Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

powershell Get-WinEvent for logon events

Posted on 2014-02-18
5
Medium Priority
?
2,277 Views
Last Modified: 2014-03-14
I have been doing a lot of research the past few days. I'm trying to get a very basic script to run on a Win 2008/Win7 that will give me a list of users who have logged on.

I found a bunch of scripts like the following

Get-WinEvent -computername $server -FilterHashTable @{Logname=$logname;ID=$eventid;StartTime=$starttime;EndTime=$endtime} | where { $_.Message | Select-String "Logon Type: 2" }

I'd like to have a starttime and endtime and I think it should just show the logon type of 2, if I'm not mistaken. It would be great if this could be output to a csv file. Any ideas? Thanks so much.
0
Comment
Question by:cb_it
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 10

Accepted Solution

by:
Prashant Girennavar earned 2000 total points
ID: 39869184
Pipe the output to Export-csv

i.e

Get-WinEvent -computername $server -FilterHashTable @{Logname=$logname;ID=$eventid;StartTime=$starttime;EndTime=$endtime} | where { $_.Message | Select-String "Logon Type: 2" } | export-csv C:\winlogs.csv -notypeinformation

Let me know if this helps.

Thanks,

-Prashant Girennavar
0
 

Author Comment

by:cb_it
ID: 39870115
Thanks for the info. The script executes and a csv file is created but it's blank. With the script as is what is getting piped to the csv file?

I would like columns for account name, date, time, etc.

Any ideas??
0
 

Author Comment

by:cb_it
ID: 39870119
Just to be clear the main point of this is to run it on a server to get a csv list of who has logged in and when, nothing more. If there is a better script out there let me know! Thanks.
0
 
LVL 71

Expert Comment

by:Qlemo
ID: 39877646
Get-WinEvent -Computer $Server -FilterHashTable  @{
  Logname = 'Security'
  StartTime=$starttime
  EndTime=$endtime
  EventID = 4624
  Data=2
}

Open in new window

gets the respective entries. But parsing the result is a pain ...
0
 
LVL 71

Expert Comment

by:Qlemo
ID: 39909917
I can't see how http:#a39869184 could have answered your question - the resulting file is empty, according to your response.
0

Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A recent project that involved parsing Tableau Desktop and Server log files to extract reusable user queries for use in other systems. I chose to use PowerShell to gather the data, and SharePoint to present it...
Previously, on our Nano Server Deployment series, we've created a new nano server image and deployed it on a physical server in part 2. Now we will go through configuration.
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
Want to learn how to record your desktop screen without having to use an outside camera. Click on this video and learn how to use the cool google extension called "Screencastify"! Step 1: Open a new google tab Step 2: Go to the left hand upper corn…

618 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question