Why not login to Qiita and try out its useful features?

We'll deliver articles that match you.

You can read useful information later.

1
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

Windowsでログイン、ログオフの時間を自動的に抽出する

Last updated at Posted at 2025-01-13
  1. 以下のコード部分をコピー
  2. メモ帳で新規ファイルを作成して、ペースト
  3. 名前をつけて保存する(loginLogoff.bat) *.bat拡張子は必須
  4. 保存したファイルを開くと、日付ごとにログイン、ログオフ時間が表示される
  5. 黒い画面を閉じる
@echo off
setlocal enabledelayedexpansion

set "prevDate="
set "firstEvent="
set "lastEvent="

for /f "tokens=1-3 delims=: " %%a in ('wevtutil qe System /q:"*[System[(EventID=6005 or EventID=6006)]]" /rd:true /f:text /c:20 ^| findstr /C:"Date:" /C:"Event ID:"') do (
    if "%%a"=="Date" (
        for /f "tokens=1-2 delims=T" %%x in ("%%b%%c") do (
            set "currentDate=%%x"
            set "currentTime=%%y"
        )
    )else if "%%a%%b"=="EventID" (
        set "eventID=%%c"
        if not "!currentDate!"=="!prevDate!" (
            if defined firstEvent (
                echo !firstEvent!
                if defined lastEvent (
                    if not "!firstEvent!"=="!lastEvent!" echo !lastEvent!
                )
                echo.
            )
            set "firstEvent=Date: !currentDate! !currentTime! - Event ID: !eventID!"
            set "lastEvent="
        ) else (
            set "lastEvent=Date: !currentDate! !currentTime! - Event ID: !eventID!"
        )
        set "prevDate=!currentDate!"
    )
)

if defined firstEvent (
    echo !firstEvent!
    if defined lastEvent (
        if not "!firstEvent!"=="!lastEvent!" echo !lastEvent!
    )
)

pause

イベントビューアーから見つけ出すのがめんどくさいので、スクリプトで実行できるようにしました。
役に立てたなら幸いです。

1
0
2

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
1
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?