Enumerate Domain Users with Local Admin Rights

[iamtheky]

This script enumerates the Domain Groups that show up under Administrators to result in a CSV that shows both the Domain Groups and their members.  It will not not show users nor groups with 0 members.

expandcollapse popup

#include <AutoItConstants.au3>
#include<array.au3>
#RequireAdmin

local $outfile = "DomainUsersWithAdminRightsOnEndpoints.csv"

If FileExists($outfile) Then FileDelete($outfile)

local $sOutCSV = ""
$sDomain = "DOMAIN"


$iPID = run("net localgroup Administrators" , "", @SW_HIDE , $stdout_child)

$sOutput = ""

 While 1
        $sOutput &= StdoutRead($iPID)
        If @error Then
            ExitLoop
        EndIf
 WEnd

$aMembers = stringsplit(stringstripws($sOutput,2) , @CRLF , 3)

local $aOut[ubound($aMembers) - 6]

    For $j = 6 to ubound($aMembers) - 2
        $aOut[$j - 6] = $aMembers[$j]
    Next


;~ _ArrayDisplay($aMembers)


For $k = 0 to ubound($aOut) - 1
    If stringleft($aOut[$k] , stringlen($sDomain) + 1) = $sDomain & "\" Then

        $iPID = run("net group " & '"' & stringtrimleft(stringstripws($aOut[$k] , 2) , stringlen($sDomain) + 1) & '"' & " /DOMAIN" , "", @SW_HIDE , $stdout_child)

        $sOutput = ""

            While 1
                $sOutput &= StdoutRead($iPID)
                If @error Then
                    ExitLoop
                EndIf
            WEnd

$aDomainMembers = stringsplit(stringstripws($sOutput,2) , @CRLF , 3)

            If UBound($aDomainMembers) > 7 Then
                $sOutDomainMembers = _ArrayToString($aDomainMembers , "" , 8 , ubound($aDomainMembers) - 2)
                $sOutRepl = stringregexpreplace(stringstripws($sOutDomainMembers , 2) , "\s\s+" , ",")
                $sOutCSV &= $aOut[$k] & "," & $sOutRepl & @LF
            EndIf
    EndIf

Next

FileWrite($outfile , $sOutCSV)
ShellExecute($outfile)

 

Edited January 27, 2016 by iamtheky

[Gianni]

....can be handy, thanks for sharing.

Here a little variation to show results in a treeview instead of in a csv file
(not much tested, just a draft). Not tested also what appens if group is empty... (line 31)

expandcollapse popup

#include <TreeViewConstants.au3>
#include <WindowsConstants.au3>
#include <AutoItConstants.au3>
#include <GUITreeView.au3>
#include<array.au3>
#RequireAdmin

Local $sOutCSV = "", $DOS_out, $aOutDomainMembers, $hTree
Local $sDomain = "Domain"

$hMain = GUICreate("Groups treeview", 280, 400, "", "", -1798701056, 256)
$hTree = GUICtrlCreateTreeView(5, 5, 270, 390, BitOR($TVS_HASBUTTONS, $TVS_HASLINES, $TVS_LINESATROOT, $TVS_DISABLEDRAGDROP, $TVS_SHOWSELALWAYS), $WS_EX_CLIENTEDGE)
GUISetState()
; Returns members of Administrator group (remove first 6 unwanted lines)
$DOS_out = _Cmd('NET LOCALGROUP Administrators | MORE /E +6')

; Parse members of administrators group from DOS output
$aOut = StringSplit(StringStripWS($DOS_out, 7), @CR, 2)
; _ArrayPop($aOut); remove last unwanted line
; _ArrayDisplay($aOut) ; show administrators group members
GUISetCursor(15, 1) ; set cursor to "wait"
_GUICtrlTreeView_BeginUpdate($hTree)
$hAncestor = _GUICtrlTreeView_Add($hTree, 0, $sDomain)
For $k = 0 To UBound($aOut) - 2
    $aElement = StringSplit($aOut[$k], "\", $STR_NOCOUNT)
    If Not @error Then
        If $aElement[0] = $sDomain Then
            $hGroup = _GUICtrlTreeView_AddChild($hTree, $hAncestor, $aElement[1])
            ; Returns members of domain group (remove first 8 unwanted lines)
            $DOS_out = _Cmd("net group " & '"' & $aElement[1] & '"' & " /DOMAIN | MORE /E +8")
            $aDomainMembers = StringSplit(StringStripWS($DOS_out, 2), @CRLF, 3) ; <----  what output if is an empty group ???
            ; _ArrayDisplay($aDomainMembers)
            If IsArray($aDomainMembers) Then
                $sOutDomainMembers = _ArrayToString($aDomainMembers, "", -1, UBound($aDomainMembers) - 2)
                $sOutRepl = StringRegExpReplace(StringStripWS($sOutDomainMembers, 2), "\s\s+", ",")
                $aOutDomainMembers = StringSplit($sOutRepl, ",")
                For $i = 1 To $aOutDomainMembers[0]
                    _GUICtrlTreeView_AddChild($hTree, $hGroup, $aOutDomainMembers[$i])
                Next
            EndIf
        EndIf
    EndIf
Next
_GUICtrlTreeView_EndUpdate($hTree)
GUISetCursor() ; cursor back to default
MsgBox(0, "Debug", "Pause")

Func _Cmd($sCommand)
    Local $sCmd_out = "", $iPID = Run(@ComSpec & " /c " & $sCommand, "", @SW_HIDE, $stdout_child)
    Do
        $sCmd_out &= StdoutRead($iPID)
    Until @error
    Return $sCmd_out
EndFunc   ;==>_Cmd