Hello
I have 2 arrays.
1 is Users (actually they are local admins on a server) aka $LocalAdmins
Jack
Joe
Jill
The other array contains 3 columns, one of which is usernames aka $NTResults
User Last Write Time Last Access Time
James 1/1/2011 12:00:00am 1/2/2011 12:01:00am
Joe 2/3/2033 12:02am 3/4/5030 9:01:am
I want take each user in the $LocalAdmins and search through the $NTResults array for that user. if i find that user, i need to retrieve that entire line, user, last write time, last access time.
Ideas?
Thanks!
This is an example of the entire script. Will work on 2k8/7
$NTResults = @(); $ErrorActionPreference = "silentlycontinue" $server = "LocalHost" #------------------ Check for last logins ---------------# $UserLookup = Get-ChildItem "\\$server\C$\users\*\ntuser.dat" -Force #| select @{e={(Split-path $_.Directory -Leaf)}},lastAccessTime,LastWriteTime | sort lastwritetime -Descending foreach ($User in $UserLookup) { $UserName = (split-path $User.Directory -leaf) #Populate Object $obj = @{ User = $Username LastAccessTime = $User.LastAccessTime LastWriteTime = $User.LastWriteTime } $NTResults += New-Object psobject -Property $obj } $NTResults | select user,LastWriteTime,LastAccessTime | sort LastWriteTime #------------Lookup local admins---------------# $LocalAdmins = Gwmi win32_groupuser –computer $server $LocalAdmins = $LocalAdmins |? {$_.groupcomponent –like '*"Administrators"'} $LocalAdmins = $LocalAdmins |% { $_.partcomponent –match “.+Domain\=(.+)\,Name\=(.+)$” > $nul $matches[1].trim('"') + “\” + $matches[2].trim('"') } #Trim DOMAIN\ from LocalUserAdmins $LocalAdmins = $LocalAdmins -creplace '^[^\\]*\\', '' #Arrys to populate and split users from groups $LocalUsers = @() $LocalGroups =@() foreach ($LocalAdmin in $LocalAdmins) { if (dsquery user -samid $LocalAdmin) {$LocalUsers += $LocalAdmin} elseif (dsquery group -samid $LocalAdmin) {$LocalGroups += $LocalAdmin} }