История входа пользователей в ОС

Get-WinEvent -ComputerName 'localhost' -FilterHashtable @{
    logname = "Security";
    StartTime = (Date).AddDays(-1);
    ID = 4624,4634;
} | %{
    
    $event = $_
    
    $xmlEvent = [xml]$event.ToXml()
    $EventData = New-Object PSObject
    $xmlEvent.event.EventData.Data | % {$EventData | Add-Member NoteProperty $_.Name $_."#text"}
    
    if ($EventData.LogonType -eq 2)
    {
 
    New-Object PSObject -Property @{
        EventId =     $event.Id
        TimeCreated = $event.TimeCreated
        Task        = "$($event.TaskDisplayName)"
        Keywords    = "$($event.KeywordsDisplayNames)"
        User        = $EventData.TargetUserName
        }
 
    }
 
} | ft -a

$time = [int64](New-TimeSpan (get-date "01/01/2017") (get-date "08/10/2018")).TotalMilliseconds
$filter = "*[System[TimeCreated[timediff(@SystemTime) < $time] and EventID=4624] and EventData[Data[@Name='LogonType']=10]]"
$results = @(
Get-WinEvent -FilterXPath $filter -LogName Security | Foreach {
$evt = $_
$addr = $evt.Properties[18].Value
$textcolor = $host.ui.rawui.foregroundcolor
$host.ui.rawui.foregroundcolor = "red"
 
if ($addr -like "192.168.0*") {$host.ui.rawui.foregroundcolor = "DarkGreen"}
if ($addr -like "10.*") {$host.ui.rawui.foregroundcolor = "yellow"}
"" | Select-Object @{n="Time";e={$evt.TimeCreated}},@{n="UserName";e={$evt.Properties[5].Value}},@{n="Address";e={$addr}}
$host.ui.rawui.foregroundcolor = $textcolor
}
)
$results | export-csv -Encoding UTF8 -Path d:\so1.csv -NoTypeInformation -Delimiter ";"

<#
Logon Type Description
 
2   Interactive (logon at keyboard and screen of system)
3   Network (i.e. connection to shared folder on this computer from elsewhere on network)
4   Batch (i.e. scheduled task)
5   Service (Service startup)
7   Unlock (i.e. unnattended workstation with password protected screen saver)
8   NetworkCleartext (Logon with credentials sent in the clear text. Most often indicates a logon to IIS with "basic authentication") See this article for more information.
9   NewCredentials such as with RunAs or mapping a network drive with alternate credentials.  This logon type does not seem to show up in any events.  If you want to track users attempting to logon with alternate credentials see 4648.  MS says "A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections."
10  RemoteInteractive (Terminal Services, Remote Desktop or Remote Assistance)
11  CachedInteractive (logon with cached domain credentials such as when logging on to a laptop when away from the network)
 
#>
 
$EndDate = date
$StartDate = $EndDate.AddDays(-365)
 
$LogonType = 10
$csvFile = 'c:\temp\report.csv'
$ComputerName = 'localhost'
 
 
$time = [int64](New-TimeSpan $StartDate $EndDate).TotalMilliseconds
$xmlFilter = "*[System[TimeCreated[timediff(@SystemTime) < $time] and (EventID=4624 or EventID=4634)] and EventData[Data[@Name='LogonType']=$LogonType]]"
 
Get-WinEvent -ComputerName $ComputerName -FilterXPath $xmlFilter -LogName Security | %{
    
    $event = $_
    
    $xmlEvent = [xml]$event.ToXml()
    $EventData = New-Object PSObject
    $xmlEvent.event.EventData.Data | % {$EventData | Add-Member NoteProperty $_.Name $_."#text"}
    
    [pscustomobject][ordered]@{
        EventId =     $event.Id
        DateCreated = $event.TimeCreated.ToShortDateString()
        TimeCreated = $event.TimeCreated.ToLongTimeString()
        Task        = "$($event.TaskDisplayName)"
        Keywords    = "$($event.KeywordsDisplayNames)"
        User        = $EventData.TargetUserName
        IP          = $EventData.IpAddress
        LogonType   = switch ($EventData.LogonType)
                      {
                        2  {'Interactive'}
                        3  {'Network'}
                        4  {'Batch'}
                        5  {'Service'}
                        7  {'Unlock'}
                        8  {'NetworkCleartext'}
                        9  {'NewCredentials'}
                        10 {'RemoteInteractive'}
                        11 {'CachedInteractive'}
                        Default {$EventData.LogonType}
                      }
 
    }
 
} | Export-Csv -Encoding UTF8 -Path $csvFile -NoTypeInformation -Delimiter ";"
 
cls
Import-Csv $csvFile -Delimiter ';' | ft -a