Busk at 03:20, 12 July 2024

2024-07-12T03:20:54Z

Busk: Created page with "# Remove Sessions by User ``` # Define the username to log out and domain (adjust these values accordingly) $userToLogoff = "username" $domain = "DOMAIN" # Ensure the Active..."

2024-07-12T03:17:16Z

Created page with "# Remove Sessions by User ``` # Define the username to log out and domain (adjust these values accordingly) $userToLogoff = "username" $domain = "DOMAIN" # Ensure the Active..."

New page

# Remove Sessions by User
```
# Define the username to log out and domain (adjust these values accordingly)
$userToLogoff = "username"
$domain = "DOMAIN"

# Ensure the Active Directory module is loaded
Import-Module ActiveDirectory

# Get all computer objects from Active Directory
$hosts = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name

# Loop through each host
foreach ($host in $hosts) {
# Use Invoke-Command to run commands remotely on each host
Invoke-Command -ComputerName $host -ScriptBlock {
# Find the session ID of the user's session using quser
$sessions = quser /server:$using:host | Where-Object { $_ -match $using:userToLogoff }
foreach ($session in $sessions) {
# Extract the session ID
$sessionId = ($session -split '\s+')[2]
if ($sessionId -ne "SESSIONNAME") {
# Log off the session
logoff $sessionId /server:$using:host
Write-Output "Logged off $($using:userToLogoff) from session $sessionId on $using:host"
}
}
} -Credential "$domain\$userToLogoff" -ErrorAction SilentlyContinue
}
```

# Find Processes by User
```
# Define the username to log out and domain (adjust these values accordingly)
$userToLogoff = "username"
$domain = "DOMAIN"

# Ensure the Active Directory module is loaded
Import-Module ActiveDirectory

# Get all computer objects from Active Directory
$hosts = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name

# Loop through each host
foreach ($host in $hosts) {
# Use Invoke-Command to run commands remotely on each host
Invoke-Command -ComputerName $host -ScriptBlock {
# Find the session ID of the user's session using quser
$sessions = quser /server:$using:host | Where-Object { $_ -match $using:userToLogoff }
foreach ($session in $sessions) {
# Extract the session ID
$sessionId = ($session -split '\s+')[2]
if ($sessionId -ne "SESSIONNAME") {
# Log off the session
logoff $sessionId /server:$using:host
Write-Output "Logged off $($using:userToLogoff) from session $sessionId on $using:host"
}
}
} -Credential "$domain\$userToLogoff" -ErrorAction SilentlyContinue
}
```

@@ Line 32: / Line 32: @@
 # Find Processes by User
 ```
-# Define the username to log out and domain (adjust these values accordingly)
+# Define the username to check for running processes and domain (adjust these values accordingly)
-$userToLogoff = "username"
+$userToCheck = "username"
 $domain = "DOMAIN"
@@ Line 46: / Line 46: @@
      # Use Invoke-Command to run commands remotely on each host
      Invoke-Command -ComputerName $host -ScriptBlock {
-         # Find the session ID of the user's session using quser
+         # Get all processes and filter by the specified user
-         $sessions = quser /server:$using:host | Where-Object { $_ -match $using:userToLogoff }
+         $processes = Get-WmiObject Win32_Process | Where-Object { $_.GetOwner().User -eq $using:userToCheck }
-         foreach ($session in $sessions) {
+         foreach ($process in $processes) {
-             # Extract the session ID
+             # Output the process name and ID
-             $sessionId = ($session -split '\s+')[2]
+             Write-Output "Process $($process.Name) with ID $($process.ProcessId) is running under user $using:userToCheck on $using:host"
+         }
-     } -Credential "$domain\$userToLogoff" -ErrorAction SilentlyContinue
+     } -Credential "$domain\$userToCheck" -ErrorAction SilentlyContinue
+}
 ```

AD Scripts - Revision history

Busk at 03:20, 12 July 2024

Busk: Created page with "# Remove Sessions by User ``` # Define the username to log out and domain (adjust these values accordingly) $userToLogoff = "username" $domain = "DOMAIN" # Ensure the Active..."