The Script Crypt

This page is for dumping my scripts. Pretty Much warts and all especially for the older stuff further down the page. Think I'm going to have to go through my removable memory too...pretty sure I have more!!! Oh Well...maybe use this to consolidate older posts...dont hold your breath!!!!

CMD\CLI Automated ping Test

Again just a quick way of using standard Wintel CLI command prompt utils to do a ping test reading hosts from a text file.....

for /f "tokens=1" %i in (Input_textfile) do ping %i >> Output_Textfile

The filenames are in itallics so name them what you want.

You need to escape the %i if you want this in a Batch\CMD file so it will look like this in a script.....

for /f "tokens=1" %%i in (Input_textfile) do ping %%i >> Output_Textfile

There ya go!!

CMD/BAT file to gather IpConfig and Route Table

Set Srv=%COMPUTERNAME%
Echo %Srv%
Echo "Date = %date% and Time =%time%"  >> \OutputFilePath\%Srv%
ipconfig /all >> \OutputFilePath\%Srv%
route print >> \OutputFilePath\%Srv%

Echo "Date = %date% and Time =%time%"  >> \OutputFilePath\%Srv%

Using WMI with Powershell and VBScript can get the information, but lets face it when you need this info you just use the standard CLI commnads as they are easy peasy to understand the output. Out put  files are straight forward text files, none of this structured CSV or HTML stuff either.


Script to Add AD Accounts to a Local Group on a Server or PC

#ScriptorJohn Buggy

#Script Date 18.12.14

#Script Version = 2.0
#Requirements = Powershell 2.0 and appropriate permissions

#Scriptocratic oath...warn them first,blame someone else

#Script Purpose...

#Add a list of AD accounts that are security compliant

#to the local administrators group of servers

#script has been updated to recieve screen input 18.12.14

#need to double check domain account or  group names are following the convention

# domain/groupname. To browse the namespace we need forward slahes

#Load AD accounts to an array

Write-Host "I hope you know what you are doing? This script will make connections to an AD and a server and ammend a specified local group"

#Setting up variable to record input for the path to a

# file holding the domain accounts that needed added to a local group

$AcctPath = read-host "Please enter location of text file containing domain accounts"

#Setting up variable to record input for the path to a

#file containing a list of servers

$SrvPath = read-host "Please enter location of text file containing servers that need configured"

$Acct = (get-content $AcctPath)

#Load a list of servers listed in appropriate documentation to an array

$Server = (get-content $SrvPath)

#Outer Loop to iterate through server list

# the group LocalGroupName = the local group to reconfig

Foreach ($S in $Server) {

         $OServer = [ADSI]("WinNT://$S/LocalGroupName") #connects a path to Loc Admin group

          Write-Host "connected to $S"  

         

          #Inner loop to iterate through AD Group Accounts and add to loacl administrators

         

          Foreach ($a in $Acct)  {

         

           $OAcct = [ADSI]("WinNT://$a")  #connects a path to AD account

           $OServer.PSBase.Invoke("Add",$OAcct.PSBase.Path) #adds accounts from the AD Path to the Server Path

           write-host "account $a added"

         

          }

}

Script to Remove AD Accounts from a Local Group on a Server or PC

#ScriptorJohn Buggy

#Script Date 17.12.14

#Script Version = 2.0
#Requirements = Powershell 2.0 and appropriate permissions

#Scriptocratic oath...warn them first,blame someone else if it goes wrong!

#Script Purpose...

#Remove a list of AD accounts that are security uncompliant

#from the local administrators group of servers

#need to double check account group names are following the convention

#domain/groupname. To browse the namespace we need forward slahes

#Script updated to recieve screen input 18.12.14

Write-Host "I hope you know what you are doing? This script will make connections to an AD and a server and ammend a specified local group"

#Load AD accounts to an array

#Setting up variable to record input for the path to a

# file holding the domain accounts that needed added to a local group

$AcctPath = read-host "Please enter location of text file containing domain accounts"

$Acct = (get-content $AcctPath)

#Load a list of servers listed in appropriate documentation to an array

#Setting up variable to record input for the path to a

#file containing a list of servers

$SrvPath = read-host "Please enter location of text file containing servers that need configured"

$Server = (get-content $SrvPath)

