时间戳

首页 > 解决方案 > 使用本地管理员凭据检查/读取远程计算机上的注册表项值

powershell - 使用本地管理员凭据检查/读取远程计算机上的注册表项值

问题描述

如何检查不在域中的计算机上的注册表项值？

我认为我必须为此使用本地管理员凭据，但我不知道如何

我试过这个：

$user = "admin"
$password = "pass" | ConvertTo-SecureString -asPlainText -Force
$computer = "computer"
$domain=$computer
        $username = $domain + "\" + $user
        $Credential = New-Object System.Management.Automation.PSCredential -ArgumentList $username,$password


$key = '\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters'
$valuename = 'DiskSpaceThreshold'

$wmi = Get-Wmiobject -list "StdRegProv" -namespace root\default -Computername $computer -Credential $Credential
$value = $wmi.GetStringValue($HKEY_Local_Machine,$key,$valuename).svalue

$wmi
$value

但结果：

Get-Wmiobject : Could not get objects from namespace root\default. Serwer RPC jest niedostępny. (Wyjątek od HRESULT: 0x800706BA) At line:12 char:8
+ $wmi = Get-Wmiobject -list "StdRegProv" -namespace root\default -Comp ...
+        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (:) [Get-WmiObject], COMException
    + FullyQualifiedErrorId : INVALID_NAMESPACE_IDENTIFIER,Microsoft.PowerShell.Commands.GetWmiObjectCommand You cannot call a method on a null-valued expression. At line:13 char:1
+ $value = $wmi.GetStringValue($HKEY_Local_Machine,$key,$valuename).sva ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 


__GENUS          : 2
__CLASS          : __PARAMETERS
__SUPERCLASS     : 
__DYNASTY        : __PARAMETERS
__RELPATH        : 
__PROPERTY_COUNT : 2
__DERIVATION     : {}
__SERVER         : 
__NAMESPACE      : 
__PATH           :  ReturnValue      : 6 uValue           :  PSComputerName   :

所以我尝试了别的东西

  # file with computer name
$computers = Get-Content F:\IT\!Set_NTP_Time\ReadRegistry\servers.txt | ?{$_ -notmatch "^#"};

#Registry Hives
[long]$HIVE_HKROOT = 2147483648
[long]$HIVE_HKCU = 2147483649
[long]$HIVE_HKLM = 2147483650
[long]$HIVE_HKU = 2147483651
[long]$HIVE_HKCC = 2147483653
[long]$HIVE_HKDD = 2147483654


# registry
$HKLM = 2147483650
$main = "Localmachine"
$keyPath = "System\CurrentControlSet\Services\W32Time"
$keyName = "Start"

#$computer ='.'
$reg = [WMIClass]"ROOT\DEFAULT:StdRegProv"
$Key = "W32Time"
#$Value = "HistoryBufferSize"
#$results = $reg.GetDWORDValue($HKEY_LOCAL_MACHINE, $Key, $keyName)
#"Current History Buffer Size: {0}" -f $results.uValue


<#
Param($computer)
$HKEY_Local_Machine = 2147483650 
$reg = [WMIClass]"\\$computer\ROOT\DEFAULT:StdRegProv"
$Key = "SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\CurrentVersion\SharedDefs"
$ValueName = "DEFWATCH_10"
$results = $reg.GetStringValue($HKEY_LOCAL_MACHINE, $Key, $ValueName)
write $results.sValue
#>

# credentials
$user = "admin"
$user1 = "admin1"
$password = "pass" | ConvertTo-SecureString -asPlainText -Force

# Start processing 
    foreach($computer in $computers) {
        $domain=$computer
        $username = $domain + "\" + $user
        $username1 = $domain + "\" + $user1
        $Credential = New-Object System.Management.Automation.PSCredential -ArgumentList $username,$password
        $Credential1 = New-Object System.Management.Automation.PSCredential -ArgumentList $username1,$password

     try {  
        if (($computer -eq "comp1") -or ($computer -eq "comp2") -or ($computer -eq "name_of_computer") -or ($computer -eq "other_computer")) {
            #$wmi = Get-Wmiobject -list "StdRegProv" -namespace root\default -Computername $computer -Credential $Credential1
            #$value = $wmi.GetStringValue($HKLM,$keyPath,$keyName).svalue
            #Write-Host -ForegroundColor DarkYellow $computer $value
            #$value = Invoke-Command -Scriptblock {Get-Item $HKLM,$keyPath,$keyName} -Computername $computer -Credential $Credential1
            $reg = Get-WmiObject -List -Namespace root\default -ComputerName $Computer -Credential $Credential1 | Where-Object {$_.Name -eq "StdRegProv"}
            #$HKLM = 2147483650
            #$value = $reg.GetStringValue($HKLM,$keyPath,$keyName).sValue
            $value = $reg.GetDWORDValue($HKEY_LOCAL_MACHINE, $Key, $keyName)
            Write-Host -ForegroundColor DarkYellow $computer $reg $value 

        } else { 
        
            #$wmi = Get-Wmiobject -list "StdRegProv" -namespace root\default -Computername $computer -Credential $Credential
            #$value = $wmi.GetStringValue($HKLM,$keyPath,$keyName).svalue
            #Write-Host -ForegroundColor DarkYellow $computer $value
            #$value = Invoke-Command -Scriptblock {Get-Item $HKLM,$keyPath,$keyName} -Computername $computer -Credential $Credential
            $reg = Get-WmiObject -List -Namespace root\default -ComputerName $Computer -Credential $Credential | Where-Object {$_.Name -eq "StdRegProv"}
            #$HKLM = 2147483650
            #$value = $reg.GetStringValue($HKLM,$keyPath,$keyName).sValue 
            $value = $reg.GetDWORDValue($HKEY_LOCAL_MACHINE, $Key, $keyName)
            Write-Host -ForegroundColor DarkYellow $computer $reg $value

        }
        <#
        if($value -eq 2)
        {
        Write-Host -ForegroundColor DarkYellow $computer "YES" 
        } else {
        Write-Host -ForegroundColor Red $computer "NO"
        }
        #>
        } catch {
        Write-Host -ForegroundColor Red "$computer access denied.$_";
    }
}

此脚本的结果

comp1 \COMP1\ROOT\default:StdRegProv System.Management.ManagementBaseObject

comp2 \COMP2\ROOT\default:StdRegProv System.Management.ManagementBaseObject

comp3 \COMP3\ROOT\default:StdRegProv System.Management.ManagementBaseObject

标签： powershellpowershell-4.0powershell-remotingpowershell-5.0powershell-v6.0

解决方案

就个人而言，由于我习惯于使用 powershell 远程处理从远程机器收集信息，我会这样进行：

  1. 建立远程 PS 会话
  2. 在远程机器上运行脚本
  3. 利润

因此，在您的情况下，类似于（如果您在HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters中检索名为DiskSpaceThreshold的值）

$user = "admin"
$password = "pass" | ConvertTo-SecureString -asPlainText -Force
$computer = "computer"
$domain=$computer
        $username = $domain + "\" + $user
        $Credential = New-Object System.Management.Automation.PSCredential -ArgumentList $username,$password

$session = New-PSSession $computer -Credential $Credential
$r = Invoke-Command -Session $session -ScriptBlock { Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters -Name "DiskSpaceThreshold" }
Remove-PSSession $session

Write-Host $r.DiskSpaceThreshold

推荐阅读