Powershell Script – Get the Most Recent User Login / Logoff Events

This great little Powershell script will generate a .csv file, that you can open in excel, which will list each time a user logged in and logged out from the computer or server you run it on.

I believe the only downside is that the list only goes as far back as the logs do on the computer or server you run it on.

Powershell Script

$UserProperty = @{n=”user”;e={(New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])}}
$TypeProperty = @{n=”Action”;e={if($_.EventID -eq 7001) {“Logon”} else {“Logoff”}}}
$TimeProeprty = @{n=”Time”;e={$_.TimeGenerated}}
Get-EventLog System -Source Microsoft-Windows-Winlogon | select $UserProperty,$TypeProperty,$TimeProeprty | export-csv -path C:\logs.csv -NoTypeInformation