#Outer Loop to iterate through server list

#the group LocalGroupName = the local group to reconfig

Foreach ($S in $Server) {

         $OServer = [ADSI]("WinNT://$S/LocalGroupName") #connects a path to Loc group

          Write-Host "connected to $S"  

    #Inner loop to remove uncompliant accounts

   

    Foreach ($a in $Acct) {

      $OAcct = [ADSI]("WinNT://$a")  #connects a path to AD account

     $OServer.PSBase.Invoke("Remove",$OAcct.PSBase.Path)

      Write-host "removed domain group $a"

   

   

   

        }

    }

   

How to get Account used to launch a process

(gwmi -class win32_process –computer <servername> | where{$_.name -eq "processname.exe"}).getowner() | Select -property domain, user

#Requirements = Powershell 2.0 and appropriate permissions

#Can be put in a loop to iterate through a server list

#change processname the process you want queried

Script to Test Browser HTTPS Connectivity to server remote admin devices

#Script to test browsing to url or ILO addresses

#Script will open multiple sites and test browsing capabilities

#Begining of Script

#Loading Hostnames or IPaddr into variable

$sites = (get-content "c:\input\IPaddr.txt")

$oIE=new-object -com internetexplorer.application

#Setting a loop to parse through variable

#and launch Internet Explorer and open required webpage

foreach ($ip in $sites)

{

$oIE.navigate2("https://$ip",0x1000)

$oIE.visible=$true

}

Delete unsecure Local Accounts

I was given a list of PCs and a list of local accounts to delete, both lists were massive.

Came up with this initial script... My Previous write up of the script

$PCname = (Get-Content drive:\filepath) #Load PC list in to array

$local = (Get-Content drive:\filepath) #Load Account list for deletion in to array

#Sets up loop that iterates through list of PCs and connects through ADSI and the WinNT provider

 Foreach ($pc in $PCname) { $Conn = [ADSI]"WinNT://$pc"

#Sets up a loop to iterate through a list of usernames and deletes them, the ADSI:WinNT connection is held #in the variable $Conn

     Foreach ($Acc in $local) { $Conn.Delete("User",$Acc)

  Write-Host "account deleted"

  }

  }

List all MMC Snap-In files or .msc files

# PowerShell script to list MMC snap-ins on a Win7 Home Premium PC

$Dir = get-childitem C:\ -recurse

# $Dir |get-member

$List = $Dir | where {$_.extension -eq ".msc"}

$List |Sort-Object -descending| format-table name

Causes duplicates to be listed as it will search through everything...at least you get a rough and ready list = better than heehaw!!

Query System Certificates

Get-psdrive

Set-location –path cert:

Get-childitem –recurse | fl *

This will return what servers have CD drives and what ones have DVD drives

Server estates have several generations of hardware. Been caught out a few times burning a DVD doing some out of hours work only to be foiled by a server rack having nothing but servers with CDs instead of DVDs....

write-host "Script Version 1.0"
write-host "This will return what servers have CD drives and what ones have DVD drives"
Write-Host "Requires Native Powershell"
Write-Host "Otherwise this dog just aint gonna hunt!!...WOOF WOOF...one of my dog impressions....Oddball from the film Kelly's Heros"
Write-Host " Woof Woof....output file is here.....EnterOutputFilePath"

$a=(get-content InputFilePath)

get-wmiobject -class win32_cdromdrive -computer $a | fl -property systemname,drive,caption,description,manufacturer,pnpdeviceid > OutputFilePath

CPU Info
Probably outdated now by Powershell V3.0 but worth keeping in mind.

$computer = "LocalHost" 
$namespace = "root\CIMV2" 


Get-WmiObject -class Win32_Processor -computername $computer -namespace $namespace

CPU Report Network/Domain Wide

$srvlist = (get-content InputFileName)
foreach ($srv in $srvlist) {
get-wmiobject -class win32_processor -computer $srv | format-table -wrap Systemname,manufacturer,name,clockspeed >> OutputFileName
 $proc = "Total Number of CPU-Cores = " >> OutputFileName
   $cpus= (get-wmiobject -class win32_computersystemprocessor -computer $srv).count >> OutputFileName

                                               }
DC Event Logs (or any other server)

write-host "Script Version 1.0"
write-host "This will return Domain Controller Event Logs"
Write-Host "Requires Native Powershell"
Write-Host "Otherwise this dog just aint gonna hunt!!...WOOF WOOF...one of my dog impressions....Oddball from the film Kelly's Heros"
Write-Host " Woof Woof....output file is here.....c:\Output\All_DC_EventLogs.txt"


