function Invoke-ScriptSentry{

[CmdletBinding()]

Param(

[boolean]$SaveOutput = $false

)

function Get-ForestDomains {

[CmdletBinding()]

param()

$forest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()

$forest.Domains

}

function Get-Domain {

[OutputType([System.DirectoryServices.ActiveDirectory.Domain])]

[CmdletBinding()]

Param(

[Parameter(Position = 0, ValueFromPipeline = $True)]

[ValidateNotNullOrEmpty()]

[String]

$Domain,

[Management.Automation.PSCredential]

[Management.Automation.CredentialAttribute()]

$Credential = [Management.Automation.PSCredential]::Empty

)

PROCESS {

if ($PSBoundParameters['Credential']) {

Write-Verbose '[Get-Domain] Using alternate credentials for Get-Domain'

if ($PSBoundParameters['Domain']) {

$TargetDomain = $Domain

}

else {

# if no domain is supplied, extract the logon domain from the PSCredential passed

$TargetDomain = $Credential.GetNetworkCredential().Domain

Write-Verbose "[Get-Domain] Extracted domain '$TargetDomain' from -Credential"

}

$DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $TargetDomain, $Credential.UserName, $Credential.GetNetworkCredential().Password)

try {

[System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext)

}

catch {

Write-Verbose "[Get-Domain] The specified domain '$TargetDomain' does not exist, could not be contacted, there isn't an existing trust, or the specified credentials are invalid: $_"

}

}

elseif ($PSBoundParameters['Domain']) {

$DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $Domain)

try {

[System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext)

}

catch {

Write-Verbose "[Get-Domain] The specified domain '$Domain' does not exist, could not be contacted, or there isn't an existing trust : $_"

}

}

else {

try {

[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()

}

catch {

Write-Verbose "[Get-Domain] Error retrieving the current domain: $_"

}

}

}

}

function Get-DomainSearcher {

[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')]

[OutputType('System.DirectoryServices.DirectorySearcher')]

[CmdletBinding()]

Param(

[Parameter(ValueFromPipeline = $True)]

[ValidateNotNullOrEmpty()]

[String]

$Domain,

[ValidateNotNullOrEmpty()]

[Alias('Filter')]

[String]

$LDAPFilter,

[ValidateNotNullOrEmpty()]

[String[]]

$Properties,

[ValidateNotNullOrEmpty()]

[Alias('ADSPath')]

[String]

$SearchBase,

[ValidateNotNullOrEmpty()]

[String]

$SearchBasePrefix,

[ValidateNotNullOrEmpty()]

[Alias('DomainController')]

[String]

$Server,

[ValidateSet('Base', 'OneLevel', 'Subtree')]

[String]

$SearchScope = 'Subtree',

[ValidateRange(1, 10000)]

[Int]

$ResultPageSize = 200,

[ValidateRange(1, 10000)]

[Int]

$ServerTimeLimit = 120,

[ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]

[String]

$SecurityMasks,

[Switch]

$Tombstone,

[Management.Automation.PSCredential]

[Management.Automation.CredentialAttribute()]

$Credential = [Management.Automation.PSCredential]::Empty

)

PROCESS {

if ($PSBoundParameters['Domain']) {

$TargetDomain = $Domain

if ($ENV:USERDNSDOMAIN -and ($ENV:USERDNSDOMAIN.Trim() -ne '')) {

# see if we can grab the user DNS logon domain from environment variables

$UserDomain = $ENV:USERDNSDOMAIN

if ($ENV:LOGONSERVER -and ($ENV:LOGONSERVER.Trim() -ne '') -and $UserDomain) {

$BindServer = "$($ENV:LOGONSERVER -replace '\\','').$UserDomain"

