Created
November 26, 2018 07:46
-
-
Save FriedrichWeinmann/5dbc880aac267d759c430e0d37b5e4f2 to your computer and use it in GitHub Desktop.
As bad as it gets
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#----------------------------------------------------------------------------# | |
# Parameters # | |
#----------------------------------------------------------------------------# | |
# Path to a file with server names | |
$servers = 'DC', 'AdminHost' | |
# Whether errors should be ignored | |
$ignoreErrors = $true | |
# Where to write the results to | |
$outFile = '.\servers-available.txt' | |
#----------------------------------------------------------------------------# | |
# Don't edit anything below here # | |
#----------------------------------------------------------------------------# | |
function get-loggedonuser ($computername) { | |
#mjolinor 3/17/10 | |
$regexa = '.+Domain="(.+)",Name="(.+)"$' | |
$regexd = '.+LogonId="(\d+)"$' | |
$logontype = @{ | |
"0"="Local System" | |
"2"="Interactive" #(Local logon) | |
"3"="Network" # (Remote logon) | |
"4"="Batch" # (Scheduled task) | |
"5"="Service" # (Service account logon) | |
"7"="Unlock" #(Screen saver) | |
"8"="NetworkCleartext" # (Cleartext network logon) | |
"9"="NewCredentials" #(RunAs using alternate credentials) | |
"10"="RemoteInteractive" #(RDP\TS\RemoteAssistance) | |
"11"="CachedInteractive" #(Local w\cached credentials) | |
} | |
$logon_sessions = @(gwmi win32_logonsession -ComputerName $computername) | |
$logon_users = @(gwmi win32_loggedonuser -ComputerName $computername) | |
$session_user = @{} | |
$logon_users |% { | |
$_.antecedent -match $regexa > $nul | |
$username = $matches[1] + "\" + $matches[2] | |
$_.dependent -match $regexd > $nul | |
$session = $matches[1] | |
$session_user[$session] += $username | |
} | |
$logon_sessions |%{ | |
$starttime = [management.managementdatetimeconverter]::todatetime($_.starttime) | |
$loggedonuser = New-Object -TypeName psobject | |
$loggedonuser | Add-Member -MemberType NoteProperty -Name "Session" -Value $_.logonid | |
$loggedonuser | Add-Member -MemberType NoteProperty -Name "User" -Value $session_user[$_.logonid] | |
$loggedonuser | Add-Member -MemberType NoteProperty -Name "Type" -Value $logontype[$_.logontype.tostring()] | |
$loggedonuser | Add-Member -MemberType NoteProperty -Name "Auth" -Value $_.authenticationpackage | |
$loggedonuser | Add-Member -MemberType NoteProperty -Name "StartTime" -Value $starttime | |
$loggedonuser | |
} | |
} | |
function Get-UserProcesses { | |
param ($username) | |
$servers | %{ | |
$proc = Get-CimInstance Win32_Process -ComputerName $ComputerName | |
$procs = $proc | % { | |
$ownerData = Invoke-CimMethod -MethodName GetOwner -InputObject $_ | |
[PSCustomObject]@{ | |
ProcessName = $_.ProcessName | |
ProcessId = $_.ProcessId | |
Handles = $_.Handles | |
VM = $_.VM | |
WS = $_.WS | |
Owner = "{0}\{1}" -f $ownerData.Domain, $ownerData.User | |
ComputerName = $ownerData.PSComputerName | |
} | |
} | |
$procs | ? Owner -eq $username | |
} | |
} | |
function Write-Result { | |
param ($message) | |
$message | ac $outFile | |
} | |
foreach ($server in $servers) | |
{ | |
Write-Result "[$server] Starting" | |
$users = get-loggedonuser -computername $server | |
$users | %{ | |
Write-Result " User logged on: $($_.User) ($($_.Type) | $($_.Session) | $($_.StartTime))" | |
} | |
Write-Result " " | |
$users | %{ | |
Write-Result " Process for user: $($_.User)" | |
$procs = Get-UserProcesses -username $_.User | |
foreach ($proc in $procs) | |
{ | |
Write-Result " $($proc.ProcessId) | $($proc.ProcessName) - $($proc.VM) / $($proc.WS) / $($proc.Handles)" | |
} | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment