#Win Event Filters/Properties
$LogFilter = @{LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
            ID = 21, 23, 24, 25
            }

$ActionProperty = @{Name='Action';Expression={
                if ($_.ID -eq '21'){"logon"}
                if ($_.ID -eq '22'){"Shell start"}
                if ($_.ID -eq '23'){"logoff"}
                if ($_.ID -eq '24'){"disconnected"}
                if ($_.ID -eq '25'){"reconnection"}
                }}


#Get Records
$LoginRecords = Get-WinEvent -FilterHashtable $LogFilter | Where-Object{($_.TimeCreated -ge (Get-Date).AddMinutes(-600))} | Select-Object $ActionProperty,$UserProperty,MachineName,$TimeProperty | Sort-Object -Property TimeCreated -Descending -Unique