}

}

}

elseif ($PSBoundParameters['Credential']) {

# if not -Domain is specified, but -Credential is, try to retrieve the current domain name with Get-Domain

$DomainObject = Get-Domain -Credential $Credential

$BindServer = ($DomainObject.PdcRoleOwner).Name

$TargetDomain = $DomainObject.Name

}

elseif ($ENV:USERDNSDOMAIN -and ($ENV:USERDNSDOMAIN.Trim() -ne '')) {

# see if we can grab the user DNS logon domain from environment variables

$TargetDomain = $ENV:USERDNSDOMAIN

if ($ENV:LOGONSERVER -and ($ENV:LOGONSERVER.Trim() -ne '') -and $TargetDomain) {

$BindServer = "$($ENV:LOGONSERVER -replace '\\','').$TargetDomain"

}

}

else {

# otherwise, resort to Get-Domain to retrieve the current domain object

write-verbose "get-domain"

$DomainObject = Get-Domain

$BindServer = ($DomainObject.PdcRoleOwner).Name

$TargetDomain = $DomainObject.Name

}

if ($PSBoundParameters['Server']) {

# if there's not a specified server to bind to, try to pull a logon server from ENV variables

$BindServer = $Server

}

$SearchString = 'LDAP://'

if ($BindServer -and ($BindServer.Trim() -ne '')) {

$SearchString += $BindServer

if ($TargetDomain) {

$SearchString += '/'

}

}

if ($PSBoundParameters['SearchBasePrefix']) {

$SearchString += $SearchBasePrefix + ','

}

if ($PSBoundParameters['SearchBase']) {

if ($SearchBase -Match '^GC://') {

# if we're searching the global catalog, get the path in the right format

$DN = $SearchBase.ToUpper().Trim('/')

$SearchString = ''

}

else {

if ($SearchBase -match '^LDAP://') {

if ($SearchBase -match "LDAP://.+/.+") {

$SearchString = ''

$DN = $SearchBase

}

else {

$DN = $SearchBase.SubString(7)

}

}

else {

$DN = $SearchBase

}

}

}

else {

# transform the target domain name into a distinguishedName if an ADS search base is not specified

if ($TargetDomain -and ($TargetDomain.Trim() -ne '')) {

$DN = "DC=$($TargetDomain.Replace('.', ',DC='))"

}

}

$SearchString += $DN

Write-Verbose "[Get-DomainSearcher] search base: $SearchString"

if ($Credential -ne [Management.Automation.PSCredential]::Empty) {

Write-Verbose "[Get-DomainSearcher] Using alternate credentials for LDAP connection"

# bind to the inital search object using alternate credentials

$DomainObject = New-Object DirectoryServices.DirectoryEntry($SearchString, $Credential.UserName, $Credential.GetNetworkCredential().Password)

$Searcher = New-Object System.DirectoryServices.DirectorySearcher($DomainObject)

}

else {

# bind to the inital object using the current credentials

$Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$SearchString)

}

$Searcher.PageSize = $ResultPageSize

$Searcher.SearchScope = $SearchScope

$Searcher.CacheResults = $False

$Searcher.ReferralChasing = [System.DirectoryServices.ReferralChasingOption]::All

if ($PSBoundParameters['ServerTimeLimit']) {

$Searcher.ServerTimeLimit = $ServerTimeLimit

}

if ($PSBoundParameters['Tombstone']) {

$Searcher.Tombstone = $True

}

if ($PSBoundParameters['LDAPFilter']) {

$Searcher.filter = $LDAPFilter

}

if ($PSBoundParameters['SecurityMasks']) {

$Searcher.SecurityMasks = Switch ($SecurityMasks) {

'Dacl' { [System.DirectoryServices.SecurityMasks]::Dacl }

'Group' { [System.DirectoryServices.SecurityMasks]::Group }

'None' { [System.DirectoryServices.SecurityMasks]::None }

'Owner' { [System.DirectoryServices.SecurityMasks]::Owner }

'Sacl' { [System.DirectoryServices.SecurityMasks]::Sacl }

}

}

if ($PSBoundParameters['Properties']) {

# handle an array of properties to load w/ the possibility of comma-separated strings

$PropertiesToLoad = $Properties| ForEach-Object { $_.Split(',') }

$Null = $Searcher.PropertiesToLoad.AddRange(($PropertiesToLoad))

