fix(windows): capture localized admin rdp activity
This commit is contained in:
@@ -16,6 +16,7 @@
|
|||||||
aw_windows_package_zip_path: ""
|
aw_windows_package_zip_path: ""
|
||||||
aw_windows_domain: "SHARKON2025"
|
aw_windows_domain: "SHARKON2025"
|
||||||
aw_windows_users:
|
aw_windows_users:
|
||||||
|
- Администратор
|
||||||
- user1
|
- user1
|
||||||
- user2
|
- user2
|
||||||
- user3
|
- user3
|
||||||
@@ -272,55 +273,13 @@
|
|||||||
} catch {}
|
} catch {}
|
||||||
|
|
||||||
$config = Get-Content -Raw -LiteralPath "{{ aw_windows_state_root }}\deployment-config.json" | ConvertFrom-Json
|
$config = Get-Content -Raw -LiteralPath "{{ aw_windows_state_root }}\deployment-config.json" | ConvertFrom-Json
|
||||||
$loggedOnUsers = New-Object 'System.Collections.Generic.HashSet[string]' ([System.StringComparer]::OrdinalIgnoreCase)
|
|
||||||
try {
|
|
||||||
foreach ($line in @(& quser.exe 2>$null)) {
|
|
||||||
$normalized = [string]$line
|
|
||||||
if ([string]::IsNullOrWhiteSpace($normalized)) { continue }
|
|
||||||
$normalized = $normalized.TrimStart(' ', '>')
|
|
||||||
if ([string]::IsNullOrWhiteSpace($normalized)) { continue }
|
|
||||||
if ($normalized -match '^(USERNAME|ПОЛЬЗОВАТЕЛЬ)\s+') { continue }
|
|
||||||
$parts = $normalized -split '\s+'
|
|
||||||
if ($parts.Count -lt 1) { continue }
|
|
||||||
$user = [string]$parts[0]
|
|
||||||
if ([string]::IsNullOrWhiteSpace($user)) { continue }
|
|
||||||
[void]$loggedOnUsers.Add($user)
|
|
||||||
[void]$loggedOnUsers.Add(('{0}\{1}' -f $env:COMPUTERNAME, $user))
|
|
||||||
if (-not [string]::IsNullOrWhiteSpace($env:USERDOMAIN)) {
|
|
||||||
[void]$loggedOnUsers.Add(('{0}\{1}' -f $env:USERDOMAIN, $user))
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} catch {}
|
|
||||||
|
|
||||||
function Test-TaskUserHasSession {
|
|
||||||
param([string]$UserId)
|
|
||||||
if ([string]::IsNullOrWhiteSpace($UserId)) { return $false }
|
|
||||||
$candidates = New-Object 'System.Collections.Generic.HashSet[string]' ([System.StringComparer]::OrdinalIgnoreCase)
|
|
||||||
[void]$candidates.Add($UserId)
|
|
||||||
$leafUser = $UserId
|
|
||||||
if ($leafUser -match '^[^\\]+\\(.+)$') {
|
|
||||||
$leafUser = $Matches[1]
|
|
||||||
[void]$candidates.Add($leafUser)
|
|
||||||
}
|
|
||||||
[void]$candidates.Add(('{0}\{1}' -f $env:COMPUTERNAME, $leafUser))
|
|
||||||
if (-not [string]::IsNullOrWhiteSpace($env:USERDOMAIN)) {
|
|
||||||
[void]$candidates.Add(('{0}\{1}' -f $env:USERDOMAIN, $leafUser))
|
|
||||||
}
|
|
||||||
foreach ($candidate in @($candidates)) {
|
|
||||||
if ($loggedOnUsers.Contains($candidate)) { return $true }
|
|
||||||
}
|
|
||||||
return $false
|
|
||||||
}
|
|
||||||
|
|
||||||
foreach ($taskDef in @($config.userTasks)) {
|
foreach ($taskDef in @($config.userTasks)) {
|
||||||
try { Enable-ScheduledTask -TaskName ([string]$taskDef.launchTaskName) -ErrorAction SilentlyContinue | Out-Null } catch {}
|
