Separating out functions & bug fix

All info gathering pieces of this script can now be called individually.
Fixed a bug where the user SID wasn't being converted to a username in
the RDP function.

1 files changed, 438 insertions, 295 deletions

diff --git a/Recon/Get-ComputerDetails.ps1 b/Recon/Get-ComputerDetails.ps1
index 1cf59cd..37abf3e 100644
--- a/Recon/Get-ComputerDetails.ps1
+++ b/Recon/Get-ComputerDetails.ps1
@@ -9,7 +9,7 @@ Function: Get-ComputerDetails
 Author: Joe Bialek, Twitter: @JosephBialek
 Required Dependencies: None
 Optional Dependencies: None
-Version: 1.0
+Version: 1.1
 
 .DESCRIPTION
 
@@ -51,248 +51,448 @@ Github repo: https://github.com/clymb3r/PowerShell
 
     Set-StrictMode -Version 2
 
-    #Retrieve the 4648 logon event. This will often find cases where a user is using remote desktop to connect to another computer. It will give the 
-    #the account that RDP was launched with and the account name of the account being used to connect to the remote computer. This is useful
-    #for identifying normal authenticaiton patterns. Other actions that will trigger this include any runas action.
-    function Find-ExplicitLogons
+
+
+    $SecurityLog = Get-EventLog -LogName Security
+    $Filtered4624 = Find-4624Logons $SecurityLog
+    $Filtered4648 = Find-4648Logons $SecurityLog
+    $AppLockerLogs = Find-AppLockerLogs
+    $PSLogs = Find-PSScriptsInPSAppLog
+    $RdpClientData = Find-RDPClientConnections
+
+    if ($ToString)
+    {
+        Write-Output "Event ID 4624 (Logon):"
+        Write-Output $Filtered4624.Values | Format-List
+        Write-Output "Event ID 4648 (Explicit Credential Logon):"
+        Write-Output $Filtered4648.Values | Format-List
+        Write-Output "AppLocker Process Starts:"
+        Write-Output $AppLockerLogs.Values | Format-List
+        Write-Output "PowerShell Script Executions:"
+        Write-Output $PSLogs.Values | Format-List
+        Write-Output "RDP Client Data:"
+        Write-Output $RdpClientData.Values | Format-List
+    }
+    else
     {
-        Param(
-            $SecurityLog
-        )
+        $Properties = @{
+            LogonEvent4624 = $Filtered4624.Values
+            LogonEvent4648 = $Filtered4648.Values
+            AppLockerProcessStart = $AppLockerLogs.Values
+            PowerShellScriptStart = $PSLogs.Values
+            RdpClientData = $RdpClientData.Values
+        }
+
+        $ReturnObj = New-Object PSObject -Property $Properties
+        return $ReturnObj
+    }
+}
+
+
+function Find-4648Logons
+{
+<#
+.SYNOPSIS
+
+Retrieve the unique 4648 logon events. This will often find cases where a user is using remote desktop to connect to another computer. It will give the 
+the account that RDP was launched with and the account name of the account being used to connect to the remote computer. This is useful
+for identifying normal authenticaiton patterns. Other actions that will trigger this include any runas action.
+
+Function: Find-4648Logons
+Author: Joe Bialek, Twitter: @JosephBialek
+Required Dependencies: None
+Optional Dependencies: None
+Version: 1.1
+
+.DESCRIPTION
+
+Retrieve the unique 4648 logon events. This will often find cases where a user is using remote desktop to connect to another computer. It will give the 
+the account that RDP was launched with and the account name of the account being used to connect to the remote computer. This is useful
+for identifying normal authenticaiton patterns. Other actions that will trigger this include any runas action.
+
+.EXAMPLE
+
+Find-4648Logons
+Gets the unique 4648 logon events.
+
+.NOTES
+
+.LINK
+
+Blog: http://clymb3r.wordpress.com/
+Github repo: https://github.com/clymb3r/PowerShell
+#>
+    Param(
+        $SecurityLog
+    )
 
