![]() When the workstation activates the screen saver in response to a period of inactivity these events are logged. Juan, do you have audit enabled for workstations? If yes then: Thank you for this script, it worked like a charm, no bugs at all. Right now output goes to a Window, but you can change Out-Gridview to Export-CSV c:\path\report.csv -NoTypeInformation Write-Host "Or there are no logon/logoff events (XP requires auditing be turned on)" Write-Host "If you see a 'Network Path not found' error, try starting the Remote Registry service on that computer." $Result | Select Time,"Event Type",User | Sort Time -Descending | Out-GridView User = (New-Object $Log.ReplacementStrings).Translate() $Result = New-Object PSObject -Property = $Log.TimeWritten $ELogs = Get-EventLog System -Source Microsoft-Windows-WinLogon -After (Get-Date).AddDays(-$Days) -ComputerName $Computer ![]() $Result = "Gathering Event Logs, this can take awhile." $Computer = (Read-Host Remote computer name), Could have set the script to do it, but since this is a one off type of deal didn't go into it. Script also requires the Remote Registry service be started, which on Win7 machines is set to manual by default. ![]() Works fine on Windows 7 machines, but XP needs to have auditing turned on to get anything so if you have an older PC this won't do much for you. It prompts you for the remote computer you want to run this against and will go back 10 days for logon/logoff information. This is a prettier version of the one-liner above. ![]()
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |