How to get all AD User accounts, associated with any application/MSA/Batch Job running in a Local or Remote machine using Script (PowerShell)

Question

Dear Scripting Guys,
I am working in an AD migration project (Migration from old legacy AD domains to single AD domain) and in the transition phase. Our infrastructure contains lots
of Users, Servers and Workstations. Authentication is being done through AD only. Many UNIX and LINUX based box are being authenticated through AD bridge to AD. 
We have lot of applications in our environment. Many applications are configured to use Managed Service Accounts. Many Workstations and servers are running batch
jobs with AD user credentials. Many applications are using AD user accounts to carry out their processes. 
We need to find out all those AD Users, which are configured as MSA, Which are configured for batch jobs and which are being used for different applications on
our network (Need to find out for every machine on network).
These identified AD Users will be migrated to the new Domain with top priority. I get stuck with this requirement and your support will be deeply appreciated.
I hope a well designed PS script can achieve this. 
Thanks in advance...
Thanks & Regards Bedanta S Mishra

Answer 1

Hey Satyajit,
Thank you for your valuable reply. It is really a great notion to enable account logon audit and collect those events for the analysis. But you know it is also a tedious job when thousand of Users come in to picture. You can imagine how complex it will be
for this analysis, where more than 200000 users getting logged in through AD. It is the fact that when a batch / MS or an application uses a Domain Users credential with successful process, automatically a successful logon event will be triggered in associated
DC. But there are also too many users which are not part of these accounts like MSA/Batch jobs or not linked to any application. In that case we have to get through unwanted events. 
Recently jrv, provided me a beautiful script to find out all MSA from a machine or from a list of machines in an AD environment. (Covers MSA part.)
$Report= 'Audit_Report.html'
$Computers= Get-ADComputer -Filter 'Enabled -eq $True' | Select -Expand Name
$head=@'
<title>Non-Standard Service Accounts</title>
<style>
BODY{background-color :#FFFFF}
TABLE{Border-width:thin;border-style: solid;border-color:Black;border-collapse: collapse;}
TH{border-width: 1px;padding: 2px;border-style: solid;border-color: black;background-color: ThreeDShadow}
TD{border-width: 1px;padding: 2px;border-style: solid;border-color: black;background-color: Transparent}
</style>
$sections=@()
foreach($computer in $Computers){
$sections+=Get-WmiObject -ComputerName $Computer -class Win32_Service -ErrorAction SilentlyContinue |
Select-Object -Property StartName,Name,DisplayName |
ConvertTo-Html -PreContent "<H2>Non-Standard Service Accounts on '$Computer'</H2>" -Fragment
$body=$sections | out-string
ConvertTo-Html -Body $body -Head $head | Out-File $report
Invoke-Item $report
A script can be designed to get all scheduled back ground batch jobs in a machine, from which the author / the Owner of that scheduled job can be extracted. like below one...
Function Get-ScheduledTasks
Param
[Alias("Computer","ComputerName")]
[Parameter(Position=1,ValuefromPipeline=$true,ValuefromPipelineByPropertyName=$true)]
[string[]]$Name = $env:COMPUTERNAME
[switch]$RootOnly = $false
Begin
$tasks = @()
$schedule = New-Object -ComObject "Schedule.Service"
Process
Function Get-Tasks
Param($path)
$out = @()
$schedule.GetFolder($path).GetTasks(0) | % {
$xml = [xml]$_.xml
$out += New-Object psobject -Property @{
"ComputerName" = $Computer
"Name" = $_.Name
"Path" = $_.Path
"LastRunTime" = $_.LastRunTime
"NextRunTime" = $_.NextRunTime
"Actions" = ($xml.Task.Actions.Exec | % { "$($_.Command) $($_.Arguments)" }) -join "`n"
"Triggers" = $(If($xml.task.triggers){ForEach($task in ($xml.task.triggers | gm | Where{$_.membertype -eq "Property"})){$xml.task.triggers.$($task.name)}})
"Enabled" = $xml.task.settings.enabled
"Author" = $xml.task.principals.Principal.UserID
"Description" = $xml.task.registrationInfo.Description
"LastTaskResult" = $_.LastTaskResult
"RunAs" = $xml.task.principals.principal.userid
If(!$RootOnly)
$schedule.GetFolder($path).GetFolders(0) | % {
$out += get-Tasks($_.Path)
$out
ForEach($Computer in $Name)
If(Test-Connection $computer -count 1 -quiet)
$schedule.connect($Computer)
$tasks += Get-Tasks "\"
Else
Write-Error "Cannot connect to $Computer. Please check it's network connectivity."
Break
$tasks
End
[System.Runtime.Interopservices.Marshal]::ReleaseComObject($schedule) | Out-Null
Remove-Variable schedule
Get-ScheduledTasks -RootOnly | Format-Table -Wrap -Autosize -Property RunAs,ComputerName,Actions
So I think, can a PS script be designed to get the report of all running applications which use domain accounts for their authentication to carry out their process. So from that result we can filter out the AD accounts being used for those
applications. After that these three individual modules can be compacted in to a single script to provide the desired output as per the requirement in a single report.
Thanks & Regards Bedanta S Mishra