Projekt: Automatisierter Passwortwechsel aller administrativen Benutzerkonten

$User = "*Administrator*";  
$OutFile = ".\AdmUsed.csv";  
$SearchBase = "OU=Servers,DC=$CONTOSO,DC=COM";  

$credential = Get-Credential;
$computers = $(Get-ADComputer -Filter * -SearchBase $SearchBase -Credential $credential).DNSHostName;

$AdmUsed = New-Object -TypeName PSObject -Property @{
    Name = "";  
    Caption = "";  
    State = "";  
    User = "";  
    TaskName = "";  
    TaskPath = "";  
    ComputerName = "";  
    Type = "";  
    ErrorMessage = "";  
};

ForEach ($computer in $computers) {
    # Services
    try {
        $ErrorActionPreference = "Stop";  
        [Array]$AdmUsed += Get-WmiObject Win32_Service -Credential $credential -ComputerName $computer | Where-Object StartName -Like $User | Select-Object Name,Caption,State,@{Name="User";Expression={$_.StartName}},@{Name="ComputerName";Expression={$computer}},@{Name="Type";Expression={"Service"}};  
    } catch {
        [Array]$AdmUsed += New-Object -TypeName PSObject | Select-Object @{Name="ErrorMessage";Expression={$($_.Exception.Message)}},@{Name="State";Expression={"Error"}},@{Name="ComputerName";Expression={$computer}},@{Name="Type";Expression={"Service"}};  
        Write-Warning "$computer - $($_.Exception.Message)";  
    };

    # Tasks
    $path = "\\" + $computer + "\c$\Windows\System32\Tasks"  
    if (Test-Path $path)
    {
        $tasks = Get-ChildItem -Path $path -File; # TODO: Implement Recursion
        if ($tasks)
        {
            Write-Verbose -Message "I found $($tasks.count) tasks for $computer";  
        };
        foreach ($item in $tasks)
        {
            $AbsolutePath = $path + "\" + $item.Name;  
            $task = [xml] (Get-Content $AbsolutePath);
            [STRING]$check = $task.Task.Principals.Principal.UserId;
            if ($check.StartsWith("S-"))  
            {
                [STRING]$check = ([wmi]"Win32_SID.SID='$check'").ReferencedDomainName + "\" +([wmi]"Win32_SID.SID='$check'").AccountName  
            }
            if ($task.Task.Principals.Principal.UserId)
            {
                Write-Verbose -Message "Writing the log file with values for $computername";  
                [Array]$AdmUsed += New-Object -TypeName PSObject | Select-Object @{Name="TaskName";Expression={$item}},@{Name="State";Expression={$task.Task.Settings.Enabled}},@{Name="TaskPath";Expression={$AbsolutePath}},@{Name="User";Expression={$check}},@{Name="ComputerName";Expression={$computer}},@{Name="Type";Expression={"Scheduled Tasks"}};  
            };
        };
    }else{
        [Array]$AdmUsed += New-Object -TypeName PSObject | Select-Object @{Name="ErrorMessage";Expression={"Unsupported OS, must be checked manually."}},@{Name="State";Expression={"Error"}},@{Name="ComputerName";Expression={$computer}},@{Name="Type";Expression={"Scheduled Tasks"}};  
        Write-Warning "$computer - Unsupported OS or offline, must be checked manually.";  
    };

};

$AdmUsed | Sort-Object -Property User, Type, Caption | Export-Csv -Encoding UTF8 -Delimiter ";" -NoTypeInformation -Path $OutFile;  

$filtersid = "S-1-5";  
Set-Location $(Split-Path $MyInvocation.MyCommand.Path)
$xmlEvent = @(); $xmlEvents = @();
$filter = @{
    Logname   = "Security";  
    ID        = 4624;
    StartTime = (Get-Date).AddDays(-10);
}

Get-WinEvent -FilterHashtable $filter | ForEach-Object {
    $xmlEvent = ([XML]$_.ToXml()).Event.EventData.Data;
    $xmlEvents += [psCustomObject][Ordered] @{
        TargetUserSid = [String]($xmlEvent | Where-Object {$_.Name -eq 'TargetUserSid'}).'#text';  
        TargetUserName = [String]($xmlEvent | Where-Object {$_.Name -eq 'TargetUserName'}).'#text';  
        TargetDomainName = [String]($xmlEvent | Where-Object {$_.Name -eq 'TargetDomainName'}).'#text';  
        IpAddress = [String]($xmlEvent | Where-Object {$_.Name -eq 'IpAddress'}).'#text';  
        LogonProcessName = [String]($xmlEvent | Where-Object {$_.Name -eq 'LogonProcessName'}).'#text';  
        AuthenticationPackageName = [String]($xmlEvent | Where-Object {$_.Name -eq 'AuthenticationPackageName'}).'#text';  
    };
};
$xmlEvents | ConvertTo-Csv -Delimiter ';' | Out-File .\LogonEvents.csv;  
$xmlEvents | Where-Object {$_.TargetUserSid -eq $filtersid} | ConvertTo-Csv -Delimiter ';' | Out-File .\filteredLogonEvent.csv;