Cozza itzCozza
thomasswilliams
/ remote-desktop-history.ps1
Last active
November 28, 2023 22:19
PowerShell script to list remote desktop logon, logoff, disconnect events from the Terminal Services event log for a passed computer, collection of computers, or computer name(s) from prompt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| .SYNOPSIS | |
| Get remote desktop sessions for a specified computer or computers, from the Terminal | |
| Services event log. Adapted from https://serverfault.com/a/687079/78216, https://ss64.com/ps/get-winevent.html | |
| Requires appropriate permission on computers to call Get-WinEvent remotely, PowerShell Active Directory module. | |
| If using Windows Firewall, may require enabling "Remote Event Log Management" rule (from | |
| https://social.technet.microsoft.com/Forums/en-US/69fba4e0-a248-4d1c-9e0d-80071a2a446d/getwinevent-the-rpc-server-is-unavailable) | |
| By Thomas Williams <https://github.com/thomasswilliams> | |
| .DESCRIPTION |