How to Fetch login and logoff event's from Powershell and Event viewer's accurately without duplicates.

[Microsoft Windows]

I have tried to fetch the Windows user login session, when did he logged in and logged out (I mean device lock and unlock) i want to calculate the user activity session's time for the user in a Windows device,when I tried to fetch the session using PowerShell script with the event's id (4624 for logon event and 4634 for the logoff event) but I got duplicate and even a case/situation like suppose I lock the screen at 10:40 am and unlock the screen at 10:45 am then, when I checked the events I got login event correctly but at the same time I got logoff event as well.Please find the Powershell sc

Continue reading...