Skip to content

Instantly share code, notes, and snippets.

@NathanTheGr8
Last active March 21, 2017 22:45
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save NathanTheGr8/b57f8496d9957783124a05de8aa0ff2e to your computer and use it in GitHub Desktop.
Save NathanTheGr8/b57f8496d9957783124a05de8aa0ff2e to your computer and use it in GitHub Desktop.
returns the most frequent , recent user of this computer
function get-freq-user
{
$newest = 20
$ComputerName = $env:computername
$UserProperty = @{ n = "User"; e = { ((New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])).ToString() } }
$logs = Get-EventLog System -Source Microsoft-Windows-Winlogon -ComputerName $ComputerName -newest $newest | select $UserProperty
$logs = $logs | Group-Object user | Sort Count | Select -First 1 | Select-Object -Property Name | Out-String
$index = $logs.indexOf("\") + 1
return $logs.substring($index)
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment