Monitor AD users on your knee for free

 import-module activedirectory [void][system.reflection.Assembly]::LoadWithPartialName("MySql.Data") $server= "localhost" $username= "logon" $password= "" $database= "logon" Set-Variable SqlConnection (New-Object MySql.Data.MySqlClient.MySqlConnection) -Scope Global -Option AllScope -Description "Personal variable for Sql Query functions" $SqlConnection.ConnectionString = "server=$server;user id=$username;password=$password;database=$database;pooling=false;Allow Zero Datetime=True;" if (-not ($SqlConnection.State -like "Open")) { $SqlConnection.Open() } function global:Get-SqlDataTable( $Query = $(if (-not ($Query -gt $null)) {Read-Host "Query to run"}) ) { # if (-not ($SqlConnection.State -like "Open")) { $SqlConnection.Open() } $SqlCmd = New-Object MySql.Data.MySqlClient.MySqlCommand $Query, $SqlConnection $SqlAdapter = New-Object MySql.Data.MySqlClient.MySqlDataAdapter $SqlAdapter.SelectCommand = $SqlCmd $DataSet = New-Object System.Data.DataSet $SqlAdapter.Fill($DataSet) | Out-Null return $DataSet.Tables[0] } function global:Insert-SqlDataTable( $Query = $(if (-not ($Query -gt $null)) {Read-Host "Query to run"}) ) { # if (-not ($SqlConnection.State -like "Open")) { $SqlConnection.Open() } $SqlCmd = New-Object MySql.Data.MySqlClient.MySqlCommand $Query, $SqlConnection $SqlAdapter = New-Object MySql.Data.MySqlClient.MySqlDataAdapter $SqlAdapter.InsertCommand = $SqlCmd $SqlAdapter.InsertCommand.ExecuteNonQuery() } $events = Get-SqlDataTable 'select * from events' $domain = 1; $fusers = $null if ((get-childitem \\nas\log$\users | measure).count -gt 0){ $fusers += get-childitem \\nas\log$\users } if ((get-childitem \\nas.d2.local\auth_log$\users | measure).count -gt 0){ $fusers += get-childitem \\nas.d2.local\auth_log$\users } foreach ($fuser in $fusers){ if ($fuser.name -match "domain1"){ $domain = 1 } if ($fuser.name -match "domain2"){ $domain = 2 } write-host domain $domain -foregroundcolor blue write-host ":" $fuser.BaseName -foregroundcolor green if (!(test-path $fuser.fullname)){continue} $ustr = get-content $fuser.fullname $error_code = $null $res_sql_user = $null $res_sql_latestdata = $null $res_sql_latestlogons = $null foreach ($line in $ustr){ $line1 = $line -replace "['|()]" $arr = $line1.split(";") if ($arr[0]){ if ($domain -eq 1){ $uname = (get-aduser $arr[0]).name } if ($domain -eq 2){ $uname = (get-aduser $arr[0] -server dc.domain2).name } $sql_str = "select id from users where lower(samaccountname) = lower('" + $arr[0] + "') and domain_id = $domain order by id limit 1;"; $userid = (Get-SqlDataTable $sql_str).id if (!$userid){ $sql_str = "insert into users (domain_id, samaccountname, name) values ($domain, '" + $arr[0] + "', '$uname'); select id from users where lower(samaccountname) = lower('" + $arr[0] + "') and domain_id = $domain order by id limit 1;"; $userid = (Get-SqlDataTable $sql_str).id } } if ($arr[1]){ $compname = $arr[1] $cdomain = 1 if ($compname -match "cn1"){ $cdomain = 1 } if ($compname -match "cn2"){ $cdomain = 2 } $sql_str = "select id from computers where lower(samaccountname) = lower('" + $arr[1] + "') order by id limit 1;"; $computerid = (Get-SqlDataTable $sql_str).id if (!$computerid){ $sql_str = "insert into computers (domain_id, samaccountname) values ($cdomain, '" + $arr[1] + "'); select id from computers where lower(samaccountname) = lower('" + $arr[1] + "') order by id limit 1;"; $computerid = (Get-SqlDataTable $sql_str).id write-host $sql_str -foregroundcolor yellow } } $ev = $events | ?{$_.event -eq $arr[3]} switch(($ev | measure).count){ 0 { write-host $arr[3] "error" -foregroundcolor red exit write-host $arr[3] "will be added" -foregroundcolor yellow $sql_str = "insert into events (event) values ('" + $arr[3] + "')" Insert-SqlDataTable $sql_str $events = Get-SqlDataTable 'select * from events' $sql_str | out-file sql.txt -append } 1 { #write-host $arr[3] "select as current" -foregroundcolor white } default: {$error_code = 3; write-host $arr[3] "error" -foregroundcolor red; exit} } $curip = $arr[2] -replace "Address. . . . . . . . . . . :","" -replace "IPv4 Address. . : ","" -replace "IPv4- ¤Ґ . . . . : ","" if ($curip){ $sql_str = "select id from ips where lower(ip) = lower('$curip') order by id limit 1;" $ipid = (Get-SqlDataTable $sql_str).id if (!