How can I know who created or modified the runbook in MS orchestrator

Question

I would like to know who created the runbook, from both user interface of runbook designer, which I guess if from event log, and also what database table and column holds that. I see in runbook table there is a createdby, and lastModifiedby but they show something like S-1-5-500, or S-1-5-21-1801674531-1417001333-1177238915-296262, how can I join table to find out the real username of it?

Thanks

Answer 1

Sure! Here's a PowerShell script that can convert both local and domain user SIDs to their corresponding usernames in bulk. This script reads SIDs from a CSV file and outputs the results to another CSV file.

Prepare the CSV file: Ensure your CSV file contains a column with SIDs, for example, sids.csv:

SID
S-1-5-21-1801674531-1417001333-1177238915-296262
S-1-5-21-1801674531-1417001333-1177238915-296263

PowerShell script:

# Read the CSV file
$sids = Import-Csv -Path "C:\path\to\sids.csv"

# Create an empty array to store results
$results = @()

# Loop through each SID
foreach ($sid in $sids) {
    try {
        # Convert SID to username
        $sidObject = New-Object System.Security.Principal.SecurityIdentifier($sid.SID)
        $username = $sidObject.Translate([System.Security.Principal.NTAccount]).Value
    } catch {
        # Handle any errors (e.g., invalid SID)
        $username = "Error: Invalid SID or not found"
    }

}

# Export the results to a CSV file
$results | Export-Csv -Path "C:\path\to\output.csv" -NoTypeInformation

This script reads each SID from the sids.csv file, converts the SID to a username, and exports the results to a new CSV file output.csv. It handles both local and domain user SIDs.

If you have any questions or need further customization, feel free to ask!