_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: objectcategory        : CN=Group,CN=Schema,CN=Configuration,DC=testlab,DC=local


_raw: objectguid            : f37903ed-b333-49f4-abaa-46c65e9cca71


_raw: member                : CN=Andy Robbins (admin),CN=Users,DC=testlab,DC=local


_raw: distinguishedname     : CN=Desktop Admins,CN=Users,DC=testlab,DC=local


_raw: dscorepropagationdata : 1/1/1601 12:00:00 AM


_raw: $Types = $FunctionDefinitions | Add-Win32Type -Module $Mod -Namespace 'Win32'


_raw: (func kernel32 CloseHandle ([Bool]) @([IntPtr]) -SetLastError)


_raw: (func Mpr WNetCancelConnection2 ([Int]) @([String], [Int], [Bool])),


_raw: (func Mpr WNetAddConnection2W ([Int]) @($NETRESOURCEW, [String], [String], [UInt32])),


_raw: (func wtsapi32 WTSCloseServer ([Int]) @([IntPtr])),


_raw: (func wtsapi32 WTSFreeMemory ([Int]) @([IntPtr])),


_raw: (func wtsapi32 WTSFreeMemoryEx ([Int]) @([Int32], [IntPtr], [Int32])),


_raw: (func wtsapi32 WTSQuerySessionInformation ([Int]) @([IntPtr], [Int], [Int], [IntPtr].MakeByRefType(), [Int32].MakeByRefType()) -SetLastError),


_raw: (func wtsapi32 WTSEnumerateSessionsEx ([Int]) @([IntPtr], [Int32].MakeByRefType(), [Int], [IntPtr].MakeByRefType(), [Int32].MakeByRefType()) -SetLastError),


_raw: (func wtsapi32 WTSOpenServerEx ([IntPtr]) @([String])),


_raw: (func advapi32 RevertToSelf ([Bool]) @() -SetLastError),


_raw: (func advapi32 ImpersonateLoggedOnUser ([Bool]) @([IntPtr]) -SetLastError),


_raw: (func advapi32 LogonUser ([Bool]) @([String], [String], [String], [UInt32], [UInt32], [IntPtr].MakeByRefType()) -SetLastError),


_raw: (func advapi32 CloseServiceHandle ([Int]) @([IntPtr])),


_raw: (func advapi32 OpenSCManagerW ([IntPtr]) @([String], [String], [Int]) -SetLastError),


_raw: (func advapi32 ConvertSidToStringSid ([Int]) @([IntPtr], [String].MakeByRefType()) -SetLastError),


_raw: (func netapi32 NetApiBufferFree ([Int]) @([IntPtr])),


_raw: (func netapi32 DsEnumerateDomainTrusts ([Int]) @([String], [UInt32], [IntPtr].MakeByRefType(), [IntPtr].MakeByRefType())),


_raw: (func netapi32 DsGetSiteName ([Int]) @([String], [IntPtr].MakeByRefType())),


_raw: (func netapi32 NetLocalGroupGetMembers ([Int]) @([String], [String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),


_raw: (func netapi32 NetLocalGroupEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),


_raw: (func netapi32 NetSessionEnum ([Int]) @([String], [String], [String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),


_raw: (func netapi32 NetWkstaUserEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),


_raw: (func netapi32 NetShareEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),


_raw: # all of the Win32 API functions we need


_raw: lpProvider =      field 7 String -MarshalAs @('LPWStr')


_raw: lpComment =       field 6 String -MarshalAs @('LPWStr')


_raw: lpRemoteName =    field 5 String -MarshalAs @('LPWStr')


_raw: lpLocalName =     field 4 String -MarshalAs @('LPWStr')


_raw: $NETRESOURCEW = struct $Mod NETRESOURCEW @{


_raw: TrustAttributes = field 5 $DsDomainTrustAttributes


_raw: DnsDomainName = field 1 String -MarshalAs @('LPWStr')


_raw: NetbiosDomainName = field 0 String -MarshalAs @('LPWStr')


_raw: $DS_DOMAIN_TRUSTS = struct $Mod DS_DOMAIN_TRUSTS @{


_raw: # the DsEnumerateDomainTrusts result structure


_raw: $DsDomainTrustAttributes = psenum $Mod DsDomain.TrustAttributes UInt32 @{


_raw: $DsDomainTrustType = psenum $Mod DsDomain.TrustType UInt32 @{


_raw: $DsDomainFlag = psenum $Mod DsDomain.Flags UInt32 @{


_raw: lgrmi2_domainandname = field 2 String -MarshalAs @('LPWStr')


_raw: $LOCALGROUP_MEMBERS_INFO_2 = struct $Mod LOCALGROUP_MEMBERS_INFO_2 @{


_raw: # the NetLocalGroupGetMembers result structure


_raw: lgrpi1_comment = field 1 String -MarshalAs @('LPWStr')


_raw: lgrpi1_name = field 0 String -MarshalAs @('LPWStr')


_raw: $LOCALGROUP_INFO_1 = struct $Mod LOCALGROUP_INFO_1 @{


_raw: # the NetLocalGroupEnum result structure


_raw: $SID_NAME_USE = psenum $Mod SID_NAME_USE UInt16 @{


_raw: # enum used by $LOCALGROUP_MEMBERS_INFO_2 below


_raw: UserName = field 1 String -MarshalAs @('LPWStr')


_raw: CName = field 0 String -MarshalAs @('LPWStr')


_raw: $SESSION_INFO_10 = struct $Mod PowerView.SessionInfo @{


_raw: LogonServer = field 3 String -MarshalAs @('LPWStr')


_raw: AuthDomains = field 2 String -MarshalAs @('LPWStr')


_raw: LogonDomain = field 1 String -MarshalAs @('LPWStr')


_raw: UserName = field 0 String -MarshalAs @('LPWStr')


_raw: $WKSTA_USER_INFO_1 = struct $Mod PowerView.LoggedOnUserInfo @{


_raw: Remark = field 2 String -MarshalAs @('LPWStr')


_raw: Name = field 0 String -MarshalAs @('LPWStr')


_raw: $SHARE_INFO_1 = struct $Mod PowerView.ShareInfo @{


_raw: Address = field 1 Byte[] -MarshalAs @('ByValArray', 20)


_raw: $WTS_CLIENT_ADDRESS = struct $mod WTS_CLIENT_ADDRESS @{


_raw: # the particular WTSQuerySessionInformation result structure


_raw: pFarmName = field 7 String -MarshalAs @('LPWStr')


_raw: pDomainName = field 6 String -MarshalAs @('LPWStr')


_raw: pUserName = field 5 String -MarshalAs @('LPWStr')


_raw: pHostName = field 4 String -MarshalAs @('LPWStr')


_raw: pSessionName = field 3 String -MarshalAs @('LPWStr')


_raw: $WTS_SESSION_INFO_1 = struct $Mod PowerView.RDPSessionInfo @{


_raw: # the WTSEnumerateSessionsEx result structure


_raw: $WTSConnectState = psenum $Mod WTS_CONNECTSTATE_CLASS UInt16 @{


_raw: # enum used by $WTS_SESSION_INFO_1 below


_raw: PARTIAL_SECRETS_ACCOUNT         =   67108864


_raw: TRUSTED_TO_AUTH_FOR_DELEGATION  =   16777216


_raw: PASSWORD_EXPIRED                =   8388608


_raw: DONT_REQ_PREAUTH                =   4194304


_raw: USE_DES_KEY_ONLY                =   2097152


_raw: NOT_DELEGATED                   =   1048576


_raw: TRUSTED_FOR_DELEGATION          =   524288


_raw: SMARTCARD_REQUIRED              =   262144


_raw: MNS_LOGON_ACCOUNT               =   131072


_raw: DONT_EXPIRE_PASSWORD            =   65536


_raw: SERVER_TRUST_ACCOUNT            =   8192


_raw: WORKSTATION_TRUST_ACCOUNT       =   4096


_raw: INTERDOMAIN_TRUST_ACCOUNT       =   2048


_raw: $UACEnum = psenum $Mod PowerView.UACEnum UInt32 @{


_raw: # used to parse the 'userAccountControl' property for users/groups


_raw: UNIVERSAL_SCOPE                 =   '0x00000008'


