Мониторим пользователей AD на коленке и бесплатно

import-module activedirectory
[void][system.reflection.Assembly]::LoadWithPartialName("MySql.Data")

$server= "localhost"
$username= "logon"
$password= ""
$database= "logon"

Set-Variable SqlConnection (New-Object MySql.Data.MySqlClient.MySqlConnection) -Scope Global -Option AllScope -Description "Personal variable for Sql Query functions"
$SqlConnection.ConnectionString = "server=$server;user id=$username;password=$password;database=$database;pooling=false;Allow Zero Datetime=True;"

if (-not ($SqlConnection.State -like "Open")) { $SqlConnection.Open() }

function global:Get-SqlDataTable( $Query = $(if (-not ($Query -gt $null)) {Read-Host "Query to run"}) ) {
#	if (-not ($SqlConnection.State -like "Open")) { $SqlConnection.Open() }
	$SqlCmd = New-Object MySql.Data.MySqlClient.MySqlCommand $Query, $SqlConnection
	$SqlAdapter = New-Object MySql.Data.MySqlClient.MySqlDataAdapter
	$SqlAdapter.SelectCommand = $SqlCmd
	$DataSet = New-Object System.Data.DataSet
	$SqlAdapter.Fill($DataSet) | Out-Null
	return $DataSet.Tables[0]
}

function global:Insert-SqlDataTable( $Query = $(if (-not ($Query -gt $null)) {Read-Host "Query to run"}) ) {
#	if (-not ($SqlConnection.State -like "Open")) { $SqlConnection.Open() }
	$SqlCmd = New-Object MySql.Data.MySqlClient.MySqlCommand $Query, $SqlConnection
	$SqlAdapter = New-Object MySql.Data.MySqlClient.MySqlDataAdapter
        $SqlAdapter.InsertCommand = $SqlCmd 
        $SqlAdapter.InsertCommand.ExecuteNonQuery()
}


$events = Get-SqlDataTable 'select * from events'

$domain = 1;

$fusers = $null

if ((get-childitem \\nas\log$\users | measure).count -gt 0){
  $fusers += get-childitem \\nas\log$\users
}

if ((get-childitem \\nas.d2.local\auth_log$\users | measure).count -gt 0){
  $fusers += get-childitem \\nas.d2.local\auth_log$\users
}


foreach ($fuser in $fusers){

  if ($fuser.name -match "domain1"){
    $domain = 1
  }
  if ($fuser.name -match "domain2"){
    $domain = 2
  }
  write-host domain $domain -foregroundcolor blue


  write-host "Пользователь:" $fuser.BaseName -foregroundcolor green
  if (!(test-path $fuser.fullname)){continue}

  $ustr = get-content $fuser.fullname
  
  $error_code = $null
  $res_sql_user = $null
  $res_sql_latestdata = $null
  $res_sql_latestlogons = $null

  foreach ($line in $ustr){
    $line1 = $line -replace "['|()]"
    $arr = $line1.split(";")

    if ($arr[0]){
      if ($domain -eq 1){
        $uname = (get-aduser $arr[0]).name
      }
      if ($domain -eq 2){
        $uname = (get-aduser $arr[0] -server dc.domain2).name
      }


      $sql_str = "select id from users where lower(samaccountname) = lower('" + $arr[0] + "') and domain_id = $domain order by id limit 1;"; 
      $userid = (Get-SqlDataTable $sql_str).id

      if (!$userid){
        $sql_str = "insert into users (domain_id, samaccountname, name) values ($domain, '" + $arr[0] + "', '$uname'); select id from users where lower(samaccountname) = lower('" + $arr[0] + "') and domain_id = $domain order by id limit 1;"; 
        $userid = (Get-SqlDataTable $sql_str).id
      }
    }

    if ($arr[1]){
      $compname = $arr[1]
      $cdomain = 1
      if ($compname -match "cn1"){
        $cdomain = 1
      }
      if ($compname -match "cn2"){
        $cdomain = 2
      }

