如何解决Powershell如何导入ADusers.csv并获取登录ComputerName.csv的列表导出
美好的一天，
Import-CSV -Path 'C:\Users\user\Desktop\U1.csv' |
Select -expand Name | Get-ADComputer -prop modifyTimeStamp | Select Name,ModifyTimeStamp
U1是LogOnName-用户列表，该列表需要登录PC名称。
我做错了什么？
解决方法
我发现this脚本可以满足您的需求，尽管dns解析度无法正常工作，因此我对该脚本进行了一些修改，以便可以正确解析设备主机名。这是修改后的代码：
<#
.SYNOPSIS
Script that will list the logon information of AD users.
.DESCRIPTION
This script will list the AD users logon information with their logged on computers by inspecting the Kerberos TGT Request
Events(EventID 4768) from domain controllers. Not Only User account Name is fetched,but also users OU path and Computer
Accounts are retrieved. You can also list the history of last logged on users. In Environment where Exchange Servers are
used,the exchange servers authentication request for users will also be logged since it also uses EventID (4768) to for
TGT Request. You can also export the result to CSV file format. Powershell version 3.0 is needed to use the script.
You can Define the following parameters to suite your need:
-MaxEvent Specify the number of all (4768) events to search for TGT Requests. Default is 1000.
-LastLogonOnly Display only the history of last logon users.
-OuOnly Do not display the full path of users/computers. Only OU is displayed.
Author: phyoepaing3.142@gmail.com
Country: Myanmar(Burma)
Released Date: 08/29/2016
Example usage:
.\Get_AD_Users_Logon_History.ps1 -MaxEvent 800 -LastLogonOnly -OuOnly
.EXAMPLE
.\Get_AD_Users_Logon_History.ps1 | Format-Table * -Auto
This command will retrieve AD users logon within default 1000 EventID-4768 events and display the results as table.
.EXAMPLE
.\Get_AD_Users_Logon_History.ps1 -MaxEvent 500 -LastLogonOnly -OuOnly
This command will retrieve AD users logon within 500 EventID-4768 events and show only the last logged users with their
related logged on computers. Only OU name is displayed in results.
.EXAMPLE
.\Get_AD_Users_Logon_History.ps1 | Export-Csv Users_Loggedon_History.csv
This command will retrieve AD users logon within default 1000 EventID-4768 events and export the result to CSV file.
.PARAMETER MaxEvent
This paraemeter will specify the number of EventID-4768 events to look for.
.PARAMETER LastLogonOnly
This paraemeter will display the history of last logged on users in descending order.
.PARAMETER OuOnly
This paraemeter will show only the OU names for users/computers but not the full path.
.LINK
You can find this script and more at: https://www.sysadminplus.blogspot.com/
#>
param( [switch]$LastLogonOnly,[switch]$OuOnly,[int]$MaxEvent=1000)
############## Find EventID 4768 with user's requesting Kerberos TGT,skipping Exchange Health Mailbox request and extracting Users/Client names,IP Addresses ####
$Domain = (Get-WmiObject Win32_Computersystem).domain
$read_log={
Param ($MaxEvent,$OuOnly,$Domain) ## Define parameter to pass maxevent to scripblock
$EventInfo=Get-WinEvent -FilterHashTable @{LogName="Security";ID=4768} -MaxEvents 200000 | select -first $MaxEvent | where {$_.Message -notmatch "SM_" } | where { $_.Message -notmatch "\$" } |
select @{N="Authenticated DC";Exp={$_.MachineName}},@{N="LoggedOn Time";Exp={$_.TimeCreated}},@{N="User"; Exp={ $SplitAccountName=(($_.Message -Split "\n") -match "Account Name") -split ':';$SplitAccountName[$SplitAccountName.Length-1].Trim() }},@{N="User Location";Exp={}},@{N="Workstation";Exp={}},@{N="IP Address"; Exp={if((($_.Message -split "\n") -match "Client Address:").Trim() -match "::1" ) {"localhost"}
else { $SplitClientAddress=(($_.Message -Split "\n") -match "Client Address") -split ':'; $splitClientAddress[$splitClientAddress.Length-1].Trim() }}},@{N="Computer Location";Exp={}}
$EventInfo | foreach {
$IPAddress=$_."Client Address"
if ($_."IP Address" -eq "localhost")
