windows - 如何使用 power-shell 将登录下的用户列为服务本地安全策略
问题描述
我想使用 Power shell 在登录作为服务策略下查找用户。我不想使用任何第三方 dll 或模块来实现这一点。
解决方案
听起来你想要这样的东西:
https://gallery.technet.microsoft.com/scriptcenter/Grant-Revoke-Query-user-26e259b0
示例使用:
Get-AccountsWithUserRight -Right SeServiceLogonRight
function Get-AccountsWithUserRight {
<#
.SYNOPSIS
Gets all accounts that are assigned a specified privilege
.DESCRIPTION
Retrieves a list of all accounts that hold a specified right (privilege). The accounts returned are those that hold the specified privilege directly through the user account, not as part of membership to a group. A list of SIDs and account names is returned. For each SID that cannot be resolved to a name, the Account property is set to an empty string ("").
.PARAMETER Right
Name of the right to query. More than one right may be listed.
Possible values:
SeTrustedCredManAccessPrivilege Access Credential Manager as a trusted caller
SeNetworkLogonRight Access this computer from the network
SeTcbPrivilege Act as part of the operating system
SeMachineAccountPrivilege Add workstations to domain
SeIncreaseQuotaPrivilege Adjust memory quotas for a process
SeInteractiveLogonRight Allow log on locally
SeRemoteInteractiveLogonRight Allow log on through Remote Desktop Services
SeBackupPrivilege Back up files and directories
SeChangeNotifyPrivilege Bypass traverse checking
SeSystemtimePrivilege Change the system time
SeTimeZonePrivilege Change the time zone
SeCreatePagefilePrivilege Create a pagefile
SeCreateTokenPrivilege Create a token object
SeCreateGlobalPrivilege Create global objects
SeCreatePermanentPrivilege Create permanent shared objects
SeCreateSymbolicLinkPrivilege Create symbolic links
SeDebugPrivilege Debug programs
SeDenyNetworkLogonRight Deny access this computer from the network
SeDenyBatchLogonRight Deny log on as a batch job
SeDenyServiceLogonRight Deny log on as a service
SeDenyInteractiveLogonRight Deny log on locally
SeDenyRemoteInteractiveLogonRight Deny log on through Remote Desktop Services
SeEnableDelegationPrivilege Enable computer and user accounts to be trusted for delegation
SeRemoteShutdownPrivilege Force shutdown from a remote system
SeAuditPrivilege Generate security audits
SeImpersonatePrivilege Impersonate a client after authentication
SeIncreaseWorkingSetPrivilege Increase a process working set
SeIncreaseBasePriorityPrivilege Increase scheduling priority
SeLoadDriverPrivilege Load and unload device drivers
SeLockMemoryPrivilege Lock pages in memory
SeBatchLogonRight Log on as a batch job
SeServiceLogonRight Log on as a service
SeSecurityPrivilege Manage auditing and security log
SeRelabelPrivilege Modify an object label
SeSystemEnvironmentPrivilege Modify firmware environment values
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session
SeManageVolumePrivilege Perform volume maintenance tasks
SeProfileSingleProcessPrivilege Profile single process
SeSystemProfilePrivilege Profile system performance
SeUnsolicitedInputPrivilege "Read unsolicited input from a terminal device"
SeUndockPrivilege Remove computer from docking station
SeAssignPrimaryTokenPrivilege Replace a process level token
SeRestorePrivilege Restore files and directories
SeShutdownPrivilege Shut down the system
SeSyncAgentPrivilege Synchronize directory service data
SeTakeOwnershipPrivilege Take ownership of files or other objects
.PARAMETER Computer
Specifies the name of the computer on which to run this cmdlet. If the input for this parameter is omitted, then the cmdlet runs on the local computer.
.PARAMETER SidForUnresolvedName
For each SID that cannot be resolved to a name, set the Account property to the SID instead of leaving it blank.
.EXAMPLE
Get-AccountsWithUserRight SeServiceLogonRight
Returns a list of all accounts that hold the "Log on as a service" right.
.EXAMPLE
Get-AccountsWithUserRight -Right SeServiceLogonRight,SeDebugPrivilege -Computer TESTPC
Returns a list of accounts that hold the "Log on as a service" right, and a list of accounts that hold the "Debug programs" right, on the TESTPC system.
.INPUTS
PS_LSA.Rights Right
String Computer
Switch SidForUnresolvedName
.OUTPUTS
String Account
String SID
String Right
.LINK
http://msdn.microsoft.com/en-us/library/ms721792.aspx
http://msdn.microsoft.com/en-us/library/bb530716.aspx
#>
[CmdletBinding()]
param (
[Parameter(Position=0, Mandatory=$true, ValueFromPipelineByPropertyName=$true, ValueFromPipeline=$true)]
[Alias('Privilege')] [PS_LSA.Rights[]] $Right,
[Parameter(ValueFromPipelineByPropertyName=$true, HelpMessage="Computer name")]
[Alias('System','ComputerName','Host')][String] $Computer,
[switch] $SidForUnresolvedName
)
process {
$lsa = New-Object PS_LSA.LsaWrapper($Computer)
foreach ($Priv in $Right) {
$sids = $lsa.EnumerateAccountsWithUserRight($Priv, $false)
foreach ($sid in $sids) {
$output = @{'Account'=(Convert-SIDtoName $sid $SidForUnresolvedName); 'SID'=$sid; 'Right'=$Priv; }
Write-Output (New-Object -Typename PSObject -Prop $output)
}
}
}
} # Gets all accounts that are assigned specified rights
推荐阅读
- python - 在 GUI 中显示命令提示符窗口
- python - 带有线程的 Python HTTP 请求
- vue.js - SassError:`darken($color, $amount)` 的参数`$color` 必须是颜色
- java - 检测到 log4j-over-slf4j.jar 和 slf4j-log4j12.jar
- java - 为什么我们需要setRollbackOnly,而不仅仅是回滚事务?
- r - 在 R 中将 512 x 3 数据帧转换为 128 x 4 x 3 矩阵
- jquery - jQuery数据表导出输入文本选项而不是同时导出特定列
- azure - 如何将我的示例数据加载到 Azure 数据湖并在 Power Bi 中进行可视化?
- sockets - 使用套接字和端口转发连接不同网络中的两台计算机
- python - 线空间函数的说明