Using PS and ADSI to enum groups+members

[iamtheky]

expandcollapse popup

#include <AutoItConstants.au3>
#include<array.au3>
#RequireAdmin

local $aFinal[0]
$sReturn = ""
$sComp = @ComputerName

$PsCommand = '"' & "([ADSI]'WinNT://" & $sComp & ",computer').psbase.children | where { $_.psbase.schemaClassName -eq 'group' } | foreach { ($_.name)[0]}" & '"'

$iPID = run("powershell " & $PsCommand, "" , @SW_HIDE , $stdout_child)

$sOutput = ""

 While 1
        $sOutput &= StdoutRead($iPID)
        If @error Then
            ExitLoop
        EndIf
 WEnd


$aSelectedGroups = stringsplit(stringtrimright($sOutput , 1) , @LF , 2)


For $i = 0 to ubound($aSelectedGroups) - 1

    $PsCommand = '"' & "$([ADSI]'WinNT://" & $sComp & "/" & stringstripws($aSelectedGroups[$i] , 3) &",group').psbase.Invoke('Members') | foreach { $_.GetType().InvokeMember('ADspath', 'GetProperty', $null, $_, $null).Replace('WinNT://', '') }" & '"'

    $iPID = run("powershell " & $PsCommand, "" , @SW_HIDE , $stdout_child)

    $sOutput = ""

     While 1
            $sOutput &= StdoutRead($iPID)
            If @error Then
                ExitLoop
            EndIf
     WEnd

If $sOutput = "" Then $sOutput = "No members" & @LF
$sReturn &= "*" & $aSelectedGroups[$i] & @LF & $sOutput & @LF

Next

$aFinal = stringsplit($sReturn , @LF , 2)
_ArrayDisplay($aFinal)

 

There are many ways to enum these values, I have a good feeling about this one.

ADSI commands found here:

https://gist.github.com/HarmJ0y/fd98c4f16575ba28c091