behavioral changes

Get-UserLogonActivity.ps1

@@ -11,14 +11,36 @@ $End = '2026-07-06T00:00:00Z'
 
 .EXAMPLE
 .\Get-UserLogonActivity.ps1
+
+Returns activity from the last 7 days.
+
+.EXAMPLE
+$Start = '2026-07-03T00:00:00Z'
+.\Get-UserLogonActivity.ps1
+
+Returns activity from the specified start date through now.
 #>
 
 $StartVariable = Get-Variable -Name Start -ErrorAction SilentlyContinue
 $EndVariable = Get-Variable -Name End -ErrorAction SilentlyContinue
-$UseDateRange = ($null -ne $StartVariable -and $null -ne $EndVariable)
 
-If (($null -ne $StartVariable) -xor ($null -ne $EndVariable)) {
+Function Test-ActivityDateRangeValue {
-    Write-Error '$Start and $End must either both be defined or both be omitted. If omitted, the script returns the latest 15 activity events.'
+    Param(
+        [AllowNull()]
+        [object]$Value
+    )
+
+    If ($null -eq $Value) { Return $false }
+    If ($Value -is [string]) { Return -not [string]::IsNullOrWhiteSpace($Value) }
+
+    Return $true
+}
+
+$StartHasValue = ($null -ne $StartVariable -and (Test-ActivityDateRangeValue -Value $StartVariable.Value))
+$EndHasValue = ($null -ne $EndVariable -and (Test-ActivityDateRangeValue -Value $EndVariable.Value))
+
+If ($EndHasValue -and -not $StartHasValue) {
+    Write-Error '$Start must be defined when $End is defined. If only $Start is defined, the script uses now for $End. If neither is defined, the script returns activity from the last 7 days.'
     Exit 1
 }
 
@@ -729,115 +751,70 @@ $PowerFilters = @(
     }
 )
 
-If ($UseDateRange) {
+Try {
-    Try {
+    If ($StartHasValue) {
         $StartDateTime = ConvertTo-ActivityDateTime -Value $Start -ParameterName 'Start'
+    }
+
+    If ($EndHasValue) {
         $EndDateTime = ConvertTo-ActivityDateTime -Value $End -ParameterName 'End'
     }
-    Catch {
+
-        Write-Error $_.Exception.Message
+    If (-not $EndHasValue) {
-        Exit 1
+        $EndDateTime = [DateTimeOffset]::Now
     }
 
