Desktop of current logged on user

001
002
003
004
005
006
007
008
009
010
011
012
013
014
015
016
017
018
019
020
021
022
023
024
025
026
027
028
029
030
031
032
033
034
035
036
037
038
039
040
041
042
043
044
045
046
047
048
049
050

## get session process
$proc = Get-WmiObject -Class Win32_SessionProcess | 
select Antecedent -First 1
$filt = ($proc -split "=")[2] -replace ‘"’,”  -replace "}",""

$ltype = DATA {
ConvertFrom-StringData -StringData @’
0 = System
2 = Interactive
3 = Network
4 = Batch
5 = Service
6 = Proxy
7 = Unlock
8 = NetworkCleartext
9 = NewCredentials
10 = RemoteInteractive
11 = CachedInteractive
12 = CachedRemoteInteractive
13 = CachedUnlock
‘@
}
## get logon session
$sess = Get-WmiObject -Class Win32_LogonSession -Filter "LogonId=’$filt’"

## get user
$query = "ASSOCIATORS OF {Win32_LogonSession.LogonId=’$filt’}" `
            + "WHERE ResultClass=Win32_UserAccount"
$user = Get-WmiObject -Query  $query

$query2 = "ASSOCIATORS OF {Win32_UserAccount.Domain=’$($user.Domain)’" `
  + ",Name=’$($user.Name)’} WHERE ResultClass=Win32_Desktop"

$desktop = Get-WmiObject -Query $query2
 
Add-Member -InputObject $sess -MemberType NoteProperty -Name User `
   -Value $($user.Caption) -PassThru |
Format-List AuthenticationPackage, LogonId,
@{Name="Logon Type"; Expression = {$ltype["$($_.LogonType)"]}},
@{Name="Time"; Expression = {$_.ConvertToDateTime($_.StartTime)}},
User
"Desktop Settings:"
$desktop | Format-List BorderWidth, Caption, CoolSwitch,
CursorBlinkRate, Description, DragFullWindows,
GridGranularity, IconSpacing, IconTitleFaceName,
IconTitleSize, IconTitleWrap, Name, Pattern,
ScreenSaverActive, ScreenSaverExecutable,
ScreenSaverSecure, ScreenSaverTimeout,
SettingID, Wallpaper, WallpaperStretched,
WallpaperTiled