Мониторим пользователей AD на коленке и бесплатно

import-module activedirectory [void][system.reflection.Assembly]::LoadWithPartialName("MySql.Data")  $server= "localhost" $username= "logon" $password= "" $database= "logon"  Set-Variable SqlConnection (New-Object MySql.Data.MySqlClient.MySqlConnection) -Scope Global -Option AllScope -Description "Personal variable for Sql Query functions" $SqlConnection.ConnectionString = "server=$server;user id=$username;password=$password;database=$database;pooling=false;Allow Zero Datetime=True;"  if (-not ($SqlConnection.State -like "Open")) { $SqlConnection.Open() }  function global:Get-SqlDataTable( $Query = $(if (-not ($Query -gt $null)) {Read-Host "Query to run"}) ) { #	if (-not ($SqlConnection.State -like "Open")) { $SqlConnection.Open() } 	$SqlCmd = New-Object MySql.Data.MySqlClient.MySqlCommand $Query, $SqlConnection 	$SqlAdapter = New-Object MySql.Data.MySqlClient.MySqlDataAdapter 	$SqlAdapter.SelectCommand = $SqlCmd 	$DataSet = New-Object System.Data.DataSet 	$SqlAdapter.Fill($DataSet) | Out-Null 	return $DataSet.Tables[0] }  function global:Insert-SqlDataTable( $Query = $(if (-not ($Query -gt $null)) {Read-Host "Query to run"}) ) { #	if (-not ($SqlConnection.State -like "Open")) { $SqlConnection.Open() } 	$SqlCmd = New-Object MySql.Data.MySqlClient.MySqlCommand $Query, $SqlConnection 	$SqlAdapter = New-Object MySql.Data.MySqlClient.MySqlDataAdapter         $SqlAdapter.InsertCommand = $SqlCmd          $SqlAdapter.InsertCommand.ExecuteNonQuery() }   $events = Get-SqlDataTable 'select * from events'  $domain = 1;  $fusers = $null  if ((get-childitem \\nas\log$\users | measure).count -gt 0){   $fusers += get-childitem \\nas\log$\users }  if ((get-childitem \\nas.d2.local\auth_log$\users | measure).count -gt 0){   $fusers += get-childitem \\nas.d2.local\auth_log$\users }   foreach ($fuser in $fusers){    if ($fuser.name -match "domain1"){     $domain = 1   }   if ($fuser.name -match "domain2"){     $domain = 2   }   write-host domain $domain -foregroundcolor blue     write-host "Пользователь:" $fuser.BaseName -foregroundcolor green   if (!(test-path $fuser.fullname)){continue}    $ustr = get-content $fuser.fullname      $error_code = $null   $res_sql_user = $null   $res_sql_latestdata = $null   $res_sql_latestlogons = $null    foreach ($line in $ustr){     $line1 = $line -replace "['|()]"     $arr = $line1.split(";")      if ($arr[0]){       if ($domain -eq 1){         $uname = (get-aduser $arr[0]).name       }       if ($domain -eq 2){         $uname = (get-aduser $arr[0] -server dc.domain2).name       }         $sql_str = "select id from users where lower(samaccountname) = lower('" + $arr[0] + "') and domain_id = $domain order by id limit 1;";        $userid = (Get-SqlDataTable $sql_str).id        if (!$userid){         $sql_str = "insert into users (domain_id, samaccountname, name) values ($domain, '" + $arr[0] + "', '$uname'); select id from users where lower(samaccountname) = lower('" + $arr[0] + "') and domain_id = $domain order by id limit 1;";          $userid = (Get-SqlDataTable $sql_str).id       }     }      if ($arr[1]){       $compname = $arr[1]       $cdomain = 1       if ($compname -match "cn1"){         $cdomain = 1       }       if ($compname -match "cn2"){         $cdomain = 2       }        $sql_str = "select id from computers where lower(samaccountname) = lower('" + $arr[1] + "') order by id limit 1;";        $computerid = (Get-SqlDataTable $sql_str).id       if (!$computerid){         $sql_str = "insert into computers (domain_id, samaccountname) values ($cdomain, '" + $arr[1] + "'); select id from computers where lower(samaccountname) = lower('" + $arr[1] + "') order by id limit 1;";          $computerid = (Get-SqlDataTable $sql_str).id         write-host $sql_str -foregroundcolor yellow       }     }      $ev = $events | ?{$_.event -eq $arr[3]}     switch(($ev | measure).count){       0 { 	write-host $arr[3] "error" -foregroundcolor red 	exit 	         write-host $arr[3] "will be added" -foregroundcolor yellow         $sql_str = "insert into events (event) values ('" + $arr[3] + "')"         Insert-SqlDataTable $sql_str         $events = Get-SqlDataTable 'select * from events' 	$sql_str  | out-file sql.txt -append       }       1 {         #write-host $arr[3] "select as current" -foregroundcolor white       }       default: {$error_code = 3; write-host $arr[3] "error" -foregroundcolor red; exit}     }                   $curip = $arr[2] -replace "Address. . . . . . . . . . . :","" -replace "IPv4 Address. . : ","" -replace "IPv4- ¤аҐб  . . . . : ",""     if ($curip){       $sql_str = "select id from ips where lower(ip) = lower('$curip') order by id limit 1;"        $ipid = (Get-SqlDataTable $sql_str).id       if (!