}

$Searcher

}

}

function Get-DomainGroupMember {

[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')]

[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')]

[OutputType('StrongView.GroupMember')]

[CmdletBinding(DefaultParameterSetName = 'None')]

Param(

[Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]

[Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]

[String[]]

$Identity,

[ValidateNotNullOrEmpty()]

[String]

$Domain,

[Parameter(ParameterSetName = 'ManualRecurse')]

[Switch]

$Recurse,

[Parameter(ParameterSetName = 'RecurseUsingMatchingRule')]

[Switch]

$RecurseUsingMatchingRule,

[ValidateNotNullOrEmpty()]

[Alias('Filter')]

[String]

$LDAPFilter,

[ValidateNotNullOrEmpty()]

[Alias('ADSPath')]

[String]

$SearchBase,

[ValidateNotNullOrEmpty()]

[Alias('DomainController')]

[String]

$Server,

[ValidateSet('Base', 'OneLevel', 'Subtree')]

[String]

$SearchScope = 'Subtree',

[ValidateRange(1, 10000)]

[Int]

$ResultPageSize = 200,

[ValidateRange(1, 10000)]

[Int]

$ServerTimeLimit,

[ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]

[String]

$SecurityMasks,

[Switch]

$Tombstone,

[Management.Automation.PSCredential]

[Management.Automation.CredentialAttribute()]

$Credential = [Management.Automation.PSCredential]::Empty

)

BEGIN {

$SearcherArguments = @{

'Properties' = 'member,samaccountname,distinguishedname'

}

if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }

if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter }

if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }

if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }

if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }

if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }

if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }

if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }

if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }

$ADNameArguments = @{}

if ($PSBoundParameters['Domain']) { $ADNameArguments['Domain'] = $Domain }

if ($PSBoundParameters['Server']) { $ADNameArguments['Server'] = $Server }

if ($PSBoundParameters['Credential']) { $ADNameArguments['Credential'] = $Credential }

}

PROCESS {

$GroupSearcher = Get-DomainSearcher @SearcherArguments

if ($GroupSearcher) {

if ($PSBoundParameters['RecurseUsingMatchingRule']) {

$SearcherArguments['Identity'] = $Identity

$SearcherArguments['Raw'] = $True

$Group = Get-DomainGroup @SearcherArguments

if (-not $Group) {

Write-Warning "[Get-DomainGroupMember] Error searching for group with identity: $Identity"

}

else {

$GroupFoundName = $Group.properties.item('samaccountname')[0]

$GroupFoundDN = $Group.properties.item('distinguishedname')[0]

if ($PSBoundParameters['Domain']) {

$GroupFoundDomain = $Domain

}

else {

# if a domain isn't passed, try to extract it from the found group distinguished name

if ($GroupFoundDN) {

$GroupFoundDomain = $GroupFoundDN.SubString($GroupFoundDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'

}

}

Write-Verbose "[Get-DomainGroupMember] Using LDAP matching rule to recurse on '$GroupFoundDN', only user accounts will be returned."

$GroupSearcher.filter = "(&(samAccountType=805306368)(memberof:1.2.840.113556.1.4.1941:=$GroupFoundDN))"

$GroupSearcher.PropertiesToLoad.AddRange(('distinguishedName'))

$Members = $GroupSearcher.FindAll() | ForEach-Object {$_.Properties.distinguishedname[0]}

}

$Null = $SearcherArguments.Remove('Raw')

}

else {

$IdentityFilter = ''

$Filter = ''

$Identity | Where-Object {$_} | ForEach-Object {

$IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')

if ($IdentityInstance -match '^S-1-') {

$IdentityFilter += "(objectsid=$IdentityInstance)"

