how to find and backup user before disable.

Question

how to find and backup user before disable.

Ilya Bokov 165

hi everyone.

how i can find pc name where worked user, and backup his C:/users/$user.

change description this $PC to delete fired username.

Accepted answer

0 additional answers

Your answer

Answer 1

Rich Matheisen 47,781

Unless you're auditing successful logons, you'll have no way to know from which machine they logged on. What about if they logged on from multiple machines?

How do you plan to back up the users home directory, and what parts of that directory? You can probably just copy what you want, but you'll need the necessary permissions to do so.

Ilya Bokov 165 Reputation points

2023-10-23T06:04:47.45+00:00

hello. domain admin have permissions. i want to backup user desktop, downloads and documents folder. users logging from 1 corporative computer on own working table
Rich Matheisen 47,781 Reputation points

2023-10-23T15:16:44.69+00:00

Domain Admins may have a lot of permission but they don't usually have ownership. Even they may encounter problems accessing (or manipulating) some files or directories.

If the user uses only a single machine, how are you mapping the users' account name to that machine? Do you add the user as the responsible person to the machines' Computer object in the AD? Or does the content of the AD Computer objects' "Description" property contain the necessary information?

Do users ever log on to servers (don't forget RDP!)?

You still haven't said how you'll be making a backup. Are you simply copying the contents of directories to a network share? Are you using 3rd-party software to make a true "backup"? Are you creating a compressed archive of the contents?

Ilya Bokov 165

this script works and output information is domain username and PC which authorized.

by this script i need scan not just in OU.

function Get-LoggedUser
{
    [CmdletBinding()]
    param
    (
        [string[]]$ComputerName 
    )
    foreach ($comp in $ComputerName)
    {
        if ((Test-NetConnection $comp -WarningAction SilentlyContinue).PingSucceeded -eq $true) 
            {  
                $output = @{'Computer' = $comp }
                $output.UserName = (Get-WmiObject -Class win32_computersystem -ComputerName $comp).UserName
            }
            else
            {
                $output = @{'Computer' = $comp }
                         $output.UserName = "offline"
            }
         [PSCustomObject]$output 
    }
}
$computers = (Get-AdComputer -Filter {enabled -eq "true"} -SearchBase 'DC=NEXT,DC=LOCAL').Name
Get-LoggedUser $computers |ft -AutoSize

Rich Matheisen 47,781 Reputation points

2023-10-26T15:40:40.8266667+00:00

The "username" property of that WMI class only shows the name of the user that's currently logged on. The machine may be online, but without anyone actually logged on. Your code doesn't take that situation into consideration.

I think a better way to do what you're trying to do is to get the list of user profiles from the registry (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList) and, for each SID in that list (that isn't a "well-known" SID) use Get-LocalUser, or if that fails (as it will for a domain user) you can use the technique noted here (which also works for local users, but I think Get-LocalUser is easier): https://community.spiceworks.com/how_to/2776-powershell-sid-to-user-and-user-to-sid

Keep this in mind if you do (what I consider insecure) and rename accounts (which doesn't change the SID) instead of issuing new ones:

https://learn.microsoft.com/en-US/troubleshoot/windows-client/user-profiles-and-logon/renaming-user-account-not-change-profile-path

Share via

how to find and backup user before disable.

0 additional answers

Your answer