From 8ae07c00301249ad48577fdecd73046fc3f3d41f Mon Sep 17 00:00:00 2001
From: ek-dyoder <dyoder@emberkom.com>
Date: Wed, 8 Jul 2026 12:13:48 -0400
Subject: [PATCH] more fixes

---
 Get-UserLogonActivity.ps1 | 70 +++++++++++++++++++++++++++++++++++----
 1 file changed, 64 insertions(+), 6 deletions(-)

diff --git a/Get-UserLogonActivity.ps1 b/Get-UserLogonActivity.ps1
index 94c15cc..219a2e4 100644
--- a/Get-UserLogonActivity.ps1
+++ b/Get-UserLogonActivity.ps1
@@ -596,6 +596,68 @@ Function Get-UniqueUserLogonActivity {
     Return $UniqueEvents
 }
 
+Function Write-PlainTextTable {
+    Param(
+        [AllowNull()]
+        [object[]]$Rows,
+
+        [Parameter(Mandatory=$true)]
+        [string[]]$Columns
+    )
+
+    $TableRows = @($Rows | Where-Object { $null -ne $_ })
+    If ($TableRows.Count -eq 0) { Return }
+
+    $Widths = @{}
+
+    ForEach ($Column in $Columns) {
+        $ColumnWidth = $Column.Length
+
+        ForEach ($Row in $TableRows) {
+            $Property = $Row.PSObject.Properties[$Column]
+            $Value = ''
+
+            If ($null -ne $Property -and $null -ne $Property.Value) {
+                $Value = [string]$Property.Value
+            }
+
+            If ($Value.Length -gt $ColumnWidth) {
+                $ColumnWidth = $Value.Length
+            }
+        }
+
+        $Widths[$Column] = $ColumnWidth
+    }
+
+    $HeaderParts = @()
+    $SeparatorParts = @()
+
+    ForEach ($Column in $Columns) {
+        $HeaderParts += $Column.PadRight($Widths[$Column])
+        $SeparatorParts += ('-' * $Widths[$Column])
+    }
+
+    Write-Output ($HeaderParts -join ' ')
+    Write-Output ($SeparatorParts -join ' ')
+
+    ForEach ($Row in $TableRows) {
+        $LineParts = @()
+
+        ForEach ($Column in $Columns) {
+            $Property = $Row.PSObject.Properties[$Column]
+            $Value = ''
+
+            If ($null -ne $Property -and $null -ne $Property.Value) {
+                $Value = [string]$Property.Value
+            }
+
+            $LineParts += $Value.PadRight($Widths[$Column])
+        }
+
+        Write-Output (($LineParts -join ' ').TrimEnd())
+    }
+}
+
 Function Write-UserLogonActivityOutput {
     Param(
         [AllowNull()]
@@ -609,7 +671,6 @@ Function Write-UserLogonActivityOutput {
     )
 
     Write-Output "Search window: $($StartDateTime.LocalDateTime.ToString('yyyy-MM-dd HH:mm:ss')) through $($EndDateTime.LocalDateTime.ToString('yyyy-MM-dd HH:mm:ss'))"
-    Write-Output ''
 
     $Rows = @($ActivityEvents | Select-Object Date,Time,User,Activity,Source,Details)
 
@@ -618,7 +679,7 @@ Function Write-UserLogonActivityOutput {
         Return
     }
 
-    Write-Output (($Rows | Format-Table -AutoSize | Out-String -Width 240).TrimEnd())
+    Write-PlainTextTable -Rows $Rows -Columns @('Date', 'Time', 'User', 'Activity', 'Source', 'Details')
 }
 
 Function Test-RedundantSessionReconnectUnlock {
@@ -738,15 +799,13 @@ Function Write-PossibleUseWindowOutput {
     $UseWindows = @(Get-PossibleUseWindow -ActivityEvents $ActivityEvents | Sort-Object -Property StartTime)
 
     If ($UseWindows.Count -eq 0) {
-        Write-Output ''
         Write-Output 'Possible use windows inferred from returned events: none'
         Return
     }
 
     $Rows = @($UseWindows | Select-Object Start,End,User,StartedBy,EndedBy)
-    Write-Output ''
     Write-Output 'Possible use windows inferred from returned events:'
-    Write-Output (($Rows | Format-Table -AutoSize | Out-String -Width 240).TrimEnd())
+    Write-PlainTextTable -Rows $Rows -Columns @('Start', 'End', 'User', 'StartedBy', 'EndedBy')
 }
 
 # Winlogon 7001/7002 tracks user session logon/logoff more reliably than Security 4624/4634.
@@ -867,6 +926,5 @@ Try {
 }
 Catch {
     $PossibleUseWindowError = Get-UserLogonActivityErrorMessage -ErrorRecord $_ -FallbackMessage 'Unable to infer possible use windows.'
-    Write-Output ''
     Write-Output "Possible use windows inferred from returned events: unavailable. ${PossibleUseWindowError}"
 }