Hi
I've enabled Active Directory Gateway Management Services on our 2003 domain I can now Powershell AD objects :-)
First task of the day.
Aim: determine which services on our servers are authenticating with the Domain Admin password. Yeah, some people have been naughty.
I'm a PS noob, but some time ago obtained a BSc in Computer Science, so can understand the principles of coding, but don't do much these days. Thus far I've spent my first few proper hours this afternoon with PS and cobbled together the following
# Load the MS Active Directory cmdlets Import-Module activedirectory # Get a list of computers in the two Servers OU (must sort that out) Get-ADcomputer -LDAPFilter "(name=*)" -SearchScope Subtree -SearchBase "ou=servers,ou=gloucester,DC=domain,dc=co,dc=uk" | foreach-object {$_.Name} | Out-File c:\scripts\servers.txt Get-ADcomputer -LDAPFilter "(name=*)" -SearchScope Subtree -SearchBase "ou=servers,ou=machines,ou=gloucester,DC=domain,dc=co,dc=uk" | foreach-object {$_.Name} | Out-File c:\scripts\servers.txt -Append # If output file already exists then remove it If (Test-Path -Path "C:\scripts\audit.txt") {Remove-Item "C:\scripts\audit.txt"} $compArray = get-content C:\Scripts\Servers.txt foreach($strComputer in $compArray) { write-output "Checking $strComputer for domain\Administrator" | Out-File "C:\scripts\audit.txt" -Append Get-WMIObject Win32_Service -ComputerName $strComputer | Where-Object {$_.StartName -eq 'domain\Administrator'} | Format-List Name, StartName | Out-File "C:\scripts\audit.txt" -Append write-output "Checking $strComputer for Administrator@domain.co.uk" | Out-File "C:\scripts\audit.txt" -Append Get-WMIObject Win32_Service -ComputerName $strComputer | Where-Object {$_.StartName -eq 'Administrator@domain.co.uk'} | Format-List Name, StartName | Out-File "C:\scripts\audit.txt" -Append }
That works for what can be contacted. However I need to handle this:
Get-WmiObject : The RPC server is unavailable. (Exception from HRESULT: 0x80070
BA)
t C:\scripts\wipservices.ps1:17 char:14
Get-WMIObject <<<< Win32_Service -ComputerName $strComputer | Where-Object {
_.StartName -eq 'Administrator@impello.co..uk'} | Format-List Name, StartName
Out-File "C:\scripts\audit.txt" -Append
+ CategoryInfo : InvalidOperation: (:) [Get-WmiObject], COMExcept
ion
+ FullyQualifiedErrorId : GetWMICOMException,Microsoft.PowerShell.Commands
.GetWmiObjectCommand
I found this link which tantalisingly leads me to Test-Port. But by gad me head hurts now! :-)
Ideally, I need to port 135 test each server in the text file, perhaps strip out the failing to a log and only run a get-wmiobject against each verified server object? I can't see how to return a false condition against Test-Port though. Am I barking up the wrong tree? Any worked solutions too would be very much appreciated. Need to learn and loving it so far :) Good task to set myself, huh?