_raw: DOMAIN_LOCAL_SCOPE              =   '0x00000004'


_raw: CREATED_BY_SYSTEM               =   '0x00000001'


_raw: $GroupTypeEnum = psenum $Mod PowerView.GroupTypeEnum UInt32 @{


_raw: # used to parse the 'grouptype' property for groups


_raw: ACCOUNT_TYPE_MAX                =   '0x7fffffff'


_raw: APP_QUERY_GROUP                 =   '0x40000001'


_raw: APP_BASIC_GROUP                 =   '0x40000000'


_raw: TRUST_ACCOUNT                   =   '0x30000002'


_raw: MACHINE_ACCOUNT                 =   '0x30000001'


_raw: NON_SECURITY_ALIAS_OBJECT       =   '0x20000001'


_raw: NON_SECURITY_GROUP_OBJECT       =   '0x10000001'


_raw: DOMAIN_OBJECT                   =   '0x00000000'


_raw: $SamAccountTypeEnum = psenum $Mod PowerView.SamAccountTypeEnum UInt32 @{


_raw: # used to parse the 'samAccountType' property for users/computers/groups


_raw: $Mod = New-InMemoryModule -ModuleName Win32


_raw: # and can't be changed while the script is running!


_raw: # Warning: Once these are executed, they are baked in


_raw: # Expose the Win32API functions and datastructures below


_raw: $GpoACL | Add-Member Noteproperty 'ActiveDirectoryRights' $ACL.ActiveDirectoryRights


_raw: $GpoACL | Add-Member Noteproperty 'IdentityReference' $ACL.IdentityReference


_raw: $GpoACL | Add-Member Noteproperty 'GPODisplayName' $gpo.Properties.displayname


_raw: $GpoACL | Add-Member Noteproperty 'ADSPath' $gpo.Properties.adspath


_raw: $ACL = ([ADSI]$gpo.path).ObjectSecurity.Access | ? {$_.ActiveDirectoryRights -match "Write" -and $_.AccessControlType -eq "Allow" -and  $Exclusions -notcontains $_.IdentityReference.toString().split("\")[1] -and $_.IdentityReference -ne "CREATOR OWNER"}


_raw: $Searcher = New-Object System.DirectoryServices.DirectorySearcher


_raw: $Domains = $DomainList | foreach { $_.GetDirectoryEntry() }


_raw: $Exclusions = @('SYSTEM','Domain Admins','Enterprise Admins')


_raw: Returns all GPO delegations on a given GPO.


_raw: Returns all GPO delegations in current forest.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: The GPO display name to query for, wildcards accepted.


_raw: Finds users with write permissions on GPO objects which may allow privilege escalation within the domain.


_raw: Write-Verbose "[Get-DomainTrustMapping] Error: $_"


_raw: if ($Trust.SourceName -and $Trust.TargetName) {


_raw: $Trusts += Get-ForestTrust @ForestTrustArguments


_raw: if ($PSBoundParameters['Credential']) { $ForestTrustArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Forest']) { $ForestTrustArguments['Forest'] = $Forest }


_raw: if ($PsCmdlet.ParameterSetName -eq 'NET') {


_raw: $Trusts = Get-DomainTrust @DomainTrustArguments


_raw: Write-Verbose "[Get-DomainTrustMapping] Enumerating trusts for domain: '$Domain'"


_raw: if ($Domain -and ($Domain.Trim() -ne '') -and (-not $SeenDomains.ContainsKey($Domain))) {


_raw: $CurrentDomain = (Get-Domain -Credential $Credential).Name


_raw: # get the current domain and push it onto the stack


_raw: if ($PSBoundParameters['Credential']) { $DomainTrustArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $DomainTrustArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $DomainTrustArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $DomainTrustArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $DomainTrustArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $DomainTrustArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $DomainTrustArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $DomainTrustArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['LDAPFilter']) { $DomainTrustArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['NET']) { $DomainTrustArguments['NET'] = $NET }


_raw: if ($PSBoundParameters['API']) { $DomainTrustArguments['API'] = $API }


_raw: $Domains = New-Object System.Collections.Stack


_raw: # keep track of domains seen so we don't hit infinite recursion


_raw: Custom PSObject with translated domain API trust result fields.


_raw: A TrustRelationshipInformationCollection returned when using .NET methods.


_raw: Custom PSObject with translated domain LDAP trust result fields (default).


_raw: using the specified alternate credentials, and output everything to a .csv file.


_raw: Map all reachable domain trusts using LDAP, binding to the PRIMARY.testlab.local server for queries


_raw: Get-DomainTrustMapping -Server 'PRIMARY.testlab.local' | Export-CSV -NoTypeInformation trusts.csv


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Map all reachable domain trusts using .NET methods and output everything to a .csv file.


_raw: Get-DomainTrustMapping -NET | Export-CSV -NoTypeInformation trusts.csv


_raw: Map all reachable domain trusts using Win32 API calls and output everything to a .csv file.


_raw: Get-DomainTrustMapping -API | Export-CSV -NoTypeInformation trusts.csv


_raw: Get-DomainTrustMapping | Export-CSV -NoTypeInformation trusts.csv


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Switch. Use .NET queries to enumerate trusts instead of the default LDAP method.


_raw: Switch. Use an API call (DsEnumerateDomainTrusts) to enumerate the trusts instead of the


_raw: object. If the -API flag is specified, the Win32 API DsEnumerateDomainTrusts() call is


_raw: GetAllTrustRelationships() is used on the System.DirectoryServices.ActiveDirectory.Domain


_raw: LDAP is used as well. If the -NET flag is specified, the .NET method


_raw: '(objectClass=trustedDomain)' is used- if any LDAP-appropriate parameters are specified


_raw: mapping all reachable trust relationships. By default, and LDAP search using the filter


_raw: a number of methods, and then enumerates all trusts for each found domain, recursively


_raw: This function will enumerate domain trust relationships for the current domain using


_raw: Required Dependencies: Get-Domain, Get-DomainTrust, Get-ForestTrust


_raw: This function enumerates all trusts for the current domain and then enumerates


_raw: $ForeignGroupMember | Add-Member Noteproperty 'MemberDistinguishedName' $MemberDistinguishedName


_raw: $ForeignGroupMember | Add-Member Noteproperty 'MemberName' $MemberName


_raw: $ForeignGroupMember | Add-Member Noteproperty 'MemberDomain' $MemberDomain


_raw: $ForeignGroupMember | Add-Member Noteproperty 'GroupDistinguishedName' $GroupDistinguishedName


_raw: $ForeignGroupMember | Add-Member Noteproperty 'GroupName' $GroupName


_raw: $ForeignGroupMember | Add-Member Noteproperty 'GroupDomain' $GroupDomain


_raw: $ForeignGroupMember = New-Object PSObject


_raw: if (($_ -match 'CN=S-1-5-21.*-.*') -or ($GroupDomain -ne $MemberDomain)) {


_raw: $MemberDomain = $_.SubString($_.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: #   or if the DN doesn't end with the proper DN for the queried domain


_raw: # filter for foreign SIDs in the cn field for users in another domain,


_raw: $GroupDomain = $GroupDistinguishedName.SubString($GroupDistinguishedName.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: Get-DomainGroup @SearcherArguments | Where-Object { $ExcludeGroups -notcontains $_.samaccountname } | ForEach-Object {


_raw: $ExcludeGroups = @('Users', 'Domain Users', 'Guests')


_raw: if ($PSBoundParameters['Raw']) { $SearcherArguments['Raw'] = $Raw }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated group member property fields.


_raw: queries, and using the specified alternate credentials.


