# encoding: ascii
# api: powershell
# title: Get Local User stats
# description: Get local user accounts info in forms of a csv file with the following attributes:
# version: 0.1
# type: script
# author: Michael Wulff
# license: CC0
# function: Convert-UserFlag
# x-poshcode-id: 6045
# x-archived: 2016-11-11T11:39:27
# x-published: 2016-10-13T13:30:00
#
# Username, Full Name, Last Login, Group Membership, Description and UserFlags (status)
# The function to convert the userflags are built into the script for easy deploy..just change the text in $Workdir and $ExcludedAccounts
#
$Workdir = 'C:\scripts\'
$Computer = $env:COMPUTERNAME
$ExcludedAccounts = '^Administrator|^Guest'
$Output = $Workdir + 'Output.csv'
Function Convert-UserFlag {
Param ($UserFlag)
$List = New-Object System.Collections.ArrayList
Switch ($UserFlag) {
($UserFlag -BOR 0x0001) {[void]$List.Add('SCRIPT')}
($UserFlag -BOR 0x0002) {[void]$List.Add('ACCOUNTDISABLE')}
($UserFlag -BOR 0x0008) {[void]$List.Add('HOMEDIR_REQUIRED')}
($UserFlag -BOR 0x0010) {[void]$List.Add('LOCKOUT')}
($UserFlag -BOR 0x0020) {[void]$List.Add('PASSWD_NOTREQD')}
($UserFlag -BOR 0x0040) {[void]$List.Add('PASSWD_CANT_CHANGE')}
($UserFlag -BOR 0x0080) {[void]$List.Add('ENCRYPTED_TEXT_PWD_ALLOWED')}
($UserFlag -BOR 0x0100) {[void]$List.Add('TEMP_DUPLICATE_ACCOUNT')}
($UserFlag -BOR 0x0200) {[void]$List.Add('NORMAL_ACCOUNT')}
($UserFlag -BOR 0x0800) {[void]$List.Add('INTERDOMAIN_TRUST_ACCOUNT')}
($UserFlag -BOR 0x1000) {[void]$List.Add('WORKSTATION_TRUST_ACCOUNT')}
($UserFlag -BOR 0x2000) {[void]$List.Add('SERVER_TRUST_ACCOUNT')}
($UserFlag -BOR 0x10000) {[void]$List.Add('DONT_EXPIRE_PASSWORD')}
($UserFlag -BOR 0x20000) {[void]$List.Add('MNS_LOGON_ACCOUNT')}
($UserFlag -BOR 0x40000) {[void]$List.Add('SMARTCARD_REQUIRED')}
($UserFlag -BOR 0x80000) {[void]$List.Add('TRUSTED_FOR_DELEGATION')}
($UserFlag -BOR 0x100000) {[void]$List.Add('NOT_DELEGATED')}
($UserFlag -BOR 0x200000) {[void]$List.Add('USE_DES_KEY_ONLY')}
($UserFlag -BOR 0x400000) {[void]$List.Add('DONT_REQ_PREAUTH')}
($UserFlag -BOR 0x800000) {[void]$List.Add('PASSWORD_EXPIRED')}
($UserFlag -BOR 0x1000000) {[void]$List.Add('TRUSTED_TO_AUTH_FOR_DELEGATION')}
($UserFlag -BOR 0x04000000) {[void]$List.Add('PARTIAL_SECRETS_ACCOUNT')}
}
$List -join '; '
}
([ADSI]"WinNT://$Computer").Children | ? {$_.SchemaClassName -eq 'user'} | foreach {
$groups = $_.Groups() | % {$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)}
$_ | Select @{n='Username';e={$_.Name}},
@{n='FullName';e={$_.FullName}},
@{n='LastUsed';e={$_.LastLogin}},
@{n='GroupMembership';e={$groups -join ' ; '}},
@{n='Description';e={$_.Description}},
@{n='Status';e={Convert-UserFlag $_.Userflags.Value}}
} | Export-Csv -NoTypeInformation -Encoding UTF8 -Delimiter ',' -Path $Output