Powershell - Get-WmiObject filter

Question

I need to get local admins on remote machine but need to show only domain users (Users with domain\prefix)

   $admins = Gwmi win32_groupuser –computer computer   
    $admins = $admins |? {$_.groupcomponent –like '*"Administrators"'} 
    $admins |% {  
    $_.partcomponent –match “.+Domain\=(.+)\,Name\=(.+)$” > $nul  
    $matches[1].trim('"') + “\” + $matches[2].trim('"') 
    } 

$admins = $admins |? {$_.groupcomponent –like '*"Administrators"'}

GroupComponent   : \\COMPUTER\root\cimv2:Win32_Group.Domain="COMPUTER",Name="Administrators"
PartComponent    : \\COMPUTER\root\cimv2:Win32_Group.Domain="DOMAIN",Name="Domain Admins"
PSComputerName   : COMPUTER

Current Output:

COMPUTER\Administrator

DOMAIN\Domain Admins

DOMAIN\User1

DOMAIN\user2

I need to show only domain users

Desired Output:

DOMAIN\Domain Admins

DOMAIN\User1

DOMAIN\user2

I tried this:

$admins |% {  
$_.partcomponent –match “.+Domain\='DOMAIN\',Name\=(.+)$” > $nul  
$matches[1].trim('"') + “\” + $matches[2].trim('"') 
}

But single user is shown multiple times

DOMAIN\User1

DOMAIN\user1

You should make the output conditional on the -match operator: if($_.PartComponent -match '...'){ $matches... }else{ Write-Warning "Couldn't extract name from $($_.PartComponent)"} — Mathias R. Jessen
– Mathias R. Jessen, Commented Oct 21, 2020 at 14:22
Any specific reason you're not using Get-LocalGroupMember ? — Doug Maurer
– Doug Maurer, Commented Oct 21, 2020 at 14:49
As aside, don't use those curly so-called 'smart-quotes' “ and ” in code. Instead use straight ones " — Theo
– Theo, Commented Oct 21, 2020 at 15:14

KUTlime · Accepted Answer · 2020-10-21 19:45:29Z

1

Please, please, please do not use that spaghetti code from TechNet gallery.

A good script is a well written (English) prose.

Get-WmiObject Win32_GroupUser –Computer PlaceYourComputerNameHere | <# Now, you have all users #>
Where-Object {$_.GroupComponent –like '*"Administrators"'} | <# Now, you have all Administrators #>
Where-Object { $_.PartComponent  –match ".+Domain\=""(.+)"",Name\=(.+)$"} | <# Now, you have all domain administrators and you have created two regex groups by (.+) with index 1 and 2 #>
ForEach-Object {"$($Matches[1])\$($Matches[2])"} <# Now, you concatenated the results from regex matches into a single string #>

edited Oct 21, 2020 at 19:45

answered Oct 21, 2020 at 16:14

KUTlime

8,4641 gold badge28 silver badges40 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

overflowed Over a year ago

Thanks for tips but it's not answer for my question

overflowed · Accepted Answer · 2020-10-22 07:05:50Z

1

Figured it out

$admins |% {  
$_.partcomponent –match ".+Domain\=(.+)\,Name\=(.+)$" > $nul 
$matches[1].trim('"') + "\" + $matches[2].trim('"') | Where-Object {$_ -like 'DOMAIN*' }
}

Output:

DOMAIN\Domain Admins
DOMAIN\user1
DOMAIN\User2

edited Oct 22, 2020 at 7:05

answered Oct 22, 2020 at 6:56

overflowed

1,2632 gold badges24 silver badges50 bronze badges

1 Comment

KUTlime Over a year ago

BTW: If you look closely on my answer, you would see that you can apply a small change to your regex and you don't need to trim anything.

Collectives™ on Stack Overflow

Powershell - Get-WmiObject filter

2 Answers 2

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related