1

Hello everyone,

I have written a powershell script to parse event logs, find out what servers you have RDP’d in and return a True False statement. Everything works, however while tweaking I came across an issue. I was trying to write the Out-File to be based off the individual wanting to run the script. For example, user John needs to type into the “Enter Admin Account” his username and the script writes the path’s as well as the user that it is looking for based off that information. When I wrote the $Account = Read-Host “EnterAdmin Account” the script ignores the variable. Here is the script:

$AdmAccount = Read-Host "EnterADM Account"
 $Desktop = "C:\Users\$($_.user)\Desktop" 

$serverlist = Start-Job { Get-WinEvent -FilterHashtable @{LogName=’Security’;ID=4648} |
                              where {$_.Properties[5].Value -eq $AdmAccount} |
                              foreach {“$($_.Properties[8].Value)” } | Out-File "$Desktop\servers.txt"
$file = "$Desktop\servers.txt"
(gc $file | Group-Object | %{$_.group | select -First 1}) | Where-Object {$_ -notmatch 'localhost'} | Set-Content $file
}

Wait-Job $serverlist
Receive-Job $serverlist  
$AdmAccount = Read-Host "EnterADM Account"
param($AdmAccount=$(throw "You must specify your name"))

function Get-LoggedOn

{

	[CmdletBinding()]
	[Alias('loggedon')]
	[OutputType([PSCustomObject])]
	
	Param
	(
		# Computer name to check
		[Parameter(ValueFromPipeline = $true,
				   ValueFromPipelineByPropertyName = $true,
			       Position = 0)]
		[Alias('ComputerName')]
		[string]
		$Name = $env:COMPUTERNAME,
		
		# Username to check against logged in users.
		[parameter()]
		[string]
		$CheckFor
	)
	
	Process
	{
		function QueryToObject ($Computer)
		{
			$Output = @()
			$Users = query user /server:$Computer.nwie.net 2>&1
			if ($Users -like "*No User exists*")
			{
				$Output += [PSCustomObject]@{
					ComputerName = $Computer
					Username = $null
					SessionState = $null
					SessionType = "[None Found]"
				}
			}
			elseif ($Users -like "*Error*")
			{
				$Output += [PSCustomObject]@{
					ComputerName = $Computer
					Username = $null
					SessionState = $null
					SessionType = "[Error]"
				}
			}
			else
			{
				$Users = $Users | ForEach-Object {
					(($_.trim() -replace ">" -replace "(?m)^([A-Za-z0-9]{3,})\s+(\d{1,2}\s+\w+)", '$1  none  $2' -replace "\s{2,}", "," -replace "none", $null))
				} | ConvertFrom-Csv
				
				foreach ($User in $Users)
				{
					$Output += [PSCustomObject]@{
						ComputerName = $Computer
						Username = $User.USERNAME
						SessionState = $User.STATE.Replace("Disc", "Disconnected")
						SessionType = $($User.SESSIONNAME -Replace '#','' -Replace "[0-9]+","")
					}
					
				}
			}
			return $Output | Sort-Object -Property ComputerName
		}
		
		if ($CheckFor)
		{
			$Usernames = @()
			$Sessions = @()
			$Result = @()
			$Users = QueryToObject -Computer $Name
			
			foreach ($User in $Users) {
				$Usernames += $User.Username
				$Sessions += $User.SessionType
			}
			
			if ("[Error]" -in $Sessions)
			{
				$Result += [PSCustomObject]@{
					ComputerName = $Name
					IsLoggedOn = "[ERROR]"
				}
			}
			elseif ($CheckFor -in $Usernames -and "[*]" -notin $Sessions)
			{
				$Result += [PSCustomObject]@{
					ComputerName = $Name
					IsLoggedOn = $true
				}
			}
			else
			{
				$Result += [PSCustomObject]@{
					ComputerName = $Name
					IsLoggedOn = $false
				}
			}
			return $Result | select ComputerName,IsLoggedOn
		}
		elseif (!$CheckFor)
		{
			$Result = QueryToObject -Computer $Name
			return $Result
		}
	}

}

$name=GC C:\users\$AdmAccount\Desktop\servers.txt
Foreach($list in $name){
Get-LoggedOn -Name $list -CheckFor $AdmAccount | Out-File C:\users\$AdmAccount\Desktop\results.txt -Append
}
5 Spice ups
2

When you use single quotes around a PowerShell variable, PS gives you the actual variable name. If you want PS to parse it and use the value instead you have to use double quotes.

where {$_.Properties[5].Value -eq "$Account"} |

Although in this particular case, I believe you don’t need to use quotes of any kind to get the variable’s value.

Also, please use the Insert Code button </> and select PowerShell when inserting code snippets. Otherwise your code is too hard for others to read.

1 Spice up
3

Thank you for the help on this, I have changed it to double quotes and still no luck. I have also modified the post by clicking and inserting the code but I am not seeing it anywhere on here.

4

Can you try posting it again? Even if it’s in a reply?

1 Spice up
5

Even then it does not insert it

weird

6

Ohh well. Post it without inserting then.

1 Spice up
7

Fixed it, long story short, IE sucks

8

Is the $Desktop variable the one that your script is ignoring? It looks like the account entered is the one you want to use for that information? if that is the case, you would change $Desktop to be:

$AdmAccount = Read-Host "EnterADM Account"
 $Desktop = "C:\Users\$AdmAccount\Desktop"
9

The script was ignoring both variables ( I was trying different things with this but this has changed a few times since i initially asked the question) Unfortunately what i sent here was the wtf happened here version lol. I got the script to work though. For the directory variable’s i used $home for the Admin account search i used $env:UserName to grab the current users name as the input.

$serverlist = Start-Job { Get-WinEvent -FilterHashtable @{LogName='Security';ID=4648} |
                              where {$_.Properties[5].Value -eq $env:UserName} |
                              foreach {“$($_.Properties[8].Value)” } | Out-File "$home\Desktop\servers.txt"
$file = "$home\Desktop\servers.txt"
(gc $file | Group-Object | %{$_.group | select -First 1}) | Where-Object {$_ -notmatch 'localhost'} | Set-Content $file
}

Wait-Job $serverlist
Receive-Job $serverlist