#Variable for the list of DCs
$dc= (Get-Content InputListTxtFileWithDCList)

#Using implied Loop
Get-EventLog -ComputerName $dc | Format-List * >> OutputFilePath

FSMO Roles on your Domain

FSMO = Flexible Single Master Operation,
Roles = PID,Infrastructure,Domain,Schema,RID
Can be on one DC or spread amongst many...here is how to check

$dom=[system.directoryservices.activedirectory.domain]::getcurrentdomain()

$dom | format-list *

HDD Report Network/Domain Wide

$srvlist = (get-content InputFilePath)

foreach ($srv in $srvlist) {
  get-wmiobject -class win32_diskdrive -computer $srv -filter "mediatype='Fixed hard disk media'" | format-table -property systemname,caption,size >> OutputFilePath

Server Hardware Resource Report
#report needs HDD,Mem,OS, CPU, CPU Cores
#convert mem and HDD to gigs
#initial testing script 

 # gathering dns hostname to an array from a file
 $srvlist = (get-content InputTextFilePath)

#setting up a loop to iterate through the array 

foreach ($srv in $srvlist) {
#Getting OS info
get-wmiobject -class win32_operatingsystem -computer $srv | format-table -wrap csname,caption,csdversion >> OutputFilePathV1

#Getting Memory Stick info
get-wmiobject -class win32_physicalmemory -computer $srv | format-table -wrap path, capacity,datawidth,speed >> OutputFilePathV2
 $txt = "Number of Memsticks =" >> OutputFilePathV2
 $mem=(get-wmiobject -class win32_physicalmemory -computer $srv).count  >> OutputFilePathV3
 #Getting HDD info
 get-wmiobject -class win32_diskdrive -computer $srv -filter "mediatype='Fixed hard disk media'" | format-table -property systemname,caption,size >> OutputFilePathV4
  #Getting CPU info
  get-wmiobject -class win32_processor -computer $srv | format-table -wrap Systemname,manufacturer,name,clockspeed >> c:\output\PhysSrv_CPU.txt
 $proc = "Total Number of CPU-Cores = " >> OutputFilePathV5
 $cpus= (get-wmiobject -class win32_computersystemprocessor -computer $srv).count >> OutputFilePathV5                                                         

                                               }
Retrieve Local Groups, Local User Accounts, and Services (GUS) on Win2kx systems and WinXP clients

write-host "Script Version 1.0"
Write-Host "Requires standard Powershell shell"
Write-Host "Retrieve Local Groups, Local User Accounts, and Services (GUS) on Win2kx systems and WinXP clients"



Function funLine($strIN)
{
  $strOUT = "-" * $strIN.length
  "$strin`n$strOUT"
}

$domainName = read-host "Enter the domain name...ie Domain1, Domain2 or ANOther..."
$computerName = read-host "Enter Server or client HostName...."
$computer = [adsi]"WinNT://$domainName/$computerName"
$objCount = ($computer.psbase.children | measure-object).count
$i=0
foreach($adsiObj in $computer.psbase.children)
{
 write-progress -activity "getting objects" -status "progress" -percentComplete ($i / $objCount*100)
  switch -regex($adsiObj.psbase.SchemaClassName)
    {
       "group" { $group += $adsiObj.name }
       "user"    { $user += $adsiObj.name }
       "service" { $service +=  $adsiObj.name }

   } #end switch
  $i++
} #end foreach

funline("groups on $domainName\$computerName") ; $group ; "`r" 

funline("users on $domainName\$computerName") ; $user ; "`r"


funline("services on $domainName\$computerName"); $service; "`r"

This will return mailbox store info for all the Exchange 2003 Servers
One of my earliest scripts with exchange and I was just learning Powershell at the time too..(I still am Learning Powershell)....note the lack of loops...Exchange 2003 had pretty poor documentation for Powershell so I just got something working and got a basic script together...tried to sanitize this as best I can maybe there are some mistakes in it so double check!!


write-host "Script Version 1.0"
write-host " This will return mailbox store info for all the Exchange Servers"


