User Logons on Microsoft Windows operating systems are called Logon Events. In this short blog post I will show you a PowerShell One-Liner which retrieves all user logons of a particular user.

PowerShell Code

Successful user logons are logged with Event ID 4648. The code below rertrieves all successful logon events of user patri. The output is formatted with the Format-Table cmdlet for better readability.

Get-EventLog -LogName Security -InstanceId 4648 | 
Where-Object Message -match "patri" |
Format-Table TimeGenerated,Message -AutoSize -Wrap

To be more precise, and to avoid extensive output, I restrict the output to show only the last successful login.

Get-EventLog -LogName Security -InstanceId 4648 | 
Where-Object Message -match "patri" | 
Select-Object -First 1 |
Format-Table TimeGenerated,Message -AutoSize -Wrap

Have fun monitoring your systems with PowerShell!