Solved

powershell Get-WinEvent for logon events

Posted on 2014-02-18
5
1,940 Views
Last Modified: 2014-03-14
I have been doing a lot of research the past few days. I'm trying to get a very basic script to run on a Win 2008/Win7 that will give me a list of users who have logged on.

I found a bunch of scripts like the following

Get-WinEvent -computername $server -FilterHashTable @{Logname=$logname;ID=$eventid;StartTime=$starttime;EndTime=$endtime} | where { $_.Message | Select-String "Logon Type: 2" }

I'd like to have a starttime and endtime and I think it should just show the logon type of 2, if I'm not mistaken. It would be great if this could be output to a csv file. Any ideas? Thanks so much.
0
Comment
Question by:cb_it
  • 2
  • 2
5 Comments
 
LVL 10

Accepted Solution

by:
Prashant Girennavar earned 500 total points
Comment Utility
Pipe the output to Export-csv

i.e

Get-WinEvent -computername $server -FilterHashTable @{Logname=$logname;ID=$eventid;StartTime=$starttime;EndTime=$endtime} | where { $_.Message | Select-String "Logon Type: 2" } | export-csv C:\winlogs.csv -notypeinformation

Let me know if this helps.

Thanks,

-Prashant Girennavar
0
 

Author Comment

by:cb_it
Comment Utility
Thanks for the info. The script executes and a csv file is created but it's blank. With the script as is what is getting piped to the csv file?

I would like columns for account name, date, time, etc.

Any ideas??
0
 

Author Comment

by:cb_it
Comment Utility
Just to be clear the main point of this is to run it on a server to get a csv list of who has logged in and when, nothing more. If there is a better script out there let me know! Thanks.
0
 
LVL 68

Expert Comment

by:Qlemo
Comment Utility
Get-WinEvent -Computer $Server -FilterHashTable  @{
  Logname = 'Security'
  StartTime=$starttime
  EndTime=$endtime
  EventID = 4624
  Data=2
}

Open in new window

gets the respective entries. But parsing the result is a pain ...
0
 
LVL 68

Expert Comment

by:Qlemo
Comment Utility
I can't see how http:#a39869184 could have answered your question - the resulting file is empty, according to your response.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Are you one of those front-line IT Service Desk staff fielding calls, replying to emails, all-the-while working to resolve end-user technological nightmares? I am! That's why I have put together this brief overview of tools and techniques I use in o…
Create and license users in Office 365 in bulk based on a CSV file. A step-by-step guide with PowerShell script examples.
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now