}

elseif ($IdentityInstance -match '^CN=') {

$IdentityFilter += "(distinguishedname=$IdentityInstance)"

if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {

# if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname

# and rebuild the domain searcher

$IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'

Write-Verbose "[Get-DomainGroupMember] Extracted domain '$IdentityDomain' from '$IdentityInstance'"

$SearcherArguments['Domain'] = $IdentityDomain

$GroupSearcher = Get-DomainSearcher @SearcherArguments

if (-not $GroupSearcher) {

Write-Warning "[Get-DomainGroupMember] Unable to retrieve domain searcher for '$IdentityDomain'"

}

}

}

elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') {

$GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join ''

$IdentityFilter += "(objectguid=$GuidByteString)"

}

elseif ($IdentityInstance.Contains('\')) {

$ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical

if ($ConvertedIdentityInstance) {

$GroupDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/'))

$GroupName = $IdentityInstance.Split('\')[1]

$IdentityFilter += "(samAccountName=$GroupName)"

$SearcherArguments['Domain'] = $GroupDomain

Write-Verbose "[Get-DomainGroupMember] Extracted domain '$GroupDomain' from '$IdentityInstance'"

$GroupSearcher = Get-DomainSearcher @SearcherArguments

}

}

else {

$IdentityFilter += "(samAccountName=$IdentityInstance)"

}

}

if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {

$Filter += "(|$IdentityFilter)"

}

if ($PSBoundParameters['LDAPFilter']) {

Write-Verbose "[Get-DomainGroupMember] Using additional LDAP filter: $LDAPFilter"

$Filter += "$LDAPFilter"

}

$GroupSearcher.filter = "(&(objectCategory=group)$Filter)"

Write-Verbose "[Get-DomainGroupMember] Get-DomainGroupMember filter string: $($GroupSearcher.filter)"

try {

$Result = $GroupSearcher.FindOne()

}

catch {

Write-Warning "[Get-DomainGroupMember] Error searching for group with identity '$Identity': $_"

$Members = @()

}

$GroupFoundName = ''

$GroupFoundDN = ''

if ($Result) {

$Members = $Result.properties.item('member')

if ($Members.count -eq 0) {

# ranged searching, thanks @meatballs__ !

$Finished = $False

$Bottom = 0

$Top = 0

while (-not $Finished) {

$Top = $Bottom + 1499

$MemberRange="member;range=$Bottom-$Top"

$Bottom += 1500

$Null = $GroupSearcher.PropertiesToLoad.Clear()

$Null = $GroupSearcher.PropertiesToLoad.Add("$MemberRange")

$Null = $GroupSearcher.PropertiesToLoad.Add('samaccountname')

$Null = $GroupSearcher.PropertiesToLoad.Add('distinguishedname')

try {

$Result = $GroupSearcher.FindOne()

$RangedProperty = $Result.Properties.PropertyNames -like "member;range=*"

$Members += $Result.Properties.item($RangedProperty)

$GroupFoundName = $Result.properties.item('samaccountname')[0]

$GroupFoundDN = $Result.properties.item('distinguishedname')[0]

if ($Members.count -eq 0) {

$Finished = $True

}

}

catch [System.Management.Automation.MethodInvocationException] {

$Finished = $True

}

}

}

else {

$GroupFoundName = $Result.properties.item('samaccountname')[0]

$GroupFoundDN = $Result.properties.item('distinguishedname')[0]

$Members += $Result.Properties.item($RangedProperty)

}

if ($PSBoundParameters['Domain']) {

$GroupFoundDomain = $Domain

}

else {

# if a domain isn't passed, try to extract it from the found group distinguished name

if ($GroupFoundDN) {

$GroupFoundDomain = $GroupFoundDN.SubString($GroupFoundDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'

