Detect switch user with powershell

Question

I want to register the date and time of each time switch user is invoked in a machine. How can I do that? Something similar to this but for the "switch user" event: detect log off and on with powershell

Thank you in advance

Satchel

Answer 1

I think that what you are looking for this :

Event ID 4778 : A user has logged by selecting Switch user command (Fast User Switching).
Event ID 4779 : A user has logged back on using Switch user command (Fast User Switching).

But these events appears in "Security" event log only when you configure "Audit conexion events" in the auditing stratégie.

Sorry for the french screen, but I think that's better than nothing.

After that when using "Fast User Switching", if you filter events IDs 4778 and 4779, you can see something like :

So the powerShell adaption of the code you point in your question is something like :

clear-Host
$UserProperty = @{n="User";e={$_.ReplacementStrings[0]}}
$TypeProperty = @{n="Action";e={switch($_.EventID) {4778 {"SwitchOn"} 4779{"SwitchOff"}}}}
$TimeProeprty = @{n="Time";e={$_.TimeGenerated}}
Get-EventLog -LogName Security -Source Microsoft-Windows-security-auditing | where {$_.EventID -eq 4778 -or $_.EventID -eq 4779} | select $UserProperty,$TypeProperty,$TimeProeprty

I hope this helps.

JP

PS : you can find other informations about "Fast user switching" in french there.

Richert