Report on user matching pattern?
Craig Mohr
Is it possible to use inventory to report on user names matching a pattern that logged into computers? For example I am looking for users with a 2 digit random number and static text after such as 42user, 13user, 01user. I need this to track down some logins that are being incorrectly used by these types of accounts. There are 30 of them so I'd rather not search for each one.
1
Comments
The first thing you'll have to do is scan for users that have logged on to your targets. There are many ways to do this, depending on what kind of detail you want. The simplest is probably just a Files & Directories scanner that looks at C:\Users. There are also a couple of PowerShell scanners that could work. https://github.com/pdq/PowerShell-Scanners/tree/master/PowerShell%20Scanners/User%20Last%20Logged%20On https://github.com/pdq/PowerShell-Scanners/tree/master/PowerShell%20Scanners/User%20Profile%20Size
Once you have that, creating the Filter for your Report/Collection should be easy. Use 'Matches Expression' and '\d\duser'.
Your solution goes beyond what I'm after but is some great info! I totally missed that filters tab in the report and then had a few issues figuring out how to use it but your info helped and I think I have it now. Thanks!