使用powershell检测切换用户

本文介绍了使用powershell检测切换用户的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！ 问题描述

我想注册每次在机器中调用 switch 用户的日期和时间.我怎样才能做到这一点?与此类似，但对于切换用户"事件:.

I want to register the date and time of each time switch user is invoked in a machine. How can I do that? Something similar to this but for the "switch user" event: detect log off and on with powershell

Thank you in advance

解决方案

I think that what you are looking for this :

Event ID 4778 : A user has logged by selecting Switch user command (Fast User Switching). Event ID 4779 : A user has logged back on using Switch user command (Fast User Switching).

But these events appears in "Security" event log only when you configure "Audit conexion events" in the auditing stratégie.

Sorry for the french screen, but I think that's better than nothing.

After that when using "Fast User Switching", if you filter events IDs 4778 and 4779, you can see something like :

So the powerShell adaption of the code you point in your question is something like :

clear-Host $UserProperty = @{n="User";e={$_.ReplacementStrings[0]}} $TypeProperty = @{n="Action";e={switch($_.EventID) {4778 {"SwitchOn"} 4779{"SwitchOff"}}}} $TimeProeprty = @{n="Time";e={$_.TimeGenerated}} Get-EventLog -LogName Security -Source Microsoft-Windows-security-auditing | where {$_.EventID -eq 4778 -or $_.EventID -eq 4779} | select $UserProperty,$TypeProperty,$TimeProeprty

I hope this helps.

JP

PS : you can find other informations about "Fast user switching" in french there.