#Foreach ($mbx in $Node)
 Get-Wmiobject -namespace root\MicrosoftExchangeV2 -class Exchange_Mailbox -computer MBXSRV1 | sort-object MailboxDisplayName | select * > OutputTxtFilePath  # write-progress -activity "generating Mailbox data MBXSRV1" -status "progress"
 Get-Wmiobject -namespace root\MicrosoftExchangeV2 -class Exchange_Mailbox -computer MBXSRV2 | sort-object MailboxDisplayName | select * >> OutputTxtFilePath  #write-progress -activity "generating Mailbox data MBXSRV2"  -status "progress"
 Get-Wmiobject -namespace root\MicrosoftExchangeV2 -class Exchange_Mailbox -computer MBXSRV3 | sort-object MailboxDisplayName | select * >> OutputTxtFilePath  #write-progress -activity "generating Mailbox data MBXSRV3"  -status "progress"
 Get-Wmiobject -namespace root\MicrosoftExchangeV2 -class Exchange_Mailbox -computer MBXSRV4 | sort-object MailboxDisplayName | select * >> OutputTxtFilePath  #write-progress -activity "generating Mailbox data MBXSRV4"  -status "progress"
 Get-Wmiobject -namespace root\MicrosoftExchangeV2 -class Exchange_Mailbox -computer MBXSRV5 | sort-object MailboxDisplayName | select * >> OutputTxtFilePath  #write-progress -activity "generating Mailbox data MBXSRV5"  -status "progress"

 write-host "Data has been written to file OutputTxtFilePath"

This will return mailbox store info
This one might be better, remember this was used in a predominantly Exchange 2003 environment

write-host "Script Version 1.3"
write-host " This will return mailbox store info"

$Node = read-host "Enter System Hostname or IP Addr"
Write-Host "Gathering Exchange server Data for "$node

#Get-Wmiobject -namespace root\MicrosoftExchangeV2 -class Exchange_Mailbox -computer $node | sort-object MailboxDisplayName | select-object MailboxDisplayName,ServerName,StorageGroupName,StoreName,lastlogontime,lastlogofftime,Size,deletedmessagessizeextended,storagelimitinfo,totalitems > c:\output\$node-StoreInfo.txt

Get-Wmiobject -namespace root\MicrosoftExchangeV2 -class Exchange_Mailbox -computer $node | sort-object MailboxDisplayName | select * > c:\output\$node-StoreInfo.txt
#Get-Wmiobject -namespace root\MicrosoftExchangeV2 -class Exchange_Mailbox -computer $node | sort-object MailboxDisplayName | ft MailboxDisplayName,ServerName,StorageGroupName,StoreName,Size,totalitems > c:\output\$node-StoreInfo.txt
write-host "Data has been written to file c:\output\$node-StoreInfo.txt"

#in v1.1 added extra properties lastlogontime,lastlogofftimedeletedmessagessizeextended,storagelimitinfo,totalitems
#in v1.2 removed the above, kept totalitems and removed -autosize switch

#in v1.3 using select-object to provide in depth mailbox site

Physical Memory Report

$srvlist = (get-content g:\output\srvdns.txt)

foreach ($srv in $srvlist) {
get-wmiobject -class win32_physicalmemory -computer $srv | format-table -wrap path, capacity,datawidth,speed >> OutputTxtFilePath
 $txt = "Number of Memsticks =" >> OutputTxtFilePath
 $mem=(get-wmiobject -class win32_physicalmemory -computer $srv).count  >> OutputTxtFilePath 
                                                           
                                               }

Hardware Report for a single server

write-host "Script Version 1.0"


$Node = read-host "Enter System Hostname or IP Addr"

Write-Host "Gathering OS,CPU,HDD,Mem and BIOS info for "$node
Write-Host "To convert to MB, number/1mb, for GB  number/1gb...for Mem nd HDD size"

get-wmiobject -class win32_operatingsystem -computer $node  | format-list * > OutputTxtFilePath
get-wmiobject -class win32_processor -computer $node  | format-list * >> OutputTxtFilePath
get-wmiobject -class win32_diskdrive -computer $node  | format-list * >> OutputTxtFilePath
get-wmiobject -class win32_physicalmemory -computer $node  | format-list * >> OutputTxtFilePath

get-wmiobject -class win32_bios -computer $node  | format-list * >>OutputTxtFilePath

SID Translator

$objSID = New-Object System.Security.Principal.SecurityIdentifier ` 
    ("S-1-5-21-1999678621-1993209541-4105137774-31174") 
$objUser = $objSID.Translate( [System.Security.Principal.NTAccount]) 

