Get list of users of PC

[halbaradkenafin]

We had an incident of some damage to a PC and wanted to track down who had used that PC. A bit of manual digging through the Event Log gave me the name but I decided that this seems like a good time for Powershell to do it's thing for when this happens in the future. An hour or two with the command line and a bunch of tabs open to various articles and I had the following script. I figured I'd share it since it's the sort of thing that's likely to come up in our line of work:

 

param (
[string]$ComputerName = $(Read-Host "Enter Computer Name to check"),
[string]$StartDate = (Get-Date -UFormat "%d/%m/%Y")
)
$Date = Get-Date $StartDate
$EventLog = Get-WinEvent -FilterHashTable @{logname='security';id=4648;StartTime=$Date;EndTime=($Date.AddDays(1))} -ComputerName $ComputerName


$EventLogXML = @()


foreach ($Event in $EventLog) {
$EventLogXML += [xml]$Event.ToXML()
}


foreach ($XMLEntry in $EventLogXML) {
foreach ($Property in $XMLEntry.Event.EventData.Data) {
	if ($Property.Name -eq "TargetUserName" -and $Property.'#text' -ne ($ComputerName + "$")) {
		Write-Host $Property.'#text'
	}
}
}

 

It currently just looks at the date specified and gives you a list of any accounts which have logged in to that machine. I'm planning on expanding it to accept a start and end date to give a bit more scope for searching but I need to adjust the script management GUI I created to handle multiple date entries first.

 

Any suggestions for improvements are welcome.

[JJonas]

We added the following to our logon.bat file

 

echo %date% %time% %computername% %username% >>\\myserver\logon$\logons.txt

echo %date% %time% %computername% >> \\myserver\logon$\users\%username%.txt

echo %date% %time% %username% >> \\myserver\logon$\computers\%computername%.txt

[halbaradkenafin]

We added the following to our logon.bat file

 

That's similar to what I used at my last place but we're not using login scripts here so I wanted something that wouldn't noticeably impact the users. If you're using login scripts then your method is probably better, especially if you also map drives etc using it and use some string concatenation to dump any errors to the log file as well.

[6Foot2]

Link: http://www.edugeek.net/forums/how-do-you-do/91722-auto-populate-ad-computer-description-last-user-logged-serial-number.html

 

Originally one of the things the script did was to add the username of the last person logged on. As new contributions were added more events/data were being written to AD.

 

We don't use this any more as we can get the reports we need from Impero. However for those who do not have this reporting functionality this might prove useful?

[Oaktech]

I used to do this by just checking the user profiles existing on the machines and their last modified dates... Lo-Fi approach!

[sted]

Link: http://www.edugeek.net/forums/how-do-you-do/91722-auto-populate-ad-computer-description-last-user-logged-serial-number.html

 

Originally one of the things the script did was to add the username of the last person logged on. As new contributions were added more events/data were being written to AD.

 

We don't use this any more as we can get the reports we need from Impero. However for those who do not have this reporting functionality this might prove useful?

ive revised my script many many times since then. the latest 2 versions now do web pages (one is vbs my prefered version is powershell but every now and again it blanks the file. if anyone wants it i can post the new version(s)

[Garacesh]

We had an incident of some damage to a PC and wanted to track down who had used that PC. A bit of manual digging through the Event Log gave me the name but I decided that this seems like a good time for Powershell to do it's thing for when this happens in the future. An hour or two with the command line and a bunch of tabs open to various articles and I had the following script. I figured I'd share it since it's the sort of thing that's likely to come up in our line of work:

Ruddy heck, don't even get me started on this.. I've spent way too many hours improving, kludging, rewriting, optimising and breaking my script over and over..

 

Rather than adding to an XML, my script sends the results to an internal email address (CC'd to me). I feed it the machine name and the amount of events I want, it does the rest.

 

But then I started diving into error checking and correction, so I've written a function with parameters and validation scripts. Test-Connection to ping the machine and make sure it's on, ensuring MaxEvents is [iNT], and checking the email address is correct.

Which raised another issue.. Get-ADUser doesn't work in Powershell 2 (in order to check I've put the username in correctly for emailing the results off), so the script has to be ran with Powershell 3.

Guess what? Get-WinEvent doesn't work in Powershell 3*! So now the first half of the script with the error checking then has to call the Get-WinEvent script with Powershell 2, passing over all the variables like ComputerName, MaxEvents etc once it's verified they're correct.

 

You are going down a deep, dark rabbit hole, my friend. Be careful how much you try and improve this script.

 

* It works in Powershell 3 if you're in the en-US locale, but not en-GB

[halbaradkenafin]

You are going down a deep, dark rabbit hole, my friend. Be careful how much you try and improve this script.

 

The only improvement I'm really looking to make is accepting two dates but that's going to require some more reworking of a GUI script I have and I've spent a lot of time on it already and want to leave it alone for a bit before looking at it again (though I've got a good idea how to make the changes I want).

 

I've not had any problems with Get-WinEvent in Powershell 4 and I'm reasonably certain I'm set at en-GB. Might have to double check that to be sure.

[Garacesh]

Hm. Fair point, I haven't upgraded to Management Framework/Powershell 4..

Can you give Get-Culture a try just to confirm you're on en-GB? (And $PSVersionTable.PSVersion to check you're definitely on 4)

Edited December 2, 2014 by Garacesh

[halbaradkenafin]

Hm. Fair point, I haven't upgraded to Management Framework/Powershell 4..

Can you give Get-Culture a try just to confirm you're on en-GB? (And $PSVersionTable.PSVersion to check you're definitely on 4)

 

Definitely got en-GB and Powershell 4.

[Garacesh]

Sweet, I'll get MF4 downloaded, thanks!

 

But still.. It's a huge rabbit hole if you try and involve error checking etc. But the 'main' bit of it is always:

 

foreach ($event in (Get-WinEvent -ComputerName ($ComputerName + "." + $env:USERDNSDOMAIN) -FilterHashtable @{ProviderName="Microsoft-Windows-Security-Auditing"; ID="4624"; Data="C:\Windows\System32\winlogon.exe"} -MaxEvents $MaxEvents)) {
[array]$Logins += (($event.timecreated).ToString("dd/MM/yyyy, HH:mm:ss") + ($($event.message -split "`r`n")[12]) + "`n`r")
}  

(with $ComputerName and $MaxEvents manually prompted for) which gives me

12/11/2014, 11:13:56   Account Name:      UserName

etc