add power events

Get-UserLogonActivity.ps1

@@ -2,7 +2,7 @@
 
 <#
 .SYNOPSIS
-Gets user logon, logoff, lock, and unlock activity from Windows event logs.
+Gets user logon, logoff, lock, unlock, and power activity from Windows event logs.
 
 .EXAMPLE
 $Start = '2026-07-03T00:00:00Z'
@@ -211,11 +211,13 @@ Function New-UserLogonActivityRecord {
         [string]$User,
 
         [Parameter(Mandatory=$true)]
-        [ValidateSet('logon', 'logoff', 'unlock', 'lock')]
+        [ValidateSet('logon', 'logoff', 'unlock', 'lock', 'sleep', 'wake', 'shutdown', 'restart', 'power on')]
-        [string]$Activity
+        [string]$Activity,
+
+        [switch]$AllowSystemUser
     )
 
-    If (-not (Test-UserLogonActivityUser -UserName $User)) { Return $null }
+    If (-not $AllowSystemUser -and -not (Test-UserLogonActivityUser -UserName $User)) { Return $null }
 
     [PSCustomObject]@{
         Date = $TimeCreated.ToString('yyyy-MM-dd')
@@ -253,14 +255,9 @@ Function ConvertTo-SecurityUserActivity {
     $EventXml = [xml]$Event.ToXml()
     $UserName = Get-EventDataValueFromList -EventXml $EventXml -Names @('TargetUserName', 'SubjectUserName')
     $DomainName = Get-EventDataValueFromList -EventXml $EventXml -Names @('TargetDomainName', 'SubjectDomainName')
-    $LogonType = Get-EventDataValue -EventXml $EventXml -Name 'LogonType'
     $Activity = $null
 
     Switch ($Event.Id) {
-        4624 {
-            If ($LogonType -ne '7') { Return $null }
-            $Activity = 'unlock'
-        }
         4800 {
             $Activity = 'lock'
         }
@@ -275,6 +272,51 @@ Function ConvertTo-SecurityUserActivity {
     New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User (Format-UserName -DomainName $DomainName -UserName $UserName) -Activity $Activity
 }
 
+Function ConvertTo-PowerUserActivity {
+    Param(
+        [Parameter(Mandatory=$true)]
+        [object]$Event
+    )
+
+    $EventXml = [xml]$Event.ToXml()
+    $ProviderName = [string]$Event.ProviderName
+    $User = 'SYSTEM'
+    $Activity = $null
+
+    If ($ProviderName -ieq 'Microsoft-Windows-Kernel-Power' -and $Event.Id -eq 42) {
+        $Activity = 'sleep'
+    }
+    ElseIf ($ProviderName -ieq 'Microsoft-Windows-Power-Troubleshooter' -and $Event.Id -eq 1) {
+        $Activity = 'wake'
+    }
+    ElseIf ($ProviderName -ieq 'EventLog' -and $Event.Id -eq 6005) {
+        $Activity = 'power on'
+    }
+    ElseIf ($ProviderName -ieq 'EventLog' -and $Event.Id -eq 6006) {
+        $Activity = 'shutdown'
+    }
+    ElseIf ($ProviderName -ieq 'User32' -and $Event.Id -eq 1074) {
+        $ShutdownType = Get-EventDataValue -EventXml $EventXml -Name 'param5'
+        $EventUser = Get-EventDataValue -EventXml $EventXml -Name 'param7'
+
+        If (-not [string]::IsNullOrWhiteSpace($EventUser) -and $EventUser -ne '-') {
+            $User = $EventUser
+        }
+
+        If ($ShutdownType -match 'restart') {
+            $Activity = 'restart'
+        }
+        Else {
+            $Activity = 'shutdown'
+        }
+    }
+    Else {
+        Return $null
+    }
+
+    New-UserLogonActivityRecord -TimeCreated $Event.TimeCreated -User $User -Activity $Activity -AllowSystemUser
+}
+
 Function Get-UserLogonActivityWinEvent {
     Param(
         [Parameter(Mandatory=$true)]
@@ -375,11 +417,36 @@ $WinlogonFilter = @{
     Id = @(7001, 7002)
 }
 
