Hi, for security reasons, I'd like to track log offs, reboots and shutdowns on my company PC (by my username/account). Is it possible? I thought about reporting each event in a text file.
Thanks
Tracking log off, restart and shutdown
Re: Tracking log off, restart and shutdown
Such events are already logged in windows event viewer
[AHK] v2.0.5 | [WIN] 11 Pro (Version 22H2) | [GitHub] Profile
Re: Tracking log off, restart and shutdown
It is possible that there are in the events viewer but I need to know how to extract them. For example, to extract the log in, I found this command line on Internet e works greatly, but I couldn't find anything for what I'm looking for, so I thought about Autohotkey:
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4624 and TimeCreated[timediff(@SystemTime) > 0000]] and EventData[Data[@Name='LogonType'] and (Data='11' or Data='2')] and EventData[Data[@Name='SubjectUserName'] and Data = '5314410']]"
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4624 and TimeCreated[timediff(@SystemTime) > 0000]] and EventData[Data[@Name='LogonType'] and (Data='11' or Data='2')] and EventData[Data[@Name='SubjectUserName'] and Data = '5314410']]"