$objUser.Value

Service Tags
#The text file creates an implied loop
#remove the domain dns name from the file by importing to excel and using the full-stop to seperate columns
#filename can bechanged to the correct file name with the cleansed data

get-wmiobject -class win32_bios -computer (get-content InputFileNamePath) | format-table -property manufacturer,serialnumber,path 



I know you can put these in your Powershell Profile...bbbbbuuuutttttt I was playing

Write-Host " Adding QAD Snap-in"
add-PSSnapin quest.activeroles.admanagement
Write-Host "Done...lets go hunting bear"
##get-command -PSSnapIn VMware.VumAutomatio
 Write-Host " Adding Powercli Vcentre Update Manager AKA........VUM!!! Snap-in"
Add-PSSnapIn VMware.VumAutomation 
Write-Host " Done...It was the dark of the moon on the 6th of June in a Kenworth Hawling Logs...Convoy!!!"
Add-PSSnapin VMware.VimAutomation.Core 
Write-Host "Done..Adding PowerCLI Core Cmdlets....Cab Over Pete with a reefer On..." 

Write-Host " In A jimmy hawlin Hawgs...."


Note The below scripts use the Quest Active Roles Powershell Snapin

write-host "Script Version 1.0"
write-host "This will return total amount of AD user login accounts"
Write-Host "Requires Quest Active Roles Powershell Snap-in"
Write-Host "Otherwise this dog just aint gonna hunt!!...WOOF WOOF...one of my dog impressions....Oddball from the film Kelly's Heroes"
Write-Host "I am counting the amount of user accounts....this may take a while...please be patient...."

Get-QADUser -DontUseDefaultIncludedProperties -SizeLimit 0 | Measure-Object

Beefed Up Hardware Report
write-host "Script Version 1.0"
write-host "This will return some System Information"
Write-Host "Requires Quest Active Roles Powershell Snap-in"
Write-Host "Otherwise this dog just aint gonna hunt!!...WOOF WOOF...one of my dog impressions....Oddball from the film Kelly's Heros"

#Script text body

$serverName = read-host "Enter hostname...."
Write-Host "Basic DNS & OS Info"
Get-QADComputer $serverName | fl -Property dNSHostName,operatingSystem,operatingSystemServicePack,OSVersion,oshotfix,Location,DN,path,Description,AccountIsDisabled,whencreated

Write-Host "All HDDs Available"
get-wmiobject -class win32_diskdrive -computer $serverName

Write-Host "Plastic Disk Media Info"
#System CD-DVD Info
get-wmiobject -class win32_cdromdrive -computer $serverName #| ft -property drive,caption,description,manufacturer,pnpdeviceid

Write-Host "Some BIOS Info"
#system Bios Info
get-wmiobject -class win32_bios -computer $serverName  #| ft -property manufacturer,caption,currentlanguage,serialnumber

Write-Host "Mem Config"
get-wmiobject -class win32_physicalmemory -computer $serverName # | fl -property capacity,caption
$mem=(get-wmiobject -class win32_physicalmemory -computer $serverName).count
Write-Host $mem "= Number of Mem Sticks"

Write-Host "CPU Config"
get-wmiobject -class win32_processor -computer $serverName # | fl -Property DeviceID,Description,Manufacturer,Name
$CPU=(get-wmiobject -class win32_processor -computername $serverName).count
Write-Host $CPU "= Number of CPU cores"

