尝试计算 PowerShell 中的启动和停止事件之间经过的时间

Question

我正在尝试在以下输出中获取每个启动和停止操作之间的时间差：

User    Computer   Time                Event      Action
----    --------   ----                -----      ------
TESTme TEST-DC-01 27/05/2020 14:45:06 Logoff     Stop
TESTme TEST-DC-01 27/05/2020 14:44:56 Unlock     Start
TESTme TEST-DC-01 27/05/2020 14:44:49 Lock       Stop
TESTme TEST-DC-01 27/05/2020 14:44:40 Reconnect  Start
TESTme TEST-DC-01 27/05/2020 14:43:17 Disconnect Stop
TESTme TEST-DC-01 27/05/2020 14:43:07 Logon      Start

我一直在使用 New-Timespan cmdlet，但在尝试将其与上述输出派生自的脚本(如下(集成时，似乎在兜圈子。

理想情况下，我希望看到以下内容附加到它：

Total active time: 00:00:29

任何人都可以就最佳方法提供建议(通过与现有脚本完全集成或以 CSV 格式导入输出(。

任何指导都非常感谢。

#
# GROUP POLICY (TO ENABLE 480x AND 477x EVENTS):
# 
#   COMPUTER CONFIGURATION
#   -  WINDOWS SETTINGS
#      -  SECURITY SETTINGS
#         -  ADVANCED AUDIT POLICY CONFIGURATION
#            -  SYSTEM AUDIT POLICIES - LOCAL GROUP POLICY OBJECT
#               -  LOGON/LOGOFF
#                  -  AUDIT OTHER LOGON/LOGOFF EVENTS
#                     -  SUCCESS
#
$OU = "OU=Domain Controllers,DC=test,DC=local"
# WHERE TO SEARCH FOR COMPUTERS IN ACTIVE DIRECTORY
$days = "-1"
# HOW MANY DAYS TO SEARCH BACK THROUGH
$directory = "C:"
# LOCATION OF FAILED CONNECTIONS FILE
$computers = Get-ADComputer -Filter * -SearchBase $OU
$logs = @()
$timestamp = ((Get-Date).ToString("yyyyMMdd_HHmmss"))
$output = ForEach ($computer in $computers){
try{
$logs += get-eventlog `
-LogName system `
-ComputerName $computer.Name `
-After (Get-Date).AddDays($days) 
$logs += get-eventlog `
-LogName security `
-ComputerName $computer.Name `
-After (Get-Date).AddDays($days)
$res = @()
ForEach ($log in $logs){
if($log.instanceid -eq 7001){
$type = "Logon"
$user = 
try{
(New-Object System.Security.Principal.SecurityIdentifier(
$log.ReplacementStrings[1])).Translate(
[System.Security.Principal.NTAccount]).value
}
catch{
$log.ReplacementStrings[1]
}
$action = "Start"
}
Elseif ($log.instanceid -eq 7002){
$type = "Logoff"
$user = 
try{
(New-Object System.Security.Principal.SecurityIdentifier(
$log.ReplacementStrings[1])).Translate(
[System.Security.Principal.NTAccount]).value
}
catch{
$log.ReplacementStrings[1]
}
$action = "Stop"
}
Elseif ($log.instanceid -eq 4800){
$type = "Lock"
$user = $log.ReplacementStrings[2] + "" + 
$log.ReplacementStrings[1]
$action = "Stop"
}
Elseif ($log.instanceid -eq 4801){
$type = "Unlock"
$user = $log.ReplacementStrings[2] + "" + 
$log.ReplacementStrings[1]
$action = "Start"
}
Elseif ($log.instanceid -eq 4778){
$type = "Reconnect"
$user = $log.ReplacementStrings[1] + "" + 
$log.ReplacementStrings[0]
$action = "Start"
}
Elseif ($log.instanceid -eq 4779){
$type = "Disconnect"
$user = $log.ReplacementStrings[1] + "" + 
$log.ReplacementStrings[0]
$action = "Stop"
}
Else {
Continue
}
$hash = [ordered]@{
"User" = $user
"Computer" = $computer.Name
"Time" = $log.TimeWritten
"Event" = $type
"Action" = $action
}
$res += New-Object PSObject -Property $hash
}
$res
}
Catch {
Add-Content -Path "${directory}${timestamp}_failed.txt" $computer.Name
}
}
$TimeDescending = @{
Expression = 'Time'
Descending = $true
}
$EventDescending = @{
Expression = 'Event'
Descending = $true
}
$output |
sort User,Computer,$TimeDescending,$EventDescending |
? User -like "*me" |
ft

Answer 1

可以使用New-TimeSpancmdlet：

$start = Get-Date
# Do some stuff here
$end = Get-Date
$timeTaken = (New-TimeSpan -Start $start -End $end).TotalSeconds