Get-VulnerableUserAccounts.ps1

# PowerShell script authored by Sean Metcalf (@PyroTek3)
# 2025-09-12
# Script provided as-is

Param
 (
    $Domain = $env:userdnsdomain
 )

$DomainDC = (Get-ADDomainController -Discover -DomainName $Domain).Name
$DomainInfo = Get-ADDomain -Server $DomainDC

$LastLoggedOnDate = $(Get-Date) - $(New-TimeSpan -days 180)  
$PasswordStaleDate = $(Get-Date) - $(New-TimeSpan -days 180)

$ADLimitedProperties = @("Name","Enabled","SAMAccountname","DisplayName","Enabled","LastLogonDate","PasswordLastSet",
        "PasswordNeverExpires","PasswordNotRequired","PasswordExpired","SmartcardLogonRequired","AccountExpirationDate",
        "AdminCount","Created","Modified","LastBadPasswordAttempt","badpwdcount","mail","CanonicalName","DistinguishedName",
        "ServicePrincipalName","SIDHistory","PrimaryGroupID","UserAccountControl","DoesNotRequirePreAuth")

[array]$DomainUsers = Get-ADUser -Filter * -Property $ADLimitedProperties -Server $DomainDC
[array]$DomainEnabledUsers = $DomainUsers | Where {$_.Enabled -eq $True }
[array]$DomainEnabledInactiveUsers = $DomainEnabledUsers | Where { ($_.LastLogonDate -le $LastLoggedOnDate) -AND ($_.PasswordLastSet -le $PasswordStaleDate) }
[array]$DomainUsersWithReversibleEncryptionPasswordArray = $DomainUsers | Where { $_.UserAccountControl -band 0x0080 } 
[array]$DomainUserPasswordNotRequiredArray = $DomainUsers | Where {$_.PasswordNotRequired -eq $True}
[array]$DomainUserPasswordNeverExpiresArray = $DomainUsers | Where {$_.PasswordNeverExpires -eq $True}
[array]$DomainKerberosDESUsersArray = $DomainUsers | Where { $_.UserAccountControl -band 0x200000 }
[array]$DomainUserDoesNotRequirePreAuthArray = $DomainUsers | Where {$_.DoesNotRequirePreAuth -eq $True}
[array]$DomainUsersWithSIDHistoryArray = $DomainUsers | Where {$_.SIDHistory -like "*"}

Write-Host "Total Users: $($DomainUsers.Count)"
Write-Host "Enabled Users: $($DomainEnabledUsers.Count)"
Write-Host "`nEnabled Users Identified as Inactive: $($DomainEnabledInactiveUsers.Count)"
Write-Host "Enabled Users With Reversible Encryption Password: $($DomainUsersWithReversibleEncryptionPasswordArray.Count)"
Write-Host "Enabled Users With Password Not Required: $($DomainUserPasswordNotRequiredArray.Count)"
Write-Host "Enabled Users With Password Never Expires: $($DomainUserPasswordNeverExpiresArray.Count)"
Write-Host "Enabled Users With Kerberos DES: $($DomainKerberosDESUsersArray.Count)"
Write-Host "Enabled Users That Do Not Require Kerberos Pre-Authentication: $($DomainUserDoesNotRequirePreAuthArray.Count)"
Write-Host "Enabled Users With SID History: $($DomainUsersWithSIDHistoryArray.Count)"
Write-Host "`nReview & clean up as appropriate"