Skip to content

Commit 0faa131

Browse files
author
Josiah Ritchie
committed
Adding powershell scripts for local managment
1 parent 60dcc5d commit 0faa131

File tree

3 files changed

+183
-0
lines changed

3 files changed

+183
-0
lines changed

‎Create-LocalAdmin.ps1

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Import-Module ActiveDirectory
2+
. .\Set-LocalUser.ps1
3+
4+
$Workstations = Get-ADComputer -Filter { OperatingSystem -NotLike '*Server*' } -Properties OperatingSystem | Select -Expand DNSHostName
5+
$Servers = Get-ADComputer -Filter { OperatingSystem -Like '*Server*' } -Properties OperatingSystem | Select -Expand DNSHostName
6+
7+
Set-LocalUser -UserName OrgAdmin -Password "Secret" -PasswordNeverExpire -ComputerName $Servers -AddGroup Administrators -Description "Local Administrator for My Org" -Verbose

‎README.markdown

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,8 @@ This is a systemd startup script / unit script / service script or whatever syst
3333

3434
## list-all-cron-jobs.sh
3535
For that time when your developers can't answer what cron job is running at what time, perhaps a bunch of them are out of reach, and one of their jobs is potentially changing a bunch of permissions inappropriately or otherwise wreaking havoc on a regular basis upon your system. Track 'em down! (Thanks to yukondude for posting a bunch of this on http://stackoverflow.com/a/137173/264881.
36+
## Set-LocalUser.ps1
37+
Allows management of local user accounts on windows machines.
38+
39+
## Create-LocalAdmins.ps1
40+
Create local admin accounts on a selection of computers pulled from ActiveDirectory. Depends on Set-LocalUser.ps1

‎Set-LocalUser.ps1

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
Function Set-LocalUser {
2+
<#
3+
.SYNOPSIS
4+
Manage local user accounts on a computer or list of computers
5+
6+
.DESCRIPTION
7+
This is a function to be used as a part of managing Local User accounts. It can be called from other scripts so that it is available in the following way:
8+
. ./Set-LocalUser.ps1
9+
10+
Thanks to Reddit /u/Namaha, original author.
11+
https://www.reddit.com/r/PowerShell/comments/2eum4f/function_to_create_andor_manipulate_a_local_user/?st=iwf81nka&sh=14b6a0
12+
13+
.PARAMETER UserName
14+
This field is required and is assumed to be the first argument.
15+
.PARAMETER ComputerName
16+
A single computer name or list of names one per line. It can be populated from Active Directory by importing the proper module and running command as follows:
17+
18+
$Computers = Get-ADComputer -Filter { OperatingSystem -Like '*Server*' } -Properties OperatingSystem | Select -Expand DNSHostName
19+
20+
Then using this $Computers variable as the value of the -ComputerName parameter.
21+
.PARAMETER Password
22+
.PARAMETER Description
23+
What should the user description be set to
24+
.PARAMETER AddGroup
25+
Set the group names that the user should be added to.
26+
.PARAMETER Disable
27+
Disable the account
28+
.PARAMETER Enable
29+
Enable the account
30+
.PARAMETER Unlock
31+
Unlock the account
32+
.PARAMETER Remove
33+
Remove the account
34+
.PARAMETER PasswordNeverExpire
35+
Set no expiration date on the password
36+
.PARAMETER UserMustChangePassword
37+
Force the password to be changed when next logging in.
38+
.PARAMETER Verbose
39+
Provide verbose output of what is happening.
40+
.EXAMPLE Manage the Local Admin account for all servers on your Active Directory Domain
41+
42+
Import-Module ActiveDirectory
43+
. .\Set-LocalUser.ps1
44+
45+
$Computers = Get-ADComputer -Filter { OperatingSystem -Like '*Server*' } -Properties OperatingSystem | Select -Expand DNSHostName
46+
echo $Computers
47+
48+
Set-LocalUser -UserName MyAdmin -Password "S3c437" -PasswordNeverExpire -ComputerName $Computers -AddGroup Administrators -Verbose
49+
50+
.EXAMPLE
51+
Set-LocalUser -UserName MyAdmin -Remove
52+
53+
.EXAMPLE
54+
# USAGE Example:
55+
56+
# Add a "TestAdmin" account to a list of computers and add to the local Administrators group
57+
58+
$serverList = get-content "C:\servers.txt"
59+
Set-LocalUser "TestAdmin" -Password "Password123" -ComputerName $serverList -AddGroup "Administrators"
60+
.EXAMPLE
61+
62+
# Disable local machine's "TestUser" account.
63+
64+
Set-LocalUser "TestUser" -Disable
65+
66+
.NOTES
67+
Must be run with Administrative credentials
68+
#>
69+
70+
[CmdletBinding(SupportsShouldProcess=$true)]
71+
param
72+
(
73+
[Parameter(Mandatory=$True,Position=1)]
74+
[string[]]$UserName,
75+
[Parameter(Mandatory=$False)]
76+
[string[]]$ComputerName,
77+
[Parameter(Mandatory=$False)]
78+
[string]$Password,
79+
[Parameter(Mandatory=$False)]
80+
[string]$Description,
81+
[Parameter(Mandatory=$False)]
82+
[string[]]$AddGroup,
83+
84+
[Switch]$Disable,
85+
[Switch]$Enable,
86+
[Switch]$Unlock,
87+
[Switch]$Remove,
88+
[Switch]$PasswordNeverExpire,
89+
[Switch]$UserMustChangePassword
90+
)
91+
92+
#If the $computerName parameter is omitted, default to the current machine
93+
if(!$ComputerName) {
94+
$ComputerName = $env:COMPUTERNAME
95+
}
96+
97+
foreach($server in $ComputerName) {
98+
Write-Verbose "---------------------------------------"
99+
Write-Output "Starting on $server"
100+
101+
foreach($UID in $UserName) {
102+
Write-Verbose "User: $UID"
103+
104+
#gets computer info for $server
105+
$computer = [ADSI]"WinNT://$server,computer"
106+
107+
#removes the user
108+
if($Remove -and $pscmdlet.ShouldProcess("$Server","Remove user `"$UID`"")) {
109+
$computer.delete("user",$UID)
110+
Write-Verbose "Removed Account"
111+
continue
112+
}
113+
114+
#creates the user if it does not already exist
115+
if(![ADSI]::Exists("WinNT://$server/$UID") -and $pscmdlet.ShouldProcess("$Server","Create user `"$UID`"")){
116+
$user = $computer.Create("user", $UID)
117+
$user.SetPassword($Password)
118+
$user.Setinfo()
119+
}
120+
else {
121+
$user = [ADSI]"WinNT://$server/$UID"
122+
Write-Verbose "Account Already Exists"
123+
}
124+
125+
if($Password -and $pscmdlet.ShouldProcess("$Server","Set Password of `"$UID`"")) {
126+
$user.SetPassword($Password)
127+
$user.Setinfo()
128+
}
129+
130+
if($Description -and $pscmdlet.ShouldProcess("$Server","Set Description `"$Description`" for user `"$UID`"")) {
131+
$user.description = $Description
132+
$user.setinfo()
133+
}
134+
135+
if($UserMustChangePassword -and $pscmdlet.ShouldProcess("$Server","Force user `"$UID`" to change password on next login")) {
136+
$user.PasswordExpired = 1
137+
$user.Setinfo()
138+
}
139+
140+
if($Enable -and $pscmdlet.ShouldProcess("$Server","Enable user `"$UID`"")) {
141+
$user.userflags = 512
142+
$user.SetInfo()
143+
}
144+
145+
if($Disable -and $pscmdlet.ShouldProcess("$Server","Disable user `"$UID`"")) {
146+
#Disables the user
147+
$user.userflags.value = $user_acc.userflags.value -bor "0x0002"
148+
$user.SetInfo()
149+
}
150+
151+
if($Unlock -and $pscmdlet.ShouldProcess("$Server","Unlock user `"$UID`"")) {
152+
$user.IsAccountLocked = $False
153+
$user.SetInfo()
154+
}
155+
156+
if($PasswordNeverExpire -and $pscmdlet.ShouldProcess("$Server","Set password for `"$UID`" to never expire")) {
157+
#sets user's password to never expire
158+
$user.UserFlags.value = $user.UserFlags.value -bor 0x10000
159+
$user.CommitChanges()
160+
}
161+
162+
#adds user to local group(s)
163+
if($AddGroup -and $pscmdlet.ShouldProcess("$Server","Add user `"$UID`" to $AddGroup group")) {
164+
foreach($group in $AddGroup) {
165+
$objGroup = [ADSI]("WinNT://$server/$Group")
166+
$objGroup.PSBase.Invoke("Add",$user.PSBase.Path)
167+
}
168+
}
169+
}
170+
}
171+
}

0 commit comments

Comments
 (0)