logon time windows

$UserProperty = @{n="User";e={(New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])}}
$TypeProperty = @{n="Action";e={if($_.EventID -eq 1000) {"Logon"} else {"Logoff"}}}
$TimeProperty = @{n="Time";e={$_.TimeGenerated}}
$MachineNameProperty = @{n="MachinenName";e={$_.MachineName}}
$logontime = Get-EventLog System -Source TdIca | select $UserProperty,$TypeProperty,$TimeProperty,$MachineNameProperty
if ($logontime.Length -ne $null) { $logontime = $logontime[0] }
# explorer might not give the right results back, sometimes something else
# that you start off from boot might give better results, like lync etc
$explorer = Get-Process | where { $_.name -eq "explorer"} | select name, starttime
write-host $logontime.Time
write-host $explorer.StartTime
(NEW-TIMESPAN –Start $logontime.Time –End $explorer.StartTime).TotalSeconds