}

}

}

}

ForEach ($Member in $Members) {

if ($Recurse -and $UseMatchingRule) {

$Properties = $_.Properties

}

else {

$ObjectSearcherArguments = $SearcherArguments.Clone()

$ObjectSearcherArguments['Identity'] = $Member

$ObjectSearcherArguments['Raw'] = $True

$ObjectSearcherArguments['Properties'] = 'distinguishedname,cn,samaccountname,objectsid,objectclass'

$Object = Get-DomainObject @ObjectSearcherArguments

$Properties = $Object.Properties

}

if ($Properties) {

$GroupMember = New-Object PSObject

$GroupMember | Add-Member Noteproperty 'GroupDomain' $GroupFoundDomain

$GroupMember | Add-Member Noteproperty 'GroupName' $GroupFoundName

$GroupMember | Add-Member Noteproperty 'GroupDistinguishedName' $GroupFoundDN

if ($Properties.objectsid) {

$MemberSID = ((New-Object System.Security.Principal.SecurityIdentifier $Properties.objectsid[0], 0).Value)

}

else {

$MemberSID = $Null

}

try {

$MemberDN = $Properties.distinguishedname[0]

if ($MemberDN -match 'ForeignSecurityPrincipals|S-1-5-21') {

try {

if (-not $MemberSID) {

$MemberSID = $Properties.cn[0]

}

$MemberSimpleName = Convert-ADName -Identity $MemberSID -OutputType 'DomainSimple' @ADNameArguments

if ($MemberSimpleName) {

$MemberDomain = $MemberSimpleName.Split('@')[1]

}

else {

Write-Warning "[Get-DomainGroupMember] Error converting $MemberDN"

$MemberDomain = $Null

}

}

catch {

Write-Warning "[Get-DomainGroupMember] Error converting $MemberDN"

$MemberDomain = $Null

}

}

else {

# extract the FQDN from the Distinguished Name

$MemberDomain = $MemberDN.SubString($MemberDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'

}

}

catch {

$MemberDN = $Null

$MemberDomain = $Null

}

if ($Properties.samaccountname) {

# forest users have the samAccountName set

$MemberName = $Properties.samaccountname[0]

}

else {

# external trust users have a SID, so convert it

try {

$MemberName = ConvertFrom-SID -ObjectSID $Properties.cn[0] @ADNameArguments

}

catch {

# if there's a problem contacting the domain to resolve the SID

$MemberName = $Properties.cn[0]

}

}

if ($Properties.objectclass -match 'computer') {

$MemberObjectClass = 'computer'

}

elseif ($Properties.objectclass -match 'group') {

$MemberObjectClass = 'group'

}

elseif ($Properties.objectclass -match 'user') {

$MemberObjectClass = 'user'

}

else {

$MemberObjectClass = $Null

}

$GroupMember | Add-Member Noteproperty 'MemberDomain' $MemberDomain

$GroupMember | Add-Member Noteproperty 'MemberName' $MemberName

$GroupMember | Add-Member Noteproperty 'MemberDistinguishedName' $MemberDN

$GroupMember | Add-Member Noteproperty 'MemberObjectClass' $MemberObjectClass

$GroupMember | Add-Member Noteproperty 'MemberSID' $MemberSID

$GroupMember.PSObject.TypeNames.Insert(0, 'StrongView.GroupMember')

$GroupMember

# if we're doing manual recursion

if ($PSBoundParameters['Recurse'] -and $MemberDN -and ($MemberObjectClass -match 'group')) {

Write-Verbose "[Get-DomainGroupMember] Manually recursing on group: $MemberDN"

$SearcherArguments['Identity'] = $MemberDN

$Null = $SearcherArguments.Remove('Properties')

Get-DomainGroupMember @SearcherArguments

}

}

}

$GroupSearcher.dispose()

}

}

}

function Get-DomainUser {

[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')]

[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')]

[OutputType('StrongView.User')]

[OutputType('StrongView.User.Raw')]