+# Use only 4800/4801 for lock/unlock. Security 4624 type 7 is an authentication event and
+# can report an unlock without the matching workstation-lock audit event in the same result set.
 $SecurityFilter = @{
     LogName = 'Security'
-    Id = @(4624, 4800, 4801)
+    Id = @(4800, 4801)
 }
 
+$PowerFilters = @(
+    @{
+        LogName = 'System'
+        ProviderName = 'Microsoft-Windows-Kernel-Power'
+        Id = 42
+    },
+    @{
+        LogName = 'System'
+        ProviderName = 'Microsoft-Windows-Power-Troubleshooter'
+        Id = 1
+    },
+    @{
+        LogName = 'System'
+        ProviderName = 'EventLog'
+        Id = @(6005, 6006)
+    },
+    @{
+        LogName = 'System'
+        ProviderName = 'User32'
+        Id = 1074
+    }
+)
+
 If ($UseDateRange) {
     Try {
         $StartDateTime = ConvertTo-ActivityDateTime -Value $Start -ParameterName 'Start'
@@ -399,6 +466,10 @@ If ($UseDateRange) {
     $WinlogonFilter.EndTime = $EndDateTime.LocalDateTime
     $SecurityFilter.StartTime = $StartDateTime.LocalDateTime
     $SecurityFilter.EndTime = $EndDateTime.LocalDateTime
+    ForEach ($PowerFilter in $PowerFilters) {
+        $PowerFilter.StartTime = $StartDateTime.LocalDateTime
+        $PowerFilter.EndTime = $EndDateTime.LocalDateTime
+    }
 
     $ActivityEvents = New-Object System.Collections.Generic.List[object]
 
@@ -410,6 +481,12 @@ If ($UseDateRange) {
         Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
     }
 
+    ForEach ($PowerFilter in $PowerFilters) {
+        ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $PowerFilter -LogDescription 'System power event log')) {
+            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-PowerUserActivity -Event $Event)
+        }
+    }
+
     $OutputEvents = @(Get-UniqueUserLogonActivity -ActivityEvents $ActivityEvents | Sort-Object -Property TimeCreated)
     Write-UserLogonActivityOutput -ActivityEvents $OutputEvents
 }
@@ -423,6 +500,8 @@ Else {
         $ActivityEvents = New-Object System.Collections.Generic.List[object]
         $WinlogonEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $WinlogonFilter -MaxEvents $SearchLimit -LogDescription 'System Winlogon event log')
         $SecurityEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $SecurityFilter -MaxEvents $SearchLimit -LogDescription 'Security event log')
+        $PowerEvents = @()
+        $PowerFiltersMayHaveMoreEvents = $false
 
         ForEach ($Event in $WinlogonEvents) {
             Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-WinlogonUserActivity -Event $Event)
@@ -432,9 +511,22 @@ Else {
             Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
         }
 
+        ForEach ($PowerFilter in $PowerFilters) {
+            $CurrentPowerEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $PowerFilter -MaxEvents $SearchLimit -LogDescription 'System power event log')
+            $PowerEvents += $CurrentPowerEvents
+
+            If ($CurrentPowerEvents.Count -ge $SearchLimit) {
+                $PowerFiltersMayHaveMoreEvents = $true
+            }
+        }
+
+        ForEach ($Event in $PowerEvents) {
+            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-PowerUserActivity -Event $Event)
+        }
+
         $OutputEvents = @(Get-UniqueUserLogonActivity -ActivityEvents $ActivityEvents | Sort-Object -Property TimeCreated -Descending | Select-Object -First $ActivityLimit)
 
-        If ($OutputEvents.Count -ge $ActivityLimit -or (($WinlogonEvents.Count -lt $SearchLimit) -and ($SecurityEvents.Count -lt $SearchLimit)) -or $SearchLimit -ge $MaxSearchLimit) {
+        If ($OutputEvents.Count -ge $ActivityLimit -or (($WinlogonEvents.Count -lt $SearchLimit) -and ($SecurityEvents.Count -lt $SearchLimit) -and -not $PowerFiltersMayHaveMoreEvents) -or $SearchLimit -ge $MaxSearchLimit) {
             Break
         }