-        $ExplicitLogons = $SecurityLog | Where {$_.InstanceID -eq 4648}
-        $ReturnInfo = @{}
+    $ExplicitLogons = $SecurityLog | Where {$_.InstanceID -eq 4648}
+    $ReturnInfo = @{}
 
-        foreach ($ExplicitLogon in $ExplicitLogons)
+    foreach ($ExplicitLogon in $ExplicitLogons)
+    {
+        $Subject = $false
+        $AccountWhosCredsUsed = $false
+        $TargetServer = $false
+        $SourceAccountName = ""
+        $SourceAccountDomain = ""
+        $TargetAccountName = ""
+        $TargetAccountDomain = ""
+        $TargetServer = ""
+        foreach ($line in $ExplicitLogon.Message -split "\r\n")
         {
-            $Subject = $false
-            $AccountWhosCredsUsed = $false
-            $TargetServer = $false
-            $SourceAccountName = ""
-            $SourceAccountDomain = ""
-            $TargetAccountName = ""
-            $TargetAccountDomain = ""
-            $TargetServer = ""
-            foreach ($line in $ExplicitLogon.Message -split "\r\n")
+            if ($line -cmatch "^Subject:$")
             {
-                if ($line -cmatch "^Subject:$")
-                {
-                    $Subject = $true
-                }
-                elseif ($line -cmatch "^Account\sWhose\sCredentials\sWere\sUsed:$")
+                $Subject = $true
+            }
+            elseif ($line -cmatch "^Account\sWhose\sCredentials\sWere\sUsed:$")
+            {
+                $Subject = $false
+                $AccountWhosCredsUsed = $true
+            }
+            elseif ($line -cmatch "^Target\sServer:")
+            {
+                $AccountWhosCredsUsed = $false
+                $TargetServer = $true
+            }
+            elseif ($Subject -eq $true)
+            {
+                if ($line -cmatch "\s+Account\sName:\s+(\S.*)")
                 {
-                    $Subject = $false
-                    $AccountWhosCredsUsed = $true
+                    $SourceAccountName = $Matches[1]
                 }
-                elseif ($line -cmatch "^Target\sServer:")
+                elseif ($line -cmatch "\s+Account\sDomain:\s+(\S.*)")
                 {
-                    $AccountWhosCredsUsed = $false
-                    $TargetServer = $true
+                    $SourceAccountDomain = $Matches[1]
                 }
-                elseif ($Subject -eq $true)
+            }
+            elseif ($AccountWhosCredsUsed -eq $true)
+            {
+                if ($line -cmatch "\s+Account\sName:\s+(\S.*)")
                 {
-                    if ($line -cmatch "\s+Account\sName:\s+(\S.*)")
-                    {
-                        $SourceAccountName = $Matches[1]
-                    }
-                    elseif ($line -cmatch "\s+Account\sDomain:\s+(\S.*)")
-                    {
-                        $SourceAccountDomain = $Matches[1]
-                    }
+                    $TargetAccountName = $Matches[1]
                 }
-                elseif ($AccountWhosCredsUsed -eq $true)
+                elseif ($line -cmatch "\s+Account\sDomain:\s+(\S.*)")
                 {
-                    if ($line -cmatch "\s+Account\sName:\s+(\S.*)")
-                    {
-                        $TargetAccountName = $Matches[1]
-                    }
-                    elseif ($line -cmatch "\s+Account\sDomain:\s+(\S.*)")
-                    {
-                        $TargetAccountDomain = $Matches[1]
-                    }
+                    $TargetAccountDomain = $Matches[1]
                 }
-                elseif ($TargetServer -eq $true)
+            }
+            elseif ($TargetServer -eq $true)
+            {
+                if ($line -cmatch "\s+Target\sServer\sName:\s+(\S.*)")
                 {
-                    if ($line -cmatch "\s+Target\sServer\sName:\s+(\S.*)")
-                    {
-                        $TargetServer = $Matches[1]
-                    }
+                    $TargetServer = $Matches[1]
                 }
             }
+        }
 