$ipid){         $sql_str = "insert into ips (ip) values ('$curip'); select id from ips where lower(ip) = lower('$curip') order by id limit 1;";          write-host $sql_str -foregroundcolor yellow         $ipid = (Get-SqlDataTable $sql_str).id       }     }      if (!$userid){write-host u userid null; exit;}     if (!$computerid){write-host u computerid null; exit;}     if (!$ipid){write-host u ipid null; exit;}     $eventid = ($events | ?{$_.event -eq $arr[3]}).id | select -first 1        #$ip = $arr[2] -replace "Address. . . . . . . . . . . :","" -replace "IPv4 Address. . : ",""       #$dt = "{0:yyyy-MM-dd HH:mm:ss}" -f [datetime](($arr[4] + " " + $arr[5]) -replace '^(.*),.*$','$1')        #$dt = get-date(($arr[4] + " " + $arr[5]) -replace '^(.*),.*$','$1') -format "yyyy-MM-dd hh:mm:ss zzz"       #$dt = get-date(($arr[4] + " " + $arr[5])) -format "yyyy-MM-dd hh:mm:ss zzz"            $t = ($arr[5] -replace '^(.*),.*$','$1').split(":")     $dt = get-date((get-date($arr[4])).Addhours($t[0]).AddMinutes($t[1]).Addseconds($t[2])) -format "yyyy-MM-dd HH:mm:ss"          if ($arr[0]){       if ($domain -eq 1){         $groups = ((Get-ADuser $arr[0] -Property memberof).memberof | %{Get-ADGroup -Identity $_} | sort name).name       }       if ($domain -eq 2){         $groups = ((Get-ADuser $arr[0] -server dc.domain2 -Property memberof).memberof | %{Get-ADGroup -Identity $_ -server dc.domain2 } | sort name).name       }       #$groups = ((Get-ADuser $arr[0] -Property memberof).memberof | %{Get-ADGroup -Identity $_} | sort name).name       $val1 = ""       $val2 = ""       $groupscnt = ($groups | measure).count       #write-host $groupscnt -foregroundcolor red       for ($i = 0; $i -lt $groupscnt; $i++){         $gr = $groups[$i] -replace "'","\'"          $sql_str = "select id from groups where name = '$gr'"         $groupid = (Get-SqlDataTable $sql_str).id         if (!$groupid){           $sql_str = "insert into groups (name) values ('$gr');"           $res = Get-SqlDataTable $sql_str         }          $val2 = $val2 + "'" + $gr  + "'"         if ($i -lt $groupscnt - 1){$val2 = $val2 + ","}       }       $sql_str = "select id from groups where name in ($val2);"       $groupsid = (Get-SqlDataTable $sql_str).id        $groupscnt = ($groupsid | measure).count       $val3 = ""       for ($i = 0; $i -lt $groupscnt; $i++){         $val3 = $val3 + "($userid, " + $groupsid[$i] + ", 1, '$dt')"         if ($i -lt $groupscnt - 1){$val3 = $val3 + ","}       }       $sql_str = "insert into membership (uid, gid, used, user_dt) values $val3 on duplicate key update used=values(used), user_dt=values(user_dt); update membership SET used=0 WHERE uid = $userid and user_dt != '$dt'"       #$sql_str       $res = Get-SqlDataTable $sql_str       #$res     }   #      $datetime = "{0:yyyy-MM-dd hh:mm:ss}" -f [datetime]$dt #::ParseExact($dt, "dd.MM.yyyy hh:mm:ss",$null)       #$datetime = get-date($dt)  #      $datetime     $res_sql_user += "insert into logonusers (domain_id, user_id, computer_id, event_id, ip_id, dt) values ($domain, $userid, $computerid, $eventid, $ipid, '$dt');"     $res_sql_latestdata += "insert into latestdata (domain_id, computer_id, user_id, user_event_id, ip_id, user_dt) values ($domain, $computerid, $userid, $eventid, $ipid, '$dt') on duplicate key update computer_id=values(computer_id), user_id=values(user_id), user_event_id=values(user_event_id), user_dt=values(user_dt), ip_id=values(ip_id);"     if ($eventid -eq 2){       $res_sql_latestlogons += "insert into latestlogons (domain_id, computer_id, user_id, user_event_id, ip_id, user_dt, processlogoff) values ($domain, $computerid, $userid, $eventid, $ipid, '$dt', 0) on duplicate key update computer_id=values(computer_id), user_id=values(user_id), user_event_id=values(user_event_id), user_dt=values(user_dt), ip_id=values(ip_id), processlogoff=values(processlogoff);"     }     if ($eventid -eq 1){       $res_sql_latestlogons += "delete from latestlogons where computer_id = $computerid and user_id = $userid limit 1;"     }       #    $sql = "insert into logon () values";   }   if (!