# encoding: ascii
# api: powershell
# title: Send-EmailNotifyOfLogin
# description: Sends an email on event trigger ID 21 and 23 (logon and logoff). Useful for auditing access to a server.
# version: 3.0
# type: script
# author: Justin Grote 
# license: CC0
# x-poshcode-id: 4633
# x-archived: 2015-10-23T21:54:44
# x-published: 2015-11-22T21:58:00
#
#
#Requires -Version 3.0

#This script is designed to be attached to Windows TS Events 21 and 22 (which work for local logons too) 
#to email notification to an audit mailbox

#Author: Justin Grote <jgrote@allieddigital.net>

#USAGE: Send-LogonNotifyEmail.ps1 <LogAction> <EmailRecipient>

#EXAMPLE: Attach to event ID 21 using event viewer GUI, and have the script run as Send-LogonNotifyEmail.ps1 logon audit@mycompany.com   
#EXAMPLE 2: Attach to event ID 23 using event viewer GUI, and have the script run as Send-LogonNotifyEmail.ps1 logon audit@mycompany.com   


#Variables
if (!$PSEmailServer) {$PSEmailServer = "mail"}
$logaction = $args[0]
$msgRecipient = $args[1]


#Get the FQDN of the server
$ComputerName = [System.Net.Dns]::GetHostByName(($env:computerName)).HostName.ToLower()

#Script
switch ($logaction) {
    logon {$ActionEventID = 21}
    logoff {$ActionEventID = 23}
}

$EventToSend = get-winevent -maxevents 1 -filterhashtable  @{ LogName = "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational";ID = $ActionEventID }

###Construct the Email and Send it

#Extract username from Event Log body and do some cleanup.
$targetUser = ($EventToSend.message.split("`n") | select-string "User:").ToString().substring(6).Normalize()

#Trim the last character. I can't figure out what it is but it is not compatible as an email subject item
$targetuser = $targetuser.substring(0,$targetuser.length-1)

#Message Subjects have to be sanitized, hence the "replace" statements at the end
$msgSubject = ("Notification: $targetuser $logaction - $computername").Replace('`r', ' ').Replace('`n', ' ')

$msgBody = "$($EventToSend.TimeCreated) 
$($eventToSend.message.Replace('`n', '`r`n'))"

#Deliver Email
send-mailmessage -To $msgRecipient -Subject $msgSubject -Body $msgBody -From "scheduledtask@$computername"

###End
