是否可以确定谁在 SC Orchestrator 2012 R2 中启动了 Runbook？

Question 1

在此处输入图片描述

步骤1

我只是提示输入此 Runbook 的用户 ID。User ID (data type: String)

第2步

我需要确定 Runbook 的 ID，以便在稍后的 SQL 查询中提取 SID。以下是返回作业 ID 的 SQL 查询。

SELECT POLICYINSTANCES.JobID 
FROM POLICYINSTANCES INNER JOIN ACTIONSERVERS ON POLICYINSTANCES.ActionServer = ACTIONSERVERS.UniqueID
WHERE     
(POLICYINSTANCES.ProcessID = '{Activity Process from "Start"}') AND 
(ACTIONSERVERS.Computer = '{Runbook Server Name from "Start"}') AND (POLICYINSTANCES.Status IS NULL)
This should return something like the following GUID: {AFA8BF28-1937-4DAE-A160-30FF130AE6CD}.

步骤3

获得此 GUID 后，您需要去掉花括号。我使用以下 powershell 脚本来执行此操作：

$a = '{Full line as string with fields separated by ':' from "Get Runbook Job ID"}'
Write-Host $a.Trim('{}')
This should return the GUID without {} AFA8BF28-1937-4DAE-A160-30FF130AE6CD

步骤4

一旦我们有了 GUID，我们现在就可以查找正确的 Runbook，并从启动 Runbook 的用户的另一个 SQL 表中获取 SID：

Select Jobs.CreatedBy
From [Microsoft.SystemCenter.Orchestrator.Runtime].Jobs AS Jobs
INNER JOIN POLICIES ON Jobs.RunbookId = POLICIES.UniqueID
Where Jobs.Id = '{PS Execution 01 Results {with Write-Host) from "Remove {} from Runbook Job GUID"}'

这将返回用户帐户的 SID，如下所示：S-1-5-21-1855722787-1516450073-351226437-1111

步骤5

我运行以下 Powershell 脚本来获取用户的 ID、电子邮件地址等。

$objSID = New-Object System.Security.Principal.SecurityIdentifier("{Full line as string with fields separated by ';' from "Get the SID of the user that executed this Runbook"}")
$objUser = $objSID.Translate( [System.Security.Principal.NTAccount])
$result = $objUser.Value
$UserName = $result.TrimStart("YOUR-DOMAIN-NAME\")

第 6 步

现在您可以从执行 Runbook 的用户那里获取各种信息。

Answer