behavioral changes

Get-UserLogonActivity.ps1

@@ -11,14 +11,36 @@ $End = '2026-07-06T00:00:00Z'
 
 .EXAMPLE
 .\Get-UserLogonActivity.ps1
+
+Returns activity from the last 7 days.
+
+.EXAMPLE
+$Start = '2026-07-03T00:00:00Z'
+.\Get-UserLogonActivity.ps1
+
+Returns activity from the specified start date through now.
 #>
 
 $StartVariable = Get-Variable -Name Start -ErrorAction SilentlyContinue
 $EndVariable = Get-Variable -Name End -ErrorAction SilentlyContinue
-$UseDateRange = ($null -ne $StartVariable -and $null -ne $EndVariable)
 
-If (($null -ne $StartVariable) -xor ($null -ne $EndVariable)) {
-    Write-Error '$Start and $End must either both be defined or both be omitted. If omitted, the script returns the latest 15 activity events.'
+Function Test-ActivityDateRangeValue {
+    Param(
+        [AllowNull()]
+        [object]$Value
+    )
+
+    If ($null -eq $Value) { Return $false }
+    If ($Value -is [string]) { Return -not [string]::IsNullOrWhiteSpace($Value) }
+
+    Return $true
+}
+
+$StartHasValue = ($null -ne $StartVariable -and (Test-ActivityDateRangeValue -Value $StartVariable.Value))
+$EndHasValue = ($null -ne $EndVariable -and (Test-ActivityDateRangeValue -Value $EndVariable.Value))
+
+If ($EndHasValue -and -not $StartHasValue) {
+    Write-Error '$Start must be defined when $End is defined. If only $Start is defined, the script uses now for $End. If neither is defined, the script returns activity from the last 7 days.'
     Exit 1
 }
 
@@ -729,11 +751,23 @@ $PowerFilters = @(
     }
 )
 
-If ($UseDateRange) {
 Try {
+    If ($StartHasValue) {
         $StartDateTime = ConvertTo-ActivityDateTime -Value $Start -ParameterName 'Start'
+    }
+
+    If ($EndHasValue) {
         $EndDateTime = ConvertTo-ActivityDateTime -Value $End -ParameterName 'End'
     }
+
+    If (-not $EndHasValue) {
+        $EndDateTime = [DateTimeOffset]::Now
+    }
+
+    If (-not $StartHasValue) {
+        $StartDateTime = $EndDateTime.AddDays(-7)
+    }
+}
 Catch {
     Write-Error $_.Exception.Message
     Exit 1
@@ -784,60 +818,3 @@ If ($UseDateRange) {
 $OutputEvents = @(Get-UniqueUserLogonActivity -ActivityEvents $ActivityEvents | Sort-Object -Property TimeCreated)
 Write-UserLogonActivityOutput -ActivityEvents $OutputEvents
 Write-PossibleUseWindowOutput -ActivityEvents $OutputEvents
-}
-Else {
-    $ActivityLimit = 15
-    $SearchLimit = 200
-    $MaxSearchLimit = 10000
-    $OutputEvents = @()
-
-    Do {
-        $ActivityEvents = New-Object System.Collections.Generic.List[object]
-        $WinlogonEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $WinlogonFilter -MaxEvents $SearchLimit -LogDescription 'System Winlogon event log')
-        $SecurityEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $SecurityFilter -MaxEvents $SearchLimit -LogDescription 'Security event log')
-        $UnlockAuthEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $UnlockAuthFilter -MaxEvents $SearchLimit -LogDescription 'Security unlock-authentication event log')
-        $TerminalServicesEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $TerminalServicesFilter -MaxEvents $SearchLimit -LogDescription 'Terminal Services Local Session Manager event log')
-        $PowerEvents = @()
-        $PowerFiltersMayHaveMoreEvents = $false
-
-        ForEach ($Event in $WinlogonEvents) {
-            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-WinlogonUserActivity -Event $Event)
-        }
-
-        ForEach ($Event in $SecurityEvents) {
-            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
-        }
-
-        ForEach ($Event in $UnlockAuthEvents) {
-            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-SecurityUserActivity -Event $Event)
-        }
-
-        ForEach ($Event in $TerminalServicesEvents) {
-            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-TerminalServicesUserActivity -Event $Event)
-        }
-
-        ForEach ($PowerFilter in $PowerFilters) {
-            $CurrentPowerEvents = @(Get-UserLogonActivityWinEvent -FilterHashtable $PowerFilter -MaxEvents $SearchLimit -LogDescription 'System power event log')
-            $PowerEvents += $CurrentPowerEvents
-
-            If ($CurrentPowerEvents.Count -ge $SearchLimit) {
-                $PowerFiltersMayHaveMoreEvents = $true
-            }
-        }
-
-        ForEach ($Event in $PowerEvents) {
-            Add-UserLogonActivityRecord -ActivityEvents $ActivityEvents -ActivityEvent (ConvertTo-PowerUserActivity -Event $Event)
-        }
-
-        $OutputEvents = @(Get-UniqueUserLogonActivity -ActivityEvents $ActivityEvents | Sort-Object -Property TimeCreated -Descending | Select-Object -First $ActivityLimit)
-
-        If ($OutputEvents.Count -ge $ActivityLimit -or (($WinlogonEvents.Count -lt $SearchLimit) -and ($SecurityEvents.Count -lt $SearchLimit) -and ($UnlockAuthEvents.Count -lt $SearchLimit) -and ($TerminalServicesEvents.Count -lt $SearchLimit) -and -not $PowerFiltersMayHaveMoreEvents) -or $SearchLimit -ge $MaxSearchLimit) {
-            Break
-        }
-
-        $SearchLimit = [Math]::Min(($SearchLimit * 2), $MaxSearchLimit)
-    } While ($true)
-
-    Write-UserLogonActivityOutput -ActivityEvents $OutputEvents
-    Write-PossibleUseWindowOutput -ActivityEvents $OutputEvents
-}