使用powershell检测切换用户 [英] Detect switch user with powershell

问题描述

我想注册每次在机器中调用 switch 用户的日期和时间.我怎样才能做到这一点?与此类似，但对于切换用户"事件:.

I want to register the date and time of each time switch user is invoked in a machine. How can I do that? Something similar to this but for the "switch user" event: detect log off and on with powershell

Thank you in advance

解决方案

I think that what you are looking for this :

Event ID 4778 : A user has logged by selecting Switch user command (Fast User Switching).
Event ID 4779 : A user has logged back on using Switch user command (Fast User Switching).

But these events appears in "Security" event log only when you configure "Audit conexion events" in the auditing stratégie.

Sorry for the french screen, but I think that's better than nothing.

After that when using "Fast User Switching", if you filter events IDs 4778 and 4779, you can see something like :

So the powerShell adaption of the code you point in your question is something like :

clear-Host
$UserProperty = @{n="User";e={$_.ReplacementStrings[0]}}
$TypeProperty = @{n="Action";e={switch($_.EventID) {4778 {"SwitchOn"} 4779{"SwitchOff"}}}}
$TimeProeprty = @{n="Time";e={$_.TimeGenerated}}
Get-EventLog -LogName Security -Source Microsoft-Windows-security-auditing | where {$_.EventID -eq 4778 -or $_.EventID -eq 4779} | select $UserProperty,$TypeProperty,$TimeProeprty

I hope this helps.

JP

PS : you can find other informations about "Fast user switching" in french there.

这篇关于使用powershell检测切换用户的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！