Initial Release

Query-UserAccountControl.ps1

@@ -0,0 +1,72 @@
+<#-----------------------------------------------------------------------------
+Russell Tomkins
+Microsoft Premier Field Engineer
+
+Name:           Query-UserAccountControl.ps1
+Description:    Exports an individual CSV for each UAC Flag all User and 
+                Computer accounts. Assists in identifying accounts with 
+                specific configurations such as Kerberos Delegations. 
+Date:           1.0 - Initial Release - January 27 2016 - Russell Tomkins
+-------------------------------------------------------------------------------
+Disclaimer
+The sample scripts are not supported under any Microsoft standard support 
+program or service. 
+The sample scripts are provided AS IS without warranty of any kind. Microsoft
+further disclaims all implied warranties including, without limitation, any 
+implied warranties of merchantability or of fitness for a particular purpose.
+The entire risk arising out of the use or performance of the sample scripts and 
+documentation remains with you. In no event shall Microsoft, its authors, or 
+anyone else involved in the creation, production, or delivery of the scripts be
+liable for any damages whatsoever (including, without limitation, damages for 
+loss of business profits, business interruption, loss of business information, 
+or other pecuniary loss) arising out of the use of or inability to use the 
+sample scripts or documentation, even if Microsoft has been advised of the 
+possibility of such damages.
+-----------------------------------------------------------------------------#>
+# -----------------------------------------------------------------------------
+# Begin Main Script
+# -----------------------------------------------------------------------------
+
+# Build the Lookup HashTable. 
+# More details can be found here https://support.microsoft.com/en-us/kb/305144
+
+$UACLookUp = @{1 = "SCRIPT|0x0001";
+                2 = "ACCOUNTDISABLE|0x0002";
+                8 = "HOMEDIR_REQUIRED|0x0008";
+                16 = "LOCKOUT|0x0010";
+                64 = "PASSWD_CANT_CHANGE|0x0040";
+                128 = "ENCRYPTED_TEXT_PWD_ALLOWED|0x0080";
+                256 = "TEMP_DUPLICATE_ACCOUNT|0x0100";
+                512 = "NORMAL_ACCOUNT|0x0200";
+                2048 = "INTERDOMAIN_TRUST_ACCOUNT|0x0800";
+                4096 = "WORKSTATION_TRUST_ACCOUNT|0x1000";
+                8192 = "SERVER_TRUST_ACCOUNT|0x2000";
+                65536 = "DONT_EXPIRE_PASSWORD|0x10000";
+                131072 = "MNS_LOGON_ACCOUNT|0x20000";
+                262144 = "SMARTCARD_REQUIRED|0x40000";
+                524288 = "TRUSTED_FOR_DELEGATION|0x80000";
+                1048576 = "NOT_DELEGATED|0x100000";
+                2097152 = "USE_DES_KEY_ONLY|0x200000";
+                4194304 = "DONT_REQ_PREAUTH|0x400000";
+                8388608 = "PASSWORD_EXPIRED|0x800000";
+                16777216 = "TRUSTED_TO_AUTH_FOR_DELEGATION|0x1000000";
+                67108864 = "PARTIAL_SECRETS_ACCOUNT|0x04000000"}
+
+#Loop through each Bitwise value and generate a CSV for affected User and Computer Accounts
+ForEach($Value in $UACLookUp.Keys){
+
+	# Prepare Our Variables
+	$Description = $UACLookup.Item($Value)
+	$FileName = $Description.Split("|",2)[0]
+	$Filter = "useraccountcontrol -band $Value"
+	$Properties = "useraccountcontrol","msDS-LastSuccessfulInteractiveLogonTime","lastLogonTimestamp"
+
+	# Grab the details for both User and Computer Accounts and Output to CSV
+	Get-ADUser -Filter $Filter -Properties $Properties| Export-CSV -NoTypeInformation "U-$FileName.csv"
+    Get-ADComputer -Filter $Filter -Properties $Properties| Export-CSV -NoTypeInformation "C-$FileName.csv"
+} # Process the Next UAC Value
+
+# -----------------------------------------------------------------------------
+# End of Script
+# -----------------------------------------------------------------------------
+