_raw: not in dev.testlab.local. binding to the secondary.dev.testlab.local for


_raw: Return all group members in the dev.testlab.local domain where the member is


_raw: Get-DomainForeignGroupMember -Domain dev.testlab.local -Server secondary.dev.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Return all group members in the dev.testlab.local domain where the member is not in dev.testlab.local.


_raw: Return all group members in the current domain where the group and member differ.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: name to the parent group's domain name, outputting the member if the domains differ.


_raw: then enumerates the members of each group, and compares the member's domain


_raw: Uses Get-DomainGroup to enumerate all groups for the current (or target) domain,


_raw: Required Dependencies: Get-Domain, Get-DomainGroup


_raw: each foreign member. This is a domain's "incoming" access.


_raw: Enumerates groups with users outside of the group's domain and returns


_raw: $ForeignUser | Add-Member Noteproperty 'GroupDistinguishedName' $Membership


_raw: $ForeignUser | Add-Member Noteproperty 'GroupName' $GroupName


_raw: $ForeignUser | Add-Member Noteproperty 'GroupDomain' $GroupDomain


_raw: $ForeignUser | Add-Member Noteproperty 'UserDistinguishedName' $_.distinguishedname


_raw: $ForeignUser | Add-Member Noteproperty 'UserName' $_.samaccountname


_raw: $ForeignUser | Add-Member Noteproperty 'UserDomain' $UserDomain


_raw: # if the group domain doesn't match the user domain, display it


_raw: $UserDomain = $($_.distinguishedname.SubString($UserIndex)) -replace 'DC=','' -replace ',','.'


_raw: $GroupDomain = $($Membership.SubString($Index)) -replace 'DC=','' -replace ',','.'


_raw: Get-DomainUser @SearcherArguments  | ForEach-Object {


_raw: if ($PSBoundParameters['Raw']) { $SearcherArguments['Raw'] = $Raw }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated user property fields.


_raw: using the specified alternate credentials.


_raw: dev.testlab.local domain, binding to the secondary.dev.testlab.local for queries, and


_raw: Return all users in the dev.testlab.local domain who are in groups not in the


_raw: Get-DomainForeignUser -Domain dev.testlab.local -Server secondary.dev.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Return all users in the current domain who are in groups not in the


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: This domain name is compared to the queried domain, and the user object is


_raw: then calculates the given user's domain name based on the user's distinguishedName.


_raw: Uses Get-DomainUser to enumerate all users for the current (or target) domain,


_raw: Required Dependencies: Get-Domain, Get-DomainUser


_raw: Enumerates users who are in groups outside of the user's domain.


_raw: $FoundForest.GetAllTrustRelationships() | ForEach-Object {


_raw: $FoundForest = Get-Forest @NetForestArguments


_raw: if ($PSBoundParameters['Credential']) { $NetForestArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Forest']) { $NetForestArguments['Forest'] = $Forest }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A TrustRelationshipInformationCollection returned when using .NET methods (default).


_raw: Return trusts for the "external.local" forest using the specified alternate credenitals.


_raw: Get-ForestTrust -Forest "external.local" -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Return trusts for the "external.local" forest.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the forest to query for trusts, defaults to the current forest.


_raw: System.DirectoryServices.ActiveDirectory.Forest returned by Get-Forest.


_raw: forest using number of method using the .NET method GetAllTrustRelationships() on a


_raw: This function will enumerate domain trust relationships for the current (or a remote)


_raw: Return all forest trusts for the current forest or a specified forest.


_raw: $FoundDomain.GetAllTrustRelationships() | ForEach-Object {


_raw: $FoundDomain = Get-Domain @NetSearcherArguments


_raw: # if we're searching for domain trusts through .NET methods


_raw: Write-Verbose "[Get-DomainTrust] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $DomainTrust | Add-Member Noteproperty 'TargetGuid' $Info.DomainGuid


_raw: $DomainTrust | Add-Member Noteproperty 'TargetSid' $SidString


_raw: $DomainTrust | Add-Member Noteproperty 'TrustAttributes' $Info.TrustAttributes


_raw: $DomainTrust | Add-Member Noteproperty 'TrustType' $Info.TrustType


_raw: $DomainTrust | Add-Member Noteproperty 'ParentIndex' $Info.ParentIndex


_raw: $DomainTrust | Add-Member Noteproperty 'Flags' $Info.Flags


_raw: $DomainTrust | Add-Member Noteproperty 'TargetNetbiosName' $Info.NetbiosDomainName


_raw: $DomainTrust | Add-Member Noteproperty 'TargetName' $Info.DnsDomainName


_raw: $DomainTrust | Add-Member Noteproperty 'SourceName' $SourceDomain


_raw: Write-Verbose "[Get-DomainTrust] Error: $(([ComponentModel.Win32Exception] $LastError).Message)"


_raw: $Result = $Advapi32::ConvertSidToStringSid($Info.DomainSid, [ref]$SidString);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()


_raw: $Info = $NewIntPtr -as $DS_DOMAIN_TRUSTS


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: for ($i = 0; ($i -lt $DomainCount); $i++) {


_raw: # Work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -eq 0) -and ($Offset -gt 0)) {


_raw: # Locate the offset of the initial intPtr


_raw: $Result = $Netapi32::DsEnumerateDomainTrusts($TargetDC, $Flags, [ref]$PtrInfo, [ref]$DomainCount)


_raw: # get the trust information from the target server


_raw: # 63 = DS_DOMAIN_IN_FOREST + DS_DOMAIN_DIRECT_OUTBOUND + DS_DOMAIN_TREE_ROOT + DS_DOMAIN_PRIMARY + DS_DOMAIN_NATIVE_MODE + DS_DOMAIN_DIRECT_INBOUND


_raw: # see https://msdn.microsoft.com/en-us/library/ms675976(v=vs.85).aspx for default NULL behavior


_raw: elseif ($Domain -and $Domain.Trim() -ne '') {


_raw: # if we're searching for domain trusts through Win32 API functions


_raw: elseif ($PsCmdlet.ParameterSetName -eq 'API') {


_raw: Write-Verbose "[Get-DomainTrust] Error disposing of the Results object: $_"


_raw: $DomainTrust | Add-Member Noteproperty 'WhenChanged' $Props.whenchanged[0]


_raw: $DomainTrust | Add-Member Noteproperty 'WhenCreated' $Props.whencreated[0]


_raw: $DomainTrust | Add-Member Noteproperty 'TrustDirection' "$Direction"


_raw: $DomainTrust | Add-Member Noteproperty 'TrustAttributes' $($TrustAttrib -join ',')


_raw: $DomainTrust | Add-Member Noteproperty 'TrustType' $TrustType


_raw: # $DomainTrust | Add-Member Noteproperty 'TargetGuid' "{$ObjectGuid}"


_raw: $DomainTrust | Add-Member Noteproperty 'TargetName' $Props.name[0]


_raw: $DomainTrust | Add-Member Noteproperty 'SourceName' $SourceDomain


_raw: $TargetSID = (New-Object System.Security.Principal.SecurityIdentifier($Props.securityidentifier[0],0)).Value


_raw: $ObjectGuid = New-Object Guid @(,$Props.objectguid[0])


_raw: $TargetDomain = $Distinguishedname.SubString(3, $TargetNameIndex-3)


_raw: $SourceDomain = $($Distinguishedname.SubString($SourceNameIndex)) -replace 'DC=','' -replace ',','.'


