extract the "owner" under security of a user

spiceuser-r9zyv · 2021-10-14T13:54:27.000Z

hello,

I have this script to extract details of users and one of the things i need is the security owner of these users. I know this is part of ACL but how can i add it to my script?

$Days = Read-Host "Enter the number of days to extract"
$Time = (Get-Date).Adddays(-($Days))
Get-ADUser -server "domain.com" -Filter * -Property whenCreated, proxyaddresses, SamAccountName, PasswordLastSet, extensionAttribute1, extensionAttribute3, extensionAttribute15, extensionAttribute14, msExchHideFromAddressLists, Mail, Country, countrycode, canonicalname, msNPAllowDialin, info, enabled, AccountExpirationDate |
    Where {$_.whenCreated -gt $Time} |
  Select Name, @{L = "ProxyAddresses"; E = { ($_.ProxyAddresses -match '^') -join ";"}}, SamAccountName, whenCreated, UserPrincipalName, PasswordLastSet, extensionAttribute1, extensionAttribute3, extensionAttribute15, extensionAttribute14, msExchHideFromAddressLists, Mail, Country, countrycode, canonicalname, msNPAllowDialin, info, enabled, AccountExpirationDate |
    export-csv newaccounts.csv -NoTypeInformation

Neally · 2021-10-14T14:01:20.000Z

Welcome

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

192033ab-bb8f-4032-88a5-8e2313af0344-codebutton_small.png

Neally Bot

Neally · 2021-10-14T14:29:04.000Z

spiceuser-r9zyv:

security owner of these users

you can add a calculated property in the ‘select-object’ statement

Get-Acl "AD:$($_.distinguishedname)").owner

Select-object Name, 
@{L = "ProxyAddresses"; E = { ($_.ProxyAddresses -match '^') -join ";"}},
@{n="owner";e={(get-acl "AD:$($_.distinguishedname)").owner}}, 
SamAccountName, whenCreated, UserPrincipalName, PasswordLastSet, extensionAttribute1,
 extensionAttribute3, extensionAttribute15, extensionAttribute14, 
 msExchHideFromAddressLists, Mail, Country, countrycode, canonicalname, 
 msNPAllowDialin, info, enabled, AccountExpirationDate

spiceuser-r9zyv · 2021-10-14T14:38:41.000Z

thanks for the reply but unfortunately my output file under owner column is empty

Neally · 2021-10-14T14:41:12.000Z

spiceuser-r9zyv:

thanks for the reply but unfortunately my output file under owner column is empty

please post the code you run

also, if you run it manually, just that part, does that work?

Neally · 2021-10-14T14:50:35.000Z

Works fine for me

Select Name, 
@{L = "ProxyAddresses"; E = { ($_.ProxyAddresses -match '^') -join ";"}}, 
@{n="owner";e={(get-acl "AD:$($_.distinguishedname)").owner}},
SamAccountName, whenCreated, UserPrincipalName, PasswordLastSet, extensionAttribute1, 
extensionAttribute3,extensionAttribute15, extensionAttribute14, msExchHideFromAddressLists,
Mail, Country,countrycode, canonicalname, msNPAllowDialin, info, enabled, AccountExpirationDate

spiceuser-r9zyv · 2021-10-15T06:02:35.000Z

still comes back with an empty field. can you advise where the get acl part goes?

Neally · 2021-10-15T13:25:35.000Z

spiceuser-r9zyv:

still comes back with an empty field. can you advise where the get acl part goes?

I verbatim run what I posted.

ad57fdc5-40b2-4fc9-9ca4-dc658f6f0e37-2021-10-15_8-24-32.png800×613 177 KB

59ca2ea7-3c84-482b-8c8d-7986982aad55-2021-10-15_8-24-32.png841×644 84.9 KB

spiceuser-r9zyv · 2021-10-15T14:38:09.000Z

I’m probably too dumb to figure this out sorry.

where does this part goes " Get-Acl “AD:$($_.distinguishedname)”).owner "?

I copied the Select part you made but the field owner is empty

Neally · 2021-10-15T14:49:19.000Z

spiceuser-r9zyv:

@{n=“owner”;e={(get-acl “AD:$($_.distinguishedname)”).owner}}

this can be anywhere in your ‘select-object’ statament.

Does it work if you run it manually?

get-acl "AD:$((get-aduser $username).distinguishedname)").owner

spiceuser-r9zyv · 2021-10-18T12:29:34.000Z

I get this when running

get-acl "AD:$((get-aduser $username).distinguishedname)").owner

Unexpected token ‘)’ in expression or statement.

CategoryInfo : ParserError: ( , ParentContainsErrorRecordException
FullyQualifiedErrorId : UnexpectedToken

Neally · 2021-10-18T13:20:17.000Z

right…

get-acl "AD:$((get-aduser $username).distinguishedname)" | select-object owner