Get-ADComputers-LAPS-Password

2.0

Get-ADComputers-LAPS-Password.ps1

<#PSScriptInfo
 
.VERSION 2.0
 
.GUID a0539e07-fe20-4f41-81f2-a0acbb51a382
 
.AUTHOR Andriy Zarevych
 
.COMPANYNAME
 
.COPYRIGHT 2018 Andriy Zarevych
 
.TAGS ActiveDirectory LAPS
 
.LICENSEURI
 
.PROJECTURI
 
.ICONURI
 
.EXTERNALMODULEDEPENDENCIES ActiveDirectory
 
.REQUIREDSCRIPTS
 
.EXTERNALSCRIPTDEPENDENCIES
 
.RELEASENOTES
 
 
.PRIVATEDATA
 
#>

<#
.SYNOPSIS
 Get LAPS Passwords information from Active Directory.
 Generates a CSV file with computer names and LAPS Passwords.
 
.DESCRIPTION
 Get LAPS Passwords information from Active Directory.
 Generates a CSV file with computer names and LAPS Passwords.
    ComputerName;OperatingSystem;Password;PasswordExpTime;DistinguishedName
 
 Requirement of the script:
    - Active Directory PowerShell Module
    - Needed rights to view AD LAPS Attributes: ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime
    
 
 Usage:
    .\Get-ADComputers-LAPS-Password.ps1
    .\Get-ADComputers-LAPS-Password.ps1 -OU "OU=Computers,OU=IT Department,DC=myDomain,DC=com"
  
 
 Recommendation is to run this script as a schedule task to have backup your LAPS Passwords
 
 In Section Initialisations you may set default value:
 to set default value for OU
    [string]$OU =
 to set default name for a CSV file
    [string]$LogFileName =
 to set default path for a CSV file
    [string]$LogFilePath =
 
 
.PARAMETER OU
    Optional parameter to narrow the scope of the script
 
.PARAMETER LogFilePath
    Optional parameter to set path for log files
 
    Example: -LogFilePath "C:\Scripts"
 
.PARAMETER LogFileName
    Optional parameter to set name for log files
 
 
.EXAMPLE
   .\Get-ADComputers-LAPS-Password.ps1
 
   Description
   -----------
   Generates a CSV file with computer names and LAPS Passwords
    
.EXAMPLE
   .\Get-ADComputers-LAPS-Password.ps1 -OU "OU=Computers,OU=IT Department,DC=myDomain,DC=com"
 
   Description
   -----------
   Generates a CSV file with computer names and LAPS Passwords for computers in targed OU
 
.EXAMPLE
   .\Get-ADComputers-LAPS-Password.ps1 -OU "OU=Computers,OU=IT Department,DC=myDomain,DC=com" -LogFilePath "C:\Scripts" -LogFileName "LAPS-Passwords.csv"
 
   Description
   -----------
   Generates a CSV file with specific name and path
 
 
.NOTES
   File Name : Get-ADComputers-LAPS-Password.ps1
   Version : 2.0
   Date : 2018.07.05
   Author : Andriy Zarevych
 
   Find me on :
   * My Blog : https://angry-admin.blogspot.com/
   * LinkedIn : https://linkedin.com/in/zarevych/
   * Github : https://github.com/zarevych
 
#>

#Requires -Modules ActiveDirectory
#Requires -Version 2.0

#---------------------------------------------------------[Initialisations]--------------------------------------------------------

[CmdletBinding()]

    Param(
    [Parameter(Mandatory=$false, HelpMessage="Enter OU, example: OU=Computers,OU=ITDep,DC=contoso,DC=com", ValueFromPipelineByPropertyName=$true)]    
    [string]$OU,
    [Parameter(Mandatory=$false, HelpMessage="Enter path for log file, example: C:\Scripts", ValueFromPipelineByPropertyName=$true)]    
    [string]$LogFilePath = ".\",
    [Parameter(Mandatory=$false, HelpMessage="Enter log file Name", ValueFromPipelineByPropertyName=$true)]    
    [string]$LogFileName = "LAPS-Password_$(Get-Date -f 'yyyy-MM-dd').csv"
    )

#----------------------------------------------------------[Declarations]----------------------------------------------------------

Import-Module ActiveDirectory

#To separating fields for report
$strDelimiter = ";"

if (-Not (Test-Path -PathType Container $LogFilePath)){
    $LogFilePath = New-Item -ItemType Directory -Force -Path $LogFilePath
}

if ($LogFilePath.Substring($LogFilePath.Length-1) -eq "\" -or $LogFilePath.Substring($LogFilePath.Length-1) -eq "/"){
   
}
else {
    $LogFilePath = $LogFilePath + "\"
}

$LogFile = $LogFilePath + $LogFileName

#-----------------------------------------------------------[Execution]------------------------------------------------------------

#Report file $LogFile

if (Test-Path $LogFile){
    #Remove-Item $LogFile
    Clear-Content $LogFile
}
else {
    $LogFile = New-Item -Path $LogFilePath -Name $LogFileName -ItemType File
}


#

write-host
write-host "Script start" $(Get-Date)
write-host

#Set scope
#Get computers info
if ($OU -ne "") {
    Write-Host "Organizational Unit:" $OU
    $Computers = Get-ADComputer -Filter 'ObjectClass -eq "computer"' -Property * -SearchBase $OU
    
}
else {
    Write-Host "Domain:" $env:userdnsdomain
    $Computers = Get-ADComputer -Filter 'ObjectClass -eq "computer"' -Property *
}

write-host "Report File Path:" $LogFile

#Write report header
$strToReport = "ComputerName" + $strDelimiter + "OperatingSystem" + $strDelimiter + "Password" + $strDelimiter + "ExpTime" + $strDelimiter + "DistinguishedName"
Add-Content $LogFile $strToReport

#Get LAPS Info
#Write report
foreach ($Computer in $Computers) {
    
    if ($Computer.'ms-Mcs-AdmPwd'){
   
        $strComputerPassword=$Computer.'ms-Mcs-AdmPwd'
        
        $strComputerExpTime = $Computer.'ms-MCS-AdmPwdExpirationTime'

        if ($strComputerExpTime -ge 0) {$strComputerExpTime = $([datetime]::FromFileTime([convert]::ToInt64($strComputerExpTime)))}
        
        $strComputerExpTime = "{0:yyyy-MM-dd HH:mm:ss}" -f [datetime]$strComputerExpTime

        $strToReport = $Computer.Name + $strDelimiter + $Computer.OperatingSystem + $strDelimiter + """$strComputerPassword""" + $strDelimiter + """$strComputerExpTime""" + $strDelimiter + $Computer.DistinguishedName

        Add-Content $LogFile $strToReport

    }

}

write-host
write-host "Script end" $(Get-Date)
write-host