_raw: $TrustType = Switch ($Props.trusttype) {


_raw: $Direction = Switch ($Props.trustdirection) {


_raw: $TrustAttrib += $TrustAttributes.Keys | Where-Object { $Props.trustattributes[0] -band $_ } | ForEach-Object { $TrustAttributes[$_] }


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: else { $Results = $TrustSearcher.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $TrustSearcher.FindOne() }


_raw: $SourceSID = Get-DomainSID @NetSearcherArguments


_raw: $TrustSearcher = Get-DomainSearcher @LdapSearcherArguments


_raw: # if we're searching for domain trusts through LDAP/ADSI


_raw: if ($PsCmdlet.ParameterSetName -eq 'LDAP') {


_raw: if ($Domain -and $Domain.Trim() -ne '') {


_raw: elseif ($PsCmdlet.ParameterSetName -ne 'NET') {


_raw: $SourceDomain = (Get-Domain -Credential $Credential).Name


_raw: if ($PsCmdlet.ParameterSetName -ne 'API') {


_raw: if ($PSBoundParameters['Credential']) { $LdapSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $LdapSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $LdapSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $LdapSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $LdapSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $LdapSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $LdapSearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $LdapSearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['LDAPFilter']) { $LdapSearcherArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['Domain']) { $LdapSearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated domain API trust result fields.


_raw: A TrustRelationshipInformationCollection returned when using .NET methods.


_raw: Custom PSObject with translated domain LDAP trust result fields (default).


_raw: Return domain trusts for the "prod.testlab.local" domain enumerated through API calls.


_raw: Get-DomainTrust -API -Domain "prod.testlab.local"


_raw: queries, binding to the PRIMARY.testlab.local server for queries, and using the specified


_raw: Return domain trusts for the "prod.testlab.local" domain enumerated through LDAP


_raw: Get-DomainTrust -Domain "prod.testlab.local" -Server "PRIMARY.testlab.local" -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Return domain trusts for the "prod.testlab.local" domain using .NET methods


_raw: Get-DomainTrust -NET -Domain "prod.testlab.local"


_raw: Return domain trusts for the current domain using built in .LDAP methods.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Switch. Use .NET queries to enumerate trusts instead of the default LDAP method.


_raw: Switch. Use an API call (DsEnumerateDomainTrusts) to enumerate the trusts instead of the built-in


_raw: Specifies the domain to query for trusts, defaults to the current domain.


_raw: object. If the -API flag is specified, the Win32 API DsEnumerateDomainTrusts() call is


_raw: GetAllTrustRelationships() is used on the System.DirectoryServices.ActiveDirectory.Domain


_raw: LDAP is used as well. If the -NET flag is specified, the .NET method


_raw: '(objectClass=trustedDomain)' is used- if any LDAP-appropriate parameters are specified


_raw: domain using a number of methods. By default, and LDAP search using the filter


_raw: This function will enumerate domain trust relationships for the current (or a remote)


_raw: Required Dependencies: Get-Domain, Get-DomainSearcher, Get-DomainSID, PSReflect


_raw: Return all domain trusts for the current domain or a specified domain.


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-DomainLocalGroupMember] Using threading with threads: $Threads"


_raw: Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $GroupName, $Method, $LogonToken


_raw: Write-Verbose "[Find-DomainLocalGroupMember] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-DomainLocalGroupMember] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-DomainLocalGroupMember] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet


_raw: # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation


_raw: $GroupName = ($AdminSecurityIdentifier.Translate([System.Security.Principal.NTAccount]).Value -split "\\")[-1]


_raw: # Add check if user defaults to/selects "Administrators"


_raw: Param($ComputerName, $GroupName, $Method, $TokenHandle)


_raw: # the host enumeration block we're using to enumerate all servers


_raw: throw '[Find-DomainLocalGroupMember] No hosts found to enumerate'


_raw: Write-Verbose "[Find-DomainLocalGroupMember] TargetComputers length: $($TargetComputers.Length)"


_raw: $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose '[Find-DomainLocalGroupMember] Querying computers in the domain'


_raw: if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName }


_raw: if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack }


_raw: if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem }


_raw: if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter }


_raw: if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated group property fields from WinNT results.


_raw: Custom PSObject with translated group property fields from API results.


_raw: Enumerates the local group memberships for all reachable machines the dev.testlab.local


_raw: Find-DomainLocalGroupMember -Domain testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Enumerates the local group memberships for all reachable machines the dev.testlab.local domain.


_raw: Enumerates the local group memberships for all reachable machines in the current domain.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: for connection to the target domain and target systems.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The collection method to use, defaults to 'API', also accepts 'WinNT'.


_raw: The local group name to query for users. If not given, it defaults to "Administrators".


_raw: Search computers in the specific AD Site name, wildcards accepted.


_raw: Search computers with a specific service pack, wildcards accepted.


_raw: Search computers with a specific operating system, wildcards accepted.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for computers,


_raw: Specifies an LDAP query string that is used to search for computer objects.


_raw: Specifies the domain to query for computers, defaults to the current domain.


_raw: in the domain returned by Get-DomainComputer.


_raw: If -ComputerName is not passed, the default behavior is to enumerate all machines


_raw: Specifies an array of one or more hosts to enumerate, passable on the pipeline.


_raw: By default, the API method is used, but this can be modified with '-Method winnt'


_raw: group (default of Administrators) for each machine using Get-NetLocalGroupMember.


_raw: using Get-DomainComputer, and enumerates the members of the specified local


_raw: This function enumerates all machines on the current (or specified) domain


_raw: Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetLocalGroupMember, New-ThreadedFunction


_raw: for all the targeted machines on the current (or specified) domain.


_raw: Enumerates the members of specified local group (default administrators)


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-LocalAdminAccess] Using threading with threads: $Threads"


_raw: Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $LogonToken


_raw: Write-Verbose "[Find-LocalAdminAccess] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-LocalAdminAccess] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-LocalAdminAccess] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: $Access = Test-AdminAccess -ComputerName $TargetComputer


_raw: # check if the current user has local admin access to this server


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet


_raw: # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation


_raw: # the host enumeration block we're using to enumerate all servers


_raw: throw '[Find-LocalAdminAccess] No hosts found to enumerate'


_raw: Write-Verbose "[Find-LocalAdminAccess] TargetComputers length: $($TargetComputers.Length)"


_raw: $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose '[Find-LocalAdminAccess] Querying computers in the domain'


_raw: if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName }


_raw: if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack }


_raw: if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem }


_raw: if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter }


_raw: if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Computer dnshostnames the current user has administrative access to.


_raw: Finds machines in the testlab.local domain that the user with the specified -Credential


_raw: Find-LocalAdminAccess -Domain testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Finds machines in the dev.testlab.local domain the current user has admin access to.


_raw: Finds machines in the current domain the current user has admin access to.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: for connection to the target domain and target systems.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Switch. Only display found shares that the local user has access to.


_raw: Search computers in the specific AD Site name, wildcards accepted.


_raw: Search computers with a specific service pack, wildcards accepted.


_raw: Search computers with a specific operating system, wildcards accepted.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for computers,


_raw: Specifies an LDAP query string that is used to search for computer objects.


_raw: Specifies the domain to query for computers, defaults to the current domain.


_raw: in the domain returned by Get-DomainComputer.


_raw: If -ComputerName is not passed, the default behavior is to enumerate all machines


_raw: Specifies an array of one or more hosts to enumerate, passable on the pipeline.


_raw: 'Royce Davis "r3dy" <rdavis[at]accuvant.com>'


_raw: 'Thomas McCarthy "smilingraccoon" <smilingraccoon[at]gmail.com>'


_raw: 'Brandon McCann "zeknox" <bmccann[at]accuvant.com>'


_raw: Idea adapted from the local_admin_search_enum post module in Metasploit written by:


_raw: before enumeration, reverting after with Invoke-RevertToSelf.


_raw: then Invoke-UserImpersonation is used to impersonate the specified user


_raw: has local administrator access using Test-AdminAccess. If -Credential is passed,


_raw: using Get-DomainComputer, and for each computer it checks if the current user


_raw: This function enumerates all machines on the current (or specified) domain


_raw: Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Test-AdminAccess, New-ThreadedFunction


_raw: Finds machines on the local domain where the current user has local administrator access.


