added source column

Get-UserLogonActivity.ps1

@@ -214,6 +214,11 @@ Function New-UserLogonActivityRecord {
         [ValidateSet('logon', 'logoff', 'unlock', 'lock', 'sleep', 'wake', 'shutdown', 'restart', 'power on')]
         [string]$Activity,
 
+        [Parameter(Mandatory=$true)]
+        [string]$Source,
+
+        [int]$SourcePriority = 50,
+
         [switch]$AllowSystemUser
     )
 
@@ -224,6 +229,8 @@ Function New-UserLogonActivityRecord {
         Time = $TimeCreated.ToString('HH:mm:ss')
         User = $User
         Activity = $Activity
+        Source = $Source
+        SourcePriority = $SourcePriority
         TimeCreated = $TimeCreated
     }
 }
@@ -235,15 +242,15 @@ Function ConvertTo-WinlogonUserActivity {
     )
 
     Switch ($Event.Id) {
-        7001 { $Activity = 'logon' }
+        7001 { $Activity = 'logon'; $Source = 'Winlogon 7001' }
-        7002 { $Activity = 'logoff' }
+        7002 { $Activity = 'logoff'; $Source = 'Winlogon 7002' }
         Default { Return $null }
     }
 
     $User = Resolve-UserLogonActivitySid -Sid (Get-UserLogonActivitySidFromEvent -Event $Event)
     If ([string]::IsNullOrWhiteSpace($User)) { Return $null }
 
-    New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User $User -Activity $Activity
+    New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User $User -Activity $Activity -Source $Source -SourcePriority 10
 }
 
 Function ConvertTo-SecurityUserActivity {
@@ -255,21 +262,32 @@ Function ConvertTo-SecurityUserActivity {
     $EventXml = [xml]$Event.ToXml()
     $UserName = Get-EventDataValueFromList -EventXml $EventXml -Names @('TargetUserName', 'SubjectUserName')
     $DomainName = Get-EventDataValueFromList -EventXml $EventXml -Names @('TargetDomainName', 'SubjectDomainName')
+    $LogonType = Get-EventDataValue -EventXml $EventXml -Name 'LogonType'
     $Activity = $null
+    $Source = $null
+    $SourcePriority = 20
 
     Switch ($Event.Id) {
+        4624 {
+            If ($LogonType -ne '7') { Return $null }
+            $Activity = 'unlock'
+            $Source = 'Security 4624 type 7'
+            $SourcePriority = 30
+        }
         4800 {
             $Activity = 'lock'
+            $Source = 'Security 4800'
         }
         4801 {
             $Activity = 'unlock'
+            $Source = 'Security 4801'
         }
         Default {
             Return $null
         }
     }
 
-    New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User (Format-UserName -DomainName $DomainName -UserName $UserName) -Activity $Activity
+    New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User (Format-UserName -DomainName $DomainName -UserName $UserName) -Activity $Activity -Source $Source -SourcePriority $SourcePriority
 }
 
 Function ConvertTo-PowerUserActivity {
@@ -285,15 +303,19 @@ Function ConvertTo-PowerUserActivity {
 
     If ($ProviderName -ieq 'Microsoft-Windows-Kernel-Power' -and $Event.Id -eq 42) {
         $Activity = 'sleep'
+        $Source = 'Kernel-Power 42'
     }
     ElseIf ($ProviderName -ieq 'Microsoft-Windows-Power-Troubleshooter' -and $Event.Id -eq 1) {
         $Activity = 'wake'
+        $Source = 'Power-Troubleshooter 1'
     }
     ElseIf ($ProviderName -ieq 'EventLog' -and $Event.Id -eq 6005) {
         $Activity = 'power on'
+        $Source = 'EventLog 6005'
     }
     ElseIf ($ProviderName -ieq 'EventLog' -and $Event.Id -eq 6006) {
         $Activity = 'shutdown'
+        $Source = 'EventLog 6006'
     }
     ElseIf ($ProviderName -ieq 'User32' -and $Event.Id -eq 1074) {
         $ShutdownType = Get-EventDataValue -EventXml $EventXml -Name 'param5'
@@ -309,12 +331,14 @@ Function ConvertTo-PowerUserActivity {
         Else {
             $Activity = 'shutdown'
         }
+
+        $Source = 'User32 1074'
     }
     Else {
         Return $null
     }
 
-    New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User $User -Activity $Activity -AllowSystemUser
+    New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User $User -Activity $Activity -Source $Source -SourcePriority 10 -AllowSystemUser
 }
 
 Function Get-UserLogonActivityWinEvent {
@@ -372,15 +396,21 @@ Function Get-UniqueUserLogonActivity {
 
     $UniqueEvents = New-Object System.Collections.Generic.List[object]
 
-    ForEach ($ActivityEvent in (@($ActivityEvents) | Where-Object { $null -ne $_ } | Sort-Object -Property TimeCreated,User,Activity)) {
+    ForEach ($ActivityEvent in (@($ActivityEvents) | Where-Object { $null -ne $_ } | Sort-Object -Property TimeCreated,User,Activity,SourcePriority)) {
         $IsDuplicate = $false
 
