added default run mode when variables are missing or not defined

Get-UserLogonActivity.ps1

@@ -8,15 +8,17 @@ Gets user logon, logoff, lock, and unlock activity from the Windows Security log
 $Start = '2026-07-03T00:00:00Z'
 $End = '2026-07-06T00:00:00Z'
 .\Get-UserLogonActivity.ps1
+
+.EXAMPLE
+.\Get-UserLogonActivity.ps1
 #>
 
-If (-not (Get-Variable -Name Start -ErrorAction SilentlyContinue)) {
-    Write-Error '$Start must be defined by the caller. Use ISO 8601 UTC format: yyyy-MM-ddTHH:mm:ssZ. Example: 2026-07-03T00:00:00Z'
-    Exit 1
-}
+$StartVariable = Get-Variable -Name Start -ErrorAction SilentlyContinue
+$EndVariable = Get-Variable -Name End -ErrorAction SilentlyContinue
+$UseDateRange = ($null -ne $StartVariable -and $null -ne $EndVariable)
 
-If (-not (Get-Variable -Name End -ErrorAction SilentlyContinue)) {
-    Write-Error '$End must be defined by the caller. Use ISO 8601 UTC format: yyyy-MM-ddTHH:mm:ssZ. Example: 2026-07-06T00:00:00Z'
+If (($null -ne $StartVariable) -xor ($null -ne $EndVariable)) {
+    Write-Error '$Start and $End must either both be defined or both be omitted. If omitted, the script returns the latest 15 activity events.'
     Exit 1
 }
 
@@ -176,40 +178,86 @@ Function ConvertTo-UserLogonActivity {
     }
 }
 
-Try {
-    $StartDateTime = ConvertTo-ActivityDateTime -Value $Start -ParameterName 'Start'
-    $EndDateTime = ConvertTo-ActivityDateTime -Value $End -ParameterName 'End'
-}
-Catch {
-    Write-Error $_.Exception.Message
-    Exit 1
-}
-
-If ($EndDateTime -le $StartDateTime) {
-    Write-Error "-End must be later than -Start."
-    Exit 1
-}
-
 $Filter = @{
     LogName = 'Security'
     Id = @(4624, 4634, 4647, 4800, 4801)
-    StartTime = $StartDateTime.LocalDateTime
-    EndTime = $EndDateTime.LocalDateTime
 }
 
-Try {
-    $Events = Get-WinEvent -FilterHashtable $Filter -ErrorAction Stop
-}
-Catch {
-    If ($_.FullyQualifiedErrorId -like '*NoMatchingEventsFound*' -or $_.Exception.Message -like '*No events were found*') {
-        $Events = @()
+If ($UseDateRange) {
+    Try {
+        $StartDateTime = ConvertTo-ActivityDateTime -Value $Start -ParameterName 'Start'
+        $EndDateTime = ConvertTo-ActivityDateTime -Value $End -ParameterName 'End'
     }
-    Else {
-        Write-Error "Unable to read the Windows Security event log. Run PowerShell as administrator if access is denied. $($_.Exception.Message)"
+    Catch {
+        Write-Error $_.Exception.Message
         Exit 1
     }
-}
 
-ForEach ($Event in ($Events | Sort-Object -Property TimeCreated)) {
-    ConvertTo-UserLogonActivity -Event $Event
+    If ($EndDateTime -le $StartDateTime) {
+        Write-Error "-End must be later than -Start."
+        Exit 1
+    }
+
+    $Filter.StartTime = $StartDateTime.LocalDateTime
+    $Filter.EndTime = $EndDateTime.LocalDateTime
+
+    Try {
+        $Events = Get-WinEvent -FilterHashtable $Filter -ErrorAction Stop
+    }
+    Catch {
+        If ($_.FullyQualifiedErrorId -like '*NoMatchingEventsFound*' -or $_.Exception.Message -like '*No events were found*') {
+            $Events = @()
+        }
+        Else {
+            Write-Error "Unable to read the Windows Security event log. Run PowerShell as administrator if access is denied. $($_.Exception.Message)"
+            Exit 1
+        }
+    }
+
+    ForEach ($Event in ($Events | Sort-Object -Property TimeCreated)) {
+        ConvertTo-UserLogonActivity -Event $Event
+    }
+}
+Else {
+    $ActivityLimit = 15
+    $SearchLimit = 200
+    $MaxSearchLimit = 10000
+    $ActivityEvents = New-Object System.Collections.Generic.List[object]
+
+    Do {
+        $ActivityEvents.Clear()
+
+        Try {
+            $Events = Get-WinEvent -FilterHashtable $Filter -MaxEvents $SearchLimit -ErrorAction Stop
+        }
+        Catch {
+            If ($_.FullyQualifiedErrorId -like '*NoMatchingEventsFound*' -or $_.Exception.Message -like '*No events were found*') {
+                $Events = @()
+            }
+            Else {
+                Write-Error "Unable to read the Windows Security event log. Run PowerShell as administrator if access is denied. $($_.Exception.Message)"
+                Exit 1
+            }
+        }
+
+        ForEach ($Event in $Events) {
+            $ActivityEvent = ConvertTo-UserLogonActivity -Event $Event
+
+            If ($null -ne $ActivityEvent) {
+                $ActivityEvents.Add($ActivityEvent)
+            }
+
+            If ($ActivityEvents.Count -ge $ActivityLimit) {
+                Break
+            }
+        }
+
+        If ($ActivityEvents.Count -ge $ActivityLimit -or $Events.Count -lt $SearchLimit -or $SearchLimit -ge $MaxSearchLimit) {
+            Break
+        }
+
+        $SearchLimit = [Math]::Min(($SearchLimit * 2), $MaxSearchLimit)
+    } While ($true)
+
+    $ActivityEvents | Select-Object -First $ActivityLimit
 }