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-InterestingDomainShareFile] Using threading with threads: $Threads"


_raw: Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $Include, $ExcludedShares, $OfficeDocs, $ExcludeHidden, $FreshEXEs, $CheckWriteAccess, $LogonToken


_raw: Write-Verbose "[Find-InterestingDomainShareFile] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-InterestingDomainShareFile] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-InterestingDomainShareFile] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: # check if the user has access to this path


_raw: if ($ExcludedShares -NotContains $ShareName) {


_raw: # skip this share if it's in the exclude list


_raw: if (($ShareName) -and ($ShareName.Trim() -ne '')) {


_raw: # make sure we get a real share name back


_raw: $Shares = Get-NetShare -ComputerName $TargetComputer


_raw: # get the shares for this host and display what we find


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet


_raw: # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation


_raw: Param($ComputerName, $Include, $ExcludedShares, $OfficeDocs, $ExcludeHidden, $FreshEXEs, $CheckWriteAccess, $TokenHandle)


_raw: # the host enumeration block we're using to enumerate all servers


_raw: throw '[Find-InterestingDomainShareFile] No hosts found to enumerate'


_raw: Write-Verbose "[Find-InterestingDomainShareFile] TargetComputers length: $($TargetComputers.Length)"


_raw: $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose '[Find-InterestingDomainShareFile] Querying computers in the domain'


_raw: if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName }


_raw: if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack }


_raw: if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter }


_raw: if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain }


_raw: $ExcludedShares = @('C$', 'Admin$', 'Print$', 'IPC$'),


_raw: $Include = @('*password*', '*sensitive*', '*admin*', '*login*', '*secret*', 'unattend*.xml', '*.vmdk', '*creds*', '*credential*', '*.config'),


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Searches interesting files in the testlab.local domain using the specified alternate credentials.


_raw: Find-DomainShare -Domain testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('DEV\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Finds 'interesting' files on readable shares on the specified systems.


_raw: Finds 'interesting' files on the current domain.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: for connection to the target domain and target systems.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Switch. Find .EXEs accessed within the last 7 days.


_raw: Switch. Search for office documents (*.doc*, *.xls*, *.ppt*)


_raw: Only return files with a CreationTime greater than this date value.


_raw: Only return files with a LastWriteTime greater than this date value.


_raw: Only return files with a LastAccessTime greater than this date value.


_raw: Specifies share paths to exclude, default of C$, Admin$, Print$, IPC$.


_raw: Specifies one or more specific share paths to search, in the form \\COMPUTER\Share


_raw: Only return files/folders that match the specified array of strings,


_raw: Search computers in the specific AD Site name, wildcards accepted.


_raw: Search computers with a specific service pack, wildcards accepted.


_raw: Search computers with a specific operating system, wildcards accepted.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for computers,


_raw: Specifies an LDAP query string that is used to search for computer objects.


_raw: Specifies the domain to query for computers, defaults to the current domain.


_raw: in the domain returned by Get-DomainComputer.


_raw: If -ComputerName is not passed, the default behavior is to enumerate all machines


_raw: Specifies an array of one or more hosts to enumerate, passable on the pipeline.


_raw: user before enumeration, reverting after with Invoke-RevertToSelf.


_raw: is passed, then Invoke-UserImpersonation is used to impersonate the specified


_raw: readhable share, searching for files marching specific criteria. If -Credential


_raw: machine with Get-NetShare. It will then use Find-InterestingFile on each


_raw: using Get-DomainComputer, and enumerates the available shares for each


_raw: This function enumerates all machines on the current (or specified) domain


_raw: Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetShare, Find-InterestingFile, New-ThreadedFunction


_raw: Searches for files matching specific criteria on readable shares


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-DomainShare] Using threading with threads: $Threads"


_raw: Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $CheckShareAccess, $LogonToken


_raw: Write-Verbose "[Find-DomainShare] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-DomainShare] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-DomainShare] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: Write-Verbose "Error accessing share path $Path : $_"


_raw: # check if the user has access to this path


_raw: # see if we want to check access to this share


_raw: if (($ShareName) -and ($ShareName.trim() -ne '')) {


_raw: $Shares = Get-NetShare -ComputerName $TargetComputer


_raw: # get the shares for this host and check what we find


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet


_raw: # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation


_raw: # the host enumeration block we're using to enumerate all servers


_raw: throw '[Find-DomainShare] No hosts found to enumerate'


_raw: Write-Verbose "[Find-DomainShare] TargetComputers length: $($TargetComputers.Length)"


_raw: $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose '[Find-DomainShare] Querying computers in the domain'


_raw: if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName }


_raw: if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack }


_raw: if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem }


_raw: if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter }


_raw: if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Searches for domain shares in the testlab.local domain using the specified alternate credentials.


_raw: Find-DomainShare -Domain testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Find all domain shares in the current domain that the current user has


_raw: Find all domain shares in the current domain.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: for connection to the target domain and target systems.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Switch. Only display found shares that the local user has access to.


_raw: Search computers in the specific AD Site name, wildcards accepted.


_raw: Search computers with a specific service pack, wildcards accepted.


_raw: Search computers with a specific operating system, wildcards accepted.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for computers,


_raw: Specifies an LDAP query string that is used to search for computer objects.


_raw: Specifies the domain to query for computers, defaults to the current domain.


_raw: in the domain returned by Get-DomainComputer.


_raw: If -ComputerName is not passed, the default behavior is to enumerate all machines


_raw: Specifies an array of one or more hosts to enumerate, passable on the pipeline.


_raw: enumeration, reverting after with Invoke-RevertToSelf.


_raw: Invoke-UserImpersonation is used to impersonate the specified user before


_raw: access to the given share. If -Credential is passed, then


_raw: [IO.Directory]::GetFiles() is used to check if the current user has read


_raw: machine with Get-NetShare. If -CheckShareAccess is passed, then


_raw: using Get-DomainComputer, and enumerates the available shares for each


_raw: This function enumerates all machines on the current (or specified) domain


_raw: Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetShare, New-ThreadedFunction


_raw: then only shares the current user has read access to are returned.


_raw: Searches for computer shares on the domain. If -CheckShareAccess is passed,


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-DomainUserEvent] Using threading with threads: $Threads"


_raw: Write-Verbose "[Find-DomainUserEvent] Target user found, returning early"


_raw: $Result = Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $StartTime, $EndTime, $MaxEvents, $TargetUsers, $Filter, $Credential


_raw: Write-Verbose "[Find-DomainUserEvent] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-DomainUserEvent] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-DomainUserEvent] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: if ($_."$Key" -notmatch $Filter[$Key]) {


_raw: Get-DomainUserEvent @DomainUserEventArgs | ForEach-Object {


_raw: $Keys = $Filter.Keys | Where-Object {($_ -ne 'Op') -and ($_ -ne 'Operator') -and ($_ -ne 'Operation')}


_raw: if (($Filter[$_] -match '&') -or ($Filter[$_] -eq 'and')) {


_raw: if (($_ -eq 'Op') -or ($_ -eq 'Operator') -or ($_ -eq 'Operation')) {


_raw: Get-DomainUserEvent @DomainUserEventArgs | Where-Object {$TargetUsers -contains $_.TargetUserName}


_raw: if ($Credential) { $DomainUserEventArgs['Credential'] = $Credential }


_raw: if ($MaxEvents) { $DomainUserEventArgs['MaxEvents'] = $MaxEvents }


_raw: if ($EndTime) { $DomainUserEventArgs['EndTime'] = $EndTime }


_raw: if ($StartTime) { $DomainUserEventArgs['StartTime'] = $StartTime }


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: Param($ComputerName, $StartTime, $EndTime, $MaxEvents, $TargetUsers, $Filter, $Credential)


_raw: # the host enumeration block we're using to enumerate all servers


_raw: throw '[Find-DomainUserEvent] No hosts found to enumerate'


_raw: Write-Verbose "[Find-DomainUserEvent] TargetComputers $TargetComputers"


_raw: Write-Verbose "[Find-DomainUserEvent] TargetComputers length: $($TargetComputers.Length)"


