locked
Logon User Graph RRS feed

  • Question

  • $LogInInstances = Get-EventLog -LogName Security -InstanceId 4624 -After $EndDay -Before $StartDay

    $DateGenerated = $LogInInstances | Select-Object TimeGenerated

    7/19/2017 7:18:03 PM
    7/19/2017 7:18:02 PM
    7/19/2017 7:17:59 PM
    7/19/2017 7:14:02 PM

    I would like to be able to take my results (from a week) and display a chart of users logging in. 

    Something like 

    For each Day in DateGenerated 

    count total logins for that day

    Add to chart

    I am not concerned with any information but the time stamps of logins. 

    Not sure if I am approaching this problem completely wrong or if I am just having a brain crash right now.

    Any suggestions would be greatly appreciated!

    Thanks

    • Moved by Bill_Stewart Wednesday, September 13, 2017 9:20 PM Abandoned
    Wednesday, July 26, 2017 8:38 PM

All replies

  • One week:

    $filter = @{
    	Logname='Security'
    	ID=4624
    	StartTime=[datetime]::Today.AddDays(-7)
    }
    Get-WinEvent $filter
    
    


    \_(ツ)_/

    Wednesday, July 26, 2017 9:29 PM
  • I am able to get the dates but how do I count logons per day?
    Friday, July 28, 2017 12:50 AM
  • You will have to group by day.  Convert date to a day or day of week and use Group-Object

    \_(ツ)_/

    Friday, July 28, 2017 12:56 AM