Vista - Collecting information from Active Directory

Hello All,

I need to get a list of all computers in our Active Directory and the user
who last logged onto it. Has anyone got a sample script to help with this, or
at least some parts of it.....

Thanks in advance.

$root = {ADSI]"LDAP://ou=workstations,dc=somedomain,dc=net"
$computers = $root.psbase.get_children()
$computers | ft distinguishedname,operatingsystem

Those attributes I used as an example, there are others available on
computers. Unfortunately, you will not find the last logged on user
stored in AD, its just not in the design. For that you would have to
enable auditing on the workstation, and look through the security logs.

The script above connects to a specific OU and enumerates the objects
inside. Things to add is a LDAP filter to search for computer objects(
like (objectcategory=computer)), and maybe starting at the rootDSE
instead of a child OU and using .findall() to find computers.

james pogran

Glenn Wilson wrote:
> Hello All,
>
> I need to get a list of all computers in our Active Directory and the user
> who last logged onto it. Has anyone got a sample script to help with this, or
> at least some parts of it.....
>
> Thanks in advance.

Use following 4 lines to retrieve a list of computers in your AD. This will return all computers no matter what OU they are in.

$ldapQuery = "(&(objectCategory=computer))"
$de = new-object system.directoryservices.directoryentry
$ads = new-object system.directoryservices.directorysearcher -argumentlist $de,$ldapQuery
$complist = $ads.findall()

Now iterate through $complist and query the registry on each remote computer for last logged on user:

$complist | % {
$cn = $_.properties['cn']
$rk = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine,$cn)
$rv = $rk.opensubkey("\Software\Microsoft\Windows NT\CurrentVersion\WinLogon")
$lastuser = $rv.GetValue("DefaultDomainName") + "\" + $rv.GetValue("DefaultUserName")
write-host "$cn - $lastuser"
}

--

gaurhoth
http://gaurhothw.spaces.live.com/


"Glenn Wilson" <GlennWilson@discussions.microsoft.com> wrote in message news:42CD0DB7-6364-4D6E-8A43-E967A501CEF7@microsoft.com...
> Hello All,
>
> I need to get a list of all computers in our Active Directory and the user
> who last logged onto it. Has anyone got a sample script to help with this, or
> at least some parts of it.....
>
> Thanks in advance.

Thanks parts of it work, but I am geting the followig error with the script,
it runs collects the machines, then when it goes to read the registery I get
the following.

Exception calling "OpenRemoteBaseKey" with "2" argument(s): "The network
path was not found."
At E:\PowerShell\Scripts\get-computerlastlogon.ps1:8 char:59
+ $rk = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey( <<<<
[Microsoft.Win32.RegistryHive]::LocalMachine,$cn)
You cannot call a method on a null-valued expression.
At E:\PowerShell\Scripts\get-computerlastlogon.ps1:10 char:29
+ $lastuser = $rv.GetValue( <<<< "DefaultDomainName") + "\" +
$rv.GetValue("DefaultUserName")


"Gaurhoth" wrote:

> Use following 4 lines to retrieve a list of computers in your AD. This will return all computers no matter what OU they are in.
>
> $ldapQuery = "(&(objectCategory=computer))"
> $de = new-object system.directoryservices.directoryentry
> $ads = new-object system.directoryservices.directorysearcher -argumentlist $de,$ldapQuery
> $complist = $ads.findall()
>
> Now iterate through $complist and query the registry on each remote computer for last logged on user:
>
> $complist | % {
> $cn = $_.properties['cn']
> $rk = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine,$cn)
> $rv = $rk.opensubkey("\Software\Microsoft\Windows NT\CurrentVersion\WinLogon")
> $lastuser = $rv.GetValue("DefaultDomainName") + "\" + $rv.GetValue("DefaultUserName")
> write-host "$cn - $lastuser"
> }
>
> --
>
> gaurhoth
> http://gaurhothw.spaces.live.com/
>
>
> "Glenn Wilson" <GlennWilson@discussions.microsoft.com> wrote in message news:42CD0DB7-6364-4D6E-8A43-E967A501CEF7@microsoft.com...
> > Hello All,
> >
> > I need to get a list of all computers in our Active Directory and the user
> > who last logged onto it. Has anyone got a sample script to help with this, or
> > at least some parts of it.....
> >
> > Thanks in advance

I don't think PS supports remote registry access (yet).