_raw: if ($TargetComputers -and ($TargetComputers -isnot [System.Array])) {


_raw: $TargetComputers = Get-DomainController @DCSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose "[Find-DomainUserEvent] Querying for domain controllers in domain: $Domain"


_raw: if ($PSBoundParameters['Credential']) { $DCSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $DCSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $DCSearcherArguments['Domain'] = $Domain }


_raw: # if not -ComputerName is passed, query the current (or target) domain for domain controllers


_raw: # build the set of computers to enumerate


_raw: $TargetUsers = Get-DomainGroupMember @GroupSearcherArguments | Select-Object -ExpandProperty MemberName


_raw: if ($PSBoundParameters['Credential']) { $GroupSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $GroupSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $GroupSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $GroupSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $GroupSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $GroupSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['UserSearchBase']) { $GroupSearcherArguments['SearchBase'] = $UserSearchBase }


_raw: if ($PSBoundParameters['UserDomain']) { $GroupSearcherArguments['Domain'] = $UserDomain }


_raw: # otherwise we're querying a specific group


_raw: elseif ($PSBoundParameters['UserGroupIdentity'] -or (-not $PSBoundParameters['Filter'])) {


_raw: $TargetUsers = Get-DomainUser @UserSearcherArguments | Select-Object -ExpandProperty samaccountname


_raw: if ($PSBoundParameters['UserIdentity'] -or $PSBoundParameters['UserLDAPFilter'] -or $PSBoundParameters['UserSearchBase'] -or $PSBoundParameters['UserAdminCount']) {


_raw: if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['UserAdminCount']) { $UserSearcherArguments['AdminCount'] = $UserAdminCount }


_raw: if ($PSBoundParameters['UserSearchBase']) { $UserSearcherArguments['SearchBase'] = $UserSearchBase }


_raw: if ($PSBoundParameters['UserLDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $UserLDAPFilter }


_raw: if ($PSBoundParameters['UserDomain']) { $UserSearcherArguments['Domain'] = $UserDomain }


_raw: if ($PSBoundParameters['UserIdentity']) { $UserSearcherArguments['Identity'] = $UserIdentity }


_raw: [Parameter(ParameterSetName = 'ComputerName', Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: instead of in a threaded manner, using the alternate credential.


_raw: through every domain controller in the current domain, enumerating each DC in serial


_raw: Find user events mathing the specified GUID AND the specified TargetLogonId, searching


_raw: Find-DomainUserEvent -Delay 1 -Filter @{'LogonGuid'='b8458aa9-b36e-eaa1-96e0-4551000fdb19'; 'TargetLogonId' = '10238128'; 'op'='&'}


_raw: $cred = Get-Credential testlab\administrator


_raw: Find user events on the primary.testlab.local system where the event matches


_raw: 'primary.testlab.local | Find-DomainUserEvent -Filter @{'IpAddress'='192.168.52.200|192.168.52.201'}


_raw: domain controller using the alternate credential


_raw: Search for any user events matching the user 'john' on the 'secondary.dev.testlab.local'


_raw: Find-DomainUserEvent -ComputerName 'secondary.dev.testlab.local' -UserIdentity 'john'


_raw: $cred = Get-Credential dev\administrator


_raw: Search for any user events matching domain admins on every DC in the current domain.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: Switch. Stop hunting after finding after finding a target user.


_raw: for connection to the target computer(s).


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Switch. Search for users users with '(adminCount=1)' (meaning are/were privileged).


_raw: If any other user specifications are set, then UserGroupIdentity is ignored.


_raw: Specifies a group identity to query for target users, defaults to 'Domain Admins.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for target users.


_raw: Specifies an LDAP query string that is used to search for target users.


_raw: Specifies the domain to query for users to search for, defaults to the current domain.


_raw: Specifies one or more user identities to search for.


_raw: The maximum number of events (per host) to retrieve. Default of 5000.


_raw: The [DateTime] object representing the end of when to collect events.


_raw: The [DateTime] object representing the start of when to collect events.


_raw: and is 'or' by default, meaning at least one clause matches instead of all.


_raw: The 'op|operator|operation' clause can have '&', '|', 'and', or 'or',


_raw: A hashtable of PowerView.LogonEvent properties to filter for.


_raw: Specifies a domain to query for domain controllers to enumerate.


_raw: Specifies an explicit computer name to retrieve events from.


_raw: the results based on the targeting criteria.


_raw: the logon events for each using Get-DomainUserEvent, and filters


_raw: (default of the local domain) using Get-DomainController, enumerates


_raw: Enumerates all domain controllers from the specified -Domain


_raw: Required Dependencies: Get-DomainUser, Get-DomainGroupMember, Get-DomainController, Get-DomainUserEvent, New-ThreadedFunction


_raw: Author: Lee Christensen (@tifkin_), Justin Warner (@sixdub), Will Schroeder (@harmj0y)


_raw: Finds logon events on the current (or remote domain) for the specified users.


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-DomainProcess] Using threading with threads: $Threads"


_raw: Write-Verbose "[Find-DomainProcess] Target user found, returning early"


_raw: $Result = Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $TargetProcessName, $TargetUsers, $Credential


_raw: Write-Verbose "[Find-DomainProcess] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-DomainProcess] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-DomainProcess] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: elseif ($TargetUsers -Contains $Process.User) {


_raw: # if the session user is in the target list, display some output


_raw: if ($ProcessName -Contains $Process.ProcessName) {


_raw: # if we're hunting for a process name or comma-separated names


_raw: $Processes = Get-WMIProcess -ComputerName $TargetComputer -ErrorAction SilentlyContinue


_raw: $Processes = Get-WMIProcess -Credential $Credential -ComputerName $TargetComputer -ErrorAction SilentlyContinue


_raw: # and search for a specific process name


_raw: # try to enumerate all active processes on the remote host


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: Param($ComputerName, $ProcessName, $TargetUsers, $Credential)


_raw: # the host enumeration block we're using to enumerate all servers


_raw: $TargetUsers = Get-DomainGroupMember @GroupSearcherArguments | Select-Object -ExpandProperty MemberName


_raw: if ($PSBoundParameters['Credential']) { $GroupSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $GroupSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $GroupSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $GroupSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $GroupSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $GroupSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['UserSearchBase']) { $GroupSearcherArguments['SearchBase'] = $UserSearchBase }


_raw: if ($PSBoundParameters['UserDomain']) { $GroupSearcherArguments['Domain'] = $UserDomain }


_raw: $TargetUsers = Get-DomainUser @UserSearcherArguments | Select-Object -ExpandProperty samaccountname


_raw: elseif ($PSBoundParameters['UserIdentity'] -or $PSBoundParameters['UserLDAPFilter'] -or $PSBoundParameters['UserSearchBase'] -or $PSBoundParameters['UserAdminCount'] -or $PSBoundParameters['UserAllowDelegation']) {


_raw: $TargetProcessName = [String[]] @($TargetProcessName)


_raw: if ($TargetProcessName -isnot [System.Array]) {


_raw: throw '[Find-DomainProcess] No hosts found to enumerate'


_raw: Write-Verbose "[Find-DomainProcess] TargetComputers length: $($TargetComputers.Length)"


_raw: $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose '[Find-DomainProcess] Querying computers in the domain'


_raw: # first, build the set of computers to enumerate


_raw: if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['UserAdminCount']) { $UserSearcherArguments['AdminCount'] = $UserAdminCount }


_raw: if ($PSBoundParameters['UserSearchBase']) { $UserSearcherArguments['SearchBase'] = $UserSearchBase }


_raw: if ($PSBoundParameters['UserLDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $UserLDAPFilter }


_raw: if ($PSBoundParameters['UserDomain']) { $UserSearcherArguments['Domain'] = $UserDomain }


_raw: if ($PSBoundParameters['Domain']) { $UserSearcherArguments['Domain'] = $Domain }


_raw: if ($PSBoundParameters['UserIdentity']) { $UserSearcherArguments['Identity'] = $UserIdentity }


_raw: if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName }


_raw: if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack }


_raw: if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem }


_raw: if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter }


_raw: if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain }


_raw: if ($PSBoundParameters['Domain']) { $ComputerSearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Searches processes being run by 'domain admins' in the testlab.local using the specified alternate credentials.