-            #Filter out logins that don't matter
-            if (-not ($TargetAccountName -cmatch "^DWM-.*" -and $TargetAccountDomain -cmatch "^Window\sManager$"))
+        #Filter out logins that don't matter
+        if (-not ($TargetAccountName -cmatch "^DWM-.*" -and $TargetAccountDomain -cmatch "^Window\sManager$"))
+        {
+            $Key = $SourceAccountName + $SourceAccountDomain + $TargetAccountName + $TargetAccountDomain + $TargetServer
+            if (-not $ReturnInfo.ContainsKey($Key))
             {
-                $Key = $SourceAccountName + $SourceAccountDomain + $TargetAccountName + $TargetAccountDomain + $TargetServer
-                if (-not $ReturnInfo.ContainsKey($Key))
-                {
-                    $Properties = @{
-                        LogType = 4648
-                        LogSource = "Security"
-                        SourceAccountName = $SourceAccountName
-                        SourceDomainName = $SourceAccountDomain
-                        TargetAccountName = $TargetAccountName
-                        TargetDomainName = $TargetAccountDomain
-                        TargetServer = $TargetServer
-                        Count = 1
-                        Times = @($ExplicitLogon.TimeGenerated)
-                    }
-
-                    $ResultObj = New-Object PSObject -Property $Properties
-                    $ReturnInfo.Add($Key, $ResultObj)
-                }
-                else
-                {
-                    $ReturnInfo[$Key].Count++
-                    $ReturnInfo[$Key].Times += ,$ExplicitLogon.TimeGenerated
+                $Properties = @{
+                    LogType = 4648
+                    LogSource = "Security"
+                    SourceAccountName = $SourceAccountName
+                    SourceDomainName = $SourceAccountDomain
+                    TargetAccountName = $TargetAccountName
+                    TargetDomainName = $TargetAccountDomain
+                    TargetServer = $TargetServer
+                    Count = 1
+                    Times = @($ExplicitLogon.TimeGenerated)
                 }
+
+                $ResultObj = New-Object PSObject -Property $Properties
+                $ReturnInfo.Add($Key, $ResultObj)
+            }
+            else
+            {
+                $ReturnInfo[$Key].Count++
+                $ReturnInfo[$Key].Times += ,$ExplicitLogon.TimeGenerated
             }
         }
-
-        return $ReturnInfo
     }
 
-    #Find all Logon events to the server. This will tell you who is logging in and how. You can use this to figure out what accounts do
-    # network logons in to the server, what accounts RDP in, what accounts log in locally, etc...
-    # This is event 4624.
-    function Find-AllLogons
-    {
-        Param (
-            $SecurityLog
-        )
+    return $ReturnInfo
+}
+
+
+<#
+.SYNOPSIS
+
+Find all unique 4624 Logon events to the server. This will tell you who is logging in and how. You can use this to figure out what accounts do
+network logons in to the server, what accounts RDP in, what accounts log in locally, etc...
+
+Function: Find-4624Logons
+Author: Joe Bialek, Twitter: @JosephBialek
+Required Dependencies: None
+Optional Dependencies: None
+Version: 1.1
+
+.DESCRIPTION
+
+Find all unique 4624 Logon events to the server. This will tell you who is logging in and how. You can use this to figure out what accounts do
+network logons in to the server, what accounts RDP in, what accounts log in locally, etc...
+
+.EXAMPLE
+
+Find-4624Logons
+Find unique 4624 logon events.
+
+.NOTES
+
+.LINK
+
+Blog: http://clymb3r.wordpress.com/
+Github repo: https://github.com/clymb3r/PowerShell
+#>
+function Find-4624Logons
+{
+    Param (
+        $SecurityLog
+    )
 
-        $Logons = $SecurityLog | Where {$_.InstanceID -eq 4624}
-        $ReturnInfo = @{}
+    $Logons = $SecurityLog | Where {$_.InstanceID -eq 4624}
+    $ReturnInfo = @{}
 
