I'm trying to get hex output. This code:
get-wmiobject -class "Win32_LoggedOnUser" -namespace "root\CIMV2" -Property * | `
Select @{Name="Antecedent";Expression={$_.Antecedent.Split('=').replace("`"","")[2]}}, `
@{Name="Dependent";Expression={$_.Dependent.Split("`"")[1]}}
Will generate two columns, login name and logonID as follows:
Antecedent Dependent
---------- ----------
SYSTEM 999
LOCAL SERVICE 997
NETWORK SERVICE 996
<user> 347528
<user> 6842494
<user> 46198354
<user> 46171169
DWM-2 223575
DWM-2 223551
Event Viewer uses the hex representation of the logonID, for example 'SYSTEM 'would be represented by 0x3e7 vs 999, or in PowerShell
ps> '{0:x}' -f 999
I'm trying to match up with that.
I'm trying to do something along these lines:
get-wmiobject -class "Win32_LoggedOnUser" -namespace "root\CIMV2" -Property * | `
Select @{Name="Antecedent";Expression={$_.Antecedent.Split('=').replace("`"","")[2]}}, `
@{Name="Dependent";Expression={'{0:x}' -f $_.Dependent.Split("`"")[1]}}
But no luck so far.