![]() There may have been better ways to accomplish the same goal, but I found this way to do exactly what I wanted to in a short amount of time. You can of course pipe this into Export-CSV if you want so you have a nice spreadsheet to view. ? So with that, you can easily run this against your enterprise and have the data you need. ![]() Much nicer than a sequential run through all systems. $SIDs = $rootkey.GetSubKeyNames() | Where " -f $Computer,$_.Exception.Message)Īs I mentioned before, since I elected to use runspaces again, I was able to run through around 4000 systems in a couple hours. $rootkey = ::OpenRemoteBaseKey("Users",$computer) With that now decided, I had to figure out the best way to accomplish this goal.īecause this would be used to query some 4000 systems, I decided to use runspaces again to handle several jobs at a given time to greatly speed up the query.īecause I am querying the registry remotely on the HKEY_Users key, I need something that can translate the SIDs to a friendly username that can be read. In this case, I went with the workstation registry query because I wasn’t confident that the logs would have as many users as the workstations would.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. Archives
December 2022
Categories |