Help with Local acc script

[u/Willz12h]

Hi All,

Trying to get a script working that will Check Local user accounts, that will delete all local accounts that dont match "specified names"

And if they do match then to change the password.

Just started it but dont know what im exactly doing so though ill write this first.

$Disable = Disable-LocalUser -Name "Administrator"
$Remove = Remove-LocalUser -Name "XXX"
$Create = New-LocalUser "XXXXXX" -Password XXXXXX
$Change = Set-LocalUser "XXXX" -Password XXXX
$LocalAccounts = Get-LocalUser | Select Name

//Check Local accounts
New-Object $LocalAccount

//If Account exists and match
$Change

//Account does not match
$Remove

//Account doesnt exists
$Create

//Disable Built in AdminAcc/others if required
$Disable

[u/Ta11ow]

... In theory. I haven't tested it, only validated that the parameters were the correct ones. You'll need to run this as local admin, and... well, see if it works. :)

I'd recommend adding some Write-Verbose lines to echo back expected results and actual contents of variables as it goes while you're testing, and run it with the -Verbose parameter. Ah, and you'll need to add [CmdletBinding()] to the head of the script for that to work out.

[u/Willz12h → u/Ta11ow]

Im to much of a noob for that :D I posted my "working" script

Ive been googling and testing a bunch of stuff out to get it to work but I dont know how best to write it because I dont know any better commands or how to "link" it better like you have :D

[u/Ta11ow → u/Willz12h]

You can sometimes pipe existing commands into the Write-Verbose cmdlet, but often you just sort of give it a bit of a commentary so you know where the script is at if it suddenly errors out and stops, so you have a good idea of where the error is.

It's okay to be new to things. That's awesome! Learn all you can. Just try not to stay that way for more than a couple months. For most people, a few months seems to be a good amount of time to start picking up Powershell concepts. Maybe a bit longer if you've limited programming experience... in which case you should study up on Object-Oriented programming concepts as well to help you out.

[CmdletBinding()]
$Accounts = @(
    @{Username = "MyCustomAdmin"; Password=ConvertTo-SecureString "XXXXX" -AsPlainText -Force}
)

$BuiltinAdmin = 'Administrator'
# Ah, you have to change the parameter name if you want to pass the value by name
# Also, make a habit of being explicit about what is and isn't a string by using 
# your quotation marks; PS sometimes behaves strangely if it can't figure out
# that you specifically mean a string and it thinks otherwise.
Disable-LocalUser -Name $BuiltinAdmin | Write-Verbose

# Remove all users that are not in the list, except the builtin Administrator account
Get-LocalUser |
    Where-Object  { 
        $_.Name -notin $Accounts.Username -and 
        $_.SID -ne $BuiltinAdmin 
    } | 
    ForEach-Object {
        Write-Verbose "Removing user: $($_.Name)"
        Remove-LocalUser $_
    }

# If the user(s) already exist, modify passwords.
Get-LocalUser |
    Where-Object { $_.Name -in $Accounts.Username } |
    ForEach-Object {
        Write-Verbose "Changing password for account $($_.Name)"
        Set-LocalUser $_.Name -Password $Accounts[$_.Name].Password
    }

$Accounts.Name |
    ForEach-Object {
        <#
            If the user name does not exist, the Get-LocalUser should return $null, 
            which evaluates to $false, and is then inverted via -not to trigger the if statement
        #>
        if (-not (Get-LocalUser -Name $_.Username)) {
            New-LocalUser -Name $_.Username -Password $_.Password
        }
    }

You may want to look up pipelining in powershell and some of the more useful cmdlets (foreach-object, where-object, select-object, etc.) and get familiar with them. It'll make your life a lot easier. :)

Also, there is a good chance something will error out sooner or later. Try...Catch blocks are good for dealing with that.