$error_code){     $out = Insert-SqlDataTable $res_sql_user     $res_sql_user     $out = Insert-SqlDataTable $res_sql_latestdata     $res_sql_latestdata     $out = Insert-SqlDataTable $res_sql_latestlogons     $res_sql_latestlogons     remove-item $fuser.fullname -force   } } ###################################################################### ###################################################################### ###################################################################### ###################################################################### ######################################################################  $fcomputers = $null  if ((get-childitem \\nas\log$\computers | measure).count -gt 0){   $fcomputers += get-childitem \\nas\log$\computers }  if ((get-childitem \\nas.d2.local\auth_log$\computers | measure).count -gt 0){   $fcomputers += get-childitem \\nas.d2.local\auth_log$\computers }   foreach ($fcomputer in $fcomputers){    if ($fcomputer.name -match "domain1"){     $domain = 1   }   if ($fcomputer.name -match "domain2"){     $domain = 2   } write-host domain $domain -foregroundcolor blue    write-host "ПК:" $fcomputer.BaseName -foregroundcolor green   $cstr = get-content $fcomputer.fullname     $error_code = $null   $res_sql_computer = $null   $res_sql_latestdata = $null    foreach ($line in $cstr){     $arr = $line.split(";")      if ($arr[0]){       $sql_str = "select id from computers where lower(samaccountname) = lower('" + $arr[0] + "') order by id limit 1;";        $computerid = (Get-SqlDataTable $sql_str).id       if (!$computerid){         $sql_str = "insert into computers (domain_id, samaccountname) values ($domain, '" + $arr[0] + "'); select id from computers where lower(samaccountname) = lower('" + $arr[0] + "') order by id limit 1;";          $computerid = (Get-SqlDataTable $sql_str).id        }     }      $ev = $events | ?{$_.event -eq $arr[2]}     switch(($ev | measure).count){       0 {         write-host $arr[2] "will be added" -foregroundcolor yellow         #$sql_str = "insert into events (event) values ('" + $arr[2] + "')"         Insert-SqlDataTable $sql_str         $events = Get-SqlDataTable 'select * from events'         $sql_str | out-file sql.txt -append       }       1 {         #write-host $arr[3] "select as current" -foregroundcolor white       }       default: {$error_code = 3; write-host $arr[2] "error" -foregroundcolor red}     }                   $curip = $arr[1] -replace "Address. . . . . . . . . . . :","" -replace "IPv4 Address. . : ","" -replace "IPv4- ¤аҐб  . . . . : ",""     #write-host $arr[1] $curip      #$error_code = 4      if ($curip){       $sql_str = "select id from ips where lower(ip) = lower('$curip') order by id limit 1;"        $ipid = (Get-SqlDataTable $sql_str).id       if (!$ipid){         $sql_str = "insert into ips (ip) values ('$curip'); select id from ips where lower(ip) = lower('$curip') order by id limit 1;";          $ipid = (Get-SqlDataTable $sql_str).id       }     }       if (!$error_code){       $eventid = ($events | ?{$_.event -eq $arr[2]}).id | select -first 1       if (!$computerid){write-host c computerid null; exit;}       if (!$ipid){write-host c ipid null; exit;}        $t = ($arr[4] -replace '^(.*),.*$','$1').split(":")       $dt = get-date((get-date($arr[3])).Addhours($t[0]).AddMinutes($t[1]).Addseconds($t[2])) -format "yyyy-MM-dd HH:mm:ss"        $res_sql_computer += "insert into logoncomputers (domain_id, computer_id, event_id, ip_id, dt) values ($domain, $computerid, $eventid, $ipid, '$dt');"       $res_sql_latestdata += "insert into latestdata (domain_id, computer_id, computer_event_id, computer_dt, ip_id) values ($domain, $computerid, $eventid, '$dt', $ipid) on duplicate key update computer_id=values(computer_id), computer_event_id=values(computer_event_id), computer_dt=values(computer_dt), ip_id=values(ip_id);"     }   }   if (!$error_code){     $res_sql_computer     $out = Insert-SqlDataTable $res_sql_computer     $res_sql_latestdata     $out = Insert-SqlDataTable $res_sql_latestdata     remove-item $fcomputer.fullname -force   } }  $SqlConnection.Close() 