-        foreach ($Logon in $Logons)
+    foreach ($Logon in $Logons)
+    {
+        $SubjectSection = $false
+        $NewLogonSection = $false
+        $NetworkInformationSection = $false
+        $AccountName = ""
+        $AccountDomain = ""
+        $LogonType = ""
+        $NewLogonAccountName = ""
+        $NewLogonAccountDomain = ""
+        $WorkstationName = ""
+        $SourceNetworkAddress = ""
+        $SourcePort = ""
+
+        foreach ($line in $Logon.Message -Split "\r\n")
         {
-            $SubjectSection = $false
-            $NewLogonSection = $false
-            $NetworkInformationSection = $false
-            $AccountName = ""
-            $AccountDomain = ""
-            $LogonType = ""
-            $NewLogonAccountName = ""
-            $NewLogonAccountDomain = ""
-            $WorkstationName = ""
-            $SourceNetworkAddress = ""
-            $SourcePort = ""
-
-            foreach ($line in $Logon.Message -Split "\r\n")
+            if ($line -cmatch "^Subject:$")
+            {
+                $SubjectSection = $true
+            }
+            elseif ($line -cmatch "^Logon\sType:\s+(\S.*)")
+            {
+                $LogonType = $Matches[1]
+            }
+            elseif ($line -cmatch "^New\sLogon:$")
             {
-                if ($line -cmatch "^Subject:$")
+                $SubjectSection = $false
+                $NewLogonSection = $true
+            }
+            elseif ($line -cmatch "^Network\sInformation:$")
+            {
+                $NewLogonSection = $false
+                $NetworkInformationSection = $true
+            }
+            elseif ($SubjectSection)
+            {
+                if ($line -cmatch "^\s+Account\sName:\s+(\S.*)")
                 {
-                    $SubjectSection = $true
+                    $AccountName = $Matches[1]
                 }
-                elseif ($line -cmatch "^Logon\sType:\s+(\S.*)")
+                elseif ($line -cmatch "^\s+Account\sDomain:\s+(\S.*)")
                 {
-                    $LogonType = $Matches[1]
+                    $AccountDomain = $Matches[1]
                 }
-                elseif ($line -cmatch "^New\sLogon:$")
+            }
+            elseif ($NewLogonSection)
+            {
+                if ($line -cmatch "^\s+Account\sName:\s+(\S.*)")
                 {
-                    $SubjectSection = $false
-                    $NewLogonSection = $true
+                    $NewLogonAccountName = $Matches[1]
                 }
-                elseif ($line -cmatch "^Network\sInformation:$")
+                elseif ($line -cmatch "^\s+Account\sDomain:\s+(\S.*)")
                 {
-                    $NewLogonSection = $false
-                    $NetworkInformationSection = $true
+                    $NewLogonAccountDomain = $Matches[1]
                 }
-                elseif ($SubjectSection)
+            }
+            elseif ($NetworkInformationSection)
+            {
+                if ($line -cmatch "^\s+Workstation\sName:\s+(\S.*)")
                 {
-                    if ($line -cmatch "^\s+Account\sName:\s+(\S.*)")
-                    {
-                        $AccountName = $Matches[1]
-                    }
-                    elseif ($line -cmatch "^\s+Account\sDomain:\s+(\S.*)")
-                    {
-                        $AccountDomain = $Matches[1]
-                    }
+                    $WorkstationName = $Matches[1]
                 }
-                elseif ($NewLogonSection)
+                elseif ($line -cmatch "^\s+Source\sNetwork\sAddress:\s+(\S.*)")
                 {
-                    if ($line -cmatch "^\s+Account\sName:\s+(\S.*)")
-                    {
-                        $NewLogonAccountName = $Matches[1]
-                    }
-                    elseif ($line -cmatch "^\s+Account\sDomain:\s+(\S.*)")
-                    {
-                        $NewLogonAccountDomain = $Matches[1]
-                    }
+                    $SourceNetworkAddress = $Matches[1]
                 }
-                elseif ($NetworkInformationSection)
+                elseif ($line -cmatch "^\s+Source\sPort:\s+(\S.*)")
                 {
-                    if ($line -cmatch "^\s+Workstation\sName:\s+(\S.*)")
-                    {
-                        $WorkstationName = $Matches[1]
-                    }
-                    elseif ($line -cmatch "^\s+Source\sNetwork\sAddress:\s+(\S.*)")
-                    {
-                        $SourceNetworkAddress = $Matches[1]
-                    }
-                    elseif ($line -cmatch "^\s+Source\sPort:\s+(\S.*)")
-                    {
-                        $SourcePort = $Matches[1]
-                    }
+                    $SourcePort = $Matches[1]
                 }
             }
+        }
 
