从 AD 获取进程所有者

Question

我在 Windows Server 2008 R2 上使用 Powershell，我需要任何普通用户使用 AD 的姓名和姓氏获得进程的所有者。

这是在 Mathias R. Jessen

的帮助下编写的脚本

 Import-Module ActiveDirectory
$ProcessWithOwners = Get-WmiObject Win32_Process -Filter 'Name LIKE "vr[0-9]%"' |Select *,@{Name="Owner";Expression={$_.GetOwner().User}}
 foreach($Process in $ProcessWithOwners)
 {
    $Username = $Process.Owner 
    $ADUser = Get-ADUser -Filter "SamAccountName -eq '$Username'" -properties *
    $a = new-object -comobject wscript.shell
    $b = $a.popup(“Process name $($Process.Name) is run by user $($ADUser.DisplayName)“,0,“Warning”,1)
 }

但是普通用户无法访问进程的所有者。

有什么办法可以解决吗？

* 最终更新 *

为了以普通用户身份运行此脚本，我做了一些更改：

Import-Module ActiveDirectory
 
Add-Type -Name win -MemberDefinition '[DllImport("user32.dll")] public static extern bool ShowWindow(int handle, int state);' -Namespace native
[native.win]::ShowWindow(([System.Diagnostics.Process]::GetCurrentProcess() | Get-Process).MainWindowHandle,0)
 
$ConsProcess = Get-WmiObject Win32_Process -Filter 'Name LIKE "vr[0-9]%"' | Select *,@{Name="Owner";Expression={$_.GetOwner().User}}
 
if ($ConsProcess -ne $null) {
 foreach($Process in $ConsProcess)
 {

$QueryProcess = query process $Process.ProcessName
$Id = ($QueryProcess[1] -replace ' +',' ').Trim().Split(' ')[2]
$QueryUser = query session $Id
$User = ($QueryUser[1] -replace ' +',' ').Trim().Split(' ')[1]
$ADUser = (Get-ADUser -Identity $User -Properties *).DisplayName

$a = new-object -comobject wscript.shell
$b = $a.popup(“Консультант запущен с именем $($Process.Name) пользователем $($ADUser)“,0,“Внимание”,1)
 }
}

else
{
& 'D:\consultantplus\cons.exe' /adm /inet
}

Answer 1

当您只需要所有者时，没有理由同时调用gwmi Win32_Process 和 Get-Process。

你可以这样做：

$CmdProcessWithOwners = Get-WmiObject Win32_Process -Filter 'Name LIKE "cmd%"' |Select *,@{Name="Owner";Expression={$_.GetOwner()}}

由于您可能会找到多个符合您的条件的进程，因此您可能希望循环遍历进程：

foreach($Process in $CmdProcessWithOwners)
{
    # Grab the user name we added earlier
    $Username = $Process.Owner.User
    $Domain = $Process.Owner.Domain

    $DisplayName = switch($Domain)
    {
        'DOMAINNAME' {
            # Process owned by AD User, grab name from AD
            Get-ADUser -Filter "SamAccountName -eq '$Username'" -Properties DisplayName |Select-Object -ExpandProperty DisplayName
        }
        $env:ComputerName {
            # Process owned by local user, look up local account full name
            [adsi]"WinNT://$($env:ComputerName)/$Username,user" |Select-Object -ExpandProperty FullName
        }
        default {
            # Likely system or virtual account, default to DOMAIN\Username
            "$Domain\$Username"
        }
    }

    # Print it
    Write-Host "Process $($Process.Name) with ID $($Process.Id) belongs to $DisplayName"
}