PowerShell script to collect user logons. This is rather slow, IMO. I was thinking of replacing my Python solution with PowerShell since our shop is moving to PowerShell for administrative purposes. Will likely need to add some filtering on users to get rid of the noise, you can see that in my Python code posted earlier.
PowerShell
x
46
46
1
Function Get-Logons-Local {2
[System.Collections.ArrayList]$Records = @()3
$TypeFilter = @("3","11")4
$Filter = @{5
Logname = 'Security'6
ID = 4624,4647,4800,48017
StartTime = [datetime]::Now.AddHours(-8)8
EndTime = [datetime]::Now9
}10
11
$Events = Get-WinEvent -FilterHashtable $Filter12
ForEach ($event in $Events) {13
$LogonKey = $null14
$eventXML = [xml]$event.ToXml()15
16
$UserName = $eventXML.Event.EventData.Data[5].'#text'17
If ($UserName.StartsWith("svc")) { continue } # Skip service accounts.18
19
$LogonType = $eventXML.Event.EventData.Data[8].'#text'20
If (-Not $TypeFilter.Contains($LogonType)) { Continue }21
22
$eventArray = New-Object -TypeName PSObject -Property @{23
EventID = $event.id24
EventTime = $event.timecreated25
UserName = $UserName26
LogonType = $LogonType27
LogonKey = $LogonKey28
}29
30
Switch ( $eventArray.EventID ) {31
4624 {32
switch ( $eventArray.LogonType ) {33
"3" { $eventArray.LogonKey = "Local Logon" }34
"11" { $eventArray.LogonKey = "Cached Logon" }35
}36
}37
4647 { $eventArray.LogonKey = "Logoff" }38
4800 { $eventArray.LogonKey = "Lock" }39
4801 { $eventArray.LogonKey = "Unlock" }40
}41
42
If ($null -eq $eventArray.LogonKey) { continue }43
$Records.Add($eventArray)44
}45
Return $Records46
}
Tech. junkie, artist, coder, and supporter of open source.
