How to modify powershell script to query Azure AD for last password set for local admins in addition to local users.

Question

Hi community,

I am using a configuration baseline in MEM/SCCM to query members of the local administrators group on all of my endpoints and upload them to the MEM/SCCM DB where I can report on it. I am using the powershell script at https://tcsmug.org/blogs/sherry-kissinger/568-cm-all-members-of-all-local-groups-powershell to do this. This script will load the local group members into a custom WMI class and then the SCCM hardware scans will upload the WMI class data into the DB.

I am trying to expand the script to include the date/time of when the passwords for any member accounts were last set. The group members could be either local or domain users. For local users, I have been able to make changes to the script to retrieve the password info on the local machine, and load it into to a new property (PasswordLastSet) I added to the custom WMI class (CM_LocalGroupMembers.) Because there is no guarantee a PC will be connected to the company network and have line of sight to the on-prem AD domain when the baseline runs, I think the best way to query the password info for domain accounts is to query the user in Azure AD (AAD). The problem I am having is figuring out how to query AAD at the same time as the local PC or how to get started. I know there is a need to load the MSonline module to make the Get-MsolUser cmdlet available, which I have added to the script. I know I will need to specify a user that will log into AAD to query it, which I will add when I am ready to automate this. For testing, I manually add Connect-MsolService to the script and log in interactively when i run it. What I am not understanding is how to query AAD specifically for a domain user and add the found password info to WMI at the same time as for local users since there is already a line in the script to populate the PasswordLastSet property with local user info.

This ForEach statement returns the members from each local group and the local accounts are queried from there.

ForEach ($TheName in $Groups) {
$Values1 = Get-LocalGroupMember -name $TheName.Name | select ObjectClass, Name, PrincipalSource

I plan to use the same results in $Values1 for the AAD query but I am having trouble figuring out the best way to format the usernames so they are ******@domain.com as opposed to domain\username. I've created a bunch of additional ForEach statements for this purpose but I'm not getting the results I need and I think I may be overthinking it. Also, if I approach it from this angle, how do I go about populating the WMI with both local and domain password info? My Powershell skills are not the best but I got pretty far from where I started. I have attached the script with my latest changes works for local accounts here MainScript_PswdLastSet.txt. Any suggestions on where to go from here are appreciated.

The changes I have made from the original script.

• Line 48: added PasswordLastSet property to the CM_LocalGroupMembers class.
• Line 115-134: added script to install the MSOnline module
• Line 182: added PasswordLastSet property when querying group members that are local users
• Line 201: added command to populate PasswordLastSet date/time to PasswordLastSet property in WMI

Answer 1

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query

You can try using the following command instead:

Get-ADUser -Filter {memberOf -eq 'CN=Local Admins,DC=example,DC=com'} -Properties LastPasswordSet |

Select-Object Name, LastPasswordSet

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.