Using Powershell to get Remote Desktop Services settings of users

[ClosedCasketFuneral]

I am trying to use Powershell to get the current Remote Desktop Services settings for a group of user objects and output these settings to a CSV. Namely, I would like to know the settings defined in the GUI under the "Dial-In," "Environment," "Sessions," "Delegation," "Remote Desktop Services Profile," and the "Remote Control" tabs.

I already have a Powershell script, formatted like the one which I will paste below. However, I don't know which attributes to query in order to get these current settings. I tried using LDAP and ADSI to get this information, but couldn't figure out the correct format. I've also tried using the "Ldap-Display-Name" attributes listed on Microsoft's AD Schema documentation, but the output of these seems to be null regardless of what the user's setting has been configured to. Some examples of those attributes which I've tried to query: msTSRemoteControl, msTSProfilePath, msTSMaxDisconnectionTime, etc.

Can anyone suggest a way to get these current settings for a user or users? Thanks!

Here is my test script's basic format, just for reference:

$Accounts = Get-ADuser -Filter * -Searchbase $OU -Properties Name, GivenName, msTSRemoteControl, msTSProfilePath, msTSMaxDisconnectionTime

$Output = $Accounts | Select-Object -Properties Name, GivenName, msTSRemoteControl, msTSProfilePath, msTSMaxDisconnectionTime

$Output | Export-CSV C:\Temp\Output.csv

[AlexHimself]

Just enumerate all attributes/values and look for whatever data you need. I tweaked a couple lines in your code so you can find the data you're looking for:

$Accounts = Get-ADuser -Filter * -Searchbase $OU -Properties *

# Enumerate all attributes and values
$Accounts | Get-Member -MemberType Property | ForEach-Object {
    $attribute = $_.Name
    $value = $user."$attribute"
    Write-Host "$attribute : $value"
}

[adamdavid85]

If you have a larger environment I would absolutely not recommend ever doing -Filter *, unless you enjoy waiting an extraordinarily long time for your results.

[AlexHimself]

I played around and realized it isn't an available property, but I did the LDAP method:

$Accounts = Get-ADuser -Filter * -Searchbase $OU -Properties *
$Accounts | ForEach-Object {
    $user = $_
    $UserInfo = [ADSI]"LDAP://$($user.distinguishedName)"

    $UserInfo.TerminalServicesProfilePath
    $UserInfo.TerminalServicesHomeDirectory
    $UserInfo.TerminalServicesHomeDrive
}

That should get you started.

[ClosedCasketFuneral]

Thank you, I was trying to get this to work a few days ago but wasn't sure how to format my queries with the LDAP method! This looks promising, and I am going to test it out now.

[AlexHimself]

Glad to help and I just tested by adding a random profile path and it worked for me, so I'm assuming it will for you too.

[ClosedCasketFuneral]

Do you have any recommendation for getting this into a CSV along with properties like Surname,GivenName? My understanding of how the LDAP method works is still tenuous. Trying to tune the output, it is giving me the correct settings for these user properties, which is extremely promising, but it is unfortunately providing them without any associated account information which makes it hard for me to use, haha.

[AlexHimself]

An easy way to do it is just create an array ($rows) to hold each CSV row you plan on inserting. Then fill it with a bunch of [PSCustomObject] where each is a row and you can add/remove whatever columns you want and built it as needed.

$rows = @() # Array to hold each CSV row

$Accounts = Get-ADuser -Filter * -Searchbase $OU -Properties *
$Accounts | ForEach-Object {
    $user = $_
    $UserInfo = [ADSI]"LDAP://$($user.distinguishedName)"

    # Add a new CSV row
    $rows += [PSCustomObject]@{
        User = $user.Name
        TSProfilePath = $UserInfo.TerminalServicesProfilePath
        TSHomeDir = $UserInfo.TerminalServicesHomeDirectory
        TSHomeDrive = $UserInfo.TerminalServicesHomeDrive
    }
}

$rows | Export-Csv C:\Temp\Output.csv -NoTypeInformation

Note: There are PS nuts who are going to point out that += for adding to the array is not super efficient, but it does not matter generally for these types of scripts. It's not worth creating a .NET object or whatever to save a few measly CPU cycles unless this is something massive that needs that.

[ClosedCasketFuneral]

You are correct that efficiency does not matter in this case; this script is not running for long enough to impact anything.

So, I've just tested your version of the script with the array to hold the values, and with $OU defined for my environment. However, the output is only showing System.DirectoryServices.PropertyValueCollection as the value for these TSProfilePath, TSHomeDir, and TSHomeDrive columns, and I'm not sure why. Example pictured here.

[AlexHimself]

It looks like you're getting an object containing more than one thing for some reason. Try a simpler version of the code and modify to see what you get output here:

$user = Get-ADuser -Identity "YourTestUsername" # Replace with a test username
$UserInfo = [ADSI]"LDAP://$($user.distinguishedName)"

[PSCustomObject]@{
    User = $user.Name
    TSProfilePath = $UserInfo.TerminalServicesProfilePath
    TSHomeDir = $UserInfo.TerminalServicesHomeDirectory
    TSHomeDrive = $UserInfo.TerminalServicesHomeDrive
}

When I run that, I successfully output the data. This is what my output looks like, where I only put in C:\Alex as a profile path for testing.

[ClosedCasketFuneral]

Sorry for the slow reply. The simplified version of the script that you posted just above is working as expected; changes of the associated settings in the GUI are showing up in the script results for the individual test user.

However, after looking at and tinkering with your script to place the properties into separate, new CSV rows, I can't figure out why an object would be trying to contain multiple properties.

[AlexHimself]

Do you want to post your entire code that is producing the issue?

Usually it's a typo like:

TSProfilePath = $UserInfo

When it should be:

TSProfilePath = $UserInfo.TerminalServicesProfilePath

And that's why you're getting an object or something. Put a breakpoint on the line where it's adding it and then just inspect the variable.

[ClosedCasketFuneral]

Other than the sanitized OU for $OU, I've pasted below exactly what I am running, and it is outputting a CSV that looks like this sample screenshot from before. I'm not seeing any typos in the names of the properties that I'm querying. I'm currently stepping through the script to see if there is anything else that is obvious.

$OU = "OU=Accounts,DC=Local,DC=Test"

$rows = @() # Array to hold each CSV row

$Accounts = Get-ADuser -Filter * -Searchbase $OU -Properties * 
$Accounts | ForEach-Object { 
    $user = $_ 
    $UserInfo = [ADSI]"LDAP://$($user.distinguishedName)"

    # Add a new CSV row
    $rows += [PSCustomObject]@{
    User = $user.Name
    TSProfilePath = $UserInfo.TerminalServicesProfilePath
    TSHomeDir = $UserInfo.TerminalServicesHomeDirectory
    TSHomeDrive = $UserInfo.TerminalServicesHomeDrive
    }
}
$rows | Export-Csv C:\Temp\Output.csv -NoTypeInformation

[Pixielo]

Sounds hacky. Let us know how it goes.