EvilATA.ps1

$ErrorActionPreference = 'SilentlyContinue'

function Test-Guid {
    param(
        [string]$Guid
    )
    return [guid]::TryParse($Guid, [ref][guid]::Empty)
    # $cleanedGuid = $Guid -replace '[{}]',''
    # return [guid]::TryParse($cleanedGuid, [ref][guid]::Empty)
}

function Set-AtaCenterURL {
    [CmdletBinding()]
    Param
    (
        # ATA Center URL. Located in ATA Center Configuration. (Example: atacenter.mydomain.com)
        [Parameter(Mandatory = $true,
                    Position = 0)]
        [string]$URL
    )
    $Global:ATACenter = "$URL"
    # $host.ui.RawUI.WindowTitle = "ATA Console"
	if ((Get-Host).Runspace) {
        $host.ui.RawUI.WindowTitle = "ATA Console"
    }
    else {
    
    }
    # $Global:ParallelPath = (Get-Module EvilATA).Path
    # echo $ParallelPath
	
	Resolve-ATASelfSignedCert
}

function Resolve-AtaSelfSignedCert {
    try {
        Add-Type -TypeDefinition @"
using System.Net;
using System.Security.Cryptography.X509Certificates;
public class TrustAllCertsPolicy : ICertificatePolicy
{
public bool CheckValidationResult(
ServicePoint srvPoint, X509Certificate certificate,
WebRequest request, int certificateProblem)
{
return true;
}
}
"@
    }
    catch {
        Write-Error $_
    }
    [System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
}

function Get-AdUserInfo {
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        # [string]$Identity,
        [string[]]$Identity,
        [ValidateSet("SamAccountName", "ObjectGUID")]
        [string]$IdentityType = "SamAccountName"
    )

    foreach ($searchObject in $Identity) {
        try {
            $domain = ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetDirectoryEntry()
            $searcher = New-Object System.DirectoryServices.DirectorySearcher($domain)
    
            switch ($IdentityType) {
                "SamAccountName" {
                    $searcher.Filter = "(&(objectCategory=person)(samAccountName=$searchObject))"
                }
                "ObjectGUID" {
                    $guid = [guid]::Parse($searchObject)
                    $byteArray = $guid.ToByteArray()
                    $escapedByteArray = ($byteArray | ForEach-Object { '\{0:X2}' -f $_ }) -join ''
                    $searcher = New-Object System.DirectoryServices.DirectorySearcher($domain)
                    $searcher.Filter = "(&(objectCategory=person)(objectGUID=$escapedByteArray))"
                }
            }
    
            $searcher.PropertiesToLoad.Add("objectGUID") | Out-Null
            $searcher.PropertiesToLoad.Add("name") | Out-Null
            $searcher.PropertiesToLoad.Add("samAccountName") | Out-Null
    
            $result = $searcher.FindOne()
    
            # if ($result -ne $null) {
            if ($null -ne $result) {
                $objectGUID = $result.Properties["objectguid"][0]
                $guid = [System.Guid]::New($objectGUID)
                $outputObj = [PSCustomObject]@{
                    Name           = $result.Properties["name"][0]
                    SamAccountName = $result.Properties["samAccountName"][0]
                    objectGUID     = $guid.ToString()
                }
                Write-Output $outputObj
            } else {
                Write-Error "User not found for ${IdentityType}: ${searchObject}"
            }
        } catch {
            Write-Error "An error occurred while searching for the user: $_"
        }
    }
}

function Get-AdGroupInfo {
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        [string[]]$Identity,
        [ValidateSet("SamAccountName", "ObjectGUID")]
        [string]$IdentityType = "SamAccountName"
    )

    foreach ($searchObject in $Identity) {
        try {
            $domain = ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetDirectoryEntry()
            $searcher = New-Object System.DirectoryServices.DirectorySearcher($domain)
    
            switch ($IdentityType) {
                "SamAccountName" {
                    $searcher.Filter = "(&(objectCategory=group)(samAccountName=$searchObject))"
                }
                "ObjectGUID" {
                    $guid = [guid]::Parse($searchObject)
                    $byteArray = $guid.ToByteArray()
                    $escapedByteArray = ($byteArray | ForEach-Object { '\{0:X2}' -f $_ }) -join ''
                    $searcher = New-Object System.DirectoryServices.DirectorySearcher($domain)
                    $searcher.Filter = "(&(objectCategory=group)(objectGUID=$escapedByteArray))"
                }
            }
    
