Obtaining Logged On Users SID on Remote Machine

[Naveed]

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set objAccount = objWMIService.Get _
("Win32_UserAccount.Name='LANID',Domain='DOMAINNAME'")
Wscript.Echo objAccount.SID

I am able to retrieve the SID using the vbs script above by specifying the computer name and lanid and domain.

However i am creating an autoit script which needs to be able to determine the SID and then use it in a function?

I have tried to use the vbs to au3 converter, doesnt work.

Any help with this will be greatly appreciated.

Here is what i have tried already but it doesnt work.

$wbemFlagReturnImmediately = 0x10
$wbemFlagForwardOnly = 0x20
$strComputer = "ASSETNUMBER"

$objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\CIMV2")
$colitems = $objWMIService.Get("SELECT * FROM Win32_UserAccount.Name='LANID','DOMAIN'")

If IsObj($colItems) then
    For $objItem In $colItems
        $sid = $objItem.SID ; in seconds
        MsgBox(1,"",$SID)
        $Output=""
    Next
Else
    Msgbox(0,"WMI Output","No WMI Objects Found" )
Endif

Thanks

Naveed

[water]

Scriptomatic generated the following AutoIt code (and it works):

expandcollapse popup

; Generated by AutoIt Scriptomatic

$wbemFlagReturnImmediately = 0x10
$wbemFlagForwardOnly = 0x20
$colItems = ""
$strComputer = "PCTS29"

$Output=""
$Output = $Output & "Computer: " & $strComputer & @CRLF
$Output = $Output & "==========================================" & @CRLF
$objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\CIMV2")
$colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_UserAccount", "WQL", _
    $wbemFlagReturnImmediately + $wbemFlagForwardOnly)

If IsObj($colItems) then
 For $objItem In $colItems
    $Output = $Output & "AccountType: " & $objItem.AccountType & @CRLF
    $Output = $Output & "Caption: " & $objItem.Caption & @CRLF
    $Output = $Output & "Description: " & $objItem.Description & @CRLF
    $Output = $Output & "Disabled: " & $objItem.Disabled & @CRLF
    $Output = $Output & "Domain: " & $objItem.Domain & @CRLF
    $Output = $Output & "FullName: " & $objItem.FullName & @CRLF
    $Output = $Output & "InstallDate: " & WMIDateStringToDate($objItem.InstallDate) & @CRLF
    $Output = $Output & "LocalAccount: " & $objItem.LocalAccount & @CRLF
    $Output = $Output & "Lockout: " & $objItem.Lockout & @CRLF
    $Output = $Output & "Name: " & $objItem.Name & @CRLF
    $Output = $Output & "PasswordChangeable: " & $objItem.PasswordChangeable & @CRLF
    $Output = $Output & "PasswordExpires: " & $objItem.PasswordExpires & @CRLF
    $Output = $Output & "PasswordRequired: " & $objItem.PasswordRequired & @CRLF
    $Output = $Output & "SID: " & $objItem.SID & @CRLF
    $Output = $Output & "SIDType: " & $objItem.SIDType & @CRLF
    $Output = $Output & "Status: " & $objItem.Status & @CRLF
    if Msgbox(1,"WMI Output",$Output) = 2 then ExitLoop
    $Output=""
 Next
Else
 Msgbox(0,"WMI Output","No WMI Objects Found for class: " & "Win32_UserAccount" )
Endif


Func WMIDateStringToDate($dtmDate)

    Return (StringMid($dtmDate, 5, 2) & "/" & _
    StringMid($dtmDate, 7, 2) & "/" & StringLeft($dtmDate, 4) _
    & " " & StringMid($dtmDate, 9, 2) & ":" & StringMid($dtmDate, 11, 2) & ":" & StringMid($dtmDate,13, 2))
EndFunc

[Naveed]

Scriptomatic generated the following AutoIt code (and it works):

expandcollapse popup

; Generated by AutoIt Scriptomatic

$wbemFlagReturnImmediately = 0x10
$wbemFlagForwardOnly = 0x20
$colItems = ""
$strComputer = "PCTS29"