As a workaround, you might be able to use the win32_Process Create method to
run regedit on the remote machine, export the key, and then parse the
username out of the .reg file.



"Glenn Wilson" wrote:

> Thanks parts of it work, but I am geting the followig error with the script,
> it runs collects the machines, then when it goes to read the registery I get
> the following.
>
> Exception calling "OpenRemoteBaseKey" with "2" argument(s): "The network
> path was not found."
> At E:\PowerShell\Scripts\get-computerlastlogon.ps1:8 char:59
> + $rk = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey( <<<<
> [Microsoft.Win32.RegistryHive]::LocalMachine,$cn)
> You cannot call a method on a null-valued expression.
> At E:\PowerShell\Scripts\get-computerlastlogon.ps1:10 char:29
> + $lastuser = $rv.GetValue( <<<< "DefaultDomainName") + "\" +
> $rv.GetValue("DefaultUserName")
>
>
> "Gaurhoth" wrote:
>
> > Use following 4 lines to retrieve a list of computers in your AD. This will return all computers no matter what OU they are in.
> >
> > $ldapQuery = "(&(objectCategory=computer))"
> > $de = new-object system.directoryservices.directoryentry
> > $ads = new-object system.directoryservices.directorysearcher -argumentlist $de,$ldapQuery
> > $complist = $ads.findall()
> >
> > Now iterate through $complist and query the registry on each remote computer for last logged on user:
> >
> > $complist | % {
> > $cn = $_.properties['cn']
> > $rk = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine,$cn)
> > $rv = $rk.opensubkey("\Software\Microsoft\Windows NT\CurrentVersion\WinLogon")
> > $lastuser = $rv.GetValue("DefaultDomainName") + "\" + $rv.GetValue("DefaultUserName")
> > write-host "$cn - $lastuser"
> > }
> >
> > --
> >
> > gaurhoth
> > http://gaurhothw.spaces.live.com/
> >
> >
> > "Glenn Wilson" <GlennWilson@discussions.microsoft.com> wrote in message news:42CD0DB7-6364-4D6E-8A43-E967A501CEF7@microsoft.com...
> > > Hello All,
> > >
> > > I need to get a list of all computers in our Active Directory and the user
> > > who last logged onto it. Has anyone got a sample script to help with this, or
> > > at least some parts of it.....
> > >
> > > Thanks in advance

My guess would be that you're receiving this error because the machine
you're trying to open the registry on is not currently available or is
not accessible for some other reason (security, firewall, etc). You can
tell the script to continue by either trapping the error or just
setting the global $ErrorActionPreference variable to
"SilentlyContinue" before running the script. This way, when the script
encounters a machine that it cannot reach it will just move onto the
next machine.

Tom G.
--



Glenn Wilson wrote:

> Thanks parts of it work, but I am geting the followig error with the
> script, it runs collects the machines, then when it goes to read the
> registery I get the following.
>
> Exception calling "OpenRemoteBaseKey" with "2" argument(s): "The
> network path was not found."
> At E:\PowerShell\Scripts\get-computerlastlogon.ps1:8 char:59
> + $rk = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey( <<<<
> [Microsoft.Win32.RegistryHive]::LocalMachine,$cn)
> You cannot call a method on a null-valued expression.
> At E:\PowerShell\Scripts\get-computerlastlogon.ps1:10 char:29
> + $lastuser = $rv.GetValue( <<<< "DefaultDomainName") + "\" +
> $rv.GetValue("DefaultUserName")
>
>
> "Gaurhoth" wrote:
>
> > Use following 4 lines to retrieve a list of computers in your AD.
> > This will return all computers no matter what OU they are in.
> >
> > $ldapQuery = "(&(objectCategory=computer))"
> > $de = new-object system.directoryservices.directoryentry
> > $ads = new-object system.directoryservices.directorysearcher
> > -argumentlist $de,$ldapQuery $complist = $ads.findall()
> >
> > Now iterate through $complist and query the registry on each remote
> > computer for last logged on user:
> >
> > $complist | % {
> > $cn = $_.properties['cn']
> > $rk =
> > [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.Re
> > gistryHive]::LocalMachine,$cn) $rv =
> > $rk.opensubkey("\Software\Microsoft\Windows
> > NT\CurrentVersion\WinLogon") $lastuser =
> > $rv.GetValue("DefaultDomainName") + "\" +
> > $rv.GetValue("DefaultUserName") write-host "$cn - $lastuser" }
> >
> > --
> >
> > gaurhoth
> > http://gaurhothw.spaces.live.com/
> >
> >
> > "Glenn Wilson" <GlennWilson@discussions.microsoft.com> wrote in
> > message news:42CD0DB7-6364-4D6E-8A43-E967A501CEF7@microsoft.com...
> > > Hello All,
> > >
> > > I need to get a list of all computers in our Active Directory and
> > > the user who last logged onto it. Has anyone got a sample script
> > > to help with this, or at least some parts of it.....
> > >
> > > Thanks in advance

