ADQuery 2.2.1.0001 jp
はじめに：ADQuery
Download Location
This content is available at: https://content.tanium.com/files/published/ADQuery/2018-05-22_05-45-52_2.2.1.0001-g7506326/ADQuery.xml
Usage
Questions
AD Query - All Windows
Get Is Windows from all machines
Packages:
AD Query - Has Stale Computer Results
Get AD Query - Has Stale Results[Computer, 4] from all machines with AD Query - Has Stale Results[Computer, 4] containing "True"
Packages:
AD Query - Has Stale Local Administrator Results
Get AD Query - Has Stale Results[Admin, 4] from all machines with AD Query - Has Stale Results[Admin, 4] containing "True"
Packages:
AD Query - Has Stale Results
Get Target from all machines with ( AD Query - Has Stale Results[Computer, 4] containing "True" or AD Query - Has Stale Results[User, 4] containing "True" or AD Query - Has Stale Results[Admin, 4] containing "True" )
Packages:
AD Query - Has Stale User Results
Get AD Query - Has Stale Results[User, 4] from all machines with AD Query - Has Stale Results[User, 4] containing "True"
Packages:
Packages
Collect Active Directory Info
This package contains 1 files and 0 sensors.
Additional Properties:
- Command Line: cmd /c cscript //T:300 collectAdInfo.vbs $1 $2 $3 /DCsAreAllowed:$4 /ProfileCount:$5 /LogVerbosity:$6 /PropertiesToExclude:"$7" /SIDsToExclude:"$8" /NameTranslate:$9
- Command Line Timeout: 300
Prompts:
| Name / Value | Prompt Help | Type | Possible / Default Values |
|---|---|---|---|
| Collect Computer Attributes | Checkbox | Disabled | |
| Collect User Attributes | Checkbox | Disabled | |
| Collect Local Group Memberships | Checkbox | Disabled | |
| Collect data from DCs | Checkbox | Disabled | |
| Number of user profiles | Numeric | ||
| Log Verbosity | Numeric | ||
| Properties to exclude | Text | ||
| SIDs to exclude | Text | ||
| Translate Names | Checkbox | Disabled |
Files:
- collectAdInfo.vbs
Sensors
AD Query - Logged In User Details
Returns details for the current logged on user.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Columns
Name Type Description Name Text Department Text Country Text City Text Text Phone Number Text
AD Query - Computer Groups
The distinguishedName of any Active Directory groups the computer is explicitly a member of (no nested groups). Also returns the computer's Primary Group. The group is returned from the memberOf attribute and is in RFC 1779 format (CN=TestGroup,OU=Sales,DC=MyDomain,DC=com).
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - Local Groups
Returns the names of all local groups. No group members are returned.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - Computer Group Memberships
All Active Directory group memberships the computer is a member of -both explicitly and implicitly. Nested groups are also returned. The group is returned in NT format (SomeDomain\SomeGroup).
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - Primary User Groups
The distinguishedName of Active Directory group memberships for the computer's primary user. The groups returned are those which the user is explicitly a member of (no nested groups). Also returns the user's Primary Group. The group is returned from the memberOf attribute and is in RFC 1779 format (CN=TestGroup,OU=Sales,DC=MyDomain,DC=com).
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - Local Group Membership
Returns local groups and their members. To return all groups, specify All. Input accepts a single group name, or a comma delimited list of multiple names. Dependent on the AD Query content pack.
Columns
Name Type Description Group Text Member Text Location Text Type Text Parameters
Name Description Type Possible / Default Values Groups Group(s) Text Administrators
AD Query - Computer Has Group Membership
Returns True if the computer is a member of the Active Directory group.
Returns False if no match was found.
The group may be specified as groupname and domain\groupname syntax.
Multiple groups may be specified if separated by a comma. Ex: group,corp\group
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Parameters
Name Description Type Possible / Default Values Groups Groups Text
AD Query - Primary User Group Memberships
All groups the primary user of the computer is a member of -both explicitly and implicitly. Nested groups are also returned. The group is returned in NT format (SomeDomain\SomeGroup).
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - User Group Memberships
All group memberships the specified user is a member of -both explicitly and implicitly. Nested groups are also returned. The result is returned in NT format as UserDomain\UserName|GroupDomain\GroupName.
User names may be specified as username, domain\username.
Multiple users may be specified if separated by a comma. Ex: user,.\user,corp\user
Input 'all' into the Users field to return group membership of all inventoried users.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Columns
Name Type Description User Text Group Text Parameters
Name Description Type Possible / Default Values Users Users Text
AD Query - Primary User Details
Returns details for the primary user based on the number of interactive logon events.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Columns
Name Type Description Name Text Department Text Country Text City Text Text Phone Number Text
AD Query - Primary User
Returns the computer's primary user based on the number of interactive logon events.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - Logged In User Group Memberships
All group memberships the logged in user is a member of -both explicitly and implicitly. Nested groups are also returned. The group is returned in NT format (SomeDomain\SomeGroup).
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - User Attributes
Returns specified attributes for the desired user.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Parameters
Name Description Type Possible / Default Values User Active Directory Username Text Attribute Active Directory Attribute Text
AD Query - Local Administrators
Returns users and groups who are a member of the local Administrators group.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Columns
Name Type Description Name Text Location Text Type Text
AD Query - Has Stale Results
Returns True/False value based on the time the AD Query XML files were generated and a time period the Active Directory data should be considered stale.
Parameters
Name Description Type Possible / Default Values Type AD Data Type Selection Computer
User
Groups
Hours Hours Old Numeric
AD Query - User Has Group Membership
Returns True if the user is a member of the group.
Returns False if no match was found.
Input 'any' in the User field to test any inventoried user for membership.
The user may be a local account or an Active Directory account.
The user may be specified as username and domain\username syntax.
Multiple users may be specified when separated by a comma. Ex: user,.\localuser,corp\user
The group may be a local group or an Active Directory group.
The group may be specified as groupname and domain\groupname syntax.
Multiple groups may be specified if separated by a comma. Ex: group,.\group,corp\group
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Parameters
Name Description Type Possible / Default Values Users Users Text Groups Groups Text
AD Query - Computer Attributes
Returns the value of the specified Active Directory attribute from the computer's Active Directory object.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Parameters
Name Description Type Possible / Default Values Attribute Active Directory Attribute Text
AD Query - Logged In User Groups
The distinguishedName of any Active Directory groups the user is explicitly a member of (no nested groups). Also returns the user's Primary Group. The group is returned from the memberOf attribute and is in RFC 1779 format (CN=TestGroup,OU=Sales,DC=MyDomain,DC=com).
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.