Private/Read-NSPEntraPairingADPasswordTime.ps1
|
function Read-NSPEntraPairingADPasswordTime { <# .SYNOPSIS Enriches inventory copies with pwdLastSet using the AD module's paged LDAP reader. #> [CmdletBinding()] param([AllowEmptyCollection()][object[]]$User) $existing = @($User | Where-Object { $null -ne $_.PSObject.Properties['PasswordLastSetState'] }) if ($existing.Count -eq $User.Count) { foreach ($item in $User) { $item.PSObject.Copy() }; return } $times = @{} foreach ($group in @($User | Group-Object Server, DomainDNSRoot)) { $first = $group.Group[0] $entries = @(& (Get-Module NSP.ActiveDirectory) { param($Server) $domain = Get-NSPADDomainInfo -Server $Server Read-NSPADLdap -Server $domain.Server -SearchBase $domain.DistinguishedName -Filter '(&(objectCategory=person)(objectClass=user))' -Property objectGUID,pwdLastSet -PageSize 500 } $first.Server) foreach ($entry in $entries) { $id = ([guid]::new([byte[]]$entry['objectguid'])).ToString() $value = $entry['pwdlastset'] $times[$id] = if ($null -eq $value) { $null } elseif ([long]$value -eq 0) { 'pwdLastSet=0; next-logon requirement unknown' } else { [datetime]::FromFileTimeUtc([long]$value).ToString('o') } } } foreach ($item in $User) { $copy = $item.PSObject.Copy() $copy | Add-Member -NotePropertyName PasswordLastSetUtc -NotePropertyValue $times[[string]$item.ObjectGUID] -Force $copy } } |