{ $Client_Name=[system.net.dns]::GetHostbyName($env:computername).hostname }
else
{
###### Resolve the PTR record to find AD computer information ################
#$Client_Name=(Resolve-DnsName $_."IP Address").NameHost
Try
{
$Client_name = ([System.Net.Dns]::GetHostByAddress($_."IP Address")).hostname
}
Catch
{
$Client_Name = "Not Found"
}
}
## $_."Authenticated DC"=($_."Authenticated DC" -split "."+$Domain)[0] ##Uncomment this line if you want to strip off domain name in "Authenticated DC" list
$user=$_.user
############# Find the User account in AD and if not found,throw and exception ###########
$Full_User_Property=0
Try ## Need Try statement to test and surpress error
{
$Full_User_Property = (Get-AdUser $_.user -Properties *)
$_."User Location" = $Full_User_Property.CanonicalName.TrimStart($Domain).SubString(1)
}
catch
{ } ## The $_."User Location" is not passed to catch statement thus needing another below statement to set value"
If (!$Full_User_Property)
{ $_."User Location"="NOT FOUND" }
$Full_User_Property=0
If($OuOnly -AND ($_."User Location" -ne "NOT FOUND"))
{
$_."User Location"= $_."User Location".Remove($_."User Location".LastIndexOf("/")) ##Trim the last user name part if -OuOnly flag is set
}
$_."Workstation"=($Client_Name -split "."+$Domain)[0] ## remove the domain suffix
########## Find the Computer account in AD and if not found,throw an exception ###########
$Full_Workstation_Property = 0
Try
{
$Full_Workstation_Property = Get-AdComputer $_."Workstation" -Properties *
$_."Computer Location"= $Full_Workstation_Property.CanonicalName.TrimStart($Domain).SubString(1)
}
catch
{ }
########## Here the catch exception does not work in Invoke session so we need to manually set the "NOT FOUND" value ######
If (!$Full_Workstation_Property)
{ $_."Computer Location" = "NOT FOUND"}
$Full_Workstation_Property=0
If ($OuOnly -AND ($_."Computer Location" -ne "NOT FOUND")) ##Trim the last computer part if -OuOnly flag is set
{
$_."Computer Location"=$_."Computer Location".Remove($_."Computer Location".LastIndexOf("/"))
}
Return $_
}
}
########### Job starts to query replica domain controllers #############
$result=@()
$RemoteJob=@() ## Make array of remote jobs
$DomainControllers = (Get-ADDomainController -Filter { isGlobalCatalog -eq $true -or isGlobalCatalog -eq $false}).Name
############### Start the Local Job and Remote Job to find the event id ################
$LocalJobExists=0
If ($DomainControllers -contains $(hostname)) ## Check if the computer running the script is Domain Controller itself
{
$LocalJob = Start-Job -scriptblock $read_log -ArgumentList $MaxEvent,$Domain;$LocalJobExists=1 ## If so,start job to query local domain controller
}
$DomainControllers | where {$_ -ne $(hostname)} | foreach { ## Start remote jobs on each other domain controllers
$RemoteJob+= Invoke-Command -ComputerName $_ -ScriptBlock $read_log -ArgumentList $MaxEvent,$Domain -AsJob
}
If ($LocalJobExists)
{
$result = $LocalJob | Wait-Job | Receive-Job; Remove-Job $LocalJob ## If the computer running the script is not a domain controller(may be RSAT installed),then all jobs will be remote jobs
}
$RemoteJob | foreach { $result+=$_ | Wait-Job | Receive-Job ; Remove-Job $_} ## Wait and Receive remote jobs on each remote DCs and add to Local job result
If ($LastLogonOnly)
{
$result | Sort-Object "LoggedOn Time" -Descending | Group-Object User | foreach { $_ | Select -ExpandProperty Group | select * -First 1 -ExcludeProperty PsComputerName,RunSpaceID,PsShowComputerName } ## the Last LoggedOn time of Each User
}
else
{
$result | Sort-Object "LoggedOn Time" -Descending | Select * -ExcludeProperty PsComputerName,PsShowComputerName ## Normal Results
}
版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 dio@foxmail.com 举报，一经查实，本站将立刻删除。