name_size_end + 1


_raw: for($i=1; $i -le $blob_element_count; $i++){


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: [Parameter( ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A custom PSObject describing the distributed file systems.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns all distributed file system shares for the 'testlab.local' domain.


_raw: Returns all distributed file system shares for the current domain.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the domains to use for the query, defaults to the current domain.


_raw: The server data is parsed appropriately and returned.


_raw: matching (objectClass=fTDfs) or (objectClass=msDFS-Linkv2), respectively


_raw: 1, 2, or both depending on -Version X) by searching for domain objects


_raw: This function searches for all distributed file systems (either version


_raw: Returns a list of all fault-tolerant distributed file systems


_raw: $(ForEach($UserResult in $UserSearcher.FindAll()) {if ($UserResult.Properties['homedirectory']) {Split-Path($UserResult.Properties['homedirectory'])}if ($UserResult.Properties['scriptpath']) {Split-Path($UserResult.Properties['scriptpath'])}if ($UserResult.Properties['profilepath']) {Split-Path($UserResult.Properties['profilepath'])}}) | Sort-Object -Unique


_raw: $UserSearcher = Get-DomainSearcher @SearcherArguments


_raw: # get all results w/o the pipeline and uniquify them (I know it's not pretty)


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($Path -and ($Path.split('\\').Count -ge 3)) {


_raw: # short internal helper to split UNC server paths


_raw: [Parameter( ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: One or more strings representing file server names.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns active file servers for the 'testing.local' domain.


_raw: Returns active file servers for the current domain.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: with non-null homedirectory, scriptpath, or profilepath fields, and extracting/uniquifying


_raw: Returns a list of likely fileservers by searching for all users in Active Directory


_raw: Returns a list of servers likely functioning as file servers.


_raw: $Member = [System.DirectoryServices.AccountManagement.Principal]::FindByIdentity($UserContext.Context, $UserIdentity)


_raw: Write-Verbose "[Remove-DomainGroupMember] Removing member '$Member' from group '$Identity'"


_raw: $UserContext = Get-PrincipalContext @ContextArguments


_raw: Write-Warning "[Remove-DomainGroupMember] Error finding the group identity '$Identity' : $_"


_raw: $GroupContext = Get-PrincipalContext @ContextArguments


_raw: if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain }


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: [Parameter(Position = 0, Mandatory = $True)]


_raw: Removes harmj0y from 'Domain Admins' in the current domain using the alternate credentials.


_raw: Remove-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y' -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Removes harmj0y from 'Domain Admins' in the current domain.


_raw: Remove-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y'


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the domain to use to search for user/group principals, defaults to the current domain.


_raw: One or more member identities, i.e. SamAccountName (e.g. Group1), DistinguishedName


_raw: specifying the group to remove members from.


_raw: A group SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local),


_raw: each entry in -Members, each member identity is similarly searched for and removed


_raw: which returns a DirectoryServices.AccountManagement.GroupPrincipal object. For


_raw: The bound domain context is then used to search for the specified -GroupIdentity,


_raw: First binds to the specified domain context using Get-PrincipalContext.


_raw: Removes a domain user (or group) from an existing domain group, assuming


_raw: $Member = [System.DirectoryServices.AccountManagement.Principal]::FindByIdentity($UserContext.Context, $UserIdentity)


_raw: Write-Verbose "[Add-DomainGroupMember] Adding member '$Member' to group '$Identity'"


_raw: $UserContext = Get-PrincipalContext @ContextArguments


_raw: Write-Warning "[Add-DomainGroupMember] Error finding the group identity '$Identity' : $_"


_raw: $GroupContext = Get-PrincipalContext @ContextArguments


_raw: if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain }


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: [Parameter(Position = 0, Mandatory = $True)]


_raw: alternate credentials, and adds the user to 'domain admins' using Add-DomainGroupMember


_raw: Creates the 'andy' user with the specified description and password, using the specified


_raw: New-DomainUser -SamAccountName andy -AccountPassword $UserPassword -Credential $Cred | Add-DomainGroupMember 'Domain Admins' -Credential $Cred


_raw: $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Adds harmj0y to 'Domain Admins' in the current domain using the alternate credentials.


