40 lines
1.7 KiB
PowerShell
40 lines
1.7 KiB
PowerShell
[CmdletBinding()]
|
|
param(
|
|
[string]$UserId = 'SHARKON2025\user1'
|
|
)
|
|
|
|
Set-StrictMode -Version Latest
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
$probeScriptPath = 'C:\ProgramData\AWatch-rus\user1-notepad-probe.ps1'
|
|
@'
|
|
Start-Process notepad.exe
|
|
Start-Sleep -Seconds 10
|
|
Get-Process notepad -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
|
|
'@ | Set-Content -LiteralPath $probeScriptPath -Encoding UTF8
|
|
|
|
schtasks /Run /TN 'ActivityWatch Launch [SHARKON2025_user1]' | Out-Null
|
|
Start-Sleep -Seconds 3
|
|
|
|
$taskName = 'AW User1 Notepad Probe'
|
|
Unregister-ScheduledTask -TaskName $taskName -Confirm:$false -ErrorAction SilentlyContinue
|
|
$action = New-ScheduledTaskAction -Execute (Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe') -Argument "-NoProfile -ExecutionPolicy Bypass -File $probeScriptPath"
|
|
$principal = New-ScheduledTaskPrincipal -UserId $UserId -LogonType Interactive -RunLevel Highest
|
|
$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew -ExecutionTimeLimit (New-TimeSpan -Minutes 5)
|
|
Register-ScheduledTask -TaskName $taskName -Action $action -Principal $principal -Settings $settings | Out-Null
|
|
Start-ScheduledTask -TaskName $taskName
|
|
Start-Sleep -Seconds 5
|
|
|
|
Write-Host 'QUSER'
|
|
quser
|
|
Write-Host '---'
|
|
Write-Host 'WATCHERS'
|
|
Get-Process aw-watcher-afk,aw-watcher-window,powershell,notepad -ErrorAction SilentlyContinue |
|
|
Select-Object Name, Id, SessionId, StartTime |
|
|
Sort-Object SessionId, Name |
|
|
Format-Table -AutoSize
|
|
|
|
Start-Sleep -Seconds 8
|
|
Unregister-ScheduledTask -TaskName $taskName -Confirm:$false -ErrorAction SilentlyContinue
|
|
Remove-Item -LiteralPath $probeScriptPath -Force -ErrorAction SilentlyContinue
|