Detect logging off and logging in powershell
You can get this infromation from the event log:
Get-EventLog System -Source Microsoft-Windows-WinlogonLogons have an InstanceId of 7001, logoffs have 7002. The user account is a SID in ReplacementStrings.
Here is some more useful code for you.
$UserProperty = @{n="User";e={(New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])}}$TypeProperty = @{n="Action";e={if($_.EventID -eq 7001) {"Logon"} else {"Logoff"}}}$TimeProeprty = @{n="Time";e={$_.TimeGenerated}}Get-EventLog System -Source Microsoft-Windows-Winlogon | select $UserProperty,$TypeProperty,$TimeProeprtyYou can also get these events from a remote computer by adding the "-ComputerName" parameter to Get-EventLog.
Such things are already be in the windows System log, with type "Winlogon". Don't know how you'd extract the information from there via powershell, but at least the logging part is already there for you.