            $searcher.PropertiesToLoad.Add("objectGUID") | Out-Null
            $searcher.PropertiesToLoad.Add("name") | Out-Null
            $searcher.PropertiesToLoad.Add("samAccountName") | Out-Null
            $searcher.PropertiesToLoad.Add("member") | Out-Null
    
            $result = $searcher.FindOne()
    
            if ($null -ne $result) {
                $objectGUID = $result.Properties["objectguid"][0]
                $guid = [System.Guid]::New($objectGUID)
                $members = $result.Properties["member"]
                $memberGuidList = @()

                foreach ($memberDN in $members) {
                    $memberSearcher = New-Object System.DirectoryServices.DirectorySearcher($domain)
                    $memberSearcher.Filter = "(distinguishedName=$memberDN)"
                    $memberSearcher.PropertiesToLoad.Add("objectGUID") | Out-Null
                    $memberResult = $memberSearcher.FindOne()

                    if ($null -ne $memberResult) {
                        $memberObjectGUID = $memberResult.Properties["objectguid"][0]
                        $memberGuid = [System.Guid]::New($memberObjectGUID)
                        $memberGuidList += $memberGuid.ToString()
                    }
                }

                $outputObj = [PSCustomObject]@{
                    Name           = $result.Properties["name"][0]
                    SamAccountName = $result.Properties["samAccountName"][0]
                    objectGUID     = $guid.ToString()
                    Member         = $memberGuidList
                }
                Write-Output $outputObj
            } else {
                Write-Error "Group not found for ${IdentityType}: ${searchObject}"
            }
        } catch {
            Write-Error "An error occurred while searching for the group: $_"
        }
    }
}

function Get-AdComputerInfo {
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        [string[]]$Identity,
        # [string]$Identity,
        [ValidateSet("SamAccountName", "ObjectGUID")]
        [string]$IdentityType = "SamAccountName"
    )

    $domain = ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetDirectoryEntry()

    foreach ($searchObject in $Identity) {
        try {
            # $domain = ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetDirectoryEntry()
            $searcher = New-Object System.DirectoryServices.DirectorySearcher($domain)
    
            switch ($IdentityType) {
                "SamAccountName" {
                    $searcher.Filter = "(&(objectCategory=computer)(name=$searchObject))"
                }
                "ObjectGUID" {
                    $guid = [guid]::Parse($searchObject)
                    $byteArray = $guid.ToByteArray()
                    $escapedByteArray = ($byteArray | ForEach-Object { '\{0:X2}' -f $_ }) -join ''
                    $searcher = New-Object System.DirectoryServices.DirectorySearcher($domain)
                    $searcher.Filter = "(&(objectCategory=computer)(objectGUID=$escapedByteArray))"
                }
            }
    
            $searcher.PropertiesToLoad.Add("objectGUID") | Out-Null
            $searcher.PropertiesToLoad.Add("name") | Out-Null
            $searcher.PropertiesToLoad.Add("samAccountName") | Out-Null
            $searcher.PropertiesToLoad.Add("dnshostname") | Out-Null
    
            $result = $searcher.FindOne()
    