-            #Filter out logins that don't matter
-            if (-not ($NewLogonAccountDomain -cmatch "NT\sAUTHORITY" -or $NewLogonAccountDomain -cmatch "Window\sManager"))
+        #Filter out logins that don't matter
+        if (-not ($NewLogonAccountDomain -cmatch "NT\sAUTHORITY" -or $NewLogonAccountDomain -cmatch "Window\sManager"))
+        {
+            $Key = $AccountName + $AccountDomain + $NewLogonAccountName + $NewLogonAccountDomain + $LogonType + $WorkstationName + $SourceNetworkAddress + $SourcePort
+            if (-not $ReturnInfo.ContainsKey($Key))
             {
-                $Key = $AccountName + $AccountDomain + $NewLogonAccountName + $NewLogonAccountDomain + $LogonType + $WorkstationName + $SourceNetworkAddress + $SourcePort
-                if (-not $ReturnInfo.ContainsKey($Key))
-                {
-                    $Properties = @{
-                        LogType = 4624
-                        LogSource = "Security"
-                        SourceAccountName = $AccountName
-                        SourceDomainName = $AccountDomain
-                        NewLogonAccountName = $NewLogonAccountName
-                        NewLogonAccountDomain = $NewLogonAccountDomain
-                        LogonType = $LogonType
-                        WorkstationName = $WorkstationName
-                        SourceNetworkAddress = $SourceNetworkAddress
-                        SourcePort = $SourcePort
-                        Count = 1
-                        Times = @($Logon.TimeGenerated)
-                    }
-
-                    $ResultObj = New-Object PSObject -Property $Properties
-                    $ReturnInfo.Add($Key, $ResultObj)
-                }
-                else
-                {
-                    $ReturnInfo[$Key].Count++
-                    $ReturnInfo[$Key].Times += ,$Logon.TimeGenerated
+                $Properties = @{
+                    LogType = 4624
+                    LogSource = "Security"
+                    SourceAccountName = $AccountName
+                    SourceDomainName = $AccountDomain
+                    NewLogonAccountName = $NewLogonAccountName
+                    NewLogonAccountDomain = $NewLogonAccountDomain
+                    LogonType = $LogonType
+                    WorkstationName = $WorkstationName
+                    SourceNetworkAddress = $SourceNetworkAddress
+                    SourcePort = $SourcePort
+                    Count = 1
+                    Times = @($Logon.TimeGenerated)
                 }
+
+                $ResultObj = New-Object PSObject -Property $Properties
+                $ReturnInfo.Add($Key, $ResultObj)
+            }
+            else
+            {
+                $ReturnInfo[$Key].Count++
+                $ReturnInfo[$Key].Times += ,$Logon.TimeGenerated
             }
         }
-
-        return $ReturnInfo
     }
 
