@GitHub Copilot - Welcome @BanterBoy, I’m your Copilot and I’m here to help you get things done faster. I can identify issues, explain and even improve code.

You can ask generic questions, but what I’m really good at is helping you with your code. For example:

Generate unit tests for my code Explain the selected code Propose a fix for the bugs in my code If you want to learn more about my capabilities and limitations, check out the Copilot documentation.

I’m powered by AI, so surprises and mistakes are possible. Make sure to verify any generated code or suggestions, and share feedback so that we can learn and improve.

@BanterBoy: - Explain what the script does and why it is useful.

@GitHub Copilot -


Russell Tomkins
Microsoft Premier Field Engineer

Name:           Query-UserAccountControl.ps1
Description:    Exports an individual CSV for each UAC Flag all User and
                Computer accounts. Assists in identifying accounts with
                specific configurations such as Kerberos Delegations.
Usage:          .\Query-UserAccountControl.ps1 [-Server <domaincontrollerfqdn>]
                .\Query-UserAccountControl.ps1 -Server "dc1.contoso.com"
                Simply execute the script in the folder you wish to generate
                the .CSV files into. Results will only include accounts the
                executing user has privileges to read the userAccountControl
                attribute of.
                If the server is in another domain, the calling user must also
                have privileges to query that domain.
Date:           1.0 - 27-01-2016 - RT - Initial Release
                1.1 - 27-01-2016 - RT - Minor Updates
The sample scripts are not supported under any Microsoft standard support
program or service.
The sample scripts are provided AS IS without warranty of any kind. Microsoft
further disclaims all implied warranties including, without limitation, any
implied warranties of merchantability or of fitness for a particular purpose.
The entire risk arising out of the use or performance of the sample scripts and
documentation remains with you. In no event shall Microsoft, its authors, or
anyone else involved in the creation, production, or delivery of the scripts be
liable for any damages whatsoever (including, without limitation, damages for
loss of business profits, business interruption, loss of business information,
or other pecuniary loss) arising out of the use of or inability to use the
sample scripts or documentation, even if Microsoft has been advised of the
possibility of such damages.
# -----------------------------------------------------------------------------
# Begin Main Script
# -----------------------------------------------------------------------------
# Prepare Variables
Param (
        [parameter(Mandatory=$false,Position=0)][String]$Server = "localhost")

# Build the Lookup HashTable.
# More details can be found here
# https://msdn.microsoft.com/en-us/library/aa772300(v=vs.85).aspx

$UACLookUp = @{1 = "SCRIPT|0x0001";
                2 = "ACCOUNTDISABLE|0x0002";
                8 = "HOMEDIR_REQUIRED|0x0008";
                16 = "LOCKOUT|0x0010";
                32 = "PASSWD_NOTREQD|0x0020";
                64 = "PASSWD_CANT_CHANGE|0x0040";
                128 = "ENCRYPTED_TEXT_PWD_ALLOWED|0x0080";
                256 = "TEMP_DUPLICATE_ACCOUNT|0x0100";
                512 = "NORMAL_ACCOUNT|0x0200";
                2048 = "INTERDOMAIN_TRUST_ACCOUNT|0x0800";
                4096 = "WORKSTATION_TRUST_ACCOUNT|0x1000";
                8192 = "SERVER_TRUST_ACCOUNT|0x2000";
                65536 = "DONT_EXPIRE_PASSWORD|0x10000";
                131072 = "MNS_LOGON_ACCOUNT|0x20000";
                262144 = "SMARTCARD_REQUIRED|0x40000";
                524288 = "TRUSTED_FOR_DELEGATION|0x80000";
                1048576 = "NOT_DELEGATED|0x100000";
                2097152 = "USE_DES_KEY_ONLY|0x200000";
                4194304 = "DONT_REQ_PREAUTH|0x400000";
                8388608 = "PASSWORD_EXPIRED|0x800000";
                16777216 = "TRUSTED_TO_AUTH_FOR_DELEGATION|0x1000000";
                67108864 = "PARTIAL_SECRETS_ACCOUNT|0x04000000"}

#Loop through each Bitwise value and generate a CSV for affected User and Computer Accounts
ForEach($Value in $UACLookUp.Keys){

	# Prepare Our Variables
	$Description = $UACLookup.Item($Value)
	$FileName = $Description.Split("|",2)[0]
	$Filter = "useraccountcontrol -band $Value"
	$Properties = "useraccountcontrol","msDS-LastSuccessfulInteractiveLogonTime","lastLogonTimestamp"

	# Grab the details for both User and Computer Accounts and Output to CSV
	Get-ADUser -Server $Server -Filter $Filter -Properties $Properties| Export-CSV -NoTypeInformation "U-$FileName.csv"
    Get-ADComputer -Server $Server -Filter $Filter -Properties $Properties| Export-CSV -NoTypeInformation "C-$FileName.csv"
} # Process the Next UAC Value

# -----------------------------------------------------------------------------
# End of Script
# -----------------------------------------------------------------------------

Back to Top


Please feel free to copy parts of the script or if you would like to download the entire script, simple click the download button. You can download the complete repository in a zip file by clicking the Download link in the menu bar on the left hand side of the page.

Report Issues

You can report an issue or contribute to this site on GitHub. Simply click the button below and add any relevant notes. I will attempt to respond to all issues as soon as possible.


Back to Top