Monitor Native Person Logons on Home windows Working Techniques – SID-500.COM

Person Logons on Microsoft Home windows working techniques are referred to as Logon Occasions. On this quick weblog publish I’ll present you a PowerShell One-Liner which retrieves all person logons of a specific person.

PowerShell Code

Profitable person logons are logged with Occasion ID 4648. The code beneath rertrieves all profitable logon occasions of person patri. The output is formatted with the Format-Desk cmdlet for higher readability.

Get-EventLog -LogName Safety -InstanceId 4648 | 
The place-Object Message -match "patri" |
Format-Desk TimeGenerated,Message -AutoSize -Wrap

To be extra exact, and to keep away from in depth output, I prohibit the output to point out solely the final profitable login.

Get-EventLog -LogName Safety -InstanceId 4648 | 
The place-Object Message -match "patri" | 
Choose-Object -First 1 |
Format-Desk TimeGenerated,Message -AutoSize -Wrap

Have enjoyable monitoring your techniques with PowerShell!