# encoding: ascii
# api: powershell
# title: Get Local User stats
# description: Get local user accounts info in forms of a csv file with the following attributes:
# version: 0.1
# type: script
# author: Michael Wulff
# license: CC0
# function: Convert-UserFlag
# x-poshcode-id: 6045
# x-archived: 2016-11-11T11:39:27
# x-published: 2016-10-13T13:30:00
#
# Username, Full Name, Last Login, Group Membership, Description and UserFlags (status)
# The function to convert the userflags are built into the script for easy deploy..just change the text in $Workdir and $ExcludedAccounts
#
$Workdir = 'C:\scripts\'
$Computer = $env:COMPUTERNAME
$ExcludedAccounts = '^Administrator|^Guest'
$Output = $Workdir + 'Output.csv'


Function Convert-UserFlag  {

  Param ($UserFlag)

  $List = New-Object System.Collections.ArrayList

  Switch  ($UserFlag) {

  ($UserFlag  -BOR 0x0001)  {[void]$List.Add('SCRIPT')}
  ($UserFlag  -BOR 0x0002)  {[void]$List.Add('ACCOUNTDISABLE')}
  ($UserFlag  -BOR 0x0008)  {[void]$List.Add('HOMEDIR_REQUIRED')}
  ($UserFlag  -BOR 0x0010)  {[void]$List.Add('LOCKOUT')}
  ($UserFlag  -BOR 0x0020)  {[void]$List.Add('PASSWD_NOTREQD')}
  ($UserFlag  -BOR 0x0040)  {[void]$List.Add('PASSWD_CANT_CHANGE')}
  ($UserFlag  -BOR 0x0080)  {[void]$List.Add('ENCRYPTED_TEXT_PWD_ALLOWED')}
  ($UserFlag  -BOR 0x0100)  {[void]$List.Add('TEMP_DUPLICATE_ACCOUNT')}
  ($UserFlag  -BOR 0x0200)  {[void]$List.Add('NORMAL_ACCOUNT')}
  ($UserFlag  -BOR 0x0800)  {[void]$List.Add('INTERDOMAIN_TRUST_ACCOUNT')}
  ($UserFlag  -BOR 0x1000)  {[void]$List.Add('WORKSTATION_TRUST_ACCOUNT')}
  ($UserFlag  -BOR 0x2000)  {[void]$List.Add('SERVER_TRUST_ACCOUNT')}
  ($UserFlag  -BOR 0x10000)  {[void]$List.Add('DONT_EXPIRE_PASSWORD')}
  ($UserFlag  -BOR 0x20000)  {[void]$List.Add('MNS_LOGON_ACCOUNT')}
  ($UserFlag  -BOR 0x40000)  {[void]$List.Add('SMARTCARD_REQUIRED')}
  ($UserFlag  -BOR 0x80000)  {[void]$List.Add('TRUSTED_FOR_DELEGATION')}
  ($UserFlag  -BOR 0x100000)  {[void]$List.Add('NOT_DELEGATED')}
  ($UserFlag  -BOR 0x200000)  {[void]$List.Add('USE_DES_KEY_ONLY')}
  ($UserFlag  -BOR 0x400000)  {[void]$List.Add('DONT_REQ_PREAUTH')}
  ($UserFlag  -BOR 0x800000)  {[void]$List.Add('PASSWORD_EXPIRED')}
  ($UserFlag  -BOR 0x1000000)  {[void]$List.Add('TRUSTED_TO_AUTH_FOR_DELEGATION')}
  ($UserFlag  -BOR 0x04000000)  {[void]$List.Add('PARTIAL_SECRETS_ACCOUNT')}
  }

  $List -join '; '

}
([ADSI]"WinNT://$Computer").Children | ? {$_.SchemaClassName -eq 'user'} |  foreach {
          $groups = $_.Groups() | % {$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)}
          $_ | Select @{n='Username';e={$_.Name}},
              @{n='FullName';e={$_.FullName}},
              @{n='LastUsed';e={$_.LastLogin}},
              @{n='GroupMembership';e={$groups -join ' ; '}},
              @{n='Description';e={$_.Description}},
              @{n='Status';e={Convert-UserFlag $_.Userflags.Value}}
} | Export-Csv -NoTypeInformation -Encoding UTF8 -Delimiter ',' -Path $Output