PowerShell itself doesn't support remoting. However, the script is
using a .NET RegistryKey object that does support remotely accessing
another machine using the OpenRemoteBaseKey method. Think of it as .NET
picking up the slack for PowerShell

Tom G.
--



Rob Campbell wrote:

> I don't think PS supports remote registry access (yet).
>
> As a workaround, you might be able to use the win32_Process Create
> method to run regedit on the remote machine, export the key, and then
> parse the username out of the .reg file.
>
>
>
> "Glenn Wilson" wrote:
>
> > Thanks parts of it work, but I am geting the followig error with
> > the script, it runs collects the machines, then when it goes to
> > read the registery I get the following.
> >
> > Exception calling "OpenRemoteBaseKey" with "2" argument(s): "The
> > network path was not found."
> > At E:\PowerShell\Scripts\get-computerlastlogon.ps1:8 char:59
> > + $rk = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey( <<<<
> > [Microsoft.Win32.RegistryHive]::LocalMachine,$cn)
> > You cannot call a method on a null-valued expression.
> > At E:\PowerShell\Scripts\get-computerlastlogon.ps1:10 char:29
> > + $lastuser = $rv.GetValue( <<<< "DefaultDomainName") + "\" +
> > $rv.GetValue("DefaultUserName")
> >
> >
> > "Gaurhoth" wrote:
> >
> > > Use following 4 lines to retrieve a list of computers in your AD.
> > > This will return all computers no matter what OU they are in.
> > >
> > > $ldapQuery = "(&(objectCategory=computer))"
> > > $de = new-object system.directoryservices.directoryentry
> > > $ads = new-object system.directoryservices.directorysearcher
> > > -argumentlist $de,$ldapQuery $complist = $ads.findall()
> > >
> > > Now iterate through $complist and query the registry on each
> > > remote computer for last logged on user:
> > >
> > > $complist | % {
> > > $cn = $_.properties['cn']
> > > $rk =
> > > [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.
> > > RegistryHive]::LocalMachine,$cn) $rv =
> > > $rk.opensubkey("\Software\Microsoft\Windows
> > > NT\CurrentVersion\WinLogon") $lastuser =
> > > $rv.GetValue("DefaultDomainName") + "\" +
> > > $rv.GetValue("DefaultUserName") write-host "$cn - $lastuser" }
> > >
> > > --
> > >
> > > gaurhoth
> > > http://gaurhothw.spaces.live.com/
> > >
> > >
> > > "Glenn Wilson" <GlennWilson@discussions.microsoft.com> wrote in
> > > message news:42CD0DB7-6364-4D6E-8A43-E967A501CEF7@microsoft.com...
> > > > Hello All,
> > > >
> > > > I need to get a list of all computers in our Active Directory
> > > > and the user who last logged onto it. Has anyone got a sample
> > > > script to help with this, or at least some parts of it.....
> > > >
> > > > Thanks in advance

It does. Use it all the time...

It is possible the RemoteRegistry Service is unavailable or Server is not
pingable.. I always ping first.

I would
1) write out the $cn and make sure there is a valid computer name.
2) ping the server before connecting to reg

