PowerShell: The Ultimate Ginsu Knife

You don’t have to stay up until the wee hours of the morning looking for an amazing tool that slices and dices like the famed Ginsu Knife. Are you looking for a way to speed up your work? Are you tired of the same old routine? Would you be surprised that your answer is already at your fingertips? Windows PowerShell is the amazing tool that can slice, dice, mince, sort, group and more all of your data. But wait…there’s more.

I’ve been working on a question in the PowerShell forum at ScriptingAnswers.com. The admin wanted to report on all the user accounts that had been assigned the change user password permission. He wanted to see the user account and then what accounts they had permission to modify. His original thought was that he needed to get the permission from every user account and then go through every account again to see if they were in the list. Oh, and we’re talking about 5000+ user accounts.

This is a great example I think of the object paradigm shift in PowerShell. If I have an object for a user account that shows the permissions, I can analyze, sort, group, filter and more that data. I only need to make a single query to Active Directory. Note: my examples are meant to illustrate a concept. They are not necessarily production-ready commands.

We suggested he use the Get-QADPermission from the free Quest AD cmdlets. We can use this cmdlet to find a particular permission.

That’s cool. So I’ll get these permissions for all accounts in Employees organizational unit filtering out Everyone and all the Exchange related objects, and save the results to a variable.

Hmmm…how many accounts am I talking about?

Now for the slicing and dicing. What accounts are affected? I’ll use Select-Object to return unique values for the TargetObject property.

When I have data like this, I also like to group information.

With this, I can find out how many people have the permission for a given count. Remember, Group-Object creates a new type of object.

I wonder who these people are?

I’m sure there are better ways to display this information, but I hope you get the point. There’s so much you can do with this information. Ultimately, I think this is the expression the original poster was looking for to create the management report.

The longest part of this entire process was querying Active Directory, but I only had to do it once.

The biggest challenge many admins still face is thinking “object-ively” but once grasped look at how much you can accomplish. Plus free shipping and handling to boot!