_raw: Find-DomainProcess -Domain testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Searchings for instances of putty.exe running on the current domain.


_raw: Enumerates Windows 7 computers in dev.testlab.local and returns any processes being run by


_raw: Find-DomainProcess -UserAdminCount -ComputerOperatingSystem 'Windows 7*' -Domain dev.testlab.local


_raw: Searches for processes run by 'Domain Admins' by enumerating every computer in the domain.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: Switch. Stop hunting after finding after finding a target user.


_raw: for connection to the target domain and target systems.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Switch. Search for users users with '(adminCount=1)' (meaning are/were privileged).


_raw: If any other user specifications are set, then UserGroupIdentity is ignored.


_raw: Specifies a group identity to query for target users, defaults to 'Domain Admins.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for target users.


_raw: Specifies an LDAP query string that is used to search for target users.


_raw: Specifies the domain to query for users to search for, defaults to the current domain.


_raw: Specifies one or more user identities to search for.


_raw: Search for processes with one or more specific names.


_raw: Search computers in the specific AD Site name, wildcards accepted.


_raw: Search computers with a specific service pack, wildcards accepted.


_raw: Search computers with a specific operating system, wildcards accepted.


_raw: Switch. Search computer objects that have unconstrained delegation.


_raw: Specifies the LDAP source to search through for computers,


_raw: Specifies an LDAP query string that is used to search for computer objects.


_raw: Specifies the domain to query for computers, defaults to the current domain.


_raw: Specifies the domain to query for computers AND users, defaults to the current domain.


_raw: in the domain returned by Get-DomainComputer.


_raw: If -ComputerName is not passed, the default behavior is to enumerate all machines


_raw: Specifies an array of one or more hosts to enumerate, passable on the pipeline.


_raw: the underlying WMI commands used to enumerate the remote machines.


_raw: specified -ProcessName. If -Credential is passed, it is passed through to


_raw: searching for processes running under any target user contexts or with the


_raw: function enumerates any current processes running with Get-WMIProcess,


_raw: (default 'Domain Admins') with Get-DomainGroupMember. Then for each server the


_raw: using Get-DomainComputer, and queries the domain for users of a specified group


_raw: This function enumerates all machines on the current (or specified) domain


_raw: Required Dependencies: Get-DomainComputer, Get-DomainUser, Get-DomainGroupMember, Get-WMIProcess, New-ThreadedFunction


_raw: Thanks to @paulbrandau for the approach idea.


_raw: that match a particular user specification or process name.


_raw: Searches for processes on the domain using WMI, returning processes


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-DomainUserLocation] TargetComputers length: $($TargetComputers.Length)"


_raw: Write-Verbose "[Find-DomainUserLocation] Using threading with threads: $Threads"


_raw: Write-Verbose "[Find-DomainUserLocation] Target user found, returning early"


_raw: Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $TargetUsers, $CurrentUser, $Stealth, $LogonToken


_raw: Write-Verbose "[Find-DomainUserLocation] Enumerating server $Computer ($Counter of $($TargetComputers.Count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-DomainUserLocation] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-DomainUserLocation] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: $UserLocation | Add-Member Noteproperty 'LocalAdmin' $Null


_raw: $UserLocation | Add-Member Noteproperty 'LocalAdmin' $Admin.IsAdmin


_raw: $Admin = Test-AdminAccess -ComputerName $TargetComputer


_raw: # see if we're checking to see if we have local admin access on this machine


_raw: $UserLocation | Add-Member Noteproperty 'SessionFromName' $Null


_raw: $UserLocation | Add-Member Noteproperty 'SessionFrom' $Null


_raw: $UserLocation | Add-Member Noteproperty 'IPAddress' $IPAddress


_raw: $UserLocation | Add-Member Noteproperty 'ComputerName' $TargetComputer


_raw: $UserLocation | Add-Member Noteproperty 'UserName' $UserName


_raw: $UserLocation | Add-Member Noteproperty 'UserDomain' $UserDomain


_raw: $IPAddress = @(Resolve-IPAddress -ComputerName $TargetComputer)[0].IPAddress


_raw: if ( (-not $TargetUsers) -or ($TargetUsers -contains $UserName) -and ($UserName -notmatch '\$$')) {


_raw: if (($UserName) -and ($UserName.trim() -ne '')) {


_raw: $LoggedOn = Get-NetLoggedon -ComputerName $TargetComputer


_raw: # if we're not 'stealthy', enumerate loggedon users as well


_raw: $Admin = (Test-AdminAccess -ComputerName $CName).IsAdmin


_raw: $UserLocation | Add-Member NoteProperty 'SessionFromName' $Null


_raw: $UserLocation | Add-Member NoteProperty 'SessionFromName' $CnameDNSName


_raw: $CNameDNSName = [System.Net.Dns]::GetHostEntry($CName) | Select-Object -ExpandProperty HostName


_raw: # try to resolve the DNS hostname of $Cname


_raw: $UserLocation | Add-Member Noteproperty 'SessionFrom' $CName


_raw: $UserLocation | Add-Member Noteproperty 'UserDomain' $Null


_raw: if ( (-not $TargetUsers) -or ($TargetUsers -contains $UserName)) {


_raw: if (($UserName) -and ($UserName.Trim() -ne '') -and ($UserName -notmatch $CurrentUser) -and ($UserName -notmatch '\$$')) {


_raw: # make sure we have a result, and ignore computer$ sessions


_raw: if ($CName -and $CName.StartsWith('\\')) {


_raw: $Sessions = Get-NetSession -ComputerName $TargetComputer


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet


_raw: # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation


_raw: Param($ComputerName, $TargetUsers, $CurrentUser, $Stealth, $TokenHandle)


_raw: # the host enumeration block we're using to enumerate all servers


_raw: throw '[Find-DomainUserLocation] No users found to target'


_raw: if ((-not $ShowAll) -and ($TargetUsers.Length -eq 0)) {


_raw: Write-Verbose "[Find-DomainUserLocation] TargetUsers length: $($TargetUsers.Length)"


_raw: $TargetUsers = Get-DomainGroupMember @GroupSearcherArguments | Select-Object -ExpandProperty MemberName


_raw: if ($PSBoundParameters['Credential']) { $GroupSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $GroupSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $GroupSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $GroupSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $GroupSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $GroupSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['UserSearchBase']) { $GroupSearcherArguments['SearchBase'] = $UserSearchBase }


_raw: if ($PSBoundParameters['UserDomain']) { $GroupSearcherArguments['Domain'] = $UserDomain }


_raw: $TargetUsers = Get-DomainUser @UserSearcherArguments | Select-Object -ExpandProperty samaccountname


_raw: elseif ($PSBoundParameters['UserIdentity'] -or $PSBoundParameters['UserLDAPFilter'] -or $PSBoundParameters['UserSearchBase'] -or $PSBoundParameters['UserAdminCount'] -or $PSBoundParameters['UserAllowDelegation']) {


_raw: # get the current user so we can ignore it in the results


_raw: throw '[Find-DomainUserLocation] No hosts found to enumerate'


_raw: Write-Verbose "[Find-DomainUserLocation] TargetComputers length: $($TargetComputers.Length)"


_raw: $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose '[Find-DomainUserLocation] Querying for all computers in the domain'


_raw: if ($DomainControllers -isnot [System.Array]) { $DomainControllers = @($DomainControllers) }


_raw: $DomainControllers = Get-DomainController @DCSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: if ($PSBoundParameters['Credential']) { $DCSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $DCSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerDomain']) { $DCSearcherArguments['Domain'] = $ComputerDomain }


