29 Aralık 2023

SCCM CMPivot Powershell ile Local Admin Raporu

Hasan AYGIR SCCM 0 Yorum

SCCM CMPivot Powershell ile Local Admin Raporu

Herhangi bir collection’da yer alan clientlardaki local adminleri bulmak için SCCM üzerinden CMPivot aracı kullanılabiliyor. Bunun için collection’a sağ tıklayıp CMPivot seçeneğini seçtiğinizde query kısmına uygun sorguyu yazmanız gerekiyor.

Örneğin Domain Adminler hariç bütün admin hesaplarının listesi için şu sorgu gerekiyor.


Administrators | where Name !contains  'Domain Admins'

Administrators | where Name !contains 'Domain Admins'

Bu işlemi daha kolay ve otomatik hale getirmek için CMpivot’u powershell rest api aracılığıyla çağırıp kullanabiliyoruz. Yukarıdaki kodun powershell örneği aşağıda yer almaktadır. Siz de kendinize göre değişiklik yapabilirsiniz.

SCCMSERVER kısmına kendi sccm server adınızı yazacaksınız <em>HAS00074</em> kısmı collection ID. Burayı işlem yapmak istediğiniz collection ID ile değiştireceksiniz.


#SCCM_CMPIVOT_Quer
$Body = @{"InputQuery" = "Administrators | where Name !contains 'Administrator' and Name !contains 'Domain Admins'"} | ConvertTo-Json
#RunQuery_Certain_Collection
$DDD = Invoke-RestMethod  -Method Post -Uri "https://<SCCMServer>/AdminService/v1.0/Collections('HAS00074')/AdminService.RunCMPivot" -UseDefaultCredentials -Body $body -ContentType "application/json" 
#Time: Time Consideration: Remember that CMPivot scanning also requires a certain amount of time. For instance, when dealing with 500 Servers, the process could potentially take around 2 minutes. If your server count exceeds this, it's advisable to allocate additional time accordingly.
$durationInSeconds = 120
$counter = 0

while ($counter -lt $durationInSeconds) {
    Write-Host "Scanning running - Elapsed time: $counter seconds" -ForegroundColor Green
    Start-Sleep -Seconds 1
    $counter++
}

Write-Host "Scanning completed."
#GetJobIDfrom_CMPivot
$Operid = $DDD.OperationId 
$url = 'https://SCCMServer>/AdminService/v1.0//SMS_CMPivotStatus?$filter=ClientOperationId eq ' + $Operid 
$ResOfOperID = Invoke-RestMethod -Method Get -Uri $url -UseDefaultCredentials -ContentType "application/json"
$ResultOfQuery = $ResOfOperID.value |  select DeviceName,ScriptOutput 
$Result = @(
   foreach ($g in $ResultOfQuery ) {
   [pscustomobject] @{
   "Name" = $g.DeviceName
   "ADObject" = $g.ScriptOutput -replace 'PrincipalSource="ActiveDirectory" /><e _i="0"', '' -replace '<result ResultCode="0" moreResults="False"><e _i="0"', '' -replace 'PrincipalSource="ActiveDirectory" /></result>','' -replace ' <result ResultCode="0" moreResults="False"><e _i="0"','' -replace 'ObjectClass="', "`nObjectClass=""" -replace ' /><e _i="0"','' -replace '/></result>','' -replace 'ObjectClass=','' -replace "Group",'Group:' -replace "Name",'' -replace '"','' -replace 'User','User:' -replace ' =','' -replace ' PrincipalSource=Local ' ,':"Local"'

   }}
   )
$LoaclAdmin = $Result 
$uniqueLoaclAdmin = $LoaclAdmin | Group-Object Name | ForEach-Object {
    $_.Group | Select-Object -First 1
}
 $FinalReport  = $uniqueLoaclAdmin 
 # Create an array to hold the structured data
$structuredData = @()
# Iterate through each item in $FinalReport
foreach ($item in $FinalReport) {
    $structuredItem = [PSCustomObject]@{
        Name = $item.Name
        ADObject = $item.ADObject
        GroupMembers = $item.Group -replace "Group:", "" -join ", "
        UserMembers = $item.User -replace "User:", "" -join ", "
    }
    $structuredData += $structuredItem
}