• Имени пользователя
• IP
• Имени ПК
• Группе

         void SystemEvents_SessionSwitch(object sender, SessionSwitchEventArgs e)         {             switch (e.Reason)             {                 // ...                 case SessionSwitchReason.SessionLock:                     // Do whatever you need to do for a lock                     // ...                     write_event("locked");                     //MessageBox.Show("Locked" + DateTime.Now);                     break;                 case SessionSwitchReason.SessionUnlock:                     // Do whatever you need to do for an unlock                     // ...                     write_event("unlocked");                     //MessageBox.Show("UnLocked" + DateTime.Now);                     break;                     //case SessionSwitchReason.                 // ...             }         }          void write_event (string e){             string computer = System.Environment.MachineName;             string user = Environment.UserName;              try              {                 StreamWriter w = File.AppendText(@"\\nas\log$\events\" + user + @".domain1.ru.txt");                 w.WriteLine(computer + ";" + user + ";" + e + ";" + DateTime.Now);                 w.Close();             }             catch {}          }          private void Form1_Load(object sender, EventArgs e)         {             this.Opacity = 0;             this.ShowInTaskbar = false;             SystemEvents.SessionSwitch += new SessionSwitchEventHandler(SystemEvents_SessionSwitch);         } 

            string source = @"\\nas\userstat$\Data\active_ws.exe";             string tempdir = System.IO.Path.GetTempPath();             string destFile = System.IO.Path.Combine(tempdir, "active_ws.exe");             if (File.Exists(source))              {                 try                 {                     System.IO.File.Copy(source, destFile, true);                     Process.Start(destFile);                 }                 catch (Exception e)                 {                  }             } 

res = GET(«api/?», «s=status»);

System.Windows.Forms.Label label = new System.Windows.Forms.Label();  label.Text = reader.Value.ToString(); label.Name = "c_" + label.Text; label.Width = 200; label.Height = 50; label.Top = 2 + (label.Height * label_cnt); label.Left = 2; label.Font = new System.Drawing.Font("Calibri", 24, System.Drawing.FontStyle.Underline, System.Drawing.GraphicsUnit.Point, ((byte)(0))); label.ForeColor = Color.Red; panel1.Controls.Add(label);  System.Windows.Forms.Button button = new System.Windows.Forms.Button(); button.Name = reader.Value.ToString(); button.Text = "Выполнить выход на данном ПК"; button.Left = 210; button.Top = label.Top; button.Font = new System.Drawing.Font("Calibri", 12, System.Drawing.FontStyle.Underline, System.Drawing.GraphicsUnit.Point, ((byte)(0))); button.Width = 250; button.Height = 50; if (button.Name == System.Environment.MachineName) {     button.Enabled = false;     button.Text = "Текущий ПК"; } button.Click += new EventHandler(btn_Click); panel1.Controls.Add(button); 

        private void btn_Click(object sender, EventArgs e)         {             string res = null;             foreach (Control item in panel1.Controls.OfType<Control>())             {                 if (item.Tag == sender || item == sender)                 {                     item.Enabled = false;                     item.Text = "Выход будет выполнен в течение 2-х минут";                     try                     {                         res = POST("http://api/?", "s=logout&c=" + item.Name); //item.Name - содержит имя ПК                     }                     catch (Exception exception)                     {                                             }                  }             }         } 

                        if (c_logoff == System.Environment.MachineName)                         {                             Process.Start("shutdown", "-l -f");                         }