try { Enable-ScheduledTask -TaskName ([string]$taskDef.launchTaskName) -ErrorAction SilentlyContinue | Out-Null } catch {}
|
||||||
}
|
}
|
||||||
|
|
||||||
Start-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}"
|
Start-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}"
|
||||||
foreach ($taskDef in @($config.userTasks)) {
|
foreach ($taskDef in @($config.userTasks)) {
|
||||||
if (Test-TaskUserHasSession -UserId ([string]$taskDef.userId)) {
|
Start-ScheduledTask -TaskName ([string]$taskDef.launchTaskName) -ErrorAction SilentlyContinue
|
||||||
Start-ScheduledTask -TaskName ([string]$taskDef.launchTaskName) -ErrorAction SilentlyContinue
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
- name: Получить Windows hostname для AW smoke-check bucket
|
- name: Получить Windows hostname для AW smoke-check bucket
|
||||||
|
|||||||
@@ -15,6 +15,7 @@ aw_windows_package_zip_path: ""
|
|||||||
|
|
||||||
aw_windows_domain: "SHARKON2025"
|
aw_windows_domain: "SHARKON2025"
|
||||||
aw_windows_users:
|
aw_windows_users:
|
||||||
|
- Администратор
|
||||||
- user1
|
- user1
|
||||||
- user2
|
- user2
|
||||||
- user3
|
- user3
|
||||||
|
|||||||
@@ -8,6 +8,7 @@ aw_windows_package_url: "https://github.com/ActivityWatch/activitywatch/releases
|
|||||||
aw_windows_package_zip_path: ""
|
aw_windows_package_zip_path: ""
|
||||||
aw_windows_domain: "SHARKON2025"
|
aw_windows_domain: "SHARKON2025"
|
||||||
aw_windows_users:
|
aw_windows_users:
|
||||||
|
- Администратор
|
||||||
- user1
|
- user1
|
||||||
- user2
|
- user2
|
||||||
- user3
|
- user3
|
||||||
|
|||||||
@@ -233,7 +233,7 @@ function Normalize-ActivityWatchUsers {
|
|||||||
$resolved = Resolve-Path -LiteralPath $UserListPath -ErrorAction Stop
|
$resolved = Resolve-Path -LiteralPath $UserListPath -ErrorAction Stop
|
||||||
$extension = [IO.Path]::GetExtension($resolved.Path)
|
$extension = [IO.Path]::GetExtension($resolved.Path)
|
||||||
if ($extension -ieq '.csv') {
|
if ($extension -ieq '.csv') {
|
||||||
$rows = Import-Csv -LiteralPath $resolved.Path
|
$rows = Import-Csv -LiteralPath $resolved.Path -Encoding UTF8
|
||||||
foreach ($row in $rows) {
|
foreach ($row in $rows) {
|
||||||
foreach ($column in 'User', 'Username', 'SamAccountName', 'Login') {
|
foreach ($column in 'User', 'Username', 'SamAccountName', 'Login') {
|
||||||
if ($row.PSObject.Properties.Name -contains $column) {
|
if ($row.PSObject.Properties.Name -contains $column) {
|
||||||
@@ -247,7 +247,7 @@ function Normalize-ActivityWatchUsers {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
Get-Content -LiteralPath $resolved.Path | ForEach-Object {
|
Get-Content -LiteralPath $resolved.Path -Encoding UTF8 | ForEach-Object {
|
||||||
$line = $_.Trim()
|
$line = $_.Trim()
|
||||||
if ($line -and -not $line.StartsWith('#')) {
|
if ($line -and -not $line.StartsWith('#')) {
|
||||||
$collected.Add($line)
|
$collected.Add($line)
|
||||||
|
|||||||
Reference in New Issue
Block a user