"Rob Campbell" <RobCampbell@discussions.microsoft.com> wrote in message
news:EAD6994E-E525-488B-A586-B9332381085A@microsoft.com...
>I don't think PS supports remote registry access (yet).
>
> As a workaround, you might be able to use the win32_Process Create method
> to
> run regedit on the remote machine, export the key, and then parse the
> username out of the .reg file.
>
>
>
> "Glenn Wilson" wrote:
>
>> Thanks parts of it work, but I am geting the followig error with the
>> script,
>> it runs collects the machines, then when it goes to read the registery I
>> get
>> the following.
>>
>> Exception calling "OpenRemoteBaseKey" with "2" argument(s): "The network
>> path was not found."
>> At E:\PowerShell\Scripts\get-computerlastlogon.ps1:8 char:59
>> + $rk = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey( <<<<
>> [Microsoft.Win32.RegistryHive]::LocalMachine,$cn)
>> You cannot call a method on a null-valued expression.
>> At E:\PowerShell\Scripts\get-computerlastlogon.ps1:10 char:29
>> + $lastuser = $rv.GetValue( <<<< "DefaultDomainName") + "\" +
>> $rv.GetValue("DefaultUserName")
>>
>>
>> "Gaurhoth" wrote:
>>
>> > Use following 4 lines to retrieve a list of computers in your AD. This
>> > will return all computers no matter what OU they are in.
>> >
>> > $ldapQuery = "(&(objectCategory=computer))"
>> > $de = new-object system.directoryservices.directoryentry
>> > $ads = new-object
>> > system.directoryservices.directorysearcher -argumentlist $de,$ldapQuery
>> > $complist = $ads.findall()
>> >
>> > Now iterate through $complist and query the registry on each remote
>> > computer for last logged on user:
>> >
>> > $complist | % {
>> > $cn = $_.properties['cn']
>> > $rk =
>> > [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine,$cn)
>> > $rv = $rk.opensubkey("\Software\Microsoft\Windows
>> > NT\CurrentVersion\WinLogon")
>> > $lastuser = $rv.GetValue("DefaultDomainName") + "\" +
>> > $rv.GetValue("DefaultUserName")
>> > write-host "$cn - $lastuser"
>> > }
>> >
>> > --
>> >
>> > gaurhoth
>> > http://gaurhothw.spaces.live.com/
>> >
>> >
>> > "Glenn Wilson" <GlennWilson@discussions.microsoft.com> wrote in message
>> > news:42CD0DB7-6364-4D6E-8A43-E967A501CEF7@microsoft.com...
>> > > Hello All,
>> > >
>> > > I need to get a list of all computers in our Active Directory and the
>> > > user
>> > > who last logged onto it. Has anyone got a sample script to help with
>> > > this, or
>> > > at least some parts of it.....
>> > >
>> > > Thanks in advance

Or better yet... Powershell utilizing the already provided power of .NET

"Tom G." <thomglow@lycos.com> wrote in message
news:uTKfieBMHHA.4912@TK2MSFTNGP02.phx.gbl...
> PowerShell itself doesn't support remoting. However, the script is
> using a .NET RegistryKey object that does support remotely accessing
> another machine using the OpenRemoteBaseKey method. Think of it as .NET
> picking up the slack for PowerShell
>
> Tom G.
> --
>
>
>
> Rob Campbell wrote:
>
>> I don't think PS supports remote registry access (yet).
>>
>> As a workaround, you might be able to use the win32_Process Create
>> method to run regedit on the remote machine, export the key, and then
>> parse the username out of the .reg file.
>>
>>
>>
>> "Glenn Wilson" wrote:
>>
>> > Thanks parts of it work, but I am geting the followig error with
>> > the script, it runs collects the machines, then when it goes to
>> > read the registery I get the following.
>> >
>> > Exception calling "OpenRemoteBaseKey" with "2" argument(s): "The
>> > network path was not found."
>> > At E:\PowerShell\Scripts\get-computerlastlogon.ps1:8 char:59
>> > + $rk = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey( <<<<
>> > [Microsoft.Win32.RegistryHive]::LocalMachine,$cn)
>> > You cannot call a method on a null-valued expression.
>> > At E:\PowerShell\Scripts\get-computerlastlogon.ps1:10 char:29
>> > + $lastuser = $rv.GetValue( <<<< "DefaultDomainName") + "\" +
>> > $rv.GetValue("DefaultUserName")
>> >
>> >
>> > "Gaurhoth" wrote:
>> >
>> > > Use following 4 lines to retrieve a list of computers in your AD.
>> > > This will return all computers no matter what OU they are in.
>> > >
>> > > $ldapQuery = "(&(objectCategory=computer))"
>> > > $de = new-object system.directoryservices.directoryentry
>> > > $ads = new-object system.directoryservices.directorysearcher
>> > > -argumentlist $de,$ldapQuery $complist = $ads.findall()
>> > >
>> > > Now iterate through $complist and query the registry on each
>> > > remote computer for last logged on user:
>> > >
>> > > $complist | % {
>> > > $cn = $_.properties['cn']
>> > > $rk =
>> > > [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.
>> > > RegistryHive]::LocalMachine,$cn) $rv =
>> > > $rk.opensubkey("\Software\Microsoft\Windows
>> > > NT\CurrentVersion\WinLogon") $lastuser =
>> > > $rv.GetValue("DefaultDomainName") + "\" +
>> > > $rv.GetValue("DefaultUserName") write-host "$cn - $lastuser" }
>> > >
>> > > --
>> > >
>> > > gaurhoth
>> > > http://gaurhothw.spaces.live.com/
>> > >
>> > >
>> > > "Glenn Wilson" <GlennWilson@discussions.microsoft.com> wrote in
>> > > message news:42CD0DB7-6364-4D6E-8A43-E967A501CEF7@microsoft.com...
>> > > > Hello All,
>> > > >
>> > > > I need to get a list of all computers in our Active Directory
>> > > > and the user who last logged onto it. Has anyone got a sample
>> > > > script to help with this, or at least some parts of it.....
>> > > >
>> > > > Thanks in advance

