Skip to content

fix: add quser fallback for currently logged-on users#145

Open
kbaker827 wants to merge 2 commits into
pdqcom:masterfrom
kbaker827:fix/110-last-logged-on-quser-fallback
Open

fix: add quser fallback for currently logged-on users#145
kbaker827 wants to merge 2 commits into
pdqcom:masterfrom
kbaker827:fix/110-last-logged-on-quser-fallback

Conversation

@kbaker827
Copy link
Copy Markdown

Summary

  • Fixes the scanner returning no data on ~80% of machines where security event log only contains logon types 3/5 (network/service), not 2/10/11
  • Adds a quser fallback that runs after the event log scan and captures the currently logged-on user if they weren't already found
  • Guards against empty account names (adds $AccountName -ne "" check)
  • Wraps quser in a try/catch and checks $LASTEXITCODE to handle machines with no logged-on user cleanly
  • Collects results into a $Results ArrayList so the event log scan and quser results are emitted together

Root cause

On many machines (especially those accessed primarily via remote/network sessions), interactive logon events with types 2/10/11 are absent from the Security log. The scanner only looked at those types, so it returned nothing even though a user was actively logged on.

Test plan

  • Run scanner on a machine with only type-3/5 events in the Security log — confirm the currently logged-on user is returned with LogonType = "Current User"
  • Run scanner on a machine with normal type-2 events — confirm existing behavior is unchanged
  • Run scanner on a machine with no logged-on user — confirm no errors and empty output

Closes #110

kbaker827 added 2 commits May 20, 2026 08:59
On machines where only logon types 3/5 appear in the Security event log
(remote sessions, VDI, etc.), the event-log scan returns no results.
Fall back to quser to capture the currently logged-on user in those cases.

Also guard against empty account names and wrap quser in a try/catch so
any errors are handled cleanly rather than propagating to the scanner.

Closes pdqcom#110
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Last Logged on User scanner doesn't always detect the last logged on user.

1 participant