emberkom/management-scripts
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

added source column

Browse Source
This commit is contained in:
dyoder
2026-07-07 17:30:11 -04:00
parent 1e10306b61
commit 41260f438b
1 changed files with 57 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Get-UserLogonActivity.ps1
+57 -11
View File
@@ -214,6 +214,11 @@ Function New-UserLogonActivityRecord {
[ValidateSet('logon', 'logoff', 'unlock', 'lock', 'sleep', 'wake', 'shutdown', 'restart', 'power on')]
[string]$Activity,
[Parameter(Mandatory=$true)]
[string]$Source,
[int]$SourcePriority = 50,
[switch]$AllowSystemUser
)
@@ -224,6 +229,8 @@ Function New-UserLogonActivityRecord {
Time = $TimeCreated.ToString('HH:mm:ss')
User = $User
Activity = $Activity
Source = $Source
SourcePriority = $SourcePriority
TimeCreated = $TimeCreated
}
}
@@ -235,15 +242,15 @@ Function ConvertTo-WinlogonUserActivity {
)
Switch ($Event.Id) {
7001 { $Activity = 'logon' }
7002 { $Activity = 'logoff' }
7001 { $Activity = 'logon'; $Source = 'Winlogon 7001' }
7002 { $Activity = 'logoff'; $Source = 'Winlogon 7002' }
Default { Return $null }
}
$User = Resolve-UserLogonActivitySid -Sid (Get-UserLogonActivitySidFromEvent -Event $Event)
If ([string]::IsNullOrWhiteSpace($User)) { Return $null }
New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User $User -Activity $Activity
New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User $User -Activity $Activity -Source $Source -SourcePriority 10
}
Function ConvertTo-SecurityUserActivity {
@@ -255,21 +262,32 @@ Function ConvertTo-SecurityUserActivity {
$EventXml = [xml]$Event.ToXml()
$UserName = Get-EventDataValueFromList -EventXml $EventXml -Names @('TargetUserName', 'SubjectUserName')
$DomainName = Get-EventDataValueFromList -EventXml $EventXml -Names @('TargetDomainName', 'SubjectDomainName')
$LogonType = Get-EventDataValue -EventXml $EventXml -Name 'LogonType'
$Activity = $null
$Source = $null
$SourcePriority = 20
Switch ($Event.Id) {
4624 {
If ($LogonType -ne '7') { Return $null }
$Activity = 'unlock'
$Source = 'Security 4624 type 7'
$SourcePriority = 30
}
4800 {
$Activity = 'lock'
$Source = 'Security 4800'
}
4801 {
$Activity = 'unlock'
$Source = 'Security 4801'
}
Default {
Return $null
}
}
New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User (Format-UserName -DomainName $DomainName -UserName $UserName) -Activity $Activity
New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User (Format-UserName -DomainName $DomainName -UserName $UserName) -Activity $Activity -Source $Source -SourcePriority $SourcePriority
}
Function ConvertTo-PowerUserActivity {
@@ -285,15 +303,19 @@ Function ConvertTo-PowerUserActivity {
If ($ProviderName -ieq 'Microsoft-Windows-Kernel-Power' -and $Event.Id -eq 42) {
$Activity = 'sleep'
$Source = 'Kernel-Power 42'
}
ElseIf ($ProviderName -ieq 'Microsoft-Windows-Power-Troubleshooter' -and $Event.Id -eq 1) {
$Activity = 'wake'
$Source = 'Power-Troubleshooter 1'
}
ElseIf ($ProviderName -ieq 'EventLog' -and $Event.Id -eq 6005) {
$Activity = 'power on'
$Source = 'EventLog 6005'
}
ElseIf ($ProviderName -ieq 'EventLog' -and $Event.Id -eq 6006) {
$Activity = 'shutdown'
$Source = 'EventLog 6006'
}
ElseIf ($ProviderName -ieq 'User32' -and $Event.Id -eq 1074) {
$ShutdownType = Get-EventDataValue -EventXml $EventXml -Name 'param5'
@@ -309,12 +331,14 @@ Function ConvertTo-PowerUserActivity {
Else {
$Activity = 'shutdown'
}
$Source = 'User32 1074'
}
Else {
Return $null
}
New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User $User -Activity $Activity -AllowSystemUser
New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User $User -Activity $Activity -Source $Source -SourcePriority 10 -AllowSystemUser
}
Function Get-UserLogonActivityWinEvent {
@@ -372,15 +396,21 @@ Function Get-UniqueUserLogonActivity {
$UniqueEvents = New-Object System.Collections.Generic.List[object]
ForEach ($ActivityEvent in (@($ActivityEvents) | Where-Object { $null -ne $_ } | Sort-Object -Property TimeCreated,User,Activity)) {
ForEach ($ActivityEvent in (@($ActivityEvents) | Where-Object { $null -ne $_ } | Sort-Object -Property TimeCreated,User,Activity,SourcePriority)) {
$IsDuplicate = $false
ForEach ($UniqueEvent in $UniqueEvents) {
For ($Index = 0; $Index -lt $UniqueEvents.Count; $Index++) {
$UniqueEvent = $UniqueEvents[$Index]
If (
$UniqueEvent.User -eq $ActivityEvent.User -and
$UniqueEvent.Activity -eq $ActivityEvent.Activity -and
[Math]::Abs(($UniqueEvent.TimeCreated - $ActivityEvent.TimeCreated).TotalSeconds) -le 5
) {
If ($ActivityEvent.SourcePriority -lt $UniqueEvent.SourcePriority) {
$UniqueEvents[$Index] = $ActivityEvent
}
$IsDuplicate = $true
Break
}
@@ -400,7 +430,7 @@ Function Write-UserLogonActivityOutput {
[object[]]$ActivityEvents
)
$Rows = @($ActivityEvents | Select-Object Date,Time,User,Activity)
$Rows = @($ActivityEvents | Select-Object Date,Time,User,Activity,Source)
If ($Rows.Count -eq 0) {
Write-Output 'No matching user logon activity events found.'