# Export the structured data to a CSV file
$structuredData | Export-Csv -Path "C:\LocalAdminList.csv" -NoTypeInformation -Encoding UTF8

#SCCM_CMPIVOT_Quer

$Body = @{"InputQuery" = "Administrators | where Name !contains 'Administrator' and Name !contains 'Domain Admins'"} | ConvertTo-Json

#RunQuery_Certain_Collection

$DDD = Invoke-RestMethod -Method Post -Uri "https://<SCCMServer>/AdminService/v1.0/Collections('HAS00074')/AdminService.RunCMPivot" -UseDefaultCredentials -Body $body -ContentType "application/json"

#Time: Time Consideration: Remember that CMPivot scanning also requires a certain amount of time. For instance, when dealing with 500 Servers, the process could potentially take around 2 minutes. If your server count exceeds this, it's advisable to allocate additional time accordingly.

$durationInSeconds = 120

$counter = 0

while ($counter -lt $durationInSeconds) {

Write-Host "Scanning running - Elapsed time: $counter seconds" -ForegroundColor Green

Start-Sleep -Seconds 1

$counter++

}

Write-Host "Scanning completed."

#GetJobIDfrom_CMPivot

$Operid = $DDD.OperationId

$url = 'https://SCCMServer>/AdminService/v1.0//SMS_CMPivotStatus?$filter=ClientOperationId eq ' + $Operid

$ResOfOperID = Invoke-RestMethod -Method Get -Uri $url -UseDefaultCredentials -ContentType "application/json"

$ResultOfQuery = $ResOfOperID.value | select DeviceName,ScriptOutput

$Result = @(

foreach ($g in $ResultOfQuery ) {

[pscustomobject] @{

"Name" = $g.DeviceName

"ADObject" = $g.ScriptOutput -replace 'PrincipalSource="ActiveDirectory" /><e _i="0"', '' -replace '<result ResultCode="0" moreResults="False"><e _i="0"', '' -replace 'PrincipalSource="ActiveDirectory" /></result>','' -replace ' <result ResultCode="0" moreResults="False"><e _i="0"','' -replace 'ObjectClass="', "`nObjectClass=""" -replace ' /><e _i="0"','' -replace '/></result>','' -replace 'ObjectClass=','' -replace "Group",'Group:' -replace "Name",'' -replace '"','' -replace 'User','User:' -replace ' =','' -replace ' PrincipalSource=Local ' ,':"Local"'

}}

)

$LoaclAdmin = $Result

$uniqueLoaclAdmin = $LoaclAdmin | Group-Object Name | ForEach-Object {

$_.Group | Select-Object -First 1

}

$FinalReport = $uniqueLoaclAdmin

# Create an array to hold the structured data

$structuredData = @()

# Iterate through each item in $FinalReport

foreach ($item in $FinalReport) {

$structuredItem = [PSCustomObject]@{

Name = $item.Name

ADObject = $item.ADObject

GroupMembers = $item.Group -replace "Group:", "" -join ", "

UserMembers = $item.User -replace "User:", "" -join ", "

}

$structuredData += $structuredItem

}

# Export the structured data to a CSV file

$structuredData | Export-Csv -Path "C:\LocalAdminList.csv" -NoTypeInformation -Encoding UTF8

CMPivot taraması belirli bir zaman istiyor o yüzden burda bir zaman tanımı yapmamız gerekiyor. 500 sunucu için yaklaşık olarak 120 saniyelik bir süre yeterli oluyor.

Raporu csv olarak export ediyoruz

Export-Csv -Path \”C:\\LocalAdminListesi.csv” -NoTypeInformation -Encoding UTF8

Kaynak: https://www.linkedin.com/pulse/sccm-restapi-cmpivot-powershell-local-admin-report-meir-peleg/

Yorum Yap

Yorum yapabilmek için oturum açmalısınız.

Benzer Yazılar

Yorum Yap