Hey All.
I'm struggling with a script. I snagged a check logon/logoff time script off the net and edited it a little by adding a remote computer option and date picker. After that i wanted to extend it by giving the option to filter the results to a single user and thats where i'm stuck.
See script below
# Adding Form Modules [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") | out-null [System.Reflection.Assembly]::LoadWithPartialName("System.Drawing") | out-null [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic') | Out-Null function logon { $Computername = [Microsoft.VisualBasic.Interaction]::InputBox("Please enter a ComputerName", "Computername") $Username = [Microsoft.VisualBasic.Interaction]::InputBox("Please enter a username", "Username") $UserProperty = @{n="User";e={(New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])}} $TypeProperty = @{n="Action";e={if($_.EventID -eq 7001) {"Logon"} else {"Logoff"}}} $TimeProperty = @{n="Time";e={$_.TimeGenerated}} write-host "Getting logon times for $Username from $Global:after to $Global:before on system $computername" Get-EventLog -computername $computername -after $Global:after -before $Global:before System -Source Microsoft-Windows-Winlogon | select $UserProperty,$TypeProperty,$TimeProperty } Function Get-DatePicker { $WinForm = New-Object Windows.Forms.Form $WinForm.text = "DatePicker Control" $WinForm.Size = New-Object Drawing.Size(205,55) $DatePicker = New-Object System.Windows.Forms.DateTimePicker #$DatePicker.Format = [windows.forms.datetimepickerFormat]::custom #$DatePicker.CustomFormat = "mm-dd-yyyy H:mm" $WinForm.Controls.Add($DatePicker) $WinForm.Add_Shown($WinForm.Activate()) $WinForm.StartPosition = "CenterScreen" $WinForm.showdialog() | Out-Null $DatePicker.value } #end function Get-DatePicker $Global:after = [datetime](Get-DatePicker) write-host "Set from date to $Global:after" $Global:before = [datetime](Get-DatePicker) write-host "Set to date to $Global:before" logon
The option to add a username to the mix is not the problem. I am stuggling with my 'where' clause and how to get the syntax right. I assume i need to do something like this (probably very wrong syntax)
Get-EventLog -computername $computername -after $Global:after -before $Global:before System -Source Microsoft-Windows-Winlogon | select $UserProperty,$TypeProperty,$TimeProperty | where {$userproperty -like $username}
What i think the problem is, is that the $userproperty is not converted to a string value so i cannot check the $username to $userproperty?
Please help me with this...