-    #Look through the AppLocker logs to find processes that get run on the server. You can then backdoor these exe's (or figure out what they normally run).
-    function Find-AppLockerLogs
+    return $ReturnInfo
+}
+
+
+function Find-AppLockerLogs
+{
+<#
+.SYNOPSIS
+
+Look through the AppLocker logs to find processes that get run on the server. You can then backdoor these exe's (or figure out what they normally run).
+
+Function: Find-AppLockerLogs
+Author: Joe Bialek, Twitter: @JosephBialek
+Required Dependencies: None
+Optional Dependencies: None
+Version: 1.1
+
+.DESCRIPTION
+
+Look through the AppLocker logs to find processes that get run on the server. You can then backdoor these exe's (or figure out what they normally run).
+
+.EXAMPLE
+
+Find-AppLockerLogs
+Find process creations from AppLocker logs.
+
+.NOTES
+
+.LINK
+
+Blog: http://clymb3r.wordpress.com/
+Github repo: https://github.com/clymb3r/PowerShell
+#>
+    $ReturnInfo = @{}
+
+    $AppLockerLogs = Get-WinEvent -LogName "Microsoft-Windows-AppLocker/EXE and DLL" -ErrorAction SilentlyContinue | Where {$_.Id -eq 8002}
+
+    foreach ($Log in $AppLockerLogs)
     {
-        $ReturnInfo = @{}
+        $SID = New-Object System.Security.Principal.SecurityIdentifier($Log.Properties[7].Value)
+        $UserName = $SID.Translate( [System.Security.Principal.NTAccount])
 
-        $AppLockerLogs = Get-WinEvent -LogName "Microsoft-Windows-AppLocker/EXE and DLL" -ErrorAction SilentlyContinue | Where {$_.Id -eq 8002}
+        $ExeName = $Log.Properties[10].Value
 
-        foreach ($Log in $AppLockerLogs)
+        $Key = $UserName.ToString() + "::::" + $ExeName
+
+        if (!$ReturnInfo.ContainsKey($Key))
         {
-            $SID = New-Object System.Security.Principal.SecurityIdentifier($Log.Properties[7].Value)
-            $UserName = $SID.Translate( [System.Security.Principal.NTAccount])
+            $Properties = @{
+                Exe = $ExeName
+                User = $UserName.Value
+                Count = 1
+                Times = @($Log.TimeCreated)
+            }
+
+            $Item = New-Object PSObject -Property $Properties
+            $ReturnInfo.Add($Key, $Item)
+        }
+        else
+        {
+            $ReturnInfo[$Key].Count++
+            $ReturnInfo[$Key].Times += ,$Log.TimeCreated
+        }
+    }
+
+    return $ReturnInfo
+}
+
+
+Function Find-PSScriptsInPSAppLog
+{
+<#
+.SYNOPSIS
+
+Go through the PowerShell operational log to find scripts that run (by looking for ExecutionPipeline logs eventID 4100 in PowerShell app log).
+You can then backdoor these scripts or do other malicious things.
 
-            $ExeName = $Log.Properties[10].Value
+Function: Find-AppLockerLogs
+Author: Joe Bialek, Twitter: @JosephBialek
+Required Dependencies: None
+Optional Dependencies: None
+Version: 1.1
+
+.DESCRIPTION
+
+Go through the PowerShell operational log to find scripts that run (by looking for ExecutionPipeline logs eventID 4100 in PowerShell app log).
+You can then backdoor these scripts or do other malicious things.
+
+.EXAMPLE
+
+Find-PSScriptsInPSAppLog
+Find unique PowerShell scripts being executed from the PowerShell operational log.
+
+.NOTES
+
+.LINK
+
+Blog: http://clymb3r.wordpress.com/
+Github repo: https://github.com/clymb3r/PowerShell
+#>
+    $ReturnInfo = @{}
+    $Logs = Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -ErrorAction SilentlyContinue | Where {$_.Id -eq 4100}
+
+    foreach ($Log in $Logs)
+    {
+        $ContainsScriptName = $false
+        $LogDetails = $Log.Message -split "`r`n"
 
