Users‐Analyzer
Users-Analyzer.ps1 is a simple PowerShell script utilized to beautify the user account information extracted via Microsoft-Extractor-Suite by Invictus-IR.
Fig 1: Users-Analyzer
| Name | Description |
|---|---|
| Id | The unique identifier for the user. |
| AccountEnabled | 'True' if the account is enabled; otherwise, 'False'. |
| DisplayName | The name displayed in the address book for the user. This value is usually the combination of the user's first name, middle initial, and family name. |
| UserPrincipalName | The user principal name (UPN) of the user. The UPN is an Internet-style sign-in name for the user based on the Internet standard RFC 822. By convention, this value should map to the user's email name. |
| The SMTP address for the user. | |
| CreateDateTime | The date and time the user was created (UTC). |
| LastPasswordChangeTime | The time when this Microsoft Entra user last changed their password or when their password was created, whichever date the latest action was performed (UTC). |
| DeletedDateTime | The date and time the user was deleted (UTC). |
| JobTitle | The user's job title. |
| Department | The name of the department in which the user works. |
| OfficeLocation | The office location in the user's place of business. |
| City | The city where the user is located. |
| State | The state or province in the user's address. |
| Country | The country/region where the user is located. |