[CmdletBinding(DefaultParameterSetName = 'AllowDelegation')]

Param(

[Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]

[Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]

[String[]]

$Identity,

[Switch]

$SPN,

[Switch]

$AdminCount,

[Parameter(ParameterSetName = 'AllowDelegation')]

[Switch]

$AllowDelegation,

[Parameter(ParameterSetName = 'DisallowDelegation')]

[Switch]

$DisallowDelegation,

[Switch]

$TrustedToAuth,

[Alias('KerberosPreauthNotRequired', 'NoPreauth')]

[Switch]

$PreauthNotRequired,

[ValidateNotNullOrEmpty()]

[String]

$Domain,

[ValidateNotNullOrEmpty()]

[Alias('Filter')]

[String]

$LDAPFilter,

[ValidateNotNullOrEmpty()]

[String[]]

$Properties,

[ValidateNotNullOrEmpty()]

[Alias('ADSPath')]

[String]

$SearchBase,

[ValidateNotNullOrEmpty()]

[Alias('DomainController')]

[String]

$Server,

[ValidateSet('Base', 'OneLevel', 'Subtree')]

[String]

$SearchScope = 'Subtree',

[ValidateRange(1, 10000)]

[Int]

$ResultPageSize = 200,

[ValidateRange(1, 10000)]

[Int]

$ServerTimeLimit,

[ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]

[String]

$SecurityMasks,

[Switch]

$Tombstone,

[Alias('ReturnOne')]

[Switch]

$FindOne,

[Management.Automation.PSCredential]

[Management.Automation.CredentialAttribute()]

$Credential = [Management.Automation.PSCredential]::Empty,

[Switch]

$Raw

)

BEGIN {

$SearcherArguments = @{}

if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }

if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }

if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }

if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }

if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }

if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }

if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }

if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }

if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }

if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }

$UserSearcher = Get-DomainSearcher @SearcherArguments

}

PROCESS {

if ($UserSearcher) {

$IdentityFilter = ''

$Filter = ''

$Identity | Where-Object {$_} | ForEach-Object {

$IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')

if ($IdentityInstance -match '^S-1-') {

$IdentityFilter += "(objectsid=$IdentityInstance)"

}

elseif ($IdentityInstance -match '^CN=') {

$IdentityFilter += "(distinguishedname=$IdentityInstance)"

if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {

# if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname

# and rebuild the domain searcher

$IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'

Write-Verbose "[Get-DomainUser] Extracted domain '$IdentityDomain' from '$IdentityInstance'"

$SearcherArguments['Domain'] = $IdentityDomain

$UserSearcher = Get-DomainSearcher @SearcherArguments

if (-not $UserSearcher) {

Write-Warning "[Get-DomainUser] Unable to retrieve domain searcher for '$IdentityDomain'"

}

}

}

elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') {

$GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join ''

$IdentityFilter += "(objectguid=$GuidByteString)"

}

elseif ($IdentityInstance.Contains('\')) {

$ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical

if ($ConvertedIdentityInstance) {

$UserDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/'))

$UserName = $IdentityInstance.Split('\')[1]

$IdentityFilter += "(samAccountName=$UserName)"

$SearcherArguments['Domain'] = $UserDomain

Write-Verbose "[Get-DomainUser] Extracted domain '$UserDomain' from '$IdentityInstance'"

$UserSearcher = Get-DomainSearcher @SearcherArguments

}

}

else {

$IdentityFilter += "(samAccountName=$IdentityInstance)"

}

}

if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {

$Filter += "(|$IdentityFilter)"

}

if ($PSBoundParameters['SPN']) {

Write-Verbose '[Get-DomainUser] Searching for non-null service principal names'

$Filter += '(servicePrincipalName=*)'

}

if ($PSBoundParameters['AllowDelegation']) {

Write-Verbose '[Get-DomainUser] Searching for users who can be delegated'