-            $Key = $UserName.ToString() + "::::" + $ExeName
+        $FoundScriptName = $false
+        foreach($Line in $LogDetails)
+        {
+            if ($Line -imatch "^\s*Script\sName\s=\s(.+)")
+            {
+                $ScriptName = $Matches[1]
+                $FoundScriptName = $true
+            }
+            elseif ($Line -imatch "^\s*User\s=\s(.*)")
+            {
+                $User = $Matches[1]
+            }
+        }
+
+        if ($FoundScriptName)
+        {
+            $Key = $ScriptName + "::::" + $User
 
             if (!$ReturnInfo.ContainsKey($Key))
             {
                 $Properties = @{
-                    Exe = $ExeName
-                    User = $UserName.Value
+                    ScriptName = $ScriptName
+                    UserName = $User
                     Count = 1
                     Times = @($Log.TimeCreated)
                 }
@@ -306,133 +506,76 @@ Github repo: https://github.com/clymb3r/PowerShell
                 $ReturnInfo[$Key].Times += ,$Log.TimeCreated
             }
         }
-
-        return $ReturnInfo
     }
 
-    #Go through the PowerShell operational log to find scripts that run (by looking for ExecutionPipeline logs eventID 4100 in PowerShell app log).
-    #You can then backdoor these scripts or do other malicious things.
-    Function Find-PSScriptsInPSAppLog
-    {
-        $ReturnInfo = @{}
-        $Logs = Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -ErrorAction SilentlyContinue | Where {$_.Id -eq 4100}
+    return $ReturnInfo
+}
 
-        foreach ($Log in $Logs)
-        {
-            $ContainsScriptName = $false
-            $LogDetails = $Log.Message -split "`r`n"
 
-            $FoundScriptName = $false
-            foreach($Line in $LogDetails)
-            {
-                if ($Line -imatch "^\s*Script\sName\s=\s(.+)")
-                {
-                    $ScriptName = $Matches[1]
-                    $FoundScriptName = $true
-                }
-                elseif ($Line -imatch "^\s*User\s=\s(.*)")
-                {
-                    $User = $Matches[1]
-                }
-            }
+Function Find-RDPClientConnections
+{
+<#
+.SYNOPSIS
 
-            if ($FoundScriptName)
-            {
-                $Key = $ScriptName + "::::" + $User
+Search the registry to find saved RDP client connections. This shows you what connections an RDP client has remembered, indicating what servers the user 
+usually RDP's to.
 
-                if (!$ReturnInfo.ContainsKey($Key))
-                {
-                    $Properties = @{
-                        ScriptName = $ScriptName
-                        UserName = $User
-                        Count = 1
-                        Times = @($Log.TimeCreated)
-                    }
-
-                    $Item = New-Object PSObject -Property $Properties
-                    $ReturnInfo.Add($Key, $Item)
-                }
-                else
-                {
-                    $ReturnInfo[$Key].Count++
-                    $ReturnInfo[$Key].Times += ,$Log.TimeCreated
-                }
-            }
-        }
+Function: Find-RDPClientConnections
+Author: Joe Bialek, Twitter: @JosephBialek
+Required Dependencies: None
+Optional Dependencies: None
+Version: 1.1
 
-        return $ReturnInfo
-    }
+.DESCRIPTION
 
-    #Search the registry to find saved RDP client connections. This shows you what connections an RDP client has remembered, indicating what servers the user 
-    #usually RDP's to.
-    Function Find-RDPClientConnections
-    {
-        $ReturnInfo = @{}
+Search the registry to find saved RDP client connections. This shows you what connections an RDP client has remembered, indicating what servers the user 
+usually RDP's to.
+
+.EXAMPLE
+
+Find-RDPClientConnections
+Find unique saved RDP client connections.
+
+.NOTES
+
+.LINK
+
+Blog: http://clymb3r.wordpress.com/
+Github repo: https://github.com/clymb3r/PowerShell
+#>
+    $ReturnInfo = @{}
+
+    New-PSDrive -Name HKU -PSProvider Registry -Root Registry::HKEY_USERS | Out-Null
 