            # if ($result -ne $null) {
            if ($null -ne $result) {
                $objectGUID = $result.Properties["objectguid"][0]
                $guid = [System.Guid]::New($objectGUID)
                $outputObj = [PSCustomObject]@{
                    Name           = $result.Properties["name"][0]
                    SamAccountName = $result.Properties["samAccountName"][0]
                    objectGUID     = $guid.ToString()
                    DnsHostName    = $result.Properties["dnshostname"][0]
                }
                Write-Output $outputObj
            } else {
                Write-Error "Computer not found for ${IdentityType}: ${searchObject}"
            }
        } catch {
            Write-Error "An error occurred while searching for the computer: $_"
        }
    }
}

function Get-AdObjectInfo {
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        # [string]$Identity
        [string[]]$Identity
    )

    foreach ($searchObject in $Identity) {
        try {
            $domain = ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetDirectoryEntry()
            $searcher = New-Object System.DirectoryServices.DirectorySearcher($domain)
    
            $guid = [guid]::Parse($searchObject)
            $byteArray = $guid.ToByteArray()
            $escapedByteArray = ($byteArray | ForEach-Object { '\{0:X2}' -f $_ }) -join ''
            $searcher = New-Object System.DirectoryServices.DirectorySearcher($domain)
            $searcher.Filter = "(&(|(objectCategory=computer)(objectCategory=person)(objectCategory=group))(objectGUID=$escapedByteArray))"
    
            $searcher.PropertiesToLoad.Add("objectGUID") | Out-Null
            $searcher.PropertiesToLoad.Add("name") | Out-Null
            $searcher.PropertiesToLoad.Add("samAccountName") | Out-Null
            $searcher.PropertiesToLoad.Add("objectCategory") | Out-Null
    
            $result = $searcher.FindOne()
    
            # if ($result -ne $null) {
            if ($null -ne $result) {
                $objectGUID = $result.Properties["objectguid"][0]
                $guid = [System.Guid]::New($objectGUID)

                $objectCategory = $result.Properties["objectCategory"].split(',',2)[0].split('=',2)[1]


                $outputObj = [PSCustomObject]@{
                    Name           = $result.Properties["name"][0]
                    SamAccountName = $result.Properties["samAccountName"][0]
                    ObjectGUID     = $guid.ToString()
                    Type = $objectCategory
                }
                Write-Output $outputObj
            } else {
                Write-Error "Computer/User not found for ${IdentityType}: ${searchObject}"
            }
        } catch {
            Write-Error "An error occurred while searching for the computer/user: $_"
        }
    }
}

function Get-AtaUserInfo {
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        [string[]]$AtaObjectGuid,
        [switch]$Profile
    )

    foreach ($guid in $AtaObjectGuid) {
        try {
            
            # 判断传入的 $AtaObjectGuid 是否是 Guid 类型
            if (-not (Test-Guid $guid)) {
                $user_guid_info = Get-AdUserInfo $guid -ErrorAction SilentlyContinue
                
                if ($null -eq $user_guid_info) {
                    Write-Host "Error: No user object found for '$guid'" -ForegroundColor Red
                    continue
                }
                $guid = $user_guid_info.objectguid
            }

            $Id = $guid
            try {
                $ata_object_url = "https://$ATACenter/api/management/uniqueEntities/$Id"
                
                if ($Profile) {
                    $ata_object_url += "/Profile"
                }
    
                $result = Invoke-WebRequest -UseBasicParsing -Uri $ata_object_url -Method Get -UseDefaultCredentials
                $result_json = $result.content | ConvertFrom-Json
                        
                # return $result_json
                Write-Output $result_json
            }
            catch {
                Write-Error "An error occurred while searching for the ATA object: $_"
            }
        }
        catch {
            Write-Error "An error occurred while searching for the object: $_"
        }
    }
}

function Get-AtaComputerInfo {
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        [string[]]$AtaObjectGuid,
        [switch]$Profile
    )

    foreach ($guid in $AtaObjectGuid) {
        try {
            
            # 判断传入的 $AtaObjectGuid 是否是 Guid 类型
            if (-not (Test-Guid $guid)) {
                $computer_guid_info = Get-ADComputerInfo $guid -ErrorAction SilentlyContinue
                
                if ($null -eq $computer_guid_info) {
                    Write-Host "Error: No computer object found for '$guid'" -ForegroundColor Red
                    continue
                }
                $guid = $computer_guid_info.objectguid
            }

