From 1e5739b75df0e037f0217f26c2643f3d96d431e5 Mon Sep 17 00:00:00 2001
From: ek-dyoder <dyoder@emberkom.com>
Date: Wed, 8 Jul 2026 16:51:52 -0400
Subject: [PATCH] replace bottom table with list of unlocked times

---
 Get-UserLogonActivity.ps1 | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/Get-UserLogonActivity.ps1 b/Get-UserLogonActivity.ps1
index a735a89..bf761d1 100644
--- a/Get-UserLogonActivity.ps1
+++ b/Get-UserLogonActivity.ps1
@@ -910,9 +910,25 @@ Function Write-LocalUnlockedWindowOutput {
         Return
     }
 
-    $Rows = @($UnlockedWindows | Select-Object Start,End,Duration,User,Opened,Closed,Note)
     Write-Output 'Local unlocked windows inferred from returned events:'
-    Write-PlainTextTable -Rows $Rows -Columns @('Start', 'End', 'Duration', 'User', 'Opened', 'Closed', 'Note')
+
+    ForEach ($UnlockedWindow in $UnlockedWindows) {
+        $Start = [string]$UnlockedWindow.Start
+        $End = [string]$UnlockedWindow.End
+        $Duration = [string]$UnlockedWindow.Duration
+        $Closed = [string]$UnlockedWindow.Closed
+
+        If ($End -eq 'open through returned events') {
+            Write-Output "Unlocked since ${Start} (still open through returned events)"
+        }
+        ElseIf ($End.StartsWith('before ')) {
+            $EndTime = $End.Substring(7)
+            Write-Output "Unlocked for ${Duration} (from ${Start} to before ${EndTime}; ${Closed})"
+        }
+        Else {
+            Write-Output "Unlocked for ${Duration} (from ${Start} to ${End})"
+        }
+    }
 }
 
 # Winlogon 7001/7002 tracks user session logon/logoff more reliably than Security 4624/4634.