      $sql_str = "select id from computers where lower(samaccountname) = lower('" + $arr[1] + "') order by id limit 1;"; 
      $computerid = (Get-SqlDataTable $sql_str).id
      if (!$computerid){
        $sql_str = "insert into computers (domain_id, samaccountname) values ($cdomain, '" + $arr[1] + "'); select id from computers where lower(samaccountname) = lower('" + $arr[1] + "') order by id limit 1;"; 
        $computerid = (Get-SqlDataTable $sql_str).id
        write-host $sql_str -foregroundcolor yellow
      }
    }

    $ev = $events | ?{$_.event -eq $arr[3]}
    switch(($ev | measure).count){
      0 {
	write-host $arr[3] "error" -foregroundcolor red
	exit
	
        write-host $arr[3] "will be added" -foregroundcolor yellow
        $sql_str = "insert into events (event) values ('" + $arr[3] + "')"
        Insert-SqlDataTable $sql_str
        $events = Get-SqlDataTable 'select * from events'
	$sql_str  | out-file sql.txt -append
      }
      1 {
        #write-host $arr[3] "select as current" -foregroundcolor white
      }
      default: {$error_code = 3; write-host $arr[3] "error" -foregroundcolor red; exit}
    }             

    $curip = $arr[2] -replace "Address. . . . . . . . . . . :","" -replace "IPv4 Address. . : ","" -replace "IPv4- ¤аҐб  . . . . : ",""
    if ($curip){
      $sql_str = "select id from ips where lower(ip) = lower('$curip') order by id limit 1;" 
      $ipid = (Get-SqlDataTable $sql_str).id
      if (!$ipid){
        $sql_str = "insert into ips (ip) values ('$curip'); select id from ips where lower(ip) = lower('$curip') order by id limit 1;"; 
        write-host $sql_str -foregroundcolor yellow
        $ipid = (Get-SqlDataTable $sql_str).id
      }
    }

    if (!$userid){write-host u userid null; exit;}
    if (!$computerid){write-host u computerid null; exit;}
    if (!$ipid){write-host u ipid null; exit;}
    $eventid = ($events | ?{$_.event -eq $arr[3]}).id | select -first 1

      #$ip = $arr[2] -replace "Address. . . . . . . . . . . :","" -replace "IPv4 Address. . : ",""
      #$dt = "{0:yyyy-MM-dd HH:mm:ss}" -f [datetime](($arr[4] + " " + $arr[5]) -replace '^(.*),.*$','$1')

      #$dt = get-date(($arr[4] + " " + $arr[5]) -replace '^(.*),.*$','$1') -format "yyyy-MM-dd hh:mm:ss zzz"
      #$dt = get-date(($arr[4] + " " + $arr[5])) -format "yyyy-MM-dd hh:mm:ss zzz"
      
    $t = ($arr[5] -replace '^(.*),.*$','$1').split(":")
    $dt = get-date((get-date($arr[4])).Addhours($t[0]).AddMinutes($t[1]).Addseconds($t[2])) -format "yyyy-MM-dd HH:mm:ss"
    
    if ($arr[0]){
      if ($domain -eq 1){
        $groups = ((Get-ADuser $arr[0] -Property memberof).memberof | %{Get-ADGroup -Identity $_} | sort name).name
      }
      if ($domain -eq 2){
        $groups = ((Get-ADuser $arr[0] -server dc.domain2 -Property memberof).memberof | %{Get-ADGroup -Identity $_ -server dc.domain2 } | sort name).name
      }
      #$groups = ((Get-ADuser $arr[0] -Property memberof).memberof | %{Get-ADGroup -Identity $_} | sort name).name
      $val1 = ""
      $val2 = ""
      $groupscnt = ($groups | measure).count
      #write-host $groupscnt -foregroundcolor red
      for ($i = 0; $i -lt $groupscnt; $i++){
        $gr = $groups[$i] -replace "'","\'"

        $sql_str = "select id from groups where name = '$gr'"
        $groupid = (Get-SqlDataTable $sql_str).id
        if (!$groupid){
          $sql_str = "insert into groups (name) values ('$gr');"
          $res = Get-SqlDataTable $sql_str
        }

        $val2 = $val2 + "'" + $gr  + "'"
        if ($i -lt $groupscnt - 1){$val2 = $val2 + ","}
      }
      $sql_str = "select id from groups where name in ($val2);"
      $groupsid = (Get-SqlDataTable $sql_str).id

