Powershell Get Citrix Current Session Logon Time

$code = @'
using System;
using System.Runtime.InteropServices;

namespace WFAPI
{
    
   public  enum WF_INFO_CLASS
    {
            WFVersion,             // OSVERSIONINFO
            WFInitialProgram,
            WFWorkingDirectory,
            WFOEMId,
            WFSessionId,
            WFUserName,
            WFWinStationName,
            WFDomainName,
            WFConnectState,
            WFClientBuildNumber,
            WFClientName,
            WFClientDirectory,
            WFClientProductId,
            WFClientHardwareId,
            WFClientAddress,
            WFClientDisplay,
            WFClientCache,
            WFClientDrives,
            WFICABufferLength,
            WFLicenseEnabler,
            RESERVED2,
            WFApplicationName,
            WFVersionEx,
            WFClientInfo,
            WFUserInfo,
            WFAppInfo,
            WFClientLatency,
            WFSessionTime,
            WFLicensingModel
    } 
    [StructLayout(LayoutKind.Sequential)]
    public struct WF_SESSION_TIME
    {
        public long ConnectTime;
        public long DisconnectTime;
        public long LastInputTime;
        public long LogonTime;
        public long CurrentTime;
    }
    
    public class Program
    {
        [DllImport("wfapi64.dll", CharSet=CharSet.Unicode,SetLastError=true)]
        public static extern bool WFQuerySessionInformation(System.IntPtr hServer, int sessionId, WF_INFO_CLASS WFInfoClass, out System.IntPtr ppBuffer, out uint pBytesReturned);              
        [DllImport("wfapi64.dll", ExactSpelling = true, SetLastError = false)]
        public static extern void WFFreeMemory(IntPtr memory);
        public const int WF_CURRENT_SESSION = -1;
        public static string GetClientName()
        {
            System.IntPtr buffer = IntPtr.Zero;
            uint bytesReturned;
            try
            {
                bool sessionInfo = WFQuerySessionInformation(System.IntPtr.Zero, WF_CURRENT_SESSION, WF_INFO_CLASS.WFClientName, out buffer, out bytesReturned);
                return Marshal.PtrToStringUni(buffer);
            }
            catch
            {
                return string.Empty;
            }
            finally
            {
                WFFreeMemory(buffer);
                buffer = IntPtr.Zero;
            }
        }       
        public static string getSessionLogonTime()
        {
            System.IntPtr buffer = IntPtr.Zero;
            string sessionLogonTime = "";
            uint bytesReturned = 0;            
            try
            {
                bool sessionInfo = WFQuerySessionInformation(System.IntPtr.Zero, WF_CURRENT_SESSION, WF_INFO_CLASS.WFSessionTime, out buffer, out bytesReturned);
                if(sessionInfo)
                {
                    WF_SESSION_TIME WFSessionTime = (WF_SESSION_TIME)Marshal.PtrToStructure(buffer, typeof(WF_SESSION_TIME));
                    sessionLogonTime = Convert.ToString(DateTime.FromFileTime(WFSessionTime.LogonTime));     
                }
            }
            catch
            {
                return string.Empty;
            }
            finally
            {
                WFFreeMemory(buffer);
                buffer = IntPtr.Zero;
            }
            return sessionLogonTime;
        }  
    }
}
'@
Add-Type -TypeDefinition $code -Language CSharp   
[WFAPI.Program]::getSessionLogonTime()

Leave a comment

Your email address will not be published. Required fields are marked *

WordPress Appliance - Powered by TurnKey Linux