system_info.py

import os
import platform
import datetime
import subprocess
import ctypes

def get_system_info():
    """
    Collect system information including user, computer name, and login times.
    """
    info = {
        'username': _get_username(),
        'computer_name': platform.node(),
        'os_version': f"{platform.system()} {platform.release()} ({platform.version()})",
        'exam_date_time': datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
        'last_login': _get_last_login(),
        'last_boot': _get_last_boot(),
        'domain': _get_domain(),
        'is_admin': _is_admin()
    }
    
    return info


def _get_username():
    """Get the currently logged in username."""
    try:
        return os.getlogin()
    except:
        try:
            return os.environ.get('USERNAME', 'Unknown')
        except:
            return 'Unknown'


def _get_domain():
    """Get the computer domain or workgroup."""
    try:
        return os.environ.get('USERDOMAIN', 'Unknown')
    except:
        return 'Unknown'


def _is_admin():
    """Check if running with administrator privileges."""
    try:
        return ctypes.windll.shell32.IsUserAnAdmin() != 0
    except:
        return False


def _get_last_login():
    """
    Get the last login timestamp from Windows Security Event Log.
    Event ID 4624 = Successful logon
    """
    ps_cmd = '''
    try {
        $event = Get-WinEvent -FilterHashtable @{
            LogName='Security'
            ID=4624
        } -MaxEvents 1 -ErrorAction Stop
        
        if ($event) {
            $event.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss')
        }
    } catch {
        # Try alternative method using net user
        try {
            $user = $env:USERNAME
            $output = net user $user 2>$null
            $lastLogon = ($output | Select-String "Last logon").ToString()
            $lastLogon -replace "Last logon\s+", ""
        } catch {
            "Unable to retrieve"
        }
    }
    '''
    
    try:
        result = subprocess.run(
            ["powershell", "-NoProfile", "-Command", ps_cmd],
            capture_output=True, text=True, timeout=30
        )
        
        if result.returncode == 0 and result.stdout.strip():
            return result.stdout.strip()
    except:
        pass
    
    # Fallback: Use WMI
    try:
        ps_wmi = '''
        try {
            $os = Get-CimInstance Win32_OperatingSystem -ErrorAction Stop
            $os.LastBootUpTime.ToString('yyyy-MM-dd HH:mm:ss')
        } catch {
            "Unable to retrieve"
        }
        '''
        result = subprocess.run(
            ["powershell", "-NoProfile", "-Command", ps_wmi],
            capture_output=True, text=True, timeout=30
        )
        if result.returncode == 0 and result.stdout.strip():
            return f"Since boot: {result.stdout.strip()}"
    except:
        pass
    
    return "Unable to retrieve"


def _get_last_boot():
    """Get the last system boot time."""
    ps_cmd = '''
    try {
        $os = Get-CimInstance Win32_OperatingSystem -ErrorAction Stop
        $os.LastBootUpTime.ToString('yyyy-MM-dd HH:mm:ss')
    } catch {
        "Unable to retrieve"
    }
    '''
    
    try:
        result = subprocess.run(
            ["powershell", "-NoProfile", "-Command", ps_cmd],
            capture_output=True, text=True, timeout=30
        )
        
        if result.returncode == 0 and result.stdout.strip():
            return result.stdout.strip()
    except:
        pass
    
    return "Unable to retrieve"


def get_all_users():
    """Get list of all user accounts on the system."""
    users = []
    
    ps_cmd = '''
    try {
        Get-LocalUser | ForEach-Object {
            "$($_.Name)|$($_.Enabled)|$($_.LastLogon)"
        }
    } catch {
        # Fallback for older systems
        net user 2>$null | Select-String -Pattern "^[A-Za-z]"
    }
    '''
    
    try:
        result = subprocess.run(
            ["powershell", "-NoProfile", "-Command", ps_cmd],
            capture_output=True, text=True, timeout=30
        )
        
        if result.returncode == 0 and result.stdout.strip():
            for line in result.stdout.strip().split('\n'):
                if '|' in line:
                    parts = line.split('|')
                    if len(parts) >= 3:
                        users.append({
                            'name': parts[0],
                            'enabled': parts[1] == 'True',
                            'last_logon': parts[2] if parts[2] else 'Never'
                        })
    except:
        pass
    
    return users


def get_recent_logons(max_events=50):
    """Get recent logon events from Security log."""
    logons = []
    
    ps_cmd = f'''
    try {{
        Get-WinEvent -FilterHashtable @{{
            LogName='Security'
            ID=4624
        }} -MaxEvents {max_events} -ErrorAction Stop | ForEach-Object {{
            $xml = [xml]$_.ToXml()
            $user = ($xml.Event.EventData.Data | Where-Object {{$_.Name -eq 'TargetUserName'}}).'#text'
            $domain = ($xml.Event.EventData.Data | Where-Object {{$_.Name -eq 'TargetDomainName'}}).'#text'
            $logonType = ($xml.Event.EventData.Data | Where-Object {{$_.Name -eq 'LogonType'}}).'#text'
            "$($_.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss'))|$domain\\$user|$logonType"
        }}
    }} catch {{
        # Access denied or log not available
    }}
    '''
    
    try:
        result = subprocess.run(
            ["powershell", "-NoProfile", "-Command", ps_cmd],
            capture_output=True, text=True, timeout=60
        )
        
        if result.returncode == 0 and result.stdout.strip():
            for line in result.stdout.strip().split('\n'):
                if '|' in line:
                    parts = line.split('|')
                    if len(parts) >= 3:
                        # Filter out system accounts
                        if not any(x in parts[1].lower() for x in ['system', 'dwm-', 'umfd-', '$']):
                            logons.append({
                                'time': parts[0],
                                'user': parts[1],
                                'logon_type': _logon_type_name(parts[2])
                            })
    except:
        pass
    
    return logons


def _logon_type_name(logon_type):
    """Convert logon type number to human-readable name."""
    types = {
        '2': 'Interactive (local)',
        '3': 'Network',
        '4': 'Batch',
        '5': 'Service',
        '7': 'Unlock',
        '8': 'NetworkCleartext',
        '9': 'NewCredentials',
        '10': 'RemoteInteractive (RDP)',
        '11': 'CachedInteractive'
    }
    return types.get(logon_type, f'Type {logon_type}')