Ever have the situation where several people have your logon password AND something goes wrong AND everyone denies having logged on?
Or would you simply like to when you logged on 2 days ago?
Try out this little example which simply involves copying and pasting into powershell. Resutls placed on your desktop:
Or would you simply like to when you logged on 2 days ago?
Try out this little example which simply involves copying and pasting into powershell. Resutls placed on your desktop:
Code:
# Start copy with very next line; Copy thru 2nd EXIT
$events = Get-WinEvent -FilterHashtable @{logname='application'; id=4101; level=4} `
-verbose:$false -erroraction:silentlycontinue
$events | format-table -property timecreated,message -auto -wrap `
> $env:userprofile\desktop\LOGONTIMES.txt
EXIT
EXIT
# Places LOGONTIMES.TXT on your DESKTOP
#
# **********************INSTRUCTIONS**************************
# STEP 1 *****************************************************
# RUN PowerShell as administrator
# START ORB | type POWERSHELL | CTRL+SHIFT+ENTER key combo | YES
# ************************************************************
# STEP 2 *****************************************************
# COPY, using CTRL + C, every line down thru both EXIT statements
# PASTE into Powershell by right-clicking at the PowerShell Prompt
# (Ctrl V does not work)
# ************************************************************
# OUTPUT File LOGONTIMES.txt is placed on your DESKTOP
#
# ***************** NOTE - POWERSHELL VERSION*****************
# if you receive this error msg:
# Get-WinEvent: The system can not find the path specified
# you need to update your PowerShell
# you must be using Powershell 2.0 or later.
#
# To determine your Powershell version:
# Run PowerShell
# enter following $host.version
# you should see at least:
# Major Minor Build Revision
# ----- ----- ----- --------
# 2 0 -1 -1
#
# If you do not see the above, update your Vista/Win 7.
# ************************************************************
#
# *************** NOTE - EXECUTION POLICY*********************
# If you haven't set the execution policy, you may need to:
# Run PowerShell
# enter following without the #
# Set-ExecutionPolicy -executionpolicy remotesigned
#
# ************************************************************
#
# ************************************************************
#My Computer
- Computer Manufacturer/Model Number
- Toshiba Satellite S875D-S7239 laptop
- OS
- MS Windows 7 Ultimate SP1 64-bit
- CPU
- AMD A10-4600M
- Motherboard
- AMD Pumori (Socket FT1)
- Memory
- 6.00 GB Dual-Channel DDR3 @ 798MHz (11-11-12-28)
- Graphics Card(s)
- AMD Radeon HD 7660G
- Sound Card
- High Definition Audio Device
- Monitor(s) Displays
- Generic PnP Monitor (1600x900@60Hz)
- Screen Resolution
- 1600x900@60Hz
- Hard Drives
- SSD 119GB Corsair CSSD-V128GB2 ATA Device
- Keyboard
- Standard PS/2 Keyboard
- Mouse
- HP Wireless Optical Mobile Mouse Model FHA-3410
- Internet Speed
- What the local pub, local coffee shop offers.
- Other Info
- Optical Drive:MATSHITA BD-CMB UJ160B ATA Device
Also have an Asus ha1002xp netbook with Win 7 Ultimate installed.