-        New-PSDrive -Name HKU -PSProvider Registry -Root Registry::HKEY_USERS | Out-Null
+    #Attempt to enumerate the servers for all users
+    $Users = Get-ChildItem -Path "HKU:\"
+    foreach ($UserSid in $Users.PSChildName)
+    {
+        $Servers = Get-ChildItem "HKU:\$($UserSid)\Software\Microsoft\Terminal Server Client\Servers" -ErrorAction SilentlyContinue
 
-        #Attempt to enumerate the servers for all users
-        $Users = Get-ChildItem -Path "HKU:\"
-        foreach ($User in $Users.PSChildName)
+        foreach ($Server in $Servers)
         {
-            $Servers = Get-ChildItem "HKU:\$($User)\Software\Microsoft\Terminal Server Client\Servers" -ErrorAction SilentlyContinue
+            $Server = $Server.PSChildName
+            $UsernameHint = (Get-ItemProperty -Path "HKU:\$($UserSid)\Software\Microsoft\Terminal Server Client\Servers\$($Server)").UsernameHint
+                
+            $Key = $UserSid + "::::" + $Server + "::::" + $UsernameHint
 
-            foreach ($Server in $Servers)
+            if (!$ReturnInfo.ContainsKey($Key))
             {
-                $Server = $Server.PSChildName
-                $UsernameHint = (Get-ItemProperty -Path "HKU:\$($User)\Software\Microsoft\Terminal Server Client\Servers\$($Server)").UsernameHint
-                
-                $Key = $User + "::::" + $Server + "::::" + $UsernameHint
+                $SIDObj = New-Object System.Security.Principal.SecurityIdentifier($UserSid)
+                $User = ($SIDObj.Translate([System.Security.Principal.NTAccount])).Value
 
-                if (!$ReturnInfo.ContainsKey($Key))
-                {
-                    $Properties = @{
-                        CurrentUser = $User
-                        Server = $Server
-                        UsernameHint = $UsernameHint
-                    }
-
-                    $Item = New-Object PSObject -Property $Properties
-                    $ReturnInfo.Add($Key, $Item)
+                $Properties = @{
+                    CurrentUser = $User
+                    Server = $Server
+                    UsernameHint = $UsernameHint
                 }
+
+                $Item = New-Object PSObject -Property $Properties
+                $ReturnInfo.Add($Key, $Item)
             }
         }
-
-        return $ReturnInfo
-    }
-
-
-    $SecurityLog = Get-EventLog -LogName Security
-    $Filtered4624 = Find-AllLogons $SecurityLog
-    $Filtered4648 = Find-ExplicitLogons $SecurityLog
-    $AppLockerLogs = Find-AppLockerLogs
-    $PSLogs = Find-PSScriptsInPSAppLog
-    $RdpClientData = Find-RDPClientConnections
-
-    if ($ToString)
-    {
-        Write-Output "Event ID 4624 (Logon):"
-        Write-Output $Filtered4624.Values | Format-List
-        Write-Output "Event ID 4648 (Explicit Credential Logon):"
-        Write-Output $Filtered4648.Values | Format-List
-        Write-Output "AppLocker Process Starts:"
-        Write-Output $AppLockerLogs.Values | Format-List
-        Write-Output "PowerShell Script Executions:"
-        Write-Output $PSLogs.Values | Format-List
-        Write-Output "RDP Client Data:"
-        Write-Output $RdpClientData.Values | Format-List
     }
-    else
-    {
-        $Properties = @{
-            LogonEvent4624 = $Filtered4624.Values
-            LogonEvent4648 = $Filtered4648.Values
-            AppLockerProcessStart = $AppLockerLogs.Values
-            PowerShellScriptStart = $PSLogs.Values
-            RdpClientData = $RdpClientData.Values
-        }
 
-        $ReturnObj = New-Object PSObject -Property $Properties
-        return $ReturnObj
-    }
-}
+    return $ReturnInfo
+}
\ No newline at end of file