            $Id = $guid
            try {
                $ata_object_url = "https://$ATACenter/api/management/uniqueEntities/$Id"
                
                if ($Profile) {
                    $ata_object_url += "/Profile"
                }
    
                $result = Invoke-WebRequest -UseBasicParsing -Uri $ata_object_url -Method Get -UseDefaultCredentials
                $result_json = $result.content | ConvertFrom-Json
                        
                # return $result_json
                Write-Output $result_json
            }
            catch {
                Write-Error "An error occurred while searching for the ATA object: $_"
            }
        }
        catch {
            Write-Error "An error occurred while searching for the object: $_"
        }
    }
}

function Get-AtaGroupInfo {
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        [string[]]$AtaObjectGuid,
        [switch]$Profile
    )

    foreach ($guid in $AtaObjectGuid) {
        try {
            
            # 判断传入的 $AtaObjectGuid 是否是 Guid 类型
            if (-not (Test-Guid $guid)) {
                $group_guid_info = Get-AdGroupInfo $guid -ErrorAction SilentlyContinue
                
                if ($null -eq $group_guid_info) {
                    Write-Host "Error: No group object found for '$guid'" -ForegroundColor Red
                    continue
                }
                $guid = $group_guid_info.objectguid
            }

            $Id = $guid
            try {
                $ata_object_url = "https://$ATACenter/api/management/uniqueEntities/$Id"
                
                if ($Profile) {
                    $ata_object_url += "/Profile"
                }
                
                $MemberObjectGuid = (Get-AdGroupInfo $Id -IdentityType ObjectGUID).member

                $result = Invoke-WebRequest -UseBasicParsing -Uri $ata_object_url -Method Get -UseDefaultCredentials
                $result_json = $result.content | ConvertFrom-Json
                
                $result_json | Add-Member -Name "Member" -MemberType NoteProperty -Value $MemberObjectGuid
                Write-Output $result_json
            }
            catch {
                Write-Error "An error occurred while searching for the ATA object: $_"
            }
        }
        catch {
            Write-Error "An error occurred while searching for the object: $_"
        }
    }
}

function Get-AtaObjectInfo {
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        [string[]]$AtaObjectGuid,
        [switch]$Profile
    )

    foreach ($guid in $AtaObjectGuid) {
        try {

            # 判断传入的 $AtaObjectGuid 是否是 Guid 类型
            if (-not (Test-Guid $guid)) {
                Write-Host "Error: Get-AtaObjectInfo requires Guid-formed value." -ForegroundColor Red
                continue
            }

            $Id = $guid
            try {
                $ata_object_url = "https://$ATACenter/api/management/uniqueEntities/$Id"
                
                if ($Profile) {
                    $ata_object_url += "/Profile"
                }
    
                $result = Invoke-WebRequest -UseBasicParsing -Uri $ata_object_url -Method Get -UseDefaultCredentials
                $result_json = $result.content | ConvertFrom-Json
                        
                # return $result_json
                Write-Output $result_json
            }
            catch {
                Write-Error "An error occurred while searching for the ATA object: $_"
            }
        }
        catch {
            Write-Error "An error occurred while searching for the object: $_"
        }
    }
}

function Get-AtaComputerIpHistory {
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        [string[]]$AtaComputerGuid
    )

    foreach ($guid in $AtaComputerGuid) {
        try {
            if (-not (Test-Guid $guid)) {
                $guid_info = Get-ADComputerInfo $guid
                if ($null -eq $guid_info) {
                    Write-Host "Error: No object found for '$guid'" -ForegroundColor Red
                    continue
                }
                $guid = $guid_info.objectguid
            }

            $Id = $guid
            # 要考虑到部分查询的 objectguid 属于已删除的对象，无法通过 Get-AdObjectInfo 查询到
            $objectInfo = Get-AtaObjectInfo $Id
                $IdentityRefer = ($objectInfo).SystemDisplayName
                $IdentityType  = ($objectInfo).type
            
