replace bottom table with list of unlocked times

2026-07-08 16:51:52 -04:00
parent db8fc541df
commit 1e5739b75d
1 changed files with 18 additions and 2 deletions
@@ -910,9 +910,25 @@ Function Write-LocalUnlockedWindowOutput {
        Return
    }

-    $Rows = @($UnlockedWindows | Select-Object Start,End,Duration,User,Opened,Closed,Note)
    Write-Output 'Local unlocked windows inferred from returned events:'
-    Write-PlainTextTable -Rows $Rows -Columns @('Start', 'End', 'Duration', 'User', 'Opened', 'Closed', 'Note')
+
+    ForEach ($UnlockedWindow in $UnlockedWindows) {
+        $Start = [string]$UnlockedWindow.Start
+        $End = [string]$UnlockedWindow.End
+        $Duration = [string]$UnlockedWindow.Duration
+        $Closed = [string]$UnlockedWindow.Closed
+
+        If ($End -eq 'open through returned events') {
+            Write-Output "Unlocked since ${Start} (still open through returned events)"
+        }
+        ElseIf ($End.StartsWith('before ')) {
+            $EndTime = $End.Substring(7)
+            Write-Output "Unlocked for ${Duration} (from ${Start} to before ${EndTime}; ${Closed})"
+        }
+        Else {
+            Write-Output "Unlocked for ${Duration} (from ${Start} to ${End})"
+        }
+    }
 }

 # Winlogon 7001/7002 tracks user session logon/logoff more reliably than Security 4624/4634.