Program: List Logon or Logoff Scripts for a Windows PowerShell User

The Group Policy system in Windows stores logon and logoff scripts under the registry keys HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\<User SID> \Scripts\Logon and HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\ State\<User SID>\Scripts\Logoff. Each key has a subkey for each group policy object that applies. Each of those child keys has another level of keys that correspond to individual scripts that apply to the user.

This can be difficult to investigate when you don’t know the SID of the user in ques tion, so Example 241 automates the mapping of username to SID, as well as all the registry manipulation tasks required to access this information.

Example 241. GetUserLogonLogoffScript.ps1

############################################################################## ## ## GetUserLogonLogoffScript.ps1 ## ## Get the logon or logoff scripts assigned to a specific user ## ## ie: ## ## PS >GetUserLogonLogoffScript LEEDESK\LEE Logon ## ##############################################################################

param( $username = $(throw "Please specify a username"), $scriptType = $(throw "Please specify the script type") )

## Verify that they've specified a correct script type $scriptOptions = "Logon","Logoff" if($scriptOptions notcontains $scriptType) {

$error = "Cannot convert value {0} to a script type. " + "Specify one of the following values and try again. " + "The possible values are ""{1}""."

$ofs = ", " throw ($error f $scriptType, ([string] $scriptOptions)) }

## Find the SID for the username $account = NewObject System.Security.Principal.NTAccount $username $sid =

$account.Translate([System.Security.Principal.SecurityIdentifier]).Value

## Map that to their group policy scripts $registryKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\" + "Group Policy\State\$sid\Scripts"

## Go through each of the policies in the specified key foreach($policy in GetChildItem $registryKey\$scriptType) {

## For each of the scripts in that policy, get its script name ## and parameters foreach($script in GetChildItem $policy.PsPath) {

GetItemProperty $script.PsPath | Select Script,Parameters } }