$ipid){ $sql_str = "insert into ips (ip) values ('$curip'); select id from ips where lower(ip) = lower('$curip') order by id limit 1;"; write-host $sql_str -foregroundcolor yellow $ipid = (Get-SqlDataTable $sql_str).id } } if (!$userid){write-host u userid null; exit;} if (!$computerid){write-host u computerid null; exit;} if (!$ipid){write-host u ipid null; exit;} $eventid = ($events | ?{$_.event -eq $arr[3]}).id | select -first 1 #$ip = $arr[2] -replace "Address. . . . . . . . . . . :","" -replace "IPv4 Address. . : ","" #$dt = "{0:yyyy-MM-dd HH:mm:ss}" -f [datetime](($arr[4] + " " + $arr[5]) -replace '^(.*),.*$','$1') #$dt = get-date(($arr[4] + " " + $arr[5]) -replace '^(.*),.*$','$1') -format "yyyy-MM-dd hh:mm:ss zzz" #$dt = get-date(($arr[4] + " " + $arr[5])) -format "yyyy-MM-dd hh:mm:ss zzz" $t = ($arr[5] -replace '^(.*),.*$','$1').split(":") $dt = get-date((get-date($arr[4])).Addhours($t[0]).AddMinutes($t[1]).Addseconds($t[2])) -format "yyyy-MM-dd HH:mm:ss" if ($arr[0]){ if ($domain -eq 1){ $groups = ((Get-ADuser $arr[0] -Property memberof).memberof | %{Get-ADGroup -Identity $_} | sort name).name } if ($domain -eq 2){ $groups = ((Get-ADuser $arr[0] -server dc.domain2 -Property memberof).memberof | %{Get-ADGroup -Identity $_ -server dc.domain2 } | sort name).name } #$groups = ((Get-ADuser $arr[0] -Property memberof).memberof | %{Get-ADGroup -Identity $_} | sort name).name $val1 = "" $val2 = "" $groupscnt = ($groups | measure).count #write-host $groupscnt -foregroundcolor red for ($i = 0; $i -lt $groupscnt; $i++){ $gr = $groups[$i] -replace "'","\'" $sql_str = "select id from groups where name = '$gr'" $groupid = (Get-SqlDataTable $sql_str).id if (!$groupid){ $sql_str = "insert into groups (name) values ('$gr');" $res = Get-SqlDataTable $sql_str } $val2 = $val2 + "'" + $gr + "'" if ($i -lt $groupscnt - 1){$val2 = $val2 + ","} } $sql_str = "select id from groups where name in ($val2);" $groupsid = (Get-SqlDataTable $sql_str).id $groupscnt = ($groupsid | measure).count $val3 = "" for ($i = 0; $i -lt $groupscnt; $i++){ $val3 = $val3 + "($userid, " + $groupsid[$i] + ", 1, '$dt')" if ($i -lt $groupscnt - 1){$val3 = $val3 + ","} } $sql_str = "insert into membership (uid, gid, used, user_dt) values $val3 on duplicate key update used=values(used), user_dt=values(user_dt); update membership SET used=0 WHERE uid = $userid and user_dt != '$dt'" #$sql_str $res = Get-SqlDataTable $sql_str #$res } # $datetime = "{0:yyyy-MM-dd hh:mm:ss}" -f [datetime]$dt #::ParseExact($dt, "dd.MM.yyyy hh:mm:ss",$null) #$datetime = get-date($dt) # $datetime $res_sql_user += "insert into logonusers (domain_id, user_id, computer_id, event_id, ip_id, dt) values ($domain, $userid, $computerid, $eventid, $ipid, '$dt');" $res_sql_latestdata += "insert into latestdata (domain_id, computer_id, user_id, user_event_id, ip_id, user_dt) values ($domain, $computerid, $userid, $eventid, $ipid, '$dt') on duplicate key update computer_id=values(computer_id), user_id=values(user_id), user_event_id=values(user_event_id), user_dt=values(user_dt), ip_id=values(ip_id);" if ($eventid -eq 2){ $res_sql_latestlogons += "insert into latestlogons (domain_id, computer_id, user_id, user_event_id, ip_id, user_dt, processlogoff) values ($domain, $computerid, $userid, $eventid, $ipid, '$dt', 0) on duplicate key update computer_id=values(computer_id), user_id=values(user_id), user_event_id=values(user_event_id), user_dt=values(user_dt), ip_id=values(ip_id), processlogoff=values(processlogoff);" } if ($eventid -eq 1){ $res_sql_latestlogons += "delete from latestlogons where computer_id = $computerid and user_id = $userid limit 1;" } # $sql = "insert into logon () values"; } if (!$error_code){ $out = Insert-SqlDataTable $res_sql_user $res_sql_user $out = Insert-SqlDataTable $res_sql_latestdata $res_sql_latestdata $out = Insert-SqlDataTable $res_sql_latestlogons $res_sql_latestlogons remove-item $fuser.fullname -force } } ###################################################################### ###################################################################### ###################################################################### ###################################################################### ###################################################################### $fcomputers = $null if ((get-childitem \\nas\log$\computers | measure).count -gt 0){ $fcomputers += get-childitem \\nas\log$\computers } if ((get-childitem \\nas.d2.local\auth_log$\computers | measure).count -gt 0){ $fcomputers += get-childitem \\nas.d2.local\auth_log$\computers } foreach ($fcomputer in $fcomputers){ if ($fcomputer.name -match "domain1"){ $domain = 1 } if ($fcomputer.name -match "domain2"){ $domain = 2 } write-host domain $domain -foregroundcolor blue write-host ":" $fcomputer.BaseName -foregroundcolor green $cstr = get-content $fcomputer.fullname $error_code = $null $res_sql_computer = $null $res_sql_latestdata = $null foreach ($line in $cstr){ $arr = $line.split(";") if ($arr[0]){ $sql_str = "select id from computers where lower(samaccountname) = lower('" + $arr[0] + "') order by id limit 1;"; $computerid = (Get-SqlDataTable $sql_str).id if (!$computerid){ $sql_str = "insert into computers (domain_id, samaccountname) values ($domain, '" + $arr[0] + "'); select id from computers where lower(samaccountname) = lower('" + $arr[0] + "') order by id limit 1;"; $computerid = (Get-SqlDataTable $sql_str).id } } $ev = $events | ?{$_.event -eq $arr[2]} switch(($ev | measure).count){ 0 { write-host $arr[2] "will be added" -foregroundcolor yellow #$sql_str = "insert into events (event) values ('" + $arr[2] + "')" Insert-SqlDataTable $sql_str $events = Get-SqlDataTable 'select * from events' $sql_str | out-file sql.txt -append } 1 { #write-host $arr[3] "select as current" -foregroundcolor white } default: {$error_code = 3; write-host $arr[2] "error" -foregroundcolor red} } $curip = $arr[1] -replace "Address. . . . . . . . . . . :","" -replace "IPv4 Address. . : ","" -replace "IPv4- ¤Ґ . . . . : ","" #write-host $arr[1] $curip #$error_code = 4 if ($curip){ $sql_str = "select id from ips where lower(ip) = lower('$curip') order by id limit 1;" $ipid = (Get-SqlDataTable $sql_str).id if (!$ipid){ $sql_str = "insert into ips (ip) values ('$curip'); select id from ips where lower(ip) = lower('$curip') order by id limit 1;"; $ipid = (Get-SqlDataTable $sql_str).id } } if (!$error_code){ $eventid = ($events | ?{$_.event -eq $arr[2]}).id | select -first 1 if (!$computerid){write-host c computerid null; exit;} if (!$ipid){write-host c ipid null; exit;} $t = ($arr[4] -replace '^(.*),.*$','$1').split(":") $dt = get-date((get-date($arr[3])).Addhours($t[0]).AddMinutes($t[1]).Addseconds($t[2])) -format "yyyy-MM-dd HH:mm:ss" $res_sql_computer += "insert into logoncomputers (domain_id, computer_id, event_id, ip_id, dt) values ($domain, $computerid, $eventid, $ipid, '$dt');" $res_sql_latestdata += "insert into latestdata (domain_id, computer_id, computer_event_id, computer_dt, ip_id) values ($domain, $computerid, $eventid, '$dt', $ipid) on duplicate key update computer_id=values(computer_id), computer_event_id=values(computer_event_id), computer_dt=values(computer_dt), ip_id=values(ip_id);" } } if (!$error_code){ $res_sql_computer $out = Insert-SqlDataTable $res_sql_computer $res_sql_latestdata $out = Insert-SqlDataTable $res_sql_latestdata remove-item $fcomputer.fullname -force } } $SqlConnection.Close() 

• Username
• IP
• Pc name
• Group

 void SystemEvents_SessionSwitch(object sender, SessionSwitchEventArgs e) { switch (e.Reason) { // ... case SessionSwitchReason.SessionLock: // Do whatever you need to do for a lock // ... write_event("locked"); //MessageBox.Show("Locked" + DateTime.Now); break; case SessionSwitchReason.SessionUnlock: // Do whatever you need to do for an unlock // ... write_event("unlocked"); //MessageBox.Show("UnLocked" + DateTime.Now); break; //case SessionSwitchReason. // ... } } void write_event (string e){ string computer = System.Environment.MachineName; string user = Environment.UserName; try { StreamWriter w = File.AppendText(@"\\nas\log$\events\" + user + @".domain1.ru.txt"); w.WriteLine(computer + ";" + user + ";" + e + ";" + DateTime.Now); w.Close(); } catch {} } private void Form1_Load(object sender, EventArgs e) { this.Opacity = 0; this.ShowInTaskbar = false; SystemEvents.SessionSwitch += new SessionSwitchEventHandler(SystemEvents_SessionSwitch); } 

  string source = @"\\nas\userstat$\Data\active_ws.exe"; string tempdir = System.IO.Path.GetTempPath(); string destFile = System.IO.Path.Combine(tempdir, "active_ws.exe"); if (File.Exists(source)) { try { System.IO.File.Copy(source, destFile, true); Process.Start(destFile); } catch (Exception e) { } }