# negation of "Accounts that are sensitive and not trusted for delegation"

$Filter += '(!(userAccountControl:1.2.840.113556.1.4.803:=1048574))'

}

if ($PSBoundParameters['DisallowDelegation']) {

Write-Verbose '[Get-DomainUser] Searching for users who are sensitive and not trusted for delegation'

$Filter += '(userAccountControl:1.2.840.113556.1.4.803:=1048574)'

}

if ($PSBoundParameters['AdminCount']) {

Write-Verbose '[Get-DomainUser] Searching for adminCount=1'

$Filter += '(admincount=1)'

}

if ($PSBoundParameters['TrustedToAuth']) {

Write-Verbose '[Get-DomainUser] Searching for users that are trusted to authenticate for other principals'

$Filter += '(msds-allowedtodelegateto=*)'

}

if ($PSBoundParameters['PreauthNotRequired']) {

Write-Verbose '[Get-DomainUser] Searching for user accounts that do not require kerberos preauthenticate'

$Filter += '(userAccountControl:1.2.840.113556.1.4.803:=4194304)'

}

if ($PSBoundParameters['LDAPFilter']) {

Write-Verbose "[Get-DomainUser] Using additional LDAP filter: $LDAPFilter"

$Filter += "$LDAPFilter"

}

# build the LDAP filter for the dynamic UAC filter value

$UACFilter | Where-Object {$_} | ForEach-Object {

if ($_ -match 'NOT_.*') {

$UACField = $_.Substring(4)

$UACValue = [Int]($UACEnum::$UACField)

$Filter += "(!(userAccountControl:1.2.840.113556.1.4.803:=$UACValue))"

}

else {

$UACValue = [Int]($UACEnum::$_)

$Filter += "(userAccountControl:1.2.840.113556.1.4.803:=$UACValue)"

}

}

$UserSearcher.filter = "(&(samAccountType=805306368)$Filter)"

Write-Verbose "[Get-DomainUser] filter string: $($UserSearcher.filter)"

if ($PSBoundParameters['FindOne']) { $Results = $UserSearcher.FindOne() }

else { $Results = $UserSearcher.FindAll() }

$Results | Where-Object {$_} | ForEach-Object {

if ($PSBoundParameters['Raw']) {

# return raw result objects

$User = $_

$User.PSObject.TypeNames.Insert(0, 'StrongView.User.Raw')

}

else {

$User = Convert-LDAPProperty -Properties $_.Properties

$User.PSObject.TypeNames.Insert(0, 'StrongView.User')

}

$User

}

if ($Results) {

try { $Results.dispose() }

catch {

Write-Verbose "[Get-DomainUser] Error disposing of the Results object: $_"

}

}

$UserSearcher.dispose()

}

}

}

function Get-DomainObject {

[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')]

[OutputType('StrongView.ADObject')]

[OutputType('StrongView.ADObject.Raw')]

[CmdletBinding()]

Param(

[Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]

[Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]

[String[]]

$Identity,

[ValidateNotNullOrEmpty()]

[String]

$Domain,

[ValidateNotNullOrEmpty()]

[Alias('Filter')]

[String]

$LDAPFilter,

[ValidateNotNullOrEmpty()]

[String[]]

$Properties,

[ValidateNotNullOrEmpty()]

[Alias('ADSPath')]

[String]

$SearchBase,

[ValidateNotNullOrEmpty()]

[Alias('DomainController')]

[String]

$Server,

[ValidateSet('Base', 'OneLevel', 'Subtree')]

[String]

$SearchScope = 'Subtree',

[ValidateRange(1, 10000)]

[Int]

$ResultPageSize = 200,

[ValidateRange(1, 10000)]

[Int]

$ServerTimeLimit,

[ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]

[String]

$SecurityMasks,

[Switch]

$Tombstone,

[Alias('ReturnOne')]

[Switch]

$FindOne,

[Management.Automation.PSCredential]

