Skip to content

Instantly share code, notes, and snippets.

@FriedrichWeinmann
Created November 26, 2018 07:46
Show Gist options
  • Save FriedrichWeinmann/5dbc880aac267d759c430e0d37b5e4f2 to your computer and use it in GitHub Desktop.
Save FriedrichWeinmann/5dbc880aac267d759c430e0d37b5e4f2 to your computer and use it in GitHub Desktop.
As bad as it gets
#----------------------------------------------------------------------------#
# Parameters #
#----------------------------------------------------------------------------#
# Path to a file with server names
$servers = 'DC', 'AdminHost'
# Whether errors should be ignored
$ignoreErrors = $true
# Where to write the results to
$outFile = '.\servers-available.txt'
#----------------------------------------------------------------------------#
# Don't edit anything below here #
#----------------------------------------------------------------------------#
function get-loggedonuser ($computername) {
#mjolinor 3/17/10
$regexa = '.+Domain="(.+)",Name="(.+)"$'
$regexd = '.+LogonId="(\d+)"$'
$logontype = @{
"0"="Local System"
"2"="Interactive" #(Local logon)
"3"="Network" # (Remote logon)
"4"="Batch" # (Scheduled task)
"5"="Service" # (Service account logon)
"7"="Unlock" #(Screen saver)
"8"="NetworkCleartext" # (Cleartext network logon)
"9"="NewCredentials" #(RunAs using alternate credentials)
"10"="RemoteInteractive" #(RDP\TS\RemoteAssistance)
"11"="CachedInteractive" #(Local w\cached credentials)
}
$logon_sessions = @(gwmi win32_logonsession -ComputerName $computername)
$logon_users = @(gwmi win32_loggedonuser -ComputerName $computername)
$session_user = @{}
$logon_users |% {
$_.antecedent -match $regexa > $nul
$username = $matches[1] + "\" + $matches[2]
$_.dependent -match $regexd > $nul
$session = $matches[1]
$session_user[$session] += $username
}
$logon_sessions |%{
$starttime = [management.managementdatetimeconverter]::todatetime($_.starttime)
$loggedonuser = New-Object -TypeName psobject
$loggedonuser | Add-Member -MemberType NoteProperty -Name "Session" -Value $_.logonid
$loggedonuser | Add-Member -MemberType NoteProperty -Name "User" -Value $session_user[$_.logonid]
$loggedonuser | Add-Member -MemberType NoteProperty -Name "Type" -Value $logontype[$_.logontype.tostring()]
$loggedonuser | Add-Member -MemberType NoteProperty -Name "Auth" -Value $_.authenticationpackage
$loggedonuser | Add-Member -MemberType NoteProperty -Name "StartTime" -Value $starttime
$loggedonuser
}
}
function Get-UserProcesses {
param ($username)
$servers | %{
$proc = Get-CimInstance Win32_Process -ComputerName $ComputerName
$procs = $proc | % {
$ownerData = Invoke-CimMethod -MethodName GetOwner -InputObject $_
[PSCustomObject]@{
ProcessName = $_.ProcessName
ProcessId = $_.ProcessId
Handles = $_.Handles
VM = $_.VM
WS = $_.WS
Owner = "{0}\{1}" -f $ownerData.Domain, $ownerData.User
ComputerName = $ownerData.PSComputerName
}
}
$procs | ? Owner -eq $username
}
}
function Write-Result {
param ($message)
$message | ac $outFile
}
foreach ($server in $servers)
{
Write-Result "[$server] Starting"
$users = get-loggedonuser -computername $server
$users | %{
Write-Result " User logged on: $($_.User) ($($_.Type) | $($_.Session) | $($_.StartTime))"
}
Write-Result " "
$users | %{
Write-Result " Process for user: $($_.User)"
$procs = Get-UserProcesses -username $_.User
foreach ($proc in $procs)
{
Write-Result " $($proc.ProcessId) | $($proc.ProcessName) - $($proc.VM) / $($proc.WS) / $($proc.Handles)"
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment