Monday, March 14, 2011

Powershell: Remote Non-WMI auditing of Windows permissions

The following scripts and information can be used to audit Administrator privileges on local servers in Windows domain and non-Domain environments. These scripts require sufficient privileges on each of the servers to be audited.

Helpful ways of manipulating data in Excel

http://support.microsoft.com/kb/213889

Perform a FIND from the RIGHT hand side in Excel:
=IFERROR(RIGHT(E113406,LEN(E113406)-FIND("^^^^^",SUBSTITUTE(E113406,":","^^^^^",LEN(E113406)-LEN(SUBSTITUTE(E113406,":",""))))),E113406)

Remove the extra domain name "\" that the non-WMI audit of local servers currently puts even though it is returninig a local group.
=IFERROR(IF(FIND("\",SUBSTITUTE(B31876,"\","b",1))>0,RIGHT(B31876,LEN(B31876)-FIND("\",SUBSTITUTE(B31876,"\","b",2))),"False"),B31876)

1 comment:

  1. Maybe I'm missing something, but I can't find the scripts mentioned in the first part of this blog post.

    Can you provide a link to them as I would find them very useful.

    ReplyDelete