CIM/Get-CimProcessLogonSession.ps1

function Get-CimProcessLogonSession {
    <#
    .SYNOPSIS
        Query the CIM database for the logon session and account infor for a specific process.
    .DESCRIPTION
        Query the CIM database for the logon session and account infor for a specific process by specifying a process Id.
    .EXAMPLE
        PS C:\> Get-CimSession -Id 1 | Get-PsgProcessLogonSession -ProcessId 5588
 
        ProcessId : 5588
        StartTime : 12/21/2019 10:00:14 PM
        AuthenticationPackage : Kerberos
        LogonId : 2921480
        LogonIdHex : 0x2921480
        LogonType : 2
        User : ACMELABS\cperez
        FullName : Carlos Perez
        SID : S-1-5-21-3150103098-694922503-2167627182-1618
        AccountType : 512
        LocalAccount : False
        PasswordChangeable : True
        PasswordRequired : True
        Lockout : False
        Disabled : False
        ComputerName : localhost
 
        Get the logon session that relates to a specified process byt their process Id.
    .INPUTS
        Microsoft.Management.Infrastructure.CimSession
    .OUTPUTS
        PSGumshoe.LogonSession
    .NOTES
        General notes
    #>

    [CmdletBinding()]
    param (
        # ProcessId to query for.
        [Parameter(Mandatory=$true)]
        [int[]]
        $ProcessId,

        # CIMSession to perform query against
        [Parameter(ValueFromPipelineByPropertyName = $True,
            ValueFromPipeline = $true)]
        [Alias('Session')]
        [Microsoft.Management.Infrastructure.CimSession]
        $CimSession
    )
    
    begin {
    
    }
    
    process {
        # If no CIMSession is provided we create one for localhost.
        if ($null -eq $CimSession) {
            $sessop = New-CimSessionOption -Protocol Dcom
            $CimSession += New-CimSession -ComputerName $env:COMPUTERNAME -SessionOption $sessop
        }

        foreach($p in $ProcessId) {
            $Wql = "Associators of {Win32_Process='$($p)'} Where Resultclass = Win32_LogonSession Assocclass = Win32_SessionProcess" 
            Get-CimInstance -Query $Wql -CimSession $CimSession | ForEach-Object {
                $objProps = [ordered]@{}
                $objProps.Add('ProcessId', $p)
                $objProps.Add('StartTime', $_.StartTime)
                $objProps.Add('AuthenticationPackage', $_.AuthenticationPackage)
                $objProps.Add('LogonId', $_.LogonId)
                $objProps.Add('LogonIdHex', "0x$("{0:x}" -f [int]$_.LogonId)")
                $objProps.Add('LogonType', $_.LogonType)

                # Get the associated win32_account info.
                Get-CimInstance -Query "Associators of {Win32_logonsession.logonid=$($_.LogonId)} Where Resultclass = Win32_UserAccount" -CimSession $CimSession | ForEach-Object {
                    $objProps.Add('User', $_.Caption)
                    $objProps.Add('FullName', $_.FullName)
                    $objProps.Add('SID', $_.SID)
                    $objProps.Add('AccountType', $_.AccountType)
                    $objProps.Add('LocalAccount', $_.LocalAccount)
                    $objProps.Add('PasswordChangeable', $_.PasswordChangeable)
                    $objProps.Add('PasswordRequired', $_.PasswordRequired)
                    $objProps.Add('Lockout', $_.Lockout)
                    $objProps.Add('Disabled', $_.Disabled)
                    $objProps.Add('ComputerName', $CimSession.ComputerName)
                    $sessObj = [PSCustomObject]$objProps
                    $sessObj.pstypenames.insert(0,'PSGumshoe.LogonSession')
                    $sessObj
                }
            }
        }
    }
    
    end {
        
    }
}