[Management.Automation.CredentialAttribute()]

$Credential = [Management.Automation.PSCredential]::Empty,

[Switch]

$Raw

)

BEGIN {

$SearcherArguments = @{}

if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }

if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }

if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }

if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }

if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }

if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }

if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }

if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }

if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }

if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }

$ObjectSearcher = Get-DomainSearcher @SearcherArguments

}

PROCESS {

if ($ObjectSearcher) {

$IdentityFilter = ''

$Filter = ''

$Identity | Where-Object {$_} | ForEach-Object {

$IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')

if ($IdentityInstance -match '^S-1-') {

$IdentityFilter += "(objectsid=$IdentityInstance)"

}

elseif ($IdentityInstance -match '^(CN|OU|DC)=') {

$IdentityFilter += "(distinguishedname=$IdentityInstance)"

if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {

# if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname

# and rebuild the domain searcher

$IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'

Write-Verbose "[Get-DomainObject] Extracted domain '$IdentityDomain' from '$IdentityInstance'"

$SearcherArguments['Domain'] = $IdentityDomain

$ObjectSearcher = Get-DomainSearcher @SearcherArguments

if (-not $ObjectSearcher) {

Write-Warning "[Get-DomainObject] Unable to retrieve domain searcher for '$IdentityDomain'"

}

}

}

elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') {

$GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join ''

$IdentityFilter += "(objectguid=$GuidByteString)"

}

elseif ($IdentityInstance.Contains('\')) {

$ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical

if ($ConvertedIdentityInstance) {

$ObjectDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/'))

$ObjectName = $IdentityInstance.Split('\')[1]

$IdentityFilter += "(samAccountName=$ObjectName)"

$SearcherArguments['Domain'] = $ObjectDomain

Write-Verbose "[Get-DomainObject] Extracted domain '$ObjectDomain' from '$IdentityInstance'"

$ObjectSearcher = Get-DomainSearcher @SearcherArguments

}

}

elseif ($IdentityInstance.Contains('.')) {

$IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance)(dnshostname=$IdentityInstance))"

}

else {

$IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance)(displayname=$IdentityInstance))"

}

}

if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {

$Filter += "(|$IdentityFilter)"

}

if ($PSBoundParameters['LDAPFilter']) {

Write-Verbose "[Get-DomainObject] Using additional LDAP filter: $LDAPFilter"

$Filter += "$LDAPFilter"

}

# build the LDAP filter for the dynamic UAC filter value

$UACFilter | Where-Object {$_} | ForEach-Object {

if ($_ -match 'NOT_.*') {

$UACField = $_.Substring(4)

$UACValue = [Int]($UACEnum::$UACField)

$Filter += "(!(userAccountControl:1.2.840.113556.1.4.803:=$UACValue))"

}

else {

$UACValue = [Int]($UACEnum::$_)

$Filter += "(userAccountControl:1.2.840.113556.1.4.803:=$UACValue)"

}

}

if ($Filter -and $Filter -ne '') {

$ObjectSearcher.filter = "(&$Filter)"

}

Write-Verbose "[Get-DomainObject] Get-DomainObject filter string: $($ObjectSearcher.filter)"

if ($PSBoundParameters['FindOne']) { $Results = $ObjectSearcher.FindOne() }

else { $Results = $ObjectSearcher.FindAll() }

$Results | Where-Object {$_} | ForEach-Object {

if ($PSBoundParameters['Raw']) {

# return raw result objects

$Object = $_

$Object.PSObject.TypeNames.Insert(0, 'StrongView.ADObject.Raw')

}

else {

$Object = Convert-LDAPProperty -Properties $_.Properties

$Object.PSObject.TypeNames.Insert(0, 'StrongView.ADObject')

}

$Object

}

if ($Results) {

try { $Results.dispose() }

catch {

Write-Verbose "[Get-DomainObject] Error disposing of the Results object: $_"

}

}