Wednesday 14 November 2018

windows - Getting SID from win32_groupuser


I am trying to get the SIDs of users and groups by querying


get-wmiobject -query 'select groupcomponent,partcomponent from win32_groupuser`

output:


__GENUS          : 2
__CLASS : Win32_GroupUser
__SUPERCLASS :
__DYNASTY :
__RELPATH : Win32_GroupUser.GroupComponent="\\\\COMPUTER\\root\\cimv2:Win32_Group.Domain=\"TESTDOMAIN\",Name=\
"Schema Admins\"",PartComponent="\\\\COMPUTER\\root\\cimv2:Win32_UserAccount.Domain=\"TESTDOMAIN\"
,Name=\"Administrator\""
__PROPERTY_COUNT : 2
__DERIVATION : {}
__SERVER :
__NAMESPACE :
__PATH :
GroupComponent : \\COMPUTER\root\cimv2:Win32_Group.Domain="TESTDOMAIN",Name="Schema Admins"
PartComponent : \\COMPUTER\root\cimv2:Win32_UserAccount.Domain="TESTDOMAIN",Name="Administrator"

groupcomponent is a win32_group (https://msdn.microsoft.com/en-us/library/windows/desktop/aa394153%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396).


win32_group is contains an SID (https://msdn.microsoft.com/en-us/library/windows/desktop/aa394151%28v=vs.85%29.aspx#)


However the groupcomponent here is a string and not a win32_group as


get-wmiobject -query 'select groupcomponent.sid from win32_groupuser'

is an invalid query. How can I access groupcomponent's members as a win32_group?



Answer



The PartComponent Property contains the SID. Access it by iterating through all objects via WMI:


gwmi win32_groupuser | % { [wmi]$_.partcomponent }

or use


gwmi win32_groupuser | % { [wmi]$_.partcomponent | select SID } 

to only receive the SID.


No comments:

Post a Comment

Where does Skype save my contact's avatars in Linux?

I'm using Skype on Linux. Where can I find images cached by skype of my contact's avatars? Answer I wanted to get those Skype avat...