0
1
I am trying to track every time a user remotes into a computer and every time they disconnect. I am using Powershell to do this. This is what I am using to do this
Get-WinEvent -Computer $env:ComputerName -FilterHashTable @{LogName='Security';ID=4634,4672} | Select-Object @{N='User';E={$_.Properties[1].Value}},TimeCreated,ID,$MachineNameProperty
Correct me if I'm wrong but my problem is that the event 4634 can apply for a failed login event too. I want just the successful events. Also event 4672 seems to apply only when admins login, again correct me if I'm wrong, but I want the successful login of any user. How do I track only the successful logins and disconnects of any user? Which event log is best suited for this? I would like the log to be able to provide user info as well. Event ID 4624 doesn't always provide user info.
I think
Get-EventLog
will work for you. Example of getting all the succesfull audit events:Get-EventLog -LogName Security -EntryType SuccessAudit
– Smeerpijp – 2019-08-09T07:22:20.307@Smeerpijp I get multiple of these events if someone logs in once. If a user logins in, it will generate two or three login events along with a logoff event. How can I filter through this? – techguy1029 – 2019-08-15T18:47:59.880
1You can filter on EventID with the
InstanceID
switch. Example:Get-EventLog -InstanceId 4624 -LogName Security -EntryType SuccessAudit
– Smeerpijp – 2019-08-16T07:22:37.427