Quantcast
Channel: Windows PowerShell forum
Viewing all articles
Browse latest Browse all 21975

struggle with where clause

$
0
0

Hey All.

I'm struggling with a script. I snagged a check logon/logoff time script off the net and edited it a little by adding a remote computer option and  date picker. After that i wanted to extend it by giving the option to filter the results to a single user and thats where i'm stuck.

See script below 

# Adding Form Modules
[System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") | out-null
[System.Reflection.Assembly]::LoadWithPartialName("System.Drawing") | out-null
[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic') | Out-Null

function logon
    {
    $Computername = [Microsoft.VisualBasic.Interaction]::InputBox("Please enter a ComputerName", "Computername")
    $Username = [Microsoft.VisualBasic.Interaction]::InputBox("Please enter a username", "Username")
    $UserProperty = @{n="User";e={(New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])}}
    $TypeProperty = @{n="Action";e={if($_.EventID -eq 7001) {"Logon"} else {"Logoff"}}}
    $TimeProperty = @{n="Time";e={$_.TimeGenerated}}

    write-host "Getting logon times for $Username from $Global:after to $Global:before on system $computername"

    Get-EventLog -computername $computername -after $Global:after -before $Global:before System -Source Microsoft-Windows-Winlogon | select $UserProperty,$TypeProperty,$TimeProperty 
    
    }

Function Get-DatePicker 
{   
 $WinForm = New-Object Windows.Forms.Form   
 $WinForm.text = "DatePicker Control"   
 $WinForm.Size = New-Object Drawing.Size(205,55) 

 $DatePicker = New-Object System.Windows.Forms.DateTimePicker   
 #$DatePicker.Format = [windows.forms.datetimepickerFormat]::custom 
 #$DatePicker.CustomFormat = "mm-dd-yyyy H:mm" 
 $WinForm.Controls.Add($DatePicker)   
 $WinForm.Add_Shown($WinForm.Activate())
 $WinForm.StartPosition = "CenterScreen"  
 $WinForm.showdialog() | Out-Null  
 $DatePicker.value 
} #end function Get-DatePicker 

$Global:after = [datetime](Get-DatePicker)
write-host "Set from date to $Global:after"

$Global:before = [datetime](Get-DatePicker)
write-host "Set to date to $Global:before"

logon

The option to add a username to the mix is not the problem. I am stuggling with my 'where' clause and how to get the syntax right. I assume i need to do something like this (probably very wrong syntax)

Get-EventLog -computername $computername -after $Global:after -before $Global:before System -Source Microsoft-Windows-Winlogon | select $UserProperty,$TypeProperty,$TimeProperty | where {$userproperty -like $username}

What i think the problem is, is that the $userproperty is not converted to a string value so i cannot check the $username to $userproperty?

Please help me with this...


Viewing all articles
Browse latest Browse all 21975

Trending Articles