improved clarity

Get-UserLogonActivity.ps1

@@ -682,7 +682,22 @@ Function Write-UserLogonActivityOutput {
     Write-PlainTextTable -Rows $Rows -Columns @('Date', 'Time', 'User', 'Activity', 'Source', 'Details')
 }
 
-Function Test-RedundantSessionReconnectUnlock {
+Function Get-PossibleUseWindowAction {
+    Param(
+        [AllowNull()]
+        [string]$Activity
+    )
+
+    Switch ($Activity) {
+        'session reconnect' { Return 'reconnect' }
+        'session disconnect' { Return 'disconnect' }
+        'screensaver dismiss' { Return 'screensaver dismiss' }
+        'screensaver start' { Return 'screensaver start' }
+        Default { Return $Activity }
+    }
+}
+
+Function Test-RedundantOpeningUnlock {
     Param(
         [Parameter(Mandatory=$true)]
         [object]$ActivityEvent,
@@ -697,7 +712,7 @@ Function Test-RedundantSessionReconnectUnlock {
 
     ForEach ($CandidateEvent in @($ActivityEvents)) {
         If (
-            $CandidateEvent.Activity -eq 'session reconnect' -and
+            $CandidateEvent.Activity -in @('logon', 'session reconnect') -and
             [Math]::Abs(($CandidateEvent.TimeCreated - $ActivityEvent.TimeCreated).TotalSeconds) -le 5
         ) {
             Return $true
@@ -717,9 +732,14 @@ Function Get-PossibleUseWindow {
     $UseWindows = New-Object System.Collections.Generic.List[object]
     $OpeningActivities = @('logon', 'unlock', 'remote logon', 'session reconnect', 'screensaver dismiss')
     $ImpliedClosureDescriptions = @{
-        'unlock' = 'implied prior lock before'
-        'session reconnect' = 'implied prior disconnect before'
-        'screensaver dismiss' = 'implied prior screensaver before'
+        'unlock' = 'lock before unlock'
+        'session reconnect' = 'disconnect before reconnect'
+        'screensaver dismiss' = 'screensaver before dismiss'
+    }
+    $ImpliedClosureNotes = @{
+        'unlock' = 'lock time unknown'
+        'session reconnect' = 'disconnect time unknown'
+        'screensaver dismiss' = 'screensaver start unknown'
     }
 
     $OrderedActivityEvents = @($ActivityEvents | Where-Object { $null -ne $_ } | Sort-Object -Property TimeCreated)
@@ -729,7 +749,7 @@ Function Get-PossibleUseWindow {
         $Activity = [string]$ActivityEvent.Activity
         $Source = [string]$ActivityEvent.Source
 
-        If (Test-RedundantSessionReconnectUnlock -ActivityEvent $ActivityEvent -ActivityEvents $OrderedActivityEvents) {
+        If (Test-RedundantOpeningUnlock -ActivityEvent $ActivityEvent -ActivityEvents $OrderedActivityEvents) {
             Continue
         }
 
@@ -740,8 +760,9 @@ Function Get-PossibleUseWindow {
                     Start = $OpenWindow.StartTime.ToString('yyyy-MM-dd HH:mm:ss')
                     End = $ActivityEvent.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss')
                     User = $OpenWindow.User
-                    StartedBy = $OpenWindow.StartedBy
-                    EndedBy = "${Activity} / ${Source}"
+                    Opened = $OpenWindow.Opened
+                    Closed = Get-PossibleUseWindowAction -Activity $Activity
+                    Note = ''
                 }) | Out-Null
                 $OpenWindow = $null
             }
@@ -760,8 +781,9 @@ Function Get-PossibleUseWindow {
                     Start = $OpenWindow.StartTime.ToString('yyyy-MM-dd HH:mm:ss')
                     End = "before $($ActivityEvent.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss'))"
                     User = $OpenWindow.User
-                    StartedBy = $OpenWindow.StartedBy
-                    EndedBy = "$($ImpliedClosureDescriptions[$Activity]) ${Activity} / ${Source}"
+                    Opened = $OpenWindow.Opened
+                    Closed = $ImpliedClosureDescriptions[$Activity]
+                    Note = $ImpliedClosureNotes[$Activity]
                 }) | Out-Null
                 $OpenWindow = $null
             }
@@ -770,7 +792,7 @@ Function Get-PossibleUseWindow {
                 $OpenWindow = [PSCustomObject]@{
                     StartTime = $ActivityEvent.TimeCreated
                     User = $User
-                    StartedBy = "${Activity} / ${Source}"
+                    Opened = Get-PossibleUseWindowAction -Activity $Activity
                 }
             }
         }
@@ -782,8 +804,9 @@ Function Get-PossibleUseWindow {
             Start = $OpenWindow.StartTime.ToString('yyyy-MM-dd HH:mm:ss')
             End = 'open through returned events'
             User = $OpenWindow.User
-            StartedBy = $OpenWindow.StartedBy
-            EndedBy = 'not closed in returned events'
+            Opened = $OpenWindow.Opened
+            Closed = 'not returned'
+            Note = 'no closing event returned'
         }) | Out-Null
     }
 
@@ -803,9 +826,9 @@ Function Write-PossibleUseWindowOutput {
         Return
     }
 
-    $Rows = @($UseWindows | Select-Object Start,End,User,StartedBy,EndedBy)
+    $Rows = @($UseWindows | Select-Object Start,End,User,Opened,Closed,Note)
     Write-Output 'Possible use windows inferred from returned events:'
-    Write-PlainTextTable -Rows $Rows -Columns @('Start', 'End', 'User', 'StartedBy', 'EndedBy')
+    Write-PlainTextTable -Rows $Rows -Columns @('Start', 'End', 'User', 'Opened', 'Closed', 'Note')
 }
 
 # Winlogon 7001/7002 tracks user session logon/logoff more reliably than Security 4624/4634.