Logon-Audit.ps1
|
<#PSScriptInfo
.VERSION 22.05.30 .GUID 8ce1ea39-7421-4190-8d59-267612fb0727 .AUTHOR Mike Galvin Contact: mike@gal.vin / twitter.com/mikegalvin_ / discord.gg/5ZsnJ5k .COMPANYNAME Mike Galvin .COPYRIGHT (C) Mike Galvin. All rights reserved. .TAGS Logon Event Audit Microsoft Teams Webhook .LICENSEURI .PROJECTURI https://gal.vin/utils/logon-audit-utility/ .ICONURI .EXTERNALMODULEDEPENDENCIES .REQUIREDSCRIPTS .EXTERNALSCRIPTDEPENDENCIES .RELEASENOTES #> <# .SYNOPSIS Logon Audit Utility - Really simple log on/off auditing utility .DESCRIPTION Log user log on and off activity to a txt file and optionally to Teams. Run with -help or no arguments for usage. #> ## Set up command line switches. [CmdletBinding()] Param( [alias("L")] $LogPathUsr, [Alias("Teams")] [ValidateScript({Test-Path -Path $_ -PathType Leaf})] [string]$Twh, [switch]$Logon, [switch]$Logoff, [switch]$Help) If ($PSBoundParameters.Values.Count -eq 0 -or $Help) { Write-Host -Object "Usage: From a terminal run: [path\]Logon-Audit.ps1 -Logon -L [path] The above command will record a logon event for the currently logged on user to the log file and also to Teams. Use -Logoff to log a logoff event. Use -Teams [path\]webhook.txt to send events to Teams via webhook. " } else { ## If logging is configured, set the log file name. If ($LogPathUsr) { ## Clean User entered string $LogPath = $LogPathUsr.trimend('\') ## Make sure the log directory exists. If ((Test-Path -Path $LogPath) -eq $False) { New-Item $LogPath -ItemType Directory -Force | Out-Null } $LogFile = "Logon-Audit.log" $Log = "$LogPath\$LogFile" } ## Function to get date in specific format. Function Get-DateFormat { Get-Date -Format "yyyy-MM-dd HH:mm:ss" } ## Function for logging. Function Write-Log($Type,$Evt) { If ($Type -eq "Logon") { If ($LogPathUsr) { Add-Content -Path $Log -Encoding ASCII -Value "$(Get-DateFormat) [LOGON] $Evt" } } If ($Type -eq "Logoff") { If ($LogPathUsr) { Add-Content -Path $Log -Encoding ASCII -Value "$(Get-DateFormat) [LOGOFF] $Evt" } } If ($Type -eq "Err") { If ($LogPathUsr) { Add-Content -Path $Log -Encoding ASCII -Value "$(Get-DateFormat) [ERROR] $Evt" } Write-Host -ForegroundColor Red -BackgroundColor Black -Object "$(Get-DateFormat) [ERROR] $Evt" } } If ($Logon -eq $false -And $Logoff -eq $false) { Write-Log -Type Err -Evt "Not Configured to do anything. Specify -Logon or -Logoff." Exit } # If the -logon switch is used, register it as a logon. If ($Logon) { Write-Log -Type Logon -Evt "Device: $env:COMPUTERNAME, Domain: $env:userdomain, Username: $env:username" If ($Twh) { $EStatus = "Logon" } } # If the -logon switch is used, register it as a logoff. If ($Logoff) { Write-Log -Type Logoff -Evt "Device: $env:COMPUTERNAME, Domain: $env:userdomain, Username: $env:username" If ($Twh) { $EStatus = "Logoff" } } # If the teams switch is used, get the webhook uri from the txt file. If ($Twh) { $uri = Get-Content $Twh # Create an array for the results. $ResultArr = @() $ResultArr += New-Object PSObject -Property @{ facts = @( @{ name = 'User:' value = $env:username }, @{ name = 'Event:' value = $EStatus }, @{ name = 'Device:' value = $env:COMPUTERNAME }, @{ name = 'Domain:' value = $env:userdomain } ) } # If the result is not empty, put array together for sending to teams. If ($Null -ne $ResultArr) { $Body = ConvertTo-Json -Depth 8 @{ text = "An event occurred." sections = $ResultArr title = "Logon Audit Utility" } Invoke-RestMethod -Uri $Uri -Method Post -body $Body -ContentType 'application/json' } } } ## End |