Tracking User Lock, Unlock, and Sleep Events with PowerShell

gistfile1.txt

# Accompanies blog article at https://jamesachambers.com/tracking-user-lock-unlock-and-sleep-events-with-powershell/
# Tracks User Lock, Unlock, and Sleep Events with PowerShell
$startTime = (Get-Date).AddDays(-3)

$securityEvents = Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    ID      = 4800, 4801, 4802, 4803, 4779, 4647
    StartTime = $startTime
}

$systemEvents = Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ID      = 42, 107
    StartTime = $startTime
}

$allEvents = ($securityEvents + $systemEvents) | Sort-Object TimeCreated

foreach ($e in $allEvents) {
    $msg = switch ($e.Id) {
        4800 { "Locked" }
        4801 { "Unlocked" }
        4802 { "Screensaver started" }
        4803 { "Screensaver dismissed" }
        4779 { "Session disconnected" }
        4647 { "User initiated logoff" }
        42   { "System entered sleep" }
        107  { "System resumed from sleep" }
        default { "Unknown" }
    }

    [PSCustomObject]@{
        Time    = $e.TimeCreated
        EventID = $e.Id
        Source  = $e.ProviderName
        Message = $msg
    }
}