Get Logon History

11/15/2016

Name:

Get Logon History

Category:

Event Logs

Description: 

Shows Logon events on the target machine.

Required Software:

PowerShell

Command:

Write-Output "Get logon history for $(Computer:TARGET)"

Get-WinEvent -ComputerName $(Computer:TARGET) `
-LogName 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' `
-MaxEvents 300 -ErrorAction SilentlyContinue |

Where {$_.Message -match "Session log"} |

Format-List -property TimeCreated, LogName, ProviderName, LevelDisplayName, ID, Message

More Info/Usage:

Get-WinEvent