@ -29,22 +29,28 @@ Function Get-MachineSid {
# only accessible by the Local System account. This method get's the local
# admin account (ends with -500) and lops it off to get the machine sid.
$admins_sid = " S-1-5-32-544 "
$admin_group = ( [ Security.Principal.SecurityIdentifier ] $admins_sid ) . Translate ( [ Security.Principal.NTAccount ] ) . Value
$machine_sid = $null
Add-Type -AssemblyName System . DirectoryServices . AccountManagement
$principal_context = New-Object -TypeName System . DirectoryServices . AccountManagement . PrincipalContext ( [ System.DirectoryServices.AccountManagement.ContextType ] :: Machine )
$group_principal = New-Object -TypeName System . DirectoryServices . AccountManagement . GroupPrincipal ( $principal_context , $admin_group )
$searcher = New-Object -TypeName System . DirectoryServices . AccountManagement . PrincipalSearcher ( $group_principal )
$groups = $searcher . FindOne ( )
try {
$admins_sid = " S-1-5-32-544 "
$admin_group = ( [ Security.Principal.SecurityIdentifier ] $admins_sid ) . Translate ( [ Security.Principal.NTAccount ] ) . Value
$machine_sid = $null
foreach ( $user in $groups . Members ) {
$user_sid = $user . Sid
if ( $user_sid . Value . EndsWith ( " -500 " ) ) {
$machine_sid = $user_sid . AccountDomainSid . Value
break
Add-Type -AssemblyName System . DirectoryServices . AccountManagement
$principal_context = New-Object -TypeName System . DirectoryServices . AccountManagement . PrincipalContext ( [ System.DirectoryServices.AccountManagement.ContextType ] :: Machine )
$group_principal = New-Object -TypeName System . DirectoryServices . AccountManagement . GroupPrincipal ( $principal_context , $admin_group )
$searcher = New-Object -TypeName System . DirectoryServices . AccountManagement . PrincipalSearcher ( $group_principal )
$groups = $searcher . FindOne ( )
foreach ( $user in $groups . Members ) {
$user_sid = $user . Sid
if ( $user_sid . Value . EndsWith ( " -500 " ) ) {
$machine_sid = $user_sid . AccountDomainSid . Value
break
}
}
} catch {
#can fail for any number of reasons, if it does just return the original null
Add-Warning -obj $result -message " Error during machine sid retrieval: $( $_ . Exception . Message ) "
}
return $machine_sid