Add-Type @'
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
namespace PInvoke.Win32 {
public static class UserInput {
[DllImport("user32.dll", SetLastError=false)]
private static extern bool GetLastInputInfo(ref LASTINPUTINFO plii);
[StructLayout(LayoutKind.Sequential)]
private struct LASTINPUTINFO {
public uint cbSize;
public int dwTime;
}
public static DateTime LastInput {
get {
DateTime bootTime = DateTime.UtcNow.AddMilliseconds(-Environment.TickCount);
DateTime lastInput = bootTime.AddMilliseconds(LastInputTicks);
return lastInput;
}
}
public static TimeSpan IdleTime {
get {
return DateTime.UtcNow.Subtract(LastInput);
}
}
public static int LastInputTicks {
get {
LASTINPUTINFO lii = new LASTINPUTINFO();
lii.cbSize = (uint)Marshal.SizeOf(typeof(LASTINPUTINFO));
GetLastInputInfo(ref lii);
return lii.dwTime;
}
}
}
}
'@
Import-Module $SuperOpsModule
Function Get-LocalTime($UTCTime)
{
$strCurrentTimeZone = (Get-WmiObject win32_timezone).StandardName
$TZ = [System.TimeZoneInfo]::FindSystemTimeZoneById($strCurrentTimeZone)
$LocalTime = [System.TimeZoneInfo]::ConvertTimeFromUtc($UTCTime, $TZ)
Return $LocalTime
}
$Idle = [PInvoke.Win32.UserInput]::IdleTime
$lastInput = [PInvoke.Win32.UserInput]::LastInput
Send-CustomField -CustomFieldName "Idle Minutes" -Value ($Idle.Minutes)
Send-CustomField -CustomFieldName "Last Input" -Value (Get-LocalTime($lastInput))
Write-Output ("Idle:" + [PInvoke.Win32.UserInput]::IdleTime)
Write-Output ("LI: " + [PInvoke.Win32.UserInput]::LastInput)
Script data
Language - PowerShell
Run as - Logged In User
Script timeout duration - 5 Mins
Read me
Create a custom field called "Idle Minutes" and "Last Input"