Windows sysinternals

192 Part II Usage Guide
on the network, and that the search might be time-consuming on a large or bandwidthconstrained
network.
PsLoggedOn’s definition of a locally logged-on user is a user that has its profile loaded into
the registry. When the user’s profile is loaded, the user’s security identifier (SID) appears as a
subkey under HKEY_USERS. PsLoggedOn looks at the last-write time stamp under a subkey
of that SID key as an approximation of the user’s logon time. The logon time reported will be
accurate in most cases but is not authoritative. For a more complete and accurate listing of
logon sessions on a computer, see the LogonSessions utility, described in Chapter 8, “Security
Utilities.”
PsLogList
PsLogList displays records from the Windows event logs of the local computer or of remote
computers. You can filter the output based on time stamp, source, ID, type, or other criteria.
PsLogList also lets you export log records to a *.evt file, read from a saved *.evt file, or clear
an event log.
Without parameters, PsLogList dumps all records from the System event log on the local
computer. To view records from a different event log, just name it on the command line. For
example, the following command lines dump records from the Application log and from the
Windows PowerShell log, respectively:
psloglist application
psloglist "Windows Powershell"
To view records from one or more remote computers, specify computer names on the
command line as described at the beginning of this chapter.
Every event log record includes an event source and an event ID. The event ID is used to look
up and display localizable, human-readable text from a message resource DLL associated
with the event source. That message text can contain placeholders for text that can vary per
event (such as a file name or an IP address). That per-event text is associated with the event
log record as zero or more insertion strings. Most event-viewing applications, including Event
Viewer, display only the insertion strings (not the full text) when the referenced message
resource DLLs are not present on the local system. This makes the text difficult to read. One
of the features that distinguishes PsLogList when reading a remote event log is that it will
get message text from the resource DLLs on those remote systems. However, this requires
that the remote system’s default administrative share (Admin$) be enabled and accessible,
that the resource DLLs be located under that directory, and that the Remote Registry service
is running on that system. Before using PsLogList to gather data from remote systems, be
sure that this is the case on those systems; otherwise, PsLogList will not be able to display full
event text.
www.it-ebooks.info