-        ForEach ($UniqueEvent in $UniqueEvents) {
+        For ($Index = 0; $Index -lt $UniqueEvents.Count; $Index++) {
+            $UniqueEvent = $UniqueEvents[$Index]
+
             If (
                 $UniqueEvent.User -eq $ActivityEvent.User -and
                 $UniqueEvent.Activity -eq $ActivityEvent.Activity -and
                 [Math]::Abs(($UniqueEvent.TimeCreated - $ActivityEvent.TimeCreated).TotalSeconds) -le 5
             ) {
+                If ($ActivityEvent.SourcePriority -lt $UniqueEvent.SourcePriority) {
+                    $UniqueEvents[$Index] = $ActivityEvent
+                }
+
                 $IsDuplicate = $true
                 Break
             }
@@ -400,7 +430,7 @@ Function Write-UserLogonActivityOutput {
         [object[]]$ActivityEvents
     )
 
-    $Rows = @($ActivityEvents | Select-Object Date,Time,User,Activity)
+    $Rows = @($ActivityEvents | Select-Object Date,Time,User,Activity,Source)
 
     If ($Rows.Count -eq 0) {
         Write-Output 'No matching user logon activity events found.'
@@ -417,13 +447,18 @@ $WinlogonFilter = @{
     Id = @(7001, 7002)
 }
 
-# Use only 4800/4801 for lock/unlock. Security 4624 type 7 is an authentication event and
-# can report an unlock without the matching workstation-lock audit event in the same result set.
 $SecurityFilter = @{
     LogName = 'Security'
     Id = @(4800, 4801)
 }
 
+# Security 4624 type 7 is unlock authentication evidence. Query it separately so it cannot
+# crowd out 4800/4801 workstation lock/unlock events in latest-event mode.
+$UnlockAuthFilter = @{
+    LogName = 'Security'
+    Id = 4624
+}
+
 $PowerFilters = @(
     @{
         LogName = 'System'
@@ -466,6 +501,8 @@ If ($UseDateRange) {
     $WinlogonFilter.EndTime = $EndDateTime.LocalDateTime
     $SecurityFilter.StartTime = $StartDateTime.LocalDateTime
     $SecurityFilter.EndTime = $EndDateTime.LocalDateTime
+    $UnlockAuthFilter.StartTime = $StartDateTime.LocalDateTime
+    $UnlockAuthFilter.EndTime = $EndDateTime.LocalDateTime
     ForEach ($PowerFilter in $PowerFilters) {
         $PowerFilter.StartTime = $StartDateTime.LocalDateTime
         $PowerFilter.EndTime = $EndDateTime.LocalDateTime
@@ -481,6 +518,10 @@ If ($UseDateRange) {
         Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
     }
 
+    ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $UnlockAuthFilter -LogDescription 'Security unlock-authentication event log')) {
+        Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
+    }
+
     ForEach ($PowerFilter in $PowerFilters) {
         ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $PowerFilter -LogDescription 'System power event log')) {
             Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-PowerUserActivity -Event $Event)
@@ -500,6 +541,7 @@ Else {
         $ActivityEvents = New-Object System.Collections.Generic.List[object]
         $WinlogonEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $WinlogonFilter -MaxEvents $SearchLimit -LogDescription 'System Winlogon event log')
         $SecurityEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $SecurityFilter -MaxEvents $SearchLimit -LogDescription 'Security event log')
+        $UnlockAuthEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $UnlockAuthFilter -MaxEvents $SearchLimit -LogDescription 'Security unlock-authentication event log')
         $PowerEvents = @()
         $PowerFiltersMayHaveMoreEvents = $false
 
@@ -511,6 +553,10 @@ Else {
             Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
         }
 
+        ForEach ($Event in $UnlockAuthEvents) {
+            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
+        }
+
         ForEach ($PowerFilter in $PowerFilters) {
             $CurrentPowerEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $PowerFilter -MaxEvents $SearchLimit -LogDescription 'System power event log')
             $PowerEvents += $CurrentPowerEvents
@@ -526,7 +572,7 @@ Else {
 
         $OutputEvents = @(Get-UniqueUserLogonActivity -ActivityEvents $ActivityEvents | Sort-Object -Property TimeCreated -Descending | Select-Object -First $ActivityLimit)
 
-        If ($OutputEvents.Count -ge $ActivityLimit -or (($WinlogonEvents.Count -lt $SearchLimit) -and ($SecurityEvents.Count -lt $SearchLimit) -and -not $PowerFiltersMayHaveMoreEvents) -or $SearchLimit -ge $MaxSearchLimit) {
+        If ($OutputEvents.Count -ge $ActivityLimit -or (($WinlogonEvents.Count -lt $SearchLimit) -and ($SecurityEvents.Count -lt $SearchLimit) -and ($UnlockAuthEvents.Count -lt $SearchLimit) -and -not $PowerFiltersMayHaveMoreEvents) -or $SearchLimit -ge $MaxSearchLimit) {
             Break
         }