尝试计算PowerShell中开始和停止事件之间经过的时间

Question

我正在尝试在以下输出中获取每个启动和停止操作之间的时间差：

User    Computer   Time                Event      Action
----    --------   ----                -----      ------
TEST\me TEST-DC-01 27/05/2020 14:45:06 Logoff     Stop
TEST\me TEST-DC-01 27/05/2020 14:44:56 Unlock     Start
TEST\me TEST-DC-01 27/05/2020 14:44:49 Lock       Stop
TEST\me TEST-DC-01 27/05/2020 14:44:40 Reconnect  Start
TEST\me TEST-DC-01 27/05/2020 14:43:17 Disconnect Stop
TEST\me TEST-DC-01 27/05/2020 14:43:07 Logon      Start

我一直在使用 New-Timespan cmdlet，但在尝试将其与上述输出所源自的脚本（如下）集成时似乎在绕圈子。

理想情况下，我希望看到以下附加内容：

Total active time: 00:00:29

任何人都可以就最佳方法提出建议（通过与现有脚本完全集成或导入 CSV 格式的输出）。

非常感谢任何指导。

#
# GROUP POLICY (TO ENABLE 480x AND 477x EVENTS):
# 
#   COMPUTER CONFIGURATION
#   -  WINDOWS SETTINGS
#      -  SECURITY SETTINGS
#         -  ADVANCED AUDIT POLICY CONFIGURATION
#            -  SYSTEM AUDIT POLICIES - LOCAL GROUP POLICY OBJECT
#               -  LOGON/LOGOFF
#                  -  AUDIT OTHER LOGON/LOGOFF EVENTS
#                     -  SUCCESS
#
$OU = "OU=Domain Controllers,DC=test,DC=local"
   # WHERE TO SEARCH FOR COMPUTERS IN ACTIVE DIRECTORY
$days = "-1"
   # HOW MANY DAYS TO SEARCH BACK THROUGH
$directory = "C:\"
   # LOCATION OF FAILED CONNECTIONS FILE
$computers = Get-ADComputer -Filter * -SearchBase $OU
$logs = @()
$timestamp = ((Get-Date).ToString("yyyyMMdd_HHmmss"))
$output = ForEach ($computer in $computers){
   try{
      $logs += get-eventlog `
         -LogName system `
         -ComputerName $computer.Name `
         -After (Get-Date).AddDays($days) 
      $logs += get-eventlog `
         -LogName security `
         -ComputerName $computer.Name `
         -After (Get-Date).AddDays($days)
      $res = @()
      ForEach ($log in $logs){
         if($log.instanceid -eq 7001){
            $type = "Logon"
            $user = 
               try{
                  (New-Object System.Security.Principal.SecurityIdentifier(
                     $log.ReplacementStrings[1])).Translate(
                     [System.Security.Principal.NTAccount]).value
               }
               catch{
                  $log.ReplacementStrings[1]
               }
            $action = "Start"
         }
         Elseif ($log.instanceid -eq 7002){
            $type = "Logoff"
            $user = 
               try{
                  (New-Object System.Security.Principal.SecurityIdentifier(
                     $log.ReplacementStrings[1])).Translate(
                     [System.Security.Principal.NTAccount]).value
               }
               catch{
                  $log.ReplacementStrings[1]
               }
            $action = "Stop"
         }
         Elseif ($log.instanceid -eq 4800){
            $type = "Lock"
            $user = $log.ReplacementStrings[2] + "\" + 
               $log.ReplacementStrings[1]
            $action = "Stop"
         }
         Elseif ($log.instanceid -eq 4801){
            $type = "Unlock"
            $user = $log.ReplacementStrings[2] + "\" + 
               $log.ReplacementStrings[1]
            $action = "Start"
         }
         Elseif ($log.instanceid -eq 4778){
            $type = "Reconnect"
            $user = $log.ReplacementStrings[1] + "\" + 
               $log.ReplacementStrings[0]
            $action = "Start"
         }
         Elseif ($log.instanceid -eq 4779){
            $type = "Disconnect"
            $user = $log.ReplacementStrings[1] + "\" + 
               $log.ReplacementStrings[0]
            $action = "Stop"
         }
         Else {
            Continue
         }
         $hash = [ordered]@{
            "User" = $user
            "Computer" = $computer.Name
            "Time" = $log.TimeWritten
            "Event" = $type
            "Action" = $action
         }
         $res += New-Object PSObject -Property $hash
      }
      $res
   }
   Catch {
      Add-Content -Path "${directory}${timestamp}_failed.txt" $computer.Name
   }
}
$TimeDescending = @{
   Expression = 'Time'
   Descending = $true
}
$EventDescending = @{
   Expression = 'Event'
   Descending = $true
}
$output |
   sort User,Computer,$TimeDescending,$EventDescending |
   ? User -like "*me" |
   ft

Answer 1

您可以使用New-TimeSpan cmdlet：

$start = Get-Date

# Do some stuff here

$end = Get-Date

$timeTaken = (New-TimeSpan -Start $start -End $end).TotalSeconds