            $AdComputerIpHistoryObjects = New-Object System.Collections.Generic.List[object]

            # 首先判断 IPMapping 是否存在，如果不存在则不是域计算机对象
            # 比如 ctxadmin、krbtgt 这种服务账号，主要是 Get-AdUserAccessHistory 碰到这种情况
            if ("Computer" -eq $IdentityType) {
                $AtaComputerIpMapping = (Get-AtaObjectInfo $Id -Profile).IpAddressToTimeMapping
                
                # 再判断 ipmapping 是否为空
                # 比如 YANKA1-PC、YF-WANGLIHONG，主要是 Get-AdUserAccessHistory 碰到这种情况
                $foo = (($AtaComputerIpMapping |
                            Get-Member).membertype |
                                Select-Object -Unique) -contains "NoteProperty"
                
                if (-not $foo) {
                    # 如果 $AtaComputerIpMapping 为空，那么这里给首先给 IPAddress、up_time 赋空字符串，避免报错：Cannot index into a null array.
                    # 适用于 YF-CHENGUANXI 这种情况
                    
                    $object = [PSCustomObject]@{
                        Identity      = $IdentityRefer
                        IPAddress     = ""
                        AvailableDate = ""
                    }
                    $AdComputerIpHistoryObjects.Add($object)
                }
                else {
                    foreach ($property in $AtaComputerIpMapping.PSObject.Properties) {
                        try {
                            # 适用于正常计算机，即存在 NoteProperty 属性的
                            $up_time = (Get-Date $property.Value).ToLocalTime()
                            $IPAddress = $property.Name
    
                            $object = [PSCustomObject]@{
                                IdentityRefer = $IdentityRefer
                                IPAddress     = $IPAddress
                                AvailableDate = $up_time
                            }
    
                            $AdComputerIpHistoryObjects.Add($object)
                        }
                        catch {
                            Write-Host "Error handling for property $($property.Name): $($property.Value)" -ForegroundColor Red
                        }
                    }    
                }
                
                $AdComputerIpHistoryObjects | Sort-Object -Property AvailableDate -Descending
            }
            else {
                Write-Error "Error: Get-AtaComputerIpHistory: Not a computer object: $Id"
            }
            
            # $AdComputerIpHistoryObjects = New-Object System.Collections.Generic.List[object]

            # foreach ($property in $AtaComputerIpMapping.PSObject.Properties) {
            #     try {
            #         $up_time = (Get-Date $property.Value).ToLocalTime()

            #         $object = [PSCustomObject]@{
            #             IdentityRefer = $IdentityRefer
            #             IPAddress = $property.Name
            #             AvailableDate = $up_time
            #         }
            #         $AdComputerIpHistoryObjects.Add($object)
            #     }
            #     catch {
            #         Write-Host "Error handling for property $($property.Name): $($property.Value)" -ForegroundColor Red
            #     }
            # }

            # $AdComputerIpHistoryObjects | Sort-Object -Property AvailableDate -Descending
        }
        catch {
            Write-Error "An error occurred while processing the GUID: $_"
        }
    }
}

function Get-AdUserLogonHistory {
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        [string[]]$AdUserGuid
    )

    foreach ($guid in $AdUserGuid) {
        try {
            if (-not (Test-Guid $guid)) {
                $guid_info = Get-ADUserInfo $guid
                if ($null -eq $guid_info) {
                    Write-Host "Error: No user found for '$guid'" -ForegroundColor Red
                    continue
                }
                $guid = $guid_info.objectguid
            }

            $Id = $guid
            $IdentityRefer = (Get-AdUserInfo $Id -IdentityType ObjectGUID).samAccountName
            $AtaUserLogonComputerIdToTimeMapping = (Get-AtaObjectInfo $Id -Profile).LogonComputerIdToTimeMapping
            $AdUserLogonHistoryObjects = New-Object System.Collections.Generic.List[object]

            foreach ($property in $AtaUserLogonComputerIdToTimeMapping.PSObject.Properties) {
                try {
                    $LogonTime = (Get-Date $property.Value).ToLocalTime()
                    $LogonComputerName = (Get-ADComputerInfo $property.Name -IdentityType ObjectGUID).Name
                    $AtaSamName = (Get-AtaObjectInfo $property.Name).SamName
                    $IPAddress = (Get-AtaComputerIpHistory $property.Name)[0].IPAddress
                    