      $groupscnt = ($groupsid | measure).count
      $val3 = ""
      for ($i = 0; $i -lt $groupscnt; $i++){
        $val3 = $val3 + "($userid, " + $groupsid[$i] + ", 1, '$dt')"
        if ($i -lt $groupscnt - 1){$val3 = $val3 + ","}
      }
      $sql_str = "insert into membership (uid, gid, used, user_dt) values $val3 on duplicate key update used=values(used), user_dt=values(user_dt); update membership SET used=0 WHERE uid = $userid and user_dt != '$dt'"
      #$sql_str
      $res = Get-SqlDataTable $sql_str
      #$res
    }


#      $datetime = "{0:yyyy-MM-dd hh:mm:ss}" -f [datetime]$dt #::ParseExact($dt, "dd.MM.yyyy hh:mm:ss",$null)
      #$datetime = get-date($dt) 
#      $datetime
    $res_sql_user += "insert into logonusers (domain_id, user_id, computer_id, event_id, ip_id, dt) values ($domain, $userid, $computerid, $eventid, $ipid, '$dt');"
    $res_sql_latestdata += "insert into latestdata (domain_id, computer_id, user_id, user_event_id, ip_id, user_dt) values ($domain, $computerid, $userid, $eventid, $ipid, '$dt') on duplicate key update computer_id=values(computer_id), user_id=values(user_id), user_event_id=values(user_event_id), user_dt=values(user_dt), ip_id=values(ip_id);"
    if ($eventid -eq 2){
      $res_sql_latestlogons += "insert into latestlogons (domain_id, computer_id, user_id, user_event_id, ip_id, user_dt, processlogoff) values ($domain, $computerid, $userid, $eventid, $ipid, '$dt', 0) on duplicate key update computer_id=values(computer_id), user_id=values(user_id), user_event_id=values(user_event_id), user_dt=values(user_dt), ip_id=values(ip_id), processlogoff=values(processlogoff);"
    }
    if ($eventid -eq 1){
      $res_sql_latestlogons += "delete from latestlogons where computer_id = $computerid and user_id = $userid limit 1;"
    }

    
#    $sql = "insert into logon () values";
  }
  if (!$error_code){
    $out = Insert-SqlDataTable $res_sql_user
    $res_sql_user
    $out = Insert-SqlDataTable $res_sql_latestdata
    $res_sql_latestdata
    $out = Insert-SqlDataTable $res_sql_latestlogons
    $res_sql_latestlogons
    remove-item $fuser.fullname -force
  }
}
######################################################################
######################################################################
######################################################################
######################################################################
######################################################################

$fcomputers = $null

if ((get-childitem \\nas\log$\computers | measure).count -gt 0){
  $fcomputers += get-childitem \\nas\log$\computers
}

if ((get-childitem \\nas.d2.local\auth_log$\computers | measure).count -gt 0){
  $fcomputers += get-childitem \\nas.d2.local\auth_log$\computers
}


foreach ($fcomputer in $fcomputers){

  if ($fcomputer.name -match "domain1"){
    $domain = 1
  }
  if ($fcomputer.name -match "domain2"){
    $domain = 2
  }
write-host domain $domain -foregroundcolor blue

  write-host "ПК:" $fcomputer.BaseName -foregroundcolor green
  $cstr = get-content $fcomputer.fullname  
  $error_code = $null
  $res_sql_computer = $null
  $res_sql_latestdata = $null

  foreach ($line in $cstr){
    $arr = $line.split(";")

    if ($arr[0]){
      $sql_str = "select id from computers where lower(samaccountname) = lower('" + $arr[0] + "') order by id limit 1;"; 
      $computerid = (Get-SqlDataTable $sql_str).id
      if (!$computerid){
        $sql_str = "insert into computers (domain_id, samaccountname) values ($domain, '" + $arr[0] + "'); select id from computers where lower(samaccountname) = lower('" + $arr[0] + "') order by id limit 1;"; 
        $computerid = (Get-SqlDataTable $sql_str).id 
      }
    }

