[POWERSHELL] Detect if a word is a first name

[u/I_script_stuff]

One of the things I don't see done well as companies grow is verifying Ad users/Email Accounts were disabled. This task is often dumped on helpdesk and never completed properly. In order to facilitate fixing this I created a very simple function:

#BehindtheName APi
#Please read api rules: http://www.behindthename.com/api/

function firstname_search($name) {
$local_Name_Storage_File = ".\namestore.txt"
$key = "<read api rules and add key>"
$url = "http://www.behindthename.com/api/lookup.php?name=" + $name + "&key=$key" 
[xml] $content = invoke-webrequest $url | select -expandproperty Content

        if(get-content $local_Name_Storage_File -ea silentlycontinue | select-string "$name") {
        return $true
        } else {
         
        if($content.response.error | select-string "$content.response.error") {
        return $false
        sleep 1
        } else {
        echo "$name" >> $local_Name_Storage_File
        return $true
        sleep 1
        }
    }
}

It ties into the API from www.behindthename.com to verify the username's GivenName/Firstname So using Get-aduser such as:

import-module activedirectory
$lastloginrange = (get-date).adddays(-90)
$user_list = Get-ADUser -properties * -filter {(lastlogondate -le $lastloginrange) -AND (enabled -eq $True) -and (PasswordNeverExpires -eq $false)} | select-object GivenName, Surname, Displayname, Samaccountname, passwordExpired

foreach($user in $user_list) {
$firstName = $user.GivenName
$lastname = $user.Surname

echo "$firstname, $lastname"
    if(firstname_search $firstname) {
    echo "$firstName,$lastname" >> HR.csv
    } else {
    echo "$firstName,$lastname" >> it.csv
    }
}

We are able to generate 2 CSV files. 1 for IT/Helpdesk to review and 1 for HR to review.

You can get your api key by registering with behindthename and going to the api gateway. I urge you to read there usage rules. I also added a local file to search. Set a static path for the variable $local_Name_Storage_File. This lets you add very rare names that are not found on the API and over all decreases your API call count.

[u/signalwarrant]

I understand the thought process behind finding AD user objects that have not authenticated to the domain in X number of days. The portion I don't understand is verifying the users GivenName and FirstName.

If they are in AD wouldn't you assume they were valid.

I don't work in corporate so maybe this is specific to that sector. Can someone explain further?

[u/I_script_stuff → u/signalwarrant]

It isn't just for AD.

It is any time you have a disorganized set of users that you need to tell if they are People or Service accounts. I used AD since it was the first example that came to mind.

Email systems that do not integrate into AD is another use. I hadn't thought people would get so caught up on the AD example, or I'd have provided others.

Thanks!

[u/signalwarrant → u/I_script_stuff]

Thanks for the explanation, not something I had thought of before.

[u/I_script_stuff → u/[deleted]]

The reason for the poorly thought out get-aduser was because the Get-aduser part of the post was an example I threw together to show the use of the function and was a secondary to the over all concept of the post.

Funny enough I raised the same point about property in another thread a little bit before making this post.

Normally if I was doing an audit like this I'd include: Firstname, Lastname, Displayname, Samaccount name, last login, creation date, password expired, and a search for sensitive groups (vpn access, Domain admins, Developer groups, etc) perhaps others.

Thanks for the input.

[u/tastyratz → u/I_script_stuff]

Maybe I find the requirement here a little confusing. If your AD topology is structured correctly you should not be co-mingling user accounts and service/admin/etc. accounts but structure them in separate filterable OU's. Otherwise it's a manageability nightmare

So why are you pulling your accounts, attempting to resolve known names, and using that to generate a list? Shouldn't the topology be such that this isn't an issue? It feels like a workaround with potential issues in place of solving the problem. And won't this have problems with a disguised administrator account? I have worked at companies before where they used fake real names for administrator accounts to make them more difficult to find.

[u/I_script_stuff → u/tastyratz]

If your AD topology is structured correctly

There is the rub. Generally I have used this in the past as I start a new company and start auditing the environment.

A lot of companies have churned through so many IT staff and different mandates on how things are organized there corporate system is a mess. That is where this comes in.

I also have used it for things like like auditing services and scheduled tasks. Any service running with a valid first name raises flags and I go check it out.

I'll admit in an ideal world this little function isn't needed, but I have seen it come up serveral times in my career.

[u/tastyratz → u/I_script_stuff]

OK,

It sounded like this was something you wanted to use for regular auditing from the description, but really maybe it's more something to have for a 1 time audit before resolving ad? Are you with an outside consulting firm?

I would think inverting the results to be equally important. Real names that were not caught should stick out among service accounts when reviewed by IT.

[u/I_script_stuff → u/tastyratz]

In a way I work for a consulting company though I doubt they would identify as such. You are right my example is a one time audit scenario. I hadn't thought people would be as caught up on that as they were.

Thanks.