Hello everyone, unfortunately I have no Powershell experience.
In the company I have a PC to which several people access and to control unauthorized access in my name some time ago I had found, I don’t remember where, a command to check for any logins and I was able to adapt it:
Get-WinEvent -LogName Security -FilterXPath “*[System[EventID=4624 and TimeCreated[timediff(@SystemTime) > 0000]] and EventData[Data[@Name=‘LogonType’] and (Data=‘11’ or Data=‘2’)] and EventData[Data[@Name=‘SubjectUserName’] and Data = ‘5314410’]]”
TimeCreated Id LevelDisplayName Message
07/11/2022 08.37.57 4624 Informazioni Accesso di un account riuscito…
04/11/2022 13.28.48 4624 Informazioni Accesso di un account riuscito…
04/11/2022 08.09.31 4624 Informazioni Accesso di un account riuscito…
Now I would like to check what time I shut down / rebooted / logout on that PC. Is it even possible to do such a thing?