CODEWITHSUNDEEP
loggingpowershell
Artur Carvalho
Artur Carvalho

Reputation: 7167

Detect logging off and logging in powershell

How can I detect if a user has logged on or off from a windows system (preferably that works with win7, vista or XP) using powershell?

I want to register the date and time of each logging on and off of the machine.

Thank you in advance

Upvotes: 5

Views: 4149

Answers (2)

JasonMArcher
JasonMArcher

Reputation: 14991

You can get this infromation from the event log:

Get-EventLog System -Source Microsoft-Windows-Winlogon

Logons have an InstanceId of 7001, logoffs have 7002. The user account is a SID in ReplacementStrings.

Here is some more useful code for you.

$UserProperty = @{n="User";e={(New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])}}
$TypeProperty = @{n="Action";e={if($_.EventID -eq 7001) {"Logon"} else {"Logoff"}}}
$TimeProeprty = @{n="Time";e={$_.TimeGenerated}}
Get-EventLog System -Source Microsoft-Windows-Winlogon | select $UserProperty,$TypeProperty,$TimeProeprty

You can also get these events from a remote computer by adding the "-ComputerName" parameter to Get-EventLog.

Upvotes: 8

Marc B
Marc B

Reputation: 360612

Such things are already be in the windows System log, with type "Winlogon". Don't know how you'd extract the information from there via powershell, but at least the logging part is already there for you.

Upvotes: 1

Related Questions