Finding current Logged in user while running as System Object

Anant Bera 86

Hello experts

We are executing a PowerShell script that requires retrieving the following details:

$fromDomain = $env:USERDOMAIN

$computerName = $env:COMPUTERNAME

$userProf = $env:USERPROFILE

$username = "$($env:USERDOMAIN)$($env:USERNAME)"

$fullDomain = $env:USERDNSDOMAIN

We have deployed the script using the SSCM, so the script is running as a system object due to which information is fetching as per the system account not the user account

We need the details as per the current logged in user not as per the system object. and we also want to run the script from SSCM as a System object

Is there is any other alternative or command for getting these values from for current logged in user while running from system object ??

Thanks

1 answer

MotoX80 32,246

See https://serverfault.com/questions/32633/how-to-check-who-is-currently-logged-on-to-windows-workstation-from-command-line

I converted the VBS to Powershell. It runs but I don't have a good test environment. You will have to test/fix/enhance to suit your needs.

$sess = Get-CimInstance  Win32_LogonSession | Where-Object {($_.LogonType -eq 2) -or ($_.LogonType -eq 10)}
$results =@()
foreach ($s in $sess) {
    $q = "Associators of {Win32_LogonSession.LogonId=" +  $s.LogonId + "} Where AssocClass=Win32_LoggedOnUser Role=Dependent" 
    Get-CimInstance -Query $q | foreach {
        $results += [PSCustomObject]@{
            Computer = $env:COMPUTERNAME;
            LogonId =  $s.LogonId;
            Type = $s.LogonType;
            StartTime = $s.StartTime;
            Domain = $_.Domain;
            User = $_.Name;
            Fullname = $_.Fullname  
        }
    }
} 
$results | Format-Table

Rich Matheisen 45,111

Just because I can't help tinkering with other people stuff, here's a slightly different take on the answer from @MotoX80 :

# Ref: https://learn.microsoft.com/en-us/windows-server/identity/securing-privileged-access/reference-tools-logon-types
enum LogonType{
    Interactive         = 2
    Locally             = 2
    Network             = 3
    Batch               = 4
    Service             = 5
    NetworkCleartext    = 8
    NewCredentials      = 9
    RemoteInteractive   = 10
}
$QueryPart1 = "Associators of {Win32_LogonSession.LogonId="
$QueryPart2 = "} Where AssocClass=Win32_LoggedOnUser Role=Dependent" 

# Replace the logon types below with the ones you're interested in (see LogonType enum)
$LogonTypesWanted = "Interactive", "RemoteInteractive"

[array]$LogonTypes= @()
Foreach ($lt in $LogonTypeswanted){         # get the associated enum value(s) from the enum name(s)
    $LogonTypes += [LogonType]::$lt.Value__
}

Get-CimInstance  Win32_LogonSession | 
    Where-Object {$LogonTypes -contains $_.LogonType} |
        ForEach-Object{
            $s = $_             # for use in nested ForEach-Object
            $q = "{0}{1}{2}" -f $QueryPart1, $_.LogonId, $QueryPart2
            Get-CimInstance -Query $q | 
                ForEach-Object {
                    [PSCustomObject]@{
                        Computer  = $env:COMPUTERNAME
                        LogonId   =  $s.LogonId
                        Type      = $s.LogonType
                        StartTime = $s.StartTime
                        Domain    = $_.Domain
                        User      = $_.Name
                        Fullname  = $_.Fullname  
                    }
                }
        } |Format-Table

You can package that as a function and parameterize it pretty easily, if you're so inclined.

MotoX80 32,246 Reputation points

2024-05-06T15:24:07.9733333+00:00

I'm going to deduct 5 points from your overall score because of the "$s = $_" to handle the nested foreach's. My preference is the "Foreach ($lt in $LogonTypeswanted)" method. :)

Rich Matheisen 45,111

Ooooo . . . a challenge! Well, sir, challenge accepted!

# Ref: https://learn.microsoft.com/en-us/windows-server/identity/securing-privileged-access/reference-tools-logon-types
enum LogonType{
    Interactive         = 2
    Locally             = 2
    Network             = 3
    Batch               = 4
    Service             = 5
    NetworkCleartext    = 8
    NewCredentials      = 9
    RemoteInteractive   = 10
}
$QueryPart1 = "Associators of {Win32_LogonSession.LogonId="
$QueryPart2 = "} Where AssocClass=Win32_LoggedOnUser Role=Dependent"
# Replace the logon types below with the ones you're interested in (see LogonType enum)
$LogonTypesWanted = "Interactive", "RemoteInteractive"
[array]$LogonTypes= @()
Foreach ($lt in $LogonTypeswanted){         # get the associated enum value(s) from the enum name(s)
    $LogonTypes += [LogonType]::$lt.Value__
}
Get-CimInstance  Win32_LogonSession | 
    Where-Object {$LogonTypes -contains $_.LogonType} |
        ForEach-Object -PipelineVariable s{
            $q = "{0}{1}{2}" -f $QueryPart1, $_.LogonId, $QueryPart2
            Get-CimInstance -Query $q | 
                ForEach-Object {
                    [PSCustomObject]@{
                        Computer  = $env:COMPUTERNAME
                        LogonId   =  $s.LogonId
                        Type      = $s.LogonType
                        StartTime = $s.StartTime
                        Domain    = $_.Domain
                        User      = $_.Name
                        Fullname  = $_.Fullname  
                    }
                }
        } |Format-Table

Ta-DA! No more intermediate variable.

For my next trick, a three-deep ForEach-Object structure where the 3rd level uses the output of the 1st and 2nd level ForEach-Object -- without having to explicitly create and assign a variable!

1..2 |
    foreach-object -PipelineVariable Left {
        $_ 
    } |
        ForEach-Object -PipelineVariable Right {
            3..4
        } |
            ForEach-Object {
                "Left = $Left; Right = $Right"
            }

Notice that at no time did my fingers leave my hands! :-)Do I get my points back?

MotoX80 32,246 Reputation points

2024-05-06T23:04:31.5833333+00:00

Yes, you get your points back, and I will even grant you extra credit for the additional script examples.

What, were you bored today?
Rich Matheisen 45,111 Reputation points

2024-05-07T01:49:10.47+00:00

Not today; but yesterday, yeah.

Share via

Finding current Logged in user while running as System Object

1 answer