ITNinja

This is what i did to get the info.

First i started with a powershell script i found on the internet.

$UserProperty = @{n="User";e={(New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])}}
$TypeProperty = @{n="Action";e={if($_.EventID -eq 7001) {"Logon"} else {"Logoff"}}}
$TimeProeprty = @{n="Time";e={$_.TimeGenerated}}
Get-EventLog System -Source Microsoft-Windows-Winlogon | select $UserProperty,$TypeProperty,$TimeProeprty
I save that as "get logon logoff.ps1".

Next i configured a shell script to run on my machines.

Upload the ps1 script, then add this for script text.
@echo off
if not exist c:\windows\tvg mkdir c:\windows\tvg\
powershell.exe -nologo -executionpolicy bypass -WindowStyle hidden -noprofile -file "get logon logoff.ps1" > c:\windows\tvg\userLogs.txt

What that does is create a text file on each computer with the logon info.

Next we create a custom inventory rule to pull the logon info called "LogOn / LogOff'
Here's the syntax for the command:
ShellCommandTextReturn(cmd.exe /c type c:\windows\tvg\userLogs.txt).

Here's the SQL to the report.
SELECT M.NAME,
MCI.STR_FIELD_VALUE
FROM SOFTWARE S,
MACHINE_CUSTOM_INVENTORY MCI,
MACHINE M
WHERE MCI.SOFTWARE_ID = S.ID
AND M.ID = MCI.ID
AND S.DISPLAY_NAME = 'LogOn / LogOff'

It looks a lil funny because of the formatting from the file.

If anyone has ideas on how to clean it up, i'd love to hear em!