Breaking News: Grepper is joining You.com. Read the official announcement!

PowerShell RDP login history

Bruno Correia answered on December 21, 2022 Popularity 3/10 Helpfulness 4/10

answer PowerShell RDP login history

PowerShell RDP login history

Comment

Get-EventLog -LogName Security -after (Get-date -hour 0 -minute 0 -second 0)| ?{(4624,4778) -contains $_.EventID -and $_.Message -match 'logon type:\s+(10)\s'}| %{
 (new-object -Type PSObject -Property @{
 TimeGenerated = $_.TimeGenerated
 ClientIP = $_.Message -replace '(?smi).*Source Network Address:\s+([^\s]+)\s+.*','$1'
 UserName = $_.Message -replace '(?smi).*Account Name:\s+([^\s]+)\s+.*','$1'
 UserDomain = $_.Message -replace '(?smi).*Account Domain:\s+([^\s]+)\s+.*','$1'
 LogonType = $_.Message -replace '(?smi).*Logon Type:\s+([^\s]+)\s+.*','$1'
 })
 } | sort TimeGenerated -Descending | Select TimeGenerated, ClientIP `
 , @{N='Username';E={'{0}\{1}' -f $_.UserDomain,$_.UserName}} `
 , @{N='LogType';E={
 switch ($_.LogonType) {
 2 {'Interactive - local logon'}
 3 {'Network connection to shared folder)'}
 4 {'Batch'}
 5 {'Service'}
 7 {'Unlock (after screensaver)'}
 8 {'NetworkCleartext'}
 9 {'NewCredentials (local impersonation process under existing connection)'}
 10 {'RDP'}
 11 {'CachedInteractive'}
 default {"LogType Not Recognised: $($_.LogonType)"}
 }
 }}

Popularity 3/10 Helpfulness 4/10 Language shell

Source: learn.microsoft.com

Tags: history powershell rdp shell

Link to this answer
Share Copy Link

Contributed on Dec 21 2022

Bruno Correia

0 Answers Avg Quality 2/10

PowerShell RDP login history

Contents

More Related Answers

PowerShell RDP login history

Grepper

Documentation

Social

Legal

Contact

Oops, You will need to install Grepper and log-in to perform this action.