Show all GUI users
This script grabs all users with a GUI (explorer.exe) and their current uptime
Copy
$users = @()
$sys_uptime = $(Get-Uptime)
$system = New-Object -TypeName PSObject -Property @{
User = "System"
Domain = "$(HOSTNAME.EXE)"
Uptime = "$([math]::floor($sys_uptime.TotalHours))h $($sys_uptime.Minutes)m $($sys_uptime.Seconds)s"
}
$users += $system
Get-CimInstance Win32_Process -Filter "name LIKE 'explorer.exe'" | ForEach-Object {
$output = Invoke-CimMethod -InputObject $_ -MethodName GetOwner | Select-Object User, Domain
$uptime = New-Timespan -start $_.CreationDate -End $current_date
$uptime_formatted = "$([math]::floor($uptime.TotalHours))h $($uptime.Minutes)m $($uptime.Seconds)s"
$output | Add-Member -MemberType NoteProperty -Name Uptime -Value $uptime_formatted
$users += $output
} ; $users | Select-Object -Property Domain, User, Uptime | Sort-Object -Property Uptime
Show all active sessions (slow)
This script gets all current sessions, this can detect a user who has escalated permissions. This is much slower as it uses a Cim method to query each process's user then it removes duplicates
Copy
$sessions = @()
Get-CimInstance Win32_Process | Where-Object { $_.SessionId -ne 0 } | ForEach-Object {
$session_info = New-Object PSObject
$session_info | Add-Member -MemberType NoteProperty -Name "SessionId" -Value $_.SessionId
$owner = Invoke-CimMethod -InputObject $_ -MethodName GetOwner
if ($null -eq $owner.User) { $owner.User = "UNKNOWN" }
if ($null -eq $owner.Domain) { $owner.Domain = "UNKNOWN" }
$session_info | Add-Member -MemberType NoteProperty -Name "User" -Value $owner.User
$session_info | Add-Member -MemberType NoteProperty -Name "Domain" -Value $owner.Domain
$session_info | Add-Member -MemberType NoteProperty -Name "Process" -Value $_.Name
$session_info | Add-Member -MemberType NoteProperty -Name "PID" -Value $_.ProcessId
$sessions += $session_info
} ; $sessions | Sort-Object -Property Name, Domain -Unique | Format-Table -AutoSize
Show all active sessions (ADMIN)
This script gets all current sessions, this can detect escalated permissions and windows service accounts. This command requires administrator permissions. NOTE: in Powershell v7.5 this script can be run without administrator permissions however the command will not show windows service accounts
Copy
Get-Process -IncludeUserName | Sort-Object Username -Unique | Where-Object { $null -ne $_.UserName} | Select-Object SessionId, Username, ProcessName, Id | Sort-Object -Property SessionId -Descending
Show all users
Shows all users who have an account on the current machine
Copy
Get-WmiObject win32_Useraccount | Select-Object Domain, Name, Disabled, SID | Sort-Object Disabled -Descending | Format-Table -Wrap