emberkom/management-scripts
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

improved clarity

Browse Source
This commit is contained in:
dyoder
2026-07-08 12:20:45 -04:00
parent 8ae07c0030
commit faddaba0ed
1 changed files with 38 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Get-UserLogonActivity.ps1
+38 -15
View File
@@ -682,7 +682,22 @@ Function Write-UserLogonActivityOutput {
Write-PlainTextTable -Rows $Rows -Columns @('Date', 'Time', 'User', 'Activity', 'Source', 'Details') Write-PlainTextTable -Rows $Rows -Columns @('Date', 'Time', 'User', 'Activity', 'Source', 'Details')
} }
Function Test-RedundantSessionReconnectUnlock { Function Get-PossibleUseWindowAction {
Param(
[AllowNull()]
[string]$Activity
)
Switch ($Activity) {
'session reconnect' { Return 'reconnect' }
'session disconnect' { Return 'disconnect' }
'screensaver dismiss' { Return 'screensaver dismiss' }
'screensaver start' { Return 'screensaver start' }
Default { Return $Activity }
}
}
Function Test-RedundantOpeningUnlock {
Param( Param(
[Parameter(Mandatory=$true)] [Parameter(Mandatory=$true)]
[object]$ActivityEvent, [object]$ActivityEvent,
@@ -697,7 +712,7 @@ Function Test-RedundantSessionReconnectUnlock {
ForEach ($CandidateEvent in @($ActivityEvents)) { ForEach ($CandidateEvent in @($ActivityEvents)) {
If ( If (
$CandidateEvent.Activity -eq 'session reconnect' -and $CandidateEvent.Activity -in @('logon', 'session reconnect') -and
[Math]::Abs(($CandidateEvent.TimeCreated - $ActivityEvent.TimeCreated).TotalSeconds) -le 5 [Math]::Abs(($CandidateEvent.TimeCreated - $ActivityEvent.TimeCreated).TotalSeconds) -le 5
) { ) {
Return $true Return $true
@@ -717,9 +732,14 @@ Function Get-PossibleUseWindow {
$UseWindows = New-Object System.Collections.Generic.List[object] $UseWindows = New-Object System.Collections.Generic.List[object]
$OpeningActivities = @('logon', 'unlock', 'remote logon', 'session reconnect', 'screensaver dismiss') $OpeningActivities = @('logon', 'unlock', 'remote logon', 'session reconnect', 'screensaver dismiss')
$ImpliedClosureDescriptions = @{ $ImpliedClosureDescriptions = @{
'unlock' = 'implied prior lock before' 'unlock' = 'lock before unlock'
'session reconnect' = 'implied prior disconnect before' 'session reconnect' = 'disconnect before reconnect'
'screensaver dismiss' = 'implied prior screensaver before' 'screensaver dismiss' = 'screensaver before dismiss'
}
$ImpliedClosureNotes = @{
'unlock' = 'lock time unknown'
'session reconnect' = 'disconnect time unknown'
'screensaver dismiss' = 'screensaver start unknown'
} }
$OrderedActivityEvents = @($ActivityEvents | Where-Object { $null -ne $_ } | Sort-Object -Property TimeCreated) $OrderedActivityEvents = @($ActivityEvents | Where-Object { $null -ne $_ } | Sort-Object -Property TimeCreated)
@@ -729,7 +749,7 @@ Function Get-PossibleUseWindow {
$Activity = [string]$ActivityEvent.Activity $Activity = [string]$ActivityEvent.Activity
$Source = [string]$ActivityEvent.Source $Source = [string]$ActivityEvent.Source
If (Test-RedundantSessionReconnectUnlock -ActivityEvent $ActivityEvent -ActivityEvents $OrderedActivityEvents) { If (Test-RedundantOpeningUnlock -ActivityEvent $ActivityEvent -ActivityEvents $OrderedActivityEvents) {
Continue Continue
} }
@@ -740,8 +760,9 @@ Function Get-PossibleUseWindow {
Start = $OpenWindow.StartTime.ToString('yyyy-MM-dd HH:mm:ss') Start = $OpenWindow.StartTime.ToString('yyyy-MM-dd HH:mm:ss')
End = $ActivityEvent.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss') End = $ActivityEvent.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss')
User = $OpenWindow.User User = $OpenWindow.User
StartedBy = $OpenWindow.StartedBy Opened = $OpenWindow.Opened
EndedBy = "${Activity} / ${Source}" Closed = Get-PossibleUseWindowAction -Activity $Activity
Note = ''
}) | Out-Null }) | Out-Null
$OpenWindow = $null $OpenWindow = $null
} }
@@ -760,8 +781,9 @@ Function Get-PossibleUseWindow {
Start = $OpenWindow.StartTime.ToString('yyyy-MM-dd HH:mm:ss') Start = $OpenWindow.StartTime.ToString('yyyy-MM-dd HH:mm:ss')
End = "before $($ActivityEvent.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss'))" End = "before $($ActivityEvent.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss'))"
User = $OpenWindow.User User = $OpenWindow.User
StartedBy = $OpenWindow.StartedBy Opened = $OpenWindow.Opened
EndedBy = "$($ImpliedClosureDescriptions[$Activity]) ${Activity} / ${Source}" Closed = $ImpliedClosureDescriptions[$Activity]
Note = $ImpliedClosureNotes[$Activity]
}) | Out-Null }) | Out-Null
$OpenWindow = $null $OpenWindow = $null
} }
@@ -770,7 +792,7 @@ Function Get-PossibleUseWindow {
$OpenWindow = [PSCustomObject]@{ $OpenWindow = [PSCustomObject]@{
StartTime = $ActivityEvent.TimeCreated StartTime = $ActivityEvent.TimeCreated
User = $User User = $User
StartedBy = "${Activity} / ${Source}" Opened = Get-PossibleUseWindowAction -Activity $Activity
} }
} }
} }
@@ -782,8 +804,9 @@ Function Get-PossibleUseWindow {
Start = $OpenWindow.StartTime.ToString('yyyy-MM-dd HH:mm:ss') Start = $OpenWindow.StartTime.ToString('yyyy-MM-dd HH:mm:ss')
End = 'open through returned events' End = 'open through returned events'
User = $OpenWindow.User User = $OpenWindow.User
StartedBy = $OpenWindow.StartedBy Opened = $OpenWindow.Opened
EndedBy = 'not closed in returned events' Closed = 'not returned'
Note = 'no closing event returned'
}) | Out-Null }) | Out-Null
} }
@@ -803,9 +826,9 @@ Function Write-PossibleUseWindowOutput {
Return Return
} }
$Rows = @($UseWindows | Select-Object Start,End,User,StartedBy,EndedBy) $Rows = @($UseWindows | Select-Object Start,End,User,Opened,Closed,Note)
Write-Output 'Possible use windows inferred from returned events:' Write-Output 'Possible use windows inferred from returned events:'
Write-PlainTextTable -Rows $Rows -Columns @('Start', 'End', 'User', 'StartedBy', 'EndedBy') Write-PlainTextTable -Rows $Rows -Columns @('Start', 'End', 'User', 'Opened', 'Closed', 'Note')
} }
# Winlogon 7001/7002 tracks user session logon/logoff more reliably than Security 4624/4634. # Winlogon 7001/7002 tracks user session logon/logoff more reliably than Security 4624/4634.