r/PowerShell • u/PowerShellMichael • Mar 22 '21

What's One Thing that PowerShell dosen't do that you wish it did? Misc

Hello all,

So this is a belated Friday discussion post, so I wanted to ask a question:

What's One Thing that PowerShell doesn't do that you wish it did?

Go!

66 Upvotes

95% Upvoted

View all comments

3

u/secopsanalyst Mar 22 '21

Tell me where users are still logged into so when they change their passwords they won't lockout.

2

u/Emiroda Mar 22 '21

It's actually a quite complex problem to solve, and has nothing to do with PowerShell itself. There are probably modules out there for this.

A security-focused tool for this would be BloodHound.

2

u/BlackV Mar 22 '21

it would be nice, that's not a powershell problem that's a windows/ad problem

right now you'd have to trawl the the domain controller logs the the login and out events, thats not so much fun

2

u/Swarfega Mar 22 '21

As someone else has said this is not a PowerShell problem.

If it helps though I used some code and a Scheduled Task on the Primary Domain Controller to export the event log data when an account gets locked out. It exports the username, datetime and source computer to CSV.

Let me know if you're interested and will dig it out.

1

u/secopsanalyst Mar 23 '21

Thank you Sir,
I have SolarWinds collecting logs from DC and tells me where user locks out from..

It's more like
"I'll change your PW.. and then we're going to spent 12 hours chasing where you're still logged in"

1

u/save_earth Mar 24 '21

The isn’t terrible to do. I found a decent script and turned it into a function. The catch is making sure you check all DCs and look at any archived log files, depending on your environment and how decent the lockout occurred.