Windows 10: How to Fetch login and logoff event's from Powershell and Event viewer's accurately without...

I have tried to fetch the Windows user login session, when did he logged in and logged out I mean device lock and unlock i want to calculate the user activity session's time for the user in a Windows device,when I tried to fetch the session using PowerShell script with the event's id 4624 for logon event and 4634 for the logoff event but I got duplicate and even a case/situation like suppose I lock the screen at 10:40 am and unlock the screen at 10:45 am then, when I checked the events I got login event correctly but at the same time I got logoff event as well.Please find the Powershell sc

:)

 

Login/Logoff events with the same timestamp

Hello

When checking on a laptop, I can see multiple login/logoff events with the same timestamp (same hour, same minute, same second but a difference of milliseconds).

What I was able to saw is that the TargetLogonID is the same, and when checking the PID of the process responsible for the logon/logoff, it leads me to the process lsass (responsible for the authentication process).

When I try to WIN+L /Lock my screen, this is at the moment I unlock that I am getting the Logon+Logoff events at the same time.
So in terms of process responsible etc... no anomalies

Could you please help me understand what coold be the root cause of those login+logoff events at the same seconds?

My device is Win10

Thanks

 

Event viewer

I suggest you re-install the video driver. I'll add a few words of explanation about Event viewer in a moment. They won't affect the need to reinstall that driver as your first step. Denis

 

Error in event viewer

Hi

I keep geting the following in the Event viewer ,
The description for Event ID (4) in source ( SuperProServer ) cannot be found . the local computer may not have the necessary registry information or message DLL files to display message from a remote computer . You may be able to use /AUXSOURCE= flag to retrieve this description . The following information is part of the event, The event log file is corrupt .

has anyone any ideas has to what this means .

cheers