Advanced Windows PowerShell Scripting Video Training

Advanced Windows PowerShell Scripting Video Training
Advanced Windows PowerShell Scripting Video Training

Tuesday, October 18, 2011

List the PSO associated with a user account with PowerShell



PSO’s (Password Setting Objects) is another name for Fine Grain Password Policy.  A PSO allows an organization to have different password policies based on a security group.  That means that unlike in an Windows 2003 domain where all password meet the same rules, in a 2008 domain you can have multiple rules for your passwords.


The code below allows you two obtain a list of all user accounts that have a PSO assigned to and that PSO is.  It is designed to be used as a function or dot sourced into PowerShell.


Returns a list of user names and there PSO.
Returns a list of user names and the Resultant
PSO that is currently in effect on that user.


Returns a list to the pipeline of the username and the
PSO currently in effect on the user account.
Get-PSOUsers | Sort-Object PSO

Returns a list of users with assigned PSO's, sorted
by the PSO.

Name PSO
---- ---
John Yokim CN=IT PSO,CN=Password Settings C...
Ofer Daliot CN=IT PSO,CN=Password Settings C...
Dave Barnett CN=IT PSO,CN=Password Settings C...
Neville Burdan CN=IT PSO,CN=Password Settings C...

function Get-PSOUsers
Import-Module ActiveDirectory -Cmdlet Get-ADUser

# Get a list of user accounts and also pull the # attribute msDs-ResultantPSO. Also, rename the # msDs-ResultantPSO so it can be processed.
$UserList = Get-AdUser -filter * -property msDS-ResultantPSO | Select name, @{Name="ResultantPSO";Expression={$_."msDS-ResultantPSO"}}

# Create the object to hold the output of this function.
$UserObj = @()

# Loop through each user object and filter # out those do not have a value in the # msDs-ResultantPSO field.
foreach ($User in $UserList)

if ($User.ResultantPSO -Like "*Password*")
# If there is a value in the msDS-ResultantPSO
# than add it to the output.
$UObj = New-Object PSObject
$UObj | Add-Member NoteProperty -Name Name -Value $User.Name
$UObj | Add-Member NoteProperty -Name PSO -Value $User.ResultantPSO
$UserObj += $UObj


No comments: