So I've been working on a Powershell script that needs to detect if an interactive logon has happened since the last reboot. I can force the system to restart before I launch the task, but I'd like to add some intelligence to the script.


  • Must use Powershell.
  • Can't require special power packs or addins.
  • Can't use Active directory commands. (No get-qaduser)

I am able to get the last time the system rebooted already:

$date = Get-WmiObject Win32_OperatingSystem | %{$_.LastBootUpTime} 
$RebootTime = [System.DateTime]::ParseExact($date.split(".")[0],'yyyyMMddHHmmss',$null) 

Any ideas? Thanks in advance

  • 1
    Are we talking a specific user or any user?
    – Zypher
    May 26, 2011 at 19:05
  • @Zypher - Any user. We mainly need to know if someone has logged on locally to the machine. I've tried looking in the win32_NetworkLoginProfile WMI object, but the LastLogon property doesn't hold the correct time. May 26, 2011 at 19:51

1 Answer 1


If you're set on using WMI, you can get LastBootUpTime a bit cleaner:

PS C:\> $wmi = Get-WmiObject -Class Win32_OperatingSystem
PS C:\> $rebootTime = $wmi.ConvertToDateTime($wmi.LastBootUpTime)
PS C:\> $rebootTime
Tuesday, May 24, 2011 3:18:28 PM

Taking that, we search the Security Event Log, since $rebootTime, for the most recent, successful, eventID 4624 containing Logon Type 2 -- Interactive Logon:

PS C:\> $entry = Get-EventLog -After $rebootTime -LogName Security | Where-Object {($_.EventID -eq '4624') -and ($_.EntryType -eq 'SuccessAudit') -and ($_.Message | Select-String "Logon Type:\t\t\t2")} | Select-Object -First 1
PS C:\> $lastLogon = $entry.TimeGenerated
PS C:\> $lastLogon
Tuesday, May 24, 2011 3:19:34 PM

Then, a quick compare:

PS C:\> $lastLogon -gt $rebootTime

The above code can be dumped into a script and/or executed on a remote computer. I only ran the commands interactively to demonstrate the example output.

  • Should you maybe add a "| sort-object TimeGenerated " before you do the select -first 1? May 26, 2011 at 20:41
  • @Mike: In my testing Get-EventLog Security returned entries in reverse chronological order. But your suggestion wouldn't hurt.
    – jscott
    May 26, 2011 at 21:18
  • Sorry...I'm a DBA. I don't trust sorting that isn't explicit. As soon as you trust it, it tricks you. May 27, 2011 at 2:03
  • @Mike No worries! If this had been a more specific question I would certainly recommend verifying the ORDER BY. @DolyKnuckle's question asked how to determine if an interactive logon had occurred since the last reboot, not necessarily the most recent since reboot -- so I cut a corner there.
    – jscott
    May 27, 2011 at 2:16
  • Good point. Again, as a DBA, I see a red flag whenever there's a "TOP n" and no "ORDER BY". In looking at the code, though, the -after in the get-eventlog would cause it to only return something if there was a login. That means that the final -eq isn't needed, right? May 27, 2011 at 5:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.