Track shut down / reboot / logout of a PC

PowerShell Help
1

Hello everyone, unfortunately I have no Powershell experience.
In the company I have a PC to which several people access and to control unauthorized access in my name some time ago I had found, I don’t remember where, a command to check for any logins and I was able to adapt it:

Get-WinEvent -LogName Security -FilterXPath “*[System[EventID=4624 and TimeCreated[timediff(@SystemTime) > 0000]] and EventData[Data[@Name=‘LogonType’] and (Data=‘11’ or Data=‘2’)] and EventData[Data[@Name=‘SubjectUserName’] and Data = ‘5314410’]]”

ProviderName: Microsoft-Windows-Security-Auditing

TimeCreated Id LevelDisplayName Message

07/11/2022 08.37.57 4624 Informazioni Accesso di un account riuscito…
04/11/2022 13.28.48 4624 Informazioni Accesso di un account riuscito…
04/11/2022 08.09.31 4624 Informazioni Accesso di un account riuscito…

Now I would like to check what time I shut down / rebooted / logout on that PC. Is it even possible to do such a thing?
Thank you
Marco

2

You would want to look at User32 events in the System log

Get-WinEvent -FilterHashtable @{LogName='System' ; ProviderName='User32'}
3

Thanks for the reply, I tried to throw the line in Powershell but it seems I don’t get my shut down / reboot / logout. Should it be so instead?