Get-WinEvent -ProviderName 'Microsoft-Windows-Security-Auditing' -FilterXPath "*[System[EventID=4624] and EventData[Data[@Name='LogonType']='7' or Data[@Name='LogonType']='2']]" -MaxEvents 50
LogonType = 2 - Login into machine
LogonType = 7 - Unlock from Screen Protector password
No comments:
Post a Comment