    $ev = $events | ?{$_.event -eq $arr[2]}
    switch(($ev | measure).count){
      0 {
        write-host $arr[2] "will be added" -foregroundcolor yellow
        #$sql_str = "insert into events (event) values ('" + $arr[2] + "')"
        Insert-SqlDataTable $sql_str
        $events = Get-SqlDataTable 'select * from events'
        $sql_str | out-file sql.txt -append
      }
      1 {
        #write-host $arr[3] "select as current" -foregroundcolor white
      }
      default: {$error_code = 3; write-host $arr[2] "error" -foregroundcolor red}
    }             

    $curip = $arr[1] -replace "Address. . . . . . . . . . . :","" -replace "IPv4 Address. . : ","" -replace "IPv4- ¤аҐб  . . . . : ",""
    #write-host $arr[1] $curip

    #$error_code = 4

    if ($curip){
      $sql_str = "select id from ips where lower(ip) = lower('$curip') order by id limit 1;" 
      $ipid = (Get-SqlDataTable $sql_str).id
      if (!$ipid){
        $sql_str = "insert into ips (ip) values ('$curip'); select id from ips where lower(ip) = lower('$curip') order by id limit 1;"; 
        $ipid = (Get-SqlDataTable $sql_str).id
      }
    }


    if (!$error_code){
      $eventid = ($events | ?{$_.event -eq $arr[2]}).id | select -first 1
      if (!$computerid){write-host c computerid null; exit;}
      if (!$ipid){write-host c ipid null; exit;}

      $t = ($arr[4] -replace '^(.*),.*$','$1').split(":")
      $dt = get-date((get-date($arr[3])).Addhours($t[0]).AddMinutes($t[1]).Addseconds($t[2])) -format "yyyy-MM-dd HH:mm:ss"

      $res_sql_computer += "insert into logoncomputers (domain_id, computer_id, event_id, ip_id, dt) values ($domain, $computerid, $eventid, $ipid, '$dt');"
      $res_sql_latestdata += "insert into latestdata (domain_id, computer_id, computer_event_id, computer_dt, ip_id) values ($domain, $computerid, $eventid, '$dt', $ipid) on duplicate key update computer_id=values(computer_id), computer_event_id=values(computer_event_id), computer_dt=values(computer_dt), ip_id=values(ip_id);"
    }
  }
  if (!$error_code){
    $res_sql_computer
    $out = Insert-SqlDataTable $res_sql_computer
    $res_sql_latestdata
    $out = Insert-SqlDataTable $res_sql_latestdata
    remove-item $fcomputer.fullname -force
  }
}

$SqlConnection.Close()

• Имени пользователя
• IP
• Имени ПК
• Группе

        void SystemEvents_SessionSwitch(object sender, SessionSwitchEventArgs e)
        {
            switch (e.Reason)
            {
                // ...
                case SessionSwitchReason.SessionLock:
                    // Do whatever you need to do for a lock
                    // ...
                    write_event("locked");
                    //MessageBox.Show("Locked" + DateTime.Now);
                    break;
                case SessionSwitchReason.SessionUnlock:
                    // Do whatever you need to do for an unlock
                    // ...
                    write_event("unlocked");
                    //MessageBox.Show("UnLocked" + DateTime.Now);
                    break;
                    //case SessionSwitchReason.
                // ...
            }
        }

        void write_event (string e){
            string computer = System.Environment.MachineName;
            string user = Environment.UserName;

            try 
            {
                StreamWriter w = File.AppendText(@"\\nas\log$\events\" + user + @".domain1.ru.txt");
                w.WriteLine(computer + ";" + user + ";" + e + ";" + DateTime.Now);
                w.Close();
            }
            catch {}

        }

        private void Form1_Load(object sender, EventArgs e)
        {
            this.Opacity = 0;
            this.ShowInTaskbar = false;
            SystemEvents.SessionSwitch += new SessionSwitchEventHandler(SystemEvents_SessionSwitch);
        }

            string source = @"\\nas\userstat$\Data\active_ws.exe";
            string tempdir = System.IO.Path.GetTempPath();
            string destFile = System.IO.Path.Combine(tempdir, "active_ws.exe");
            if (File.Exists(source)) 
            {
                try
                {
                    System.IO.File.Copy(source, destFile, true);
                    Process.Start(destFile);
                }
                catch (Exception e)
                {

                }
            }