OK. My bad.

"Brandon Shell" wrote:

> It does. Use it all the time...
>
> It is possible the RemoteRegistry Service is unavailable or Server is not
> pingable.. I always ping first.
>
> I would
> 1) write out the $cn and make sure there is a valid computer name.
> 2) ping the server before connecting to reg
>
> "Rob Campbell" <RobCampbell@discussions.microsoft.com> wrote in message
> news:EAD6994E-E525-488B-A586-B9332381085A@microsoft.com...
> >I don't think PS supports remote registry access (yet).
> >
> > As a workaround, you might be able to use the win32_Process Create method
> > to
> > run regedit on the remote machine, export the key, and then parse the
> > username out of the .reg file.
> >
> >
> >
> > "Glenn Wilson" wrote:
> >
> >> Thanks parts of it work, but I am geting the followig error with the
> >> script,
> >> it runs collects the machines, then when it goes to read the registery I
> >> get
> >> the following.
> >>
> >> Exception calling "OpenRemoteBaseKey" with "2" argument(s): "The network
> >> path was not found."
> >> At E:\PowerShell\Scripts\get-computerlastlogon.ps1:8 char:59
> >> + $rk = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey( <<<<
> >> [Microsoft.Win32.RegistryHive]::LocalMachine,$cn)
> >> You cannot call a method on a null-valued expression.
> >> At E:\PowerShell\Scripts\get-computerlastlogon.ps1:10 char:29
> >> + $lastuser = $rv.GetValue( <<<< "DefaultDomainName") + "\" +
> >> $rv.GetValue("DefaultUserName")
> >>
> >>
> >> "Gaurhoth" wrote:
> >>
> >> > Use following 4 lines to retrieve a list of computers in your AD. This
> >> > will return all computers no matter what OU they are in.
> >> >
> >> > $ldapQuery = "(&(objectCategory=computer))"
> >> > $de = new-object system.directoryservices.directoryentry
> >> > $ads = new-object
> >> > system.directoryservices.directorysearcher -argumentlist $de,$ldapQuery
> >> > $complist = $ads.findall()
> >> >
> >> > Now iterate through $complist and query the registry on each remote
> >> > computer for last logged on user:
> >> >
> >> > $complist | % {
> >> > $cn = $_.properties['cn']
> >> > $rk =
> >> > [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine,$cn)
> >> > $rv = $rk.opensubkey("\Software\Microsoft\Windows
> >> > NT\CurrentVersion\WinLogon")
> >> > $lastuser = $rv.GetValue("DefaultDomainName") + "\" +
> >> > $rv.GetValue("DefaultUserName")
> >> > write-host "$cn - $lastuser"
> >> > }
> >> >
> >> > --
> >> >
> >> > gaurhoth
> >> > http://gaurhothw.spaces.live.com/
> >> >
> >> >
> >> > "Glenn Wilson" <GlennWilson@discussions.microsoft.com> wrote in message
> >> > news:42CD0DB7-6364-4D6E-8A43-E967A501CEF7@microsoft.com...
> >> > > Hello All,
> >> > >
> >> > > I need to get a list of all computers in our Active Directory and the
> >> > > user
> >> > > who last logged onto it. Has anyone got a sample script to help with
> >> > > this, or
> >> > > at least some parts of it.....
> >> > >
> >> > > Thanks in advance
>
>