Monitor Log on Off

#Set the Audit log on the Other Logon/Logoff Events which records lock/unlock events.
Auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable

#List the last thirty days
$Last30Days = (Get-date).AddDays(-30)

#Get Time of event
$TimeProperty = @{n = "Time"; e = { $_.timecreated } }

#Get name of event (Lock, Unlock)
$SecurityTypeProperty = @{n = "Action"; e = { if ($_.ID -eq 4800) { "Lock" } elseif ($_.ID -eq 4801) { "Unlock" } } }

#Get the user logon name from the securtiy event.
$User = @{n = 'User'; e = { $_.Properties[0].Value.Translate([System.Security.Principal.NTAccount]) } }

# Filter system events for (Logon, Logoff)
$TypeProperty = @{n = "Action"; e = { if ($_.ID -eq 7001) { "Logon" } else { "Logoff" } } }

#Get user logon name for the system logon/logoff event
$UserProperty = @{n = "User"; e = { (New-Object System.Security.Principal.SecurityIdentifier $_.Properties.Value[1]).Translate([System.Security.Principal.NTAccount]) } }

#Get System logon events for the last thirty days
Get-WinEvent -FilterHash @{LogName = 'system'; providername = 'Microsoft-Windows-Winlogon'; Starttime = $Last30Days } | Select-Object $UserProperty, $TimeProperty, $TypeProperty| Out-File -FilePath "C:\Users\Public\Documents\events.log"

#Collect security lock events for the last thirty days.
Get-winevent -FilterHashtable @{Logname = 'security'; providername = 'Microsoft-Windows-Security-Auditing'; id = 4800, 4801; Starttime = $Last30Days } | Select-object $User, $TimeProperty, $SecurityTypeProperty | Out-File -FilePath "C:\Users\Public\Documents\events.log" -Append