-    If ($EndDateTime -le $StartDateTime) {
+    If (-not $StartHasValue) {
-        Write-Error "-End must be later than -Start."
+        $StartDateTime = $EndDateTime.AddDays(-7)
-        Exit 1
     }
-
-    $WinlogonFilter.StartTime = $StartDateTime.LocalDateTime
-    $WinlogonFilter.EndTime = $EndDateTime.LocalDateTime
-    $SecurityFilter.StartTime = $StartDateTime.LocalDateTime
-    $SecurityFilter.EndTime = $EndDateTime.LocalDateTime
-    $UnlockAuthFilter.StartTime = $StartDateTime.LocalDateTime
-    $UnlockAuthFilter.EndTime = $EndDateTime.LocalDateTime
-    $TerminalServicesFilter.StartTime = $StartDateTime.LocalDateTime
-    $TerminalServicesFilter.EndTime = $EndDateTime.LocalDateTime
-    ForEach ($PowerFilter in $PowerFilters) {
-        $PowerFilter.StartTime = $StartDateTime.LocalDateTime
-        $PowerFilter.EndTime = $EndDateTime.LocalDateTime
-    }
-
-    $ActivityEvents = New-Object System.Collections.Generic.List[object]
-
-    ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $WinlogonFilter -LogDescription 'System Winlogon event log')) {
-        Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-WinlogonUserActivity -Event $Event)
-    }
-
-    ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $SecurityFilter -LogDescription 'Security event log')) {
-        Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
-    }
-
-    ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $UnlockAuthFilter -LogDescription 'Security unlock-authentication event log')) {
-        Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
-    }
-
-    ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $TerminalServicesFilter -LogDescription 'Terminal Services Local Session Manager event log')) {
-        Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-TerminalServicesUserActivity -Event $Event)
-    }
-
-    ForEach ($PowerFilter in $PowerFilters) {
-        ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $PowerFilter -LogDescription 'System power event log')) {
-            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-PowerUserActivity -Event $Event)
-        }
-    }
-
-    $OutputEvents = @(Get-UniqueUserLogonActivity -ActivityEvents $ActivityEvents | Sort-Object -Property TimeCreated)
-    Write-UserLogonActivityOutput -ActivityEvents $OutputEvents
-    Write-PossibleUseWindowOutput -ActivityEvents $OutputEvents
 }
-Else {
+Catch {
-    $ActivityLimit = 15
+    Write-Error $_.Exception.Message
-    $SearchLimit = 200
+    Exit 1
-    $MaxSearchLimit = 10000
-    $OutputEvents = @()
-
-    Do {
-        $ActivityEvents = New-Object System.Collections.Generic.List[object]
-        $WinlogonEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $WinlogonFilter -MaxEvents $SearchLimit -LogDescription 'System Winlogon event log')
-        $SecurityEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $SecurityFilter -MaxEvents $SearchLimit -LogDescription 'Security event log')
-        $UnlockAuthEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $UnlockAuthFilter -MaxEvents $SearchLimit -LogDescription 'Security unlock-authentication event log')
-        $TerminalServicesEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $TerminalServicesFilter -MaxEvents $SearchLimit -LogDescription 'Terminal Services Local Session Manager event log')
-        $PowerEvents = @()
-        $PowerFiltersMayHaveMoreEvents = $false
-
-        ForEach ($Event in $WinlogonEvents) {
-            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-WinlogonUserActivity -Event $Event)
-        }
-
-        ForEach ($Event in $SecurityEvents) {
-            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
-        }
-
-        ForEach ($Event in $UnlockAuthEvents) {
-            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
-        }
-
-        ForEach ($Event in $TerminalServicesEvents) {
-            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-TerminalServicesUserActivity -Event $Event)
-        }
-
-        ForEach ($PowerFilter in $PowerFilters) {
-            $CurrentPowerEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $PowerFilter -MaxEvents $SearchLimit -LogDescription 'System power event log')
-            $PowerEvents += $CurrentPowerEvents
-
-            If ($CurrentPowerEvents.Count -ge $SearchLimit) {
-                $PowerFiltersMayHaveMoreEvents = $true
-            }
-        }
-
-        ForEach ($Event in $PowerEvents) {
-            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-PowerUserActivity -Event $Event)
-        }
-
-        $OutputEvents = @(Get-UniqueUserLogonActivity -ActivityEvents $ActivityEvents | Sort-Object -Property TimeCreated -Descending | Select-Object -First $ActivityLimit)
-
-        If ($OutputEvents.Count -ge $ActivityLimit -or (($WinlogonEvents.Count -lt $SearchLimit) -and ($SecurityEvents.Count -lt $SearchLimit) -and ($UnlockAuthEvents.Count -lt $SearchLimit) -and ($TerminalServicesEvents.Count -lt $SearchLimit) -and -not $PowerFiltersMayHaveMoreEvents) -or $SearchLimit -ge $MaxSearchLimit) {
-            Break
-        }
-
-        $SearchLimit = [Math]::Min(($SearchLimit * 2), $MaxSearchLimit)
-    } While ($true)
-
-    Write-UserLogonActivityOutput -ActivityEvents $OutputEvents
-    Write-PossibleUseWindowOutput -ActivityEvents $OutputEvents
 }
+
+If ($EndDateTime -le $StartDateTime) {
+    Write-Error "-End must be later than -Start."
+    Exit 1
+}
+
+$WinlogonFilter.StartTime = $StartDateTime.LocalDateTime
+$WinlogonFilter.EndTime = $EndDateTime.LocalDateTime
+$SecurityFilter.StartTime = $StartDateTime.LocalDateTime
+$SecurityFilter.EndTime = $EndDateTime.LocalDateTime
+$UnlockAuthFilter.StartTime = $StartDateTime.LocalDateTime
+$UnlockAuthFilter.EndTime = $EndDateTime.LocalDateTime
+$TerminalServicesFilter.StartTime = $StartDateTime.LocalDateTime
+$TerminalServicesFilter.EndTime = $EndDateTime.LocalDateTime
+ForEach ($PowerFilter in $PowerFilters) {
+    $PowerFilter.StartTime = $StartDateTime.LocalDateTime
+    $PowerFilter.EndTime = $EndDateTime.LocalDateTime
+}
+
+$ActivityEvents = New-Object System.Collections.Generic.List[object]
+
+ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $WinlogonFilter -LogDescription 'System Winlogon event log')) {
+    Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-WinlogonUserActivity -Event $Event)
+}
+
+ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $SecurityFilter -LogDescription 'Security event log')) {
+    Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
+}
+
+ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $UnlockAuthFilter -LogDescription 'Security unlock-authentication event log')) {
+    Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
+}
+
+ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $TerminalServicesFilter -LogDescription 'Terminal Services Local Session Manager event log')) {
+    Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-TerminalServicesUserActivity -Event $Event)
+}
+
+ForEach ($PowerFilter in $PowerFilters) {
+    ForEach ($Event in (Get-UserLogonActivityWinEvent -FilterHashtable $PowerFilter -LogDescription 'System power event log')) {
+        Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-PowerUserActivity -Event $Event)
+    }
+}
+
+$OutputEvents = @(Get-UniqueUserLogonActivity -ActivityEvents $ActivityEvents | Sort-Object -Property TimeCreated)
+Write-UserLogonActivityOutput -ActivityEvents $OutputEvents
+Write-PossibleUseWindowOutput -ActivityEvents $OutputEvents