Here is a more complete and more useful way to retrieve these events. It can allow you to match logon and logoff events by "SessionID".
function Get-TSUserEvents{
[CmdletBinding()]
Param(
[string[]]$ComputerName = $env:COMPUTERNAME,
[datetime]$StartTime = [datetime]::Today
)
Begin{
$actions = @{
'21' = 'logon'
'22' = 'Shell start'
'23' = 'Logoff'
'24' = 'Disconnected'
'25' = 'Reconnected'
}
$LogFilter = @{
LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
ID = 21, 22, 23, 24, 25
StartTime = $StartTime
}
}
Process{
foreach ($server in $ComputerName) {
Get-WinEvent -FilterHashtable $LogFilter -ComputerName $Server |
ForEach-Object {
$entry = [xml]$_.ToXml()
[pscustomobject]@{
ServerName = $server
EventID = $entry.Event.System.EventID
TimeCreated = $_.TimeCreated
SessionID = $entry.Event.UserData.EventXML.SessionID
User = $entry.Event.UserData.EventXML.User
IPAddress = $entry.Event.UserData.EventXML.Address
Action = $actions[$entry.Event.System.EventID]
}
}
}
}
}
To export just do this:
Get-TSUserEvents | Export-Csv $filename -NoType
\_(ツ)_/
Need help to fetch event viewer security Account Name,Logondate,Log off date,Source Network address,