@@ -417,13 +447,18 @@ $WinlogonFilter = @{
Id = @(7001, 7002)
}
# Use only 4800/4801 for lock/unlock. Security 4624 type 7 is an authentication event and
# can report an unlock without the matching workstation-lock audit event in the same result set.
$SecurityFilter = @{
LogName = 'Security'
Id = @(4800, 4801)
}
# Security 4624 type 7 is unlock authentication evidence. Query it separately so it cannot
# crowd out 4800/4801 workstation lock/unlock events in latest-event mode.
$UnlockAuthFilter = @{
LogName = 'Security'
Id = 4624
}
$PowerFilters = @(
@{
LogName = 'System'
@@ -466,6 +501,8 @@ If ($UseDateRange) {
$WinlogonFilter.EndTime = $EndDateTime.LocalDateTime
$SecurityFilter.StartTime = $StartDateTime.LocalDateTime
$SecurityFilter.EndTime = $EndDateTime.LocalDateTime
$UnlockAuthFilter.StartTime = $StartDateTime.LocalDateTime
$UnlockAuthFilter.EndTime = $EndDateTime.LocalDateTime
ForEach ($PowerFilter in $PowerFilters) {
$PowerFilter.StartTime = $StartDateTime.LocalDateTime
$PowerFilter.EndTime = $EndDateTime.LocalDateTime
@@ -481,6 +518,10 @@ If ($UseDateRange) {
Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
}
ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $UnlockAuthFilter -LogDescription 'Security unlock-authentication event log')) {
Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
}
ForEach ($PowerFilter in $PowerFilters) {
ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $PowerFilter -LogDescription 'System power event log')) {
Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-PowerUserActivity -Event $Event)
@@ -500,6 +541,7 @@ Else {
$ActivityEvents = New-Object System.Collections.Generic.List[object]
$WinlogonEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $WinlogonFilter -MaxEvents $SearchLimit -LogDescription 'System Winlogon event log')
$SecurityEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $SecurityFilter -MaxEvents $SearchLimit -LogDescription 'Security event log')
$UnlockAuthEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $UnlockAuthFilter -MaxEvents $SearchLimit -LogDescription 'Security unlock-authentication event log')
$PowerEvents = @()
$PowerFiltersMayHaveMoreEvents = $false
@@ -511,6 +553,10 @@ Else {
Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
}
ForEach ($Event in $UnlockAuthEvents) {
Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
}
ForEach ($PowerFilter in $PowerFilters) {
$CurrentPowerEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $PowerFilter -MaxEvents $SearchLimit -LogDescription 'System power event log')
$PowerEvents += $CurrentPowerEvents
@@ -526,7 +572,7 @@ Else {
$OutputEvents = @(Get-UniqueUserLogonActivity -ActivityEvents $ActivityEvents | Sort-Object -Property TimeCreated -Descending | Select-Object -First $ActivityLimit)
If ($OutputEvents.Count -ge $ActivityLimit -or (($WinlogonEvents.Count -lt $SearchLimit) -and ($SecurityEvents.Count -lt $SearchLimit) -and -not $PowerFiltersMayHaveMoreEvents) -or $SearchLimit -ge $MaxSearchLimit) {
If ($OutputEvents.Count -ge $ActivityLimit -or (($WinlogonEvents.Count -lt $SearchLimit) -and ($SecurityEvents.Count -lt $SearchLimit) -and ($UnlockAuthEvents.Count -lt $SearchLimit) -and -not $PowerFiltersMayHaveMoreEvents) -or $SearchLimit -ge $MaxSearchLimit) {
Break
}