Ejecutar PowerShell como administrador.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
# 4624: An account was successfully logged on $iniciossesion = Get-EventLog -LogName Security -InstanceId 4624 | ForEach-Object { # Convertir el contenido del log en un objeto [PSCustomObject]@{ Time = $_.TimeGenerated Usuario = "{0}\{1}" -f $_.ReplacementStrings[5], $_.ReplacementStrings[6] Type = $_.ReplacementStrings[10] Path = $_.ReplacementStrings[17] } } $iniciossesion | Sort-Object Time -Descending |