                    $object = [PSCustomObject]@{
                        IdentityRefer      = $IdentityRefer
                        LogonComputerGUID  = $property.Name
                        LogonTime          = $LogonTime
                        LogonComputerName  = $LogonComputerName
                        ATASamName         = $AtaSamName
                        IPAddress          = $IPAddress
                    }
                    $AdUserLogonHistoryObjects.Add($object)
                }
                catch {
                    Write-Host "Error handling for property $($property.Name): $($property.Value)" -ForegroundColor Red
                }
            }
        
            # return $AdUserLogonHistoryObjects | Sort-Object -Property LogonTime -Descending
            $AdUserLogonHistoryObjects | Sort-Object -Property LogonTime -Descending
        }
        catch {
            Write-Error "An error occurred while processing the GUID: $_"
        }
    }
}

function Get-AdUserAccessHistory {
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        [string[]]$AdUserGuid
    )

    foreach ($guid in $AdUserGuid) {
        try {
            if (-not (Test-Guid $guid)) {
                $user_guid_info = Get-AdUserInfo $guid -ErrorAction SilentlyContinue
                if ($null -eq $user_guid_info) {
                    Write-Host "Error: No user found for '$guid'" -ForegroundColor Red
                    Continue
                }
                
                $guid = $user_guid_info.objectGUID
            }

            $Id = $guid
            $IdentityRefer = (Get-AdUserInfo $Id -IdentityType ObjectGUID).samAccountName
            $AtaUserAccessedResourceAccountIdToTimeMapping = (Get-AtaUserInfo $Id -Profile).AccessedResourceAccountIdToTimeMapping
            $AdUserAccessedResourceHistoryObjects = New-Object System.Collections.Generic.List[object]

            foreach ($property in $AtaUserAccessedResourceAccountIdToTimeMapping.PSObject.Properties) {
                try {

                    $objectInfo = Get-AdObjectInfo $property.Name
                        $AccessedResourceName = $objectInfo.Name
                        $objectType           = $objectInfo.type

                    $AccessTime = (Get-Date $property.Value).ToLocalTime()
                    $AtaSamName = (Get-AtaObjectInfo $property.Name).SamName
                    $IPAddress = ""

                    if ("Computer" -eq $objectType) {

                        $IPAddress = (Get-AtaComputerIpHistory $property.Name)[0].IPAddress
                    }
                    
                    $object = [PSCustomObject]@{
                        IdentityRefer        = $IdentityRefer
                        AccessedResourceGUID = $property.Name
                        AccessedTime         = $AccessTime
                        AccessedResourceName = $AccessedResourceName
                        ATASamName           = $AtaSamName
                        IPAddress            = $IPAddress
                    }
                    
                    $AdUserAccessedResourceHistoryObjects.Add($object)
                }
                catch {
                    Write-Error "Error: Get-AdUserAccessHistory: handling for property $($property.Name): $($property.Value)"
                }
            }
            
            $AdUserAccessedResourceHistoryObjects | Sort-Object -Property AccessedTime -Descending
        }
        catch {
            Write-Error "An error occured while processing the GUID: $_"
        }
    }
}

function Get-AdComputerLogonHistory {
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        [string[]]$AtaComputerGuid
    )

    foreach ($guid in $AtaComputerGuid) {
        try {
            if (-not (Test-Guid $guid)) {
                $guid_info = Get-AdComputerInfo $guid
                if ($null -eq $guid_info) {
                    Write-Host "Error: No computer object found for '$guid'" -ForegroundColor Red
                    continue
                }
                $guid = $guid_info.objectguid
            }