Write-Host "NIC Settings"
#NIC Settings
$NicConfig = Get-WmiObject -Class Win32_NetworkAdapterConfiguration -ComputerName $serverName
$myCol = @()
ForEach ($Nic in $NicConfig)
{
If ($Nic.IPAddress -ne $null)
{
$myObj = "" | Select-Object Description, DHCPEnabled, IPAddress, IPSubnet, DefaultIPGateway, DNSServers, WINSServers, NICModel, SpeedDuplex
$myObj.Description = $Nic.Description
$myObj.DHCPEnabled = $Nic.DHCPEnabled
$myObj.IPAddress = $Nic.IPAddress
$myObj.IPSubnet = $Nic.IPSubnet
$myObj.DefaultIPGateway = $Nic.DefaultIPGateway
$myObj.DNSServers = $Nic.DNSServerSearchOrder
$myObj.WINSServers = $Nic.WINSPrimaryServer,$Nic.WINSSecondaryServer
$registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $serverName)
$baseKey = $registry.OpenSubKey("SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}")
$subKeyNames = $baseKey.GetSubKeyNames()
ForEach ($subKeyName in $subKeyNames)
{
$subKey = $baseKey.OpenSubKey("$subKeyName")
$ID = $subKey.GetValue("NetCfgInstanceId")
If ($ID -eq $Nic.SettingId)
{
$componentID = $subKey.GetValue("ComponentID")
If ($componentID -match "ven_14e4")
{
$myObj.NICModel = "Broadcom"
$requestedMediaType = $subKey.GetValue("RequestedMediaType")
$enum = $subKey.OpenSubKey("Ndi\Params\RequestedMediaType\Enum")
$myObj.SpeedDuplex = $enum.GetValue("$requestedMediaType")
}
ElseIf ($componentID -match "ven_8086")
{
$myObj.NICModel = "Intel"
$SD = $subKey.GetValue("SpeedDuplex")
$enum = $subKey.OpenSubKey("Ndi\Params\SpeedDuplex\Enum")
$myObj.SpeedDuplex = $enum.GetValue("$SD")
}
ElseIf ($componentID -match "b06bdrv")
{
$myObj.NICModel = "HP"
$SD = $subKey.GetValue("req_medium")
$enum = $subKey.OpenSubKey("Ndi\Params\req_medium\Enum")
$myObj.SpeedDuplex = $enum.GetValue("$SD")
}
Else
{
$myObj.NICModel = "unknown"
$myObj.SpeedDuplex = "unknown"
}
}
}
$myCol += $myObj
}
}
$myCol

NB I'm being brutally honest...I wrote this script in 2011. As a result of my newbyness to Powershell I ripped the NIC section from a Tech Article I found on the WWW...I'll take credit for my work but nobody elses....

Query Network/Domain wird for server DNS names

get-qadcomputer -osname ‘windows*server*’ | format-table -hidetableheader -property dnshostname

Use the dotted sperators as a method of stripping out the Computername for a flat text file.

AD Group Info

write-host "Script Version 1.0"
write-host "This will return some AD Group Information"
Write-Host "Requires Quest Active Roles Powershell Snap-in"
Write-Host "Otherwise this dog just aint gonna hunt!!...WOOF WOOF...one of my dog impressions....Oddball from the film Kelly's Heros"

#Script text body

$GRP = read-host "Enter AD Group Name...."
Write-Host "Generating info...."


get-qadgroup $GRP | fl -property managedby,ManagerCanUpdateMembershipList,member,members,memberof,nestedmembers,nestedmembersof,ntaccountname,path,type,EmailAddresses,whencreated,whenchanged

List DCs

get-qadcomputer -computerrole "domaincontroller" | fl -Property name,guid,sid,objectGUID,operatingSystemServicePack,operatingSystemVersion,operatingSystem,TrustedForDelegation,AccountIsDisabled

Basic User Account Info

write-host "Script Version 1.0"
write-host "This will return user account and mailbox store info"
Write-Host "Requires Quest Active Roles Powershell Snap-in"
Write-Host "Otherwise this dog just aint gonna hunt!!...WOOF WOOF..one of my Dog Impressions...Oddball from the film Kelly's Heros!!"

$user = read-host "Enter Username in the following format....LastName.GivenName"

get-qaduser wlcorporate\$user | fl -property displayname,email,phonenumber,userprincipalname,lastlogontimestamp,lastlogon,lastlogoff,dn,homedirectory,passwordstatus,accountislockedout,accountisdisabled,memberof,nestedmemberof,passwordstatus,tsprofilepath

Get-QADUser “$user” -IncludedProperties homeMDB | Format-Table Name,homeMDB

#reminder for testing see line below

#get-qaduser "*mith*" -includedproperties homemdb | fl name,homemdb

# needs QAD Active roles shell

Determine your VMWare servers
This is an ancient script and is a reconstruct so should give you an idea how to tell what servers are VMWare.

$srvlist=get-qadcomputer -osname 'windows*server*'| format-table name | @{list}
foreach ($h in $$srvlist) {



get-wmiobject -class win32_process -computer $h -filter "name='VMwareService.exe' #returnes the hostname too

}