Artifact 3fb920c553261fe89e5bca7cfc057b1ce6c52aef:

• File tools/user/findlocaladmins.ps1 — part of check-in [2e564262f9] at 2017-09-24 06:58:54 on branch trunk — Moved more user-related scripts to... users/ (user: mario size: 736)

# api: multitool
# version: 0.5
# title: Detect admins
# description: list local admins on remote machine
# type: inline
# category: user
# img: users.png
# hidden: 0
# key: i13|localadmins
# config: {}
# 
# list local admins on computer
# - via WMI win32_groupuser
# - shortened to DOMAIN\UserName


Param($machine = (Read-Host "Machine"))

Write-Host -f Green "WMI query 'win32_groupuser'..."
$admins = Gwmi win32_groupuser –computer $machine

Write-Host -f Green "Extract account infos"
$admins = $admins |? {$_.groupcomponent –like '*"Administrators"'}
$admins | ? {
    $_.PartComponent -match 'Domain="(.*)",Name="(.*)"'
} | % { 
    Write-Host -f Yellow "♞ $($matches[1])\$($matches[2])"
}