1

In order to determine logon and logoff times for a given day on my Windows PC, I've used the following script in Windows PowerShell run as administrator:

Get-WinEvent -FilterHashtable @{starttime='5/6/2018';endtime='5/7/2018';logname='security';id=4648,4634}

I've tried and determined that the above does not work when PowerShell is not run as administrator. Local admin privilege will soon be taken away on the PC on which I need to run this script - which I think means I will no longer be able to run PowerShell as administrator. Is there an alternative that I can run from Powershell or the standard CLI by which I can determine logon and logoff times for a given day?

If relevant, the PC is running Windows 7 Enterprise.

StoneThrow
  • 1,083
  • 3
  • 13
  • 22
  • 2
    Possible duplicate of [Show Windows 7 logon time?](https://superuser.com/questions/310128/show-windows-7-logon-time) –  Jun 02 '18 at 05:25
  • `Get-ADUser` and `Get-LocalUser` cmdlets seem to work okay without admin privileges. They return the last logon times. Now, if searching the security log is part of your purpose, you must know that, for a good reason, its access is restricted to administrators only. –  Jun 02 '18 at 05:48
  • @FleetCommand The answer at the link you posted didn't work, but it prompted me to a little further research which led me to https://stackoverflow.com/questions/30692600/counting-computer-login-times-for-the-week/46989739#46989739 which looks like it's solved my probem. – StoneThrow Jun 04 '18 at 22:51

1 Answers1

1

You could create a scheduled task which is activated whenever one of the relevant events occurs, and writes the desired event info to a log file which is accessible to your non-admin user.

kreemoweet
  • 4,565
  • 17
  • 19