# 查詢最近登入紀錄

* 查詢最近七日的登入紀錄

Get-WinEvent -LogName "Security" -FilterXPath "
*[
    System[
        EventID=4624 and 
        TimeCreated[timediff(@SystemTime) <= 604800000]
    ] and 
    EventData[
        Data[@Name='TargetUserName'] and
        ( Data[@Name='LogonType']='2' or Data[@Name='LogonType']='3' ) 
    ]
]" |
Where-Object { $_.Properties[5].Value -notlike "*$" -and $_.Properties[5].Value -notlike "UMFD*" -and $_.Properties[5].Value -notlike "DWM*" } | 
Select-Object @{Name='LogonType';Expression={$_.Properties[8].Value}}, @{Name='IpAddress';Expression={$_.Properties[18].Value}}, @{Name='TargetUserName';Expression={$_.Properties[5].Value}}, TimeCreated | 
Format-Table -AutoSize

* 網路參考資料
* [實用小工具 - 查誰在偷連我的 Windows？](https://blog.darkthread.net/blog/ps-list-logon-events/)