搜索登录到AD的OU内的多台计算机的用户的最快方法

Question

Im trying to create a powershell script where you enter a username and it will parse all machines in a specific ou and see if they are logged into multiple machines.

I am not quite sure whether WMI, CIM or query will provide me with the fastest query to see if a user will be logged into additional machines that could prevent account lockout in AD.

What is the best way to enter an a username, then have it scan a specific OU and output the results to a .csv file?

Thanks

Answer 1

If in your AD environment you have a share on a server where all user home directories are stored, this may be a solution.

It connects to the server and gets a list of user connections with that home directories share.
Using that list, it looks for connections made by the given user and tests if the computer the connection was made from is in the given OU.

$ouDN          = 'THE DISTINGHUISHED NAME OF THE OU'
$homeDirServer = 'THE NAME OF THE SERVER WHERE THE USER HOME DIRECTORIES ARE KEPT'
$homeDirShare  = 'THE NAME OF THE SHARED ROOT FOLDER OF THE USERS HOME DIRECTORIES'
$userName      = 'SAMACCOUNTNAME OF THE USER TO SEARCH FOR'
$outputFile    = 'THE PATH AND FILENAME OF THE EXPORTED CSV FILE'

# first get a list of computernames in the given OU
$computers = Get-ADComputer -Filter * -SearchBase $ouDN | Select-Object -ExpandProperty SamAccountName

# next, get user connections on the homedir share and loop through them
Get-CimInstance -Class Win32_ServerConnection -ComputerName $homeDirServer |
# or use WMI:
# Get-WmiObject -Class Win32_ServerConnection -ComputerName $homeDirServer | 

    Where-Object { $_.ShareName -eq $homeDirShare -and $_.UserName -eq $userName } | 
    # if you want a list of all user connections, use this instead:
    # Where-Object { $_.ShareName -eq $homeDirShare -and (!$($_.UserName).EndsWith("$")) } | 

    ForEach-Object {
        # get the computername from the IP Address you usually get in '$_.ComputerName'
        $computerName = (([System.Net.Dns]::GetHostEntry($_.ComputerName).HostName) -split "\.", 2)[0]
        # is this a computer in the given OU?
        if ($computers -contains $computerName) {
            # emit an object
            [PSCustomObject]@{
                'DisplayName'  = Get-ADUser -Identity $_.UserName -Properties DisplayName | Select-Object -ExpandProperty DisplayName
                'AccountName'  = $_.UserName
                'ComputerName' = $computerName
       }
    }
} | Export-Csv -Path $outputFile -NoTypeInformation