Remotely query user profile information with PowerShell

• Author
• Recent Posts

Sitaram Pamarthi

Sitaram Pamarthi is working as a Windows Engineer and his special fields of interest are PowerShell, Active Directory, Exchange, and virtualization.

Latest posts by Sitaram Pamarthi (see all)

• Add a domain user or group to local administrators with PowerShell - Wed, Mar 19 2014
• Create a list of local administrators with PowerShell - Wed, Mar 5 2014
• Remotely query user profile information with PowerShell - Tue, Nov 26 2013

I will show you how to query Windows user profile information for a remote computer using WMI and PowerShell. Since Windows Vista SP1, Microsoft has offered a WMI class named Win32_UserProfile to facilitate querying profile information for a remote computer. There are other ways to accomplish this task, such as listing the directories in the c:\users folder, but these methods are not efficient and might fail in cases where user profiles are stored in different drives or directories.

Querying using the Win32_UserProfile class will return a list of profile objects. These objects contain information such as the SID of the user to whom the profile belongs and the type of profile. Because the SID is not in a human-friendly format for identifying the user names, the script tries to convert the SID to a user name. This conversion will work for both domain and local user accounts when run locally on the computer. The SID-to-name conversion fails when you query profile information for local user accounts remotely. In such cases, you will see the SID number instead of a user name in the script output.

Another thing the script does is translate the profile type. The profile objects returned by the WMI query contain an attribute called Status. Per the Technet page, this attribute should contain values of 0, 1, 2, and 3. But what people have noticed is that the attribute stores values of 0, 1, 2, 4, and 8, where 1 = Temporary, 2 = Roaming, 4 = Mandatory, and 8 = Corrupted. The script output contains this profile type information as well.

Look at the PowerShell script below to understand how SID translation and profile type determination is done using PowerShell.

[cmdletbinding()]
param (
[parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)]
[string[]]$ComputerName = $env:computername
)            

foreach ($Computer in $ComputerName) {
 $Profiles = Get-WmiObject -Class Win32_UserProfile -Computer $Computer -ea 0
 foreach ($profile in $profiles) {
  try {
	  $objSID = New-Object System.Security.Principal.SecurityIdentifier($profile.sid)
	  $objuser = $objsid.Translate([System.Security.Principal.NTAccount])
	  $objusername = $objuser.value
  } catch {
		$objusername = $profile.sid
  }
  switch($profile.status){
   1 { $profileType="Temporary" }
   2 { $profileType="Roaming" }
   4 { $profileType="Mandatory" }
   8 { $profileType="Corrupted" }
   default { $profileType = "LOCAL" }
  }
  $User = $objUser.Value
  $ProfileLastUseTime = ([WMI]"").Converttodatetime($profile.lastusetime)
  $OutputObj = New-Object -TypeName PSobject
  $OutputObj | Add-Member -MemberType NoteProperty -Name ComputerName -Value $Computer.toUpper()
  $OutputObj | Add-Member -MemberType NoteProperty -Name ProfileName -Value $objusername
  $OutputObj | Add-Member -MemberType NoteProperty -Name ProfilePath -Value $profile.localpath
  $OutputObj | Add-Member -MemberType NoteProperty -Name ProfileType -Value $ProfileType
  $OutputObj | Add-Member -MemberType NoteProperty -Name IsinUse -Value $profile.loaded
  $OutputObj | Add-Member -MemberType NoteProperty -Name IsSystemAccount -Value $profile.special
  $OutputObj
  
 }
}

The script also gives you information such as whether the profile is in use or not and if the profile belongs to a system account such as SYSTEM. In addition, the script indicates whether the profile is in use or not.

Sample usage and output:

Query profile information on a local computer:

.\Get-WindowsProfiles.ps1

Query profile information for a remote computer:

.\Get-WindowsProfiles.ps1 -ComputerName SRVTIB1

Query profile information for multiple remote computers:

.\Get-WindowsProfiles.ps1 -ComputerName (get-content c:\temp\servers.txt)

Get user profile information with PowerShell