_raw: Add-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y' -Credential $Cred


_raw: Adds harmj0y to 'Domain Admins' in the current domain.


_raw: Add-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y'


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the domain to use to search for user/group principals, defaults to the current domain.


_raw: One or more member identities, i.e. SamAccountName (e.g. Group1), DistinguishedName


_raw: A group SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local),


_raw: each entry in -Members, each member identity is similarly searched for and added


_raw: which returns a DirectoryServices.AccountManagement.GroupPrincipal object. For


_raw: The bound domain context is then used to search for the specified -GroupIdentity,


_raw: First binds to the specified domain context using Get-PrincipalContext.


_raw: Adds a domain user (or group) to an existing domain group, assuming


_raw: Write-Verbose "[Get-DomainGroupMemberDeleted] Error retrieving 'msds-replvaluemetadata' for '$ObjectDN'"


_raw: $Output | Add-Member NoteProperty 'LastOriginatingDsaDN' $TempObject.pszLastOriginatingDsaDN


_raw: $Output | Add-Member NoteProperty 'TimesAdded' ($TempObject.dwVersion / 2)


_raw: $Output | Add-Member NoteProperty 'LastOriginatingChange' $TempObject.ftimeLastOriginatingChange


_raw: $Output | Add-Member NoteProperty 'TimeDeleted' $TempObject.ftimeDeleted


_raw: $Output | Add-Member NoteProperty 'TimeFirstAdded' $TempObject.ftimeCreated


_raw: $Output | Add-Member NoteProperty 'MemberDN' $TempObject.pszObjectDn


_raw: $Output | Add-Member NoteProperty 'GroupDN' $ObjectDN


_raw: if (($TempObject.pszAttributeName -Match 'member') -and (($TempObject.dwVersion % 2) -eq 0 )) {


_raw: $TempObject = [xml]$XMLNode | Select-Object -ExpandProperty 'DS_REPL_VALUE_META_DATA' -ErrorAction SilentlyContinue


_raw: ForEach($XMLNode in $_.Properties['msds-replvaluemetadata']) {


_raw: Get-DomainObject @SearcherArguments | ForEach-Object {


_raw: if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: 'LDAPFilter'    =   '(objectCategory=group)'


_raw: 'Properties'    =   'msds-replvaluemetadata','distinguishedname'


_raw: [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated replication metadata fields.


_raw: LastOriginatingDsaDN  : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First


_raw: MemberDN              : CN=dfm,CN=Users,DC=testlab,DC=local


_raw: GroupDN               : CN=Domain Admins,CN=Users,DC=testlab,DC=local


_raw:
    Logon Time:                   11/5/2025 5:43:51 PM
    Logon Type:                   Service
    Start Time:
    Domain:                       NT SERVICE
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    SplunkForwarder
    User Principal Name:          DECKHAND-01$@allports.local
    User SID:                     S-1-5-80-972488765-139171986-783781252-3188962990-3730692313
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     999


_raw:
    Logon Time:                   11/5/2025 5:42:26 PM
    Logon Type:                   Service
    Start Time:
    Domain:                       NT SERVICE
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    SplunkForwarder
    User Principal Name:          DECKHAND-01$@allports.local
    User SID:                     S-1-5-80-972488765-139171986-783781252-3188962990-3730692313
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:
    Logon Id:                     42633


_raw:
    Logon Time:                   11/5/2025 5:37:59 PM
    Logon Type:                   Service
    Start Time:
    Domain:                       NT AUTHORITY
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    LOCAL SERVICE
    User Principal Name:
    User SID:                     S-1-5-19
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     23509