$Output=""
$Output = $Output & "Computer: " & $strComputer & @CRLF
$Output = $Output & "==========================================" & @CRLF
$objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\CIMV2")
$colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_UserAccount", "WQL", _
    $wbemFlagReturnImmediately + $wbemFlagForwardOnly)

If IsObj($colItems) then
 For $objItem In $colItems
    $Output = $Output & "AccountType: " & $objItem.AccountType & @CRLF
    $Output = $Output & "Caption: " & $objItem.Caption & @CRLF
    $Output = $Output & "Description: " & $objItem.Description & @CRLF
    $Output = $Output & "Disabled: " & $objItem.Disabled & @CRLF
    $Output = $Output & "Domain: " & $objItem.Domain & @CRLF
    $Output = $Output & "FullName: " & $objItem.FullName & @CRLF
    $Output = $Output & "InstallDate: " & WMIDateStringToDate($objItem.InstallDate) & @CRLF
    $Output = $Output & "LocalAccount: " & $objItem.LocalAccount & @CRLF
    $Output = $Output & "Lockout: " & $objItem.Lockout & @CRLF
    $Output = $Output & "Name: " & $objItem.Name & @CRLF
    $Output = $Output & "PasswordChangeable: " & $objItem.PasswordChangeable & @CRLF
    $Output = $Output & "PasswordExpires: " & $objItem.PasswordExpires & @CRLF
    $Output = $Output & "PasswordRequired: " & $objItem.PasswordRequired & @CRLF
    $Output = $Output & "SID: " & $objItem.SID & @CRLF
    $Output = $Output & "SIDType: " & $objItem.SIDType & @CRLF
    $Output = $Output & "Status: " & $objItem.Status & @CRLF
    if Msgbox(1,"WMI Output",$Output) = 2 then ExitLoop
    $Output=""
 Next
Else
 Msgbox(0,"WMI Output","No WMI Objects Found for class: " & "Win32_UserAccount" )
Endif


Func WMIDateStringToDate($dtmDate)

    Return (StringMid($dtmDate, 5, 2) & "/" & _
    StringMid($dtmDate, 7, 2) & "/" & StringLeft($dtmDate, 4) _
    & " " & StringMid($dtmDate, 9, 2) & ":" & StringMid($dtmDate, 11, 2) & ":" & StringMid($dtmDate,13, 2))
EndFunc

Thanks once again mate, i have tested it and it works what did you use to generate the code?

[water]

Hi Naveed,

I used the AutoIt version of Scriptomatic - it can be found here.

Greetings

water

[Naveed]

Hi Naveed,

I used the AutoIt version of Scriptomatic - it can be found here.

Greetings

water

Hi Water,

I tested the script on my windows 7 laptop and it worked fine, however when i am testing on my main administrator xp machine the script returns SID values for multiple accounts? any idea how i would isolate the id for the currently logged on user on MachineX?

Thanks

Naveed

[water]

Hi Naveed,

change the Select statement accordingly:

$colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_UserAccount Where Name='" & @UserName & "'", "WQL", _
    $wbemFlagReturnImmediately + $wbemFlagForwardOnly)

[water]

Or you could have a look at the "_Security__GetAccountSid" function in the Security UDF (its part of Autoit).

[Naveed]

Or you could have a look at the "_Security__GetAccountSid" function in the Security UDF (its part of Autoit).

Thanks once again, i have managed to get the SID using the above method, however when i try to read the registry entry with the SID included for a remote machine, it comes back blank, any ideas??

[water]

Could you please post the code you have so far?

[Euphoria]

Hi Naveed,

change the Select statement accordingly:

$colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_UserAccount Where Name='" & @UserName & "'", "WQL", _
    $wbemFlagReturnImmediately + $wbemFlagForwardOnly)

Hi,

I tried to use this code however it gives me below error:

Variable must be of type "Object".:

$colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_UserAccount Where Name='" & @UserName & "'", "WQL", $wbemFlagReturnImmediately + $wbemFlagForwardOnly)

$colItems = $objWMIService^ ERROR

 

I am trying to run it on WIN7. Any help is much appreciated.

[water]

Can you post the complete code you run?