_raw: if ($PSBoundParameters['Domain']) { $DCSearcherArguments['Domain'] = $Domain }


_raw: Write-Verbose '[Find-DomainUserLocation] Querying for domain controllers'


_raw: # $ComputerName += Get-DomainDFSShare -Domain $Domain -Server $DomainController | ForEach-Object {$_.RemoteServerName}


_raw: # # TODO: fix the passed parameters to Get-DomainDFSShare


_raw: Write-Verbose '[Find-DomainUserLocation] Querying for DFS servers'


_raw: if ($FileServers -isnot [System.Array]) { $FileServers = @($FileServers) }


_raw: $FileServers = Get-DomainFileServer @FileServerSearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $FileServerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $FileServerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $FileServerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $FileServerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $FileServerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $FileServerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $FileServerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerDomain']) { $FileServerSearcherArguments['Domain'] = $ComputerDomain }


_raw: if ($PSBoundParameters['Domain']) { $FileServerSearcherArguments['Domain'] = $Domain }


_raw: Write-Verbose '[Find-DomainUserLocation] Querying for file servers'


_raw: $TargetComputerArrayList = New-Object System.Collections.ArrayList


_raw: Write-Verbose "[Find-DomainUserLocation] Stealth enumeration using source: $StealthSource"


_raw: # first, build the set of computers to enumerate


_raw: if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['UserAllowDelegation']) { $UserSearcherArguments['AllowDelegation'] = $UserAllowDelegation }


_raw: if ($PSBoundParameters['UserAdminCount']) { $UserSearcherArguments['AdminCount'] = $UserAdminCount }


_raw: if ($PSBoundParameters['UserSearchBase']) { $UserSearcherArguments['SearchBase'] = $UserSearchBase }


_raw: if ($PSBoundParameters['UserLDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $UserLDAPFilter }


_raw: if ($PSBoundParameters['UserDomain']) { $UserSearcherArguments['Domain'] = $UserDomain }


_raw: if ($PSBoundParameters['Domain']) { $UserSearcherArguments['Domain'] = $Domain }


_raw: if ($PSBoundParameters['UserIdentity']) { $UserSearcherArguments['Identity'] = $UserIdentity }


_raw: if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName }


_raw: if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack }


_raw: if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem }


_raw: if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter }


_raw: if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain }


_raw: if ($PSBoundParameters['Domain']) { $ComputerSearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('DFS', 'DC', 'File', 'All')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Searches for domain admin locations in the testlab.local using the specified alternate credentials.


_raw: Find-DomainUserLocation -Domain testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Enumerates Windows 7 computers in dev.testlab.local and returns user results for privileged


_raw: Find-DomainUserLocation -UserAdminCount -ComputerOperatingSystem 'Windows 7*' -Domain dev.testlab.local


_raw: Enumerates likely highly-trafficked servers, performs just session enumeration


_raw: Searches for 'Domain Admins' by enumerating every computer in the domain.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: 'DC' (domain controllers), 'File' (file servers), or 'All' (the default).


_raw: The source of target servers to use, 'DFS' (distributed file servers),


_raw: Switch. Only enumerate sessions from connonly used target servers.


_raw: Switch. Return all user location results instead of filtering based on target


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: Switch. Stop hunting after finding after finding a target user.


_raw: for connection to the target domain and target systems.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Switch. Check if the current user has local admin access to computers where target users are found.


_raw: Switch. Search for user accounts that are not marked as 'sensitive and not allowed for delegation'.


_raw: Switch. Search for users users with '(adminCount=1)' (meaning are/were privileged).


_raw: If any other user specifications are set, then UserGroupIdentity is ignored.


_raw: Specifies a group identity to query for target users, defaults to 'Domain Admins.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for target users.


_raw: Specifies an LDAP query string that is used to search for target users.


_raw: Specifies the domain to query for users to search for, defaults to the current domain.


_raw: Specifies one or more user identities to search for.


_raw: Search computers in the specific AD Site name, wildcards accepted.


_raw: Search computers with a specific service pack, wildcards accepted.


_raw: Search computers with a specific operating system, wildcards accepted.


_raw: Switch. Search computer objects that have unconstrained delegation.


_raw: Specifies the LDAP source to search through for computers,


_raw: Specifies an LDAP query string that is used to search for computer objects.


_raw: Specifies the domain to query for computers, defaults to the current domain.


_raw: Specifies the domain to query for computers AND users, defaults to the current domain.


_raw: in the domain returned by Get-DomainComputer.


_raw: If -ComputerName is not passed, the default behavior is to enumerate all machines


_raw: Specifies an array of one or more hosts to enumerate, passable on the pipeline.


_raw: before enumeration, reverting after with Invoke-RevertToSelf.


_raw: then Invoke-UserImpersonation is used to impersonate the specified user


_raw: enumeration is executed only against those servers. If -Credential is passed,


_raw: are enumerated with Get-DomainFileServer/Get-DomainController, and session


_raw: the filtered set. If -Stealth is specified, then likely highly-trafficed servers


_raw: displayed. If -ShowAll is specified, all results are displayed instead of


_raw: The found user list is compared against the target list, and any matches are


_raw: function enumerates any active user sessions with Get-NetSession/Get-NetLoggedon


_raw: (default 'Domain Admins') with Get-DomainGroupMember. Then for each server the


_raw: using Get-DomainComputer, and queries the domain for users of a specified group


_raw: This function enumerates all machines on the current (or specified) domain


_raw: Required Dependencies: Get-DomainFileServer, Get-DomainDFSShare, Get-DomainController, Get-DomainComputer, Get-DomainUser, Get-DomainGroupMember, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetSession, Test-AdminAccess, Get-NetLoggedon, Resolve-IPAddress, New-ThreadedFunction


_raw: Finds domain machines where specific users are logged into.


_raw: Write-Verbose "[New-ThreadedFunction] all threads completed"


_raw: for ($i=0; $i -lt $SleepSeconds; $i++) {


_raw: # cleanup- make sure we didn't miss anything


_raw: Write-Verbose "[New-ThreadedFunction] Waiting $SleepSeconds seconds for final cleanup..."


_raw: While (($Jobs | Where-Object { -not $_.Result.IsCompleted }).Count -gt 0)


_raw: # continuously loop through each job queue, consuming output as appropriate


_raw: Write-Verbose "[New-ThreadedFunction] Threads executing"


_raw: Result = $Method.Invoke($PowerShell, @($Null, [Management.Automation.PSDataCollection[Object]]$Output))


_raw: # kick off execution using the BeginInvok() method that allows queues


_raw: $Output = New-Object Management.Automation.PSDataCollection[Object]


_raw: $Null = $PowerShell.AddParameter($Param.Name, $Param.Value)


_raw: ForEach ($Param in $ScriptParameters.GetEnumerator()) {


_raw: $Null = $PowerShell.AddScript($ScriptBlock).AddParameter('ComputerName', $ComputerNamePartition)


_raw: # add the script block + arguments with the given computer partition


_raw: ForEach ($ComputerNamePartition in $ComputerNamePartitioned) {


_raw: Write-Verbose "[New-ThreadedFunction] Total number of threads/partitions: $Threads"


_raw: $List = New-Object System.Collections.ArrayList


_raw: if ($Threads -ge $ComputerName.Length) {


_raw: # partition all hosts from -ComputerName into $Threads number of groups


_raw: Write-Verbose "[New-ThreadedFunction] Total number of hosts: $($ComputerName.count)"


_raw: $ComputerName = $ComputerName | Where-Object {$_ -and $_.Trim()}


_raw: $Method = $M.MakeGenericMethod([Object], [Object])


_raw: if (($MethodParameters.Count -eq 2) -and $MethodParameters[0].Name -eq 'input' -and $MethodParameters[1].Name -eq 'output') {


_raw: ForEach ($M in [PowerShell].GetMethods() | Where-Object { $_.Name -eq 'BeginInvoke' }) {