Get-WinEvent - Both Interactive Logon and Logoff Event ID Messages Only

353 Views Asked by At

I am newish to PowerShell so still learning.

I am wanting to combine the two working commands below into one so the Out-File log will be combined with both the Users Interactive Logon and Logoff Security Event history ID's. Name of the log file does not matter.

Thanks in advance of any assistance.

Get-WinEvent -FilterHashTable @{LogName="Security";ID=4624} | where { $_.Message | Select-String "Logon Type:\s+2"} | Out-File -FilePath c:\Logs\LogIn.txt

Get-WinEvent -LogName Security| Where-Object {$_.ID -eq 4647} | Out-File -FilePath c:\Logs\LogOut.txt
0

There are 0 best solutions below