Hey All.
I'm struggling with a script. I snagged a check logon/logoff time script off the net and edited it a little by adding a remote computer option and date picker. After that i wanted to extend it by giving the option to filter the results to a single user and thats where i'm stuck.
See script below
# Adding Form Modules
[System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") | out-null
[System.Reflection.Assembly]::LoadWithPartialName("System.Drawing") | out-null
[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic') | Out-Null
function logon
{
$Computername = [Microsoft.VisualBasic.Interaction]::InputBox("Please enter a ComputerName", "Computername")
$Username = [Microsoft.VisualBasic.Interaction]::InputBox("Please enter a username", "Username")
$UserProperty = @{n="User";e={(New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])}}
$TypeProperty = @{n="Action";e={if($_.EventID -eq 7001) {"Logon"} else {"Logoff"}}}
$TimeProperty = @{n="Time";e={$_.TimeGenerated}}
write-host "Getting logon times for $Username from $Global:after to $Global:before on system $computername"
Get-EventLog -computername $computername -after $Global:after -before $Global:before System -Source Microsoft-Windows-Winlogon | select $UserProperty,$TypeProperty,$TimeProperty
}
Function Get-DatePicker
{
$WinForm = New-Object Windows.Forms.Form
$WinForm.text = "DatePicker Control"
$WinForm.Size = New-Object Drawing.Size(205,55)
$DatePicker = New-Object System.Windows.Forms.DateTimePicker
#$DatePicker.Format = [windows.forms.datetimepickerFormat]::custom
#$DatePicker.CustomFormat = "mm-dd-yyyy H:mm"
$WinForm.Controls.Add($DatePicker)
$WinForm.Add_Shown($WinForm.Activate())
$WinForm.StartPosition = "CenterScreen"
$WinForm.showdialog() | Out-Null
$DatePicker.value
} #end function Get-DatePicker
$Global:after = [datetime](Get-DatePicker)
write-host "Set from date to $Global:after"
$Global:before = [datetime](Get-DatePicker)
write-host "Set to date to $Global:before"
logonThe option to add a username to the mix is not the problem. I am stuggling with my 'where' clause and how to get the syntax right. I assume i need to do something like this (probably very wrong syntax)
Get-EventLog -computername $computername -after $Global:after -before $Global:before System -Source Microsoft-Windows-Winlogon | select $UserProperty,$TypeProperty,$TimeProperty | where {$userproperty -like $username}What i think the problem is, is that the $userproperty is not converted to a string value so i cannot check the $username to $userproperty?
Please help me with this...