            # 这里可能存在一个问题：如果用户直接输入 [域用户的 objectguid] ，那么这里可能无法及时拦截
            $Id = $guid
            $objectInfo = Get-AdComputerInfo $Id -IdentityType ObjectGUID
                $IdentityRefer = ($objectInfo).name
                # $IdentityType  = ($objectInfo).type

            $AdComputerLogonHistoryObjects = New-Object 'System.Collections.Generic.List[System.Object]'
            $LogonSourceAccountIdToTimeMapping = (Get-AtaObjectInfo $Id -Profile).LogonSourceAccountIdToTimeMapping

            foreach ($property in $LogonSourceAccountIdToTimeMapping.PSObject.properties) {
                try {
                    $LogonUserAtaName = (Get-AtaObjectInfo $property.name).SamName
                    # 这里使用 Get-AdObjectInfo 的原因是攻击者可能使用计算机账号登录系统
                    $LogonUserName = (Get-AdObjectInfo $property.name).samAccountName
                    $LogonTime = (Get-Date $property.value).ToLocalTime()
                    
                    $object = [PSCustomObject]@{
                        IdentityRefer    = $IdentityRefer
                        LogonUserGuid    = $property.name
                        LogonTime        = $LogonTime
                        LogonUserName    = $LogonUserName
                        ATASamName       = $LogonUserAtaName
                    }
                    $AdComputerLogonHistoryObjects.Add($object)
                }
                catch {
                    Write-Error "Error handling for property $($property.name): $($property.Value)" -ForegroundColor Red
                }
            }
            
            $AdComputerLogonHistoryObjects | Sort-Object -Property LogonTime -Descending
        }
        catch {
            Write-Error "Error when handling $guid"
        }
    }
}

function Get-AdComputerAccessHistory {
    param (
        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
        [string[]]$AtaComputerGuid
    )

    foreach ($guid in $AtaComputerGuid) {
        try {
            if (-not (Test-Guid $guid)) {
                $guid_info = Get-AdComputerInfo $guid
                if ($null -eq $guid) {
                    Write-Host "Error: No computer object found for '$guid'" -ForegroundColor Red
                    continue
                }
                $guid = $guid_info.objectguid
            }
            
            # 这里可能存在一个问题：如果用户直接输入 [域用户的 objectguid] ，那么这里可能无法及时拦截
            $Id = $guid
            $objectInfo = Get-AdComputerInfo $Id -IdentityType objectguid
                $IdentityRefer = ($objectInfo).name
            
            $AdComputerAccessHistoryObjects = New-Object 'System.Collections.Generic.List[System.Object]'
            $AccessedResourceAccountIdToTimeMapping = (Get-AtaObjectInfo $Id -Profile).AccessedResourceAccountIdToTimeMapping

            foreach ($property in $AccessedResourceAccountIdToTimeMapping.PSObject.properties) {
                try {
                    $objectInfo = Get-AdObjectInfo $property.Name
                        $AccessResourceName = $objectInfo.name
                        $objectType         = $objectInfo.type
                    
                    $AccessTime = (Get-Date $property.value).ToLocalTime()
                    $AtaSamName = (Get-AtaObjectInfo $property.Name).SamName
                    $IPAddress  = ""

                    if ("Computer" -eq $objectType) {
                        $IPAddress = (Get-AtaComputerIpHistory $property.name)[0].IPAddress
                    }

                    $object = [PSCustomObject]@{
                        IdentityRefer        = $IdentityRefer
                        AccessedResourceGUID = $property.name
                        AccessedTime         = $AccessTime
                        AccessedResourceName = $AccessResourceName
                        ATASamName           = $AtaSamName
                        IPAddress            = $IPAddress
                    }

                    $AdComputerAccessHistoryObjects.Add($object)
                }
                catch {
                    Write-Error "Error handling for property $($property.name): $($property.Value)" -ForegroundColor Red
                }
            }
            
            $AdComputerAccessHistoryObjects | Sort-Object -Property AccessedTime -Descending
        }
        catch {
            Write-Error "Error when handling $guid"
        }
    }
}