Code: Select all
@echo off
setlocal enabledelayedexpansion
for /f "tokens=3 delims=: " %%a in ('wevtutil qe Security /q:"*[System[(EventID=4624)]] and *[EventData[Data[@Name='LogonType'] and (Data=2 or Data=11)]]" /c:1 /rd:true /f:text ^|findstr "Type:"') do for /f "tokens=*" %%b in ("%%a") do set logonType=%%b
if %logonType% EQU 11 set logonTypeInfo=Cached Interactive (Locally stored network credentials)
if %logonType% EQU 2 set logonTypeInfo=Interactive (A user logged on to this computer)
for /f "tokens=* delims=: " %%c in ('wevtutil qe Security /q:"*[System[(EventID=4624)]] and *[EventData[Data[@Name='LogonType'] and (Data=2 or Data=11)]]" /c:1 /rd:true /f:text ^|findstr "Date:"') do for /f "tokens=*" %%d in ("%%c") do set logonDate=%%d
if defined logonDate set logonDate=!logonDate:~6,-9!
set logonInfo=%logonDate:~5,2%/%logonDate:~8,2%/%logonDate:~0,4% at %logonDate:~11,8%
set exportPath="%userprofile%\info_%username%.txt"
(
echo Logon Info:
echo Last Logon: %logonInfo% [%logonTypeInfo%]
)> %exportPath%
I know I can do this, but I'd like the code to look cleaner:
Code: Select all
echo Logon Info: >%exportPath
echo Last Logon: %logonInfo% [%logonTypeInfo%] >> %exportPath