1

I am currently trying to figure out how to view a users login history to a specific machine. This command is meant to be ran locally to view how long consultant spends logged into a server.

I currently only have knowledge to this command that pulls the full EventLog but I need to filter it so it can display per-user or a specific user.

Get-EventLog System -Source Microsoft-Windows-WinLogon -After (Get-Date).AddDays(-5) -ComputerName $env:computername

Improve this question
  • Look for event IDs 4634: An account was logged off and 4624: An account was successfully logged on. – DavidPostill♦ Sep 20 '16 at 17:36
  • I lack so much experience with powershell. How would I go about this? – BSwordsman Sep 20 '16 at 17:47
  • No idea. You will need to wait for a PowerShell guru to come along ... – DavidPostill♦ Sep 20 '16 at 17:58
3

Going off of the discussion in the comments, you can search the Event Log using Powershell.

Get-EventLog security | Where-Object {$_.TimeGenerated -gt '9/15/16'} | Where-Object {($_.InstanceID -eq 4634) -or ($_.InstanceID -eq 4624)} | Select-Object Index,TimeGenerated,InstanceID,Message
  • Get-EventLog allows you to access the Event Log, specifically the Security logs
  • The first Where-Object specifies that you want any records that are newer than the provided date
  • The second Where-Object specifies the two Event IDs you're interested in
  • Select-Object lets us only return columns we're interested having in the output

You will likely need to run this from an elevated instance of Powershell since this is accessing the Windows registry.

Improve this answer
  • Nice! Only problem is that after running this script in elevated PS nothing is printed in the prompt. – BSwordsman Sep 20 '16 at 18:50
  • In the Event Log under Security, are there any events that actually match this criteria (Event ID in 4634/4624 and date>=Sep 15th)? – root Sep 20 '16 at 19:12
  • Probably not. Would I have to enable logging for Security? – BSwordsman Sep 20 '16 at 19:54
  • No, unless you've disabled the Windows Event Log service. – root Sep 21 '16 at 12:12
  • 1
    Sorry about that, looks like I had to play around with the Event IDs. Thank you so much again Root! – BSwordsman Sep 21 '16 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.