Running Powershell command with API Endpoint

PowerShell
1

I am doing a POC and I am trying to run the below \powershell script as an API Endpoint.

[CmdletBinding()]
Param (
[string] $User,
[int] $Hours = 6
)

$dtStart = Get-Date
Write-Verbose “”
Write-Verbose “Started — $dtStart”
Write-Verbose “”

if ($Hours -lt 1) { $Hours = 1 }

3600000 = 1 hour in ms

$Time = $Hours * 3600000
Write-Verbose “$Hours hrs → $Time ms”

if ($User -eq $null -or $User -eq “”) {
Write-Verbose “General query”
$sQuery = “[System[EventID=4740 and TimeCreated[timediff(@SystemTime) <= $Time]]]"
} else {
Write-Verbose “User query: $User”
$sQuery = "[System[EventID=4740 and TimeCreated[timediff(@SystemTime) <= $Time]] and EventData[Data[@Name=‘TargetUserName’]=‘$User’]]”
}

Query AD user account for the source of a lock

$PDC = Get-ADDomainController -Discover -Service PrimaryDC
Write-Verbose “DC: $($PDC.Name)”
Get-WinEvent -ComputerName $PDC.Name -Logname Security -FilterXPath $sQuery |
Select-Object TimeCreated,@{Name=‘Name’;Expression={$.Properties[0].Value}},@{Name=‘Source’;Expression={$.Properties[1].Value}} | Format-Table -Auto

Write-Verbose “”
Write-Verbose (“Script completed in {0:0.0} seconds” -f ((Get-Date) - $dtStart).TotalSeconds)
Write-Verbose “”

When running from a powershell prompt I get the below output

8/21/2024 3:57:11 PM username Servername
8/21/2024 3:20:06 PM username Servername

When I run it from http://IPaddress:5000/lockout I get the below output.

[
{
“pageHeaderEntry”: null,
“pageFooterEntry”: null,
“autosizeInfo”: {
“objectCount”: 0,
“ClassId2e4f51ef21dd47e99d3c952918aff9cd”: “a27f094f0eec4d64845801a4c06a32ae”
},
“shapeInfo”: {
“hideHeader”: false,
“repeatHeader”: false,
“tableColumnInfoList”: [
{
“width”: 0,
“alignment”: 1,
“label”: null,
“propertyName”: “TimeCreated”,
“ClassId2e4f51ef21dd47e99d3c952918aff9cd”: “7572aa4155ec4558817a615acf7dd92e”
},
{
“width”: 0,
“alignment”: 1,
“label”: null,
“propertyName”: “Name”,
“ClassId2e4f51ef21dd47e99d3c952918aff9cd”: “7572aa4155ec4558817a615acf7dd92e”
},
{
“width”: 0,
“alignment”: 1,
“label”: null,
“propertyName”: “Source”,
“ClassId2e4f51ef21dd47e99d3c952918aff9cd”: “7572aa4155ec4558817a615acf7dd92e”
}
],
“ClassId2e4f51ef21dd47e99d3c952918aff9cd”: “e3b7a39c089845d388b2e84c5d38f5dd”
},
“groupingEntry”: null,
“ClassId2e4f51ef21dd47e99d3c952918aff9cd”: “033ecb2bc07a4d43b5ef94ed5a35d280”
},
{
“shapeInfo”: null,
“groupingEntry”: null,
“ClassId2e4f51ef21dd47e99d3c952918aff9cd”: “9e210fe47d09416682b841769c78b8a3”
},
{
“formatEntryInfo”: {
“formatPropertyFieldList”: [
{
“propertyValue”: “8/21/2024 2:28:24 PM”,
“alignment”: 0,
“ClassId2e4f51ef21dd47e99d3c952918aff9cd”: “78b102e894f742aca8c1d6737b6ff86a”
},
{
“propertyValue”: “username”,
“alignment”: 0,
“ClassId2e4f51ef21dd47e99d3c952918aff9cd”: “78b102e894f742aca8c1d6737b6ff86a”
},
{
“propertyValue”: “servername”,
“alignment”: 0,
“ClassId2e4f51ef21dd47e99d3c952918aff9cd”: “78b102e894f742aca8c1d6737b6ff86a”
}