Help Needed with ‘Analyze Logon Duration’ Script: Auto-Action Issue and Incomplete Output

A user experienced an issue with the "Analyze logon duration" script run as a triggered task, only seeing an error attachment instead of the full output they needed. Ton suggested removing the -ErrorAction SilentlyContinue part to see if this helps, and @member suggested it may be a permission issue. The automated script creates the same output, with priority given to stderr streams over stdout. Users should check the audit log and ensure the logging of events is enabled.

Read the entire ‘Troubleshooting "Analyze logon duration" Script Run As Triggered Task’ thread below:

Hi All, Hope you’re having a nice Friday!

I was wondering if anyone can help me with this issue I found with the "Analyze logon duration" script that I’m running as a triggered task.

When I run it manually against a session I do get the information I need in Output. And it does give me an Error, but I’m not too bothered about that as I still get my desired output.

However when my trigger runs and it auto actions the script I get only the error as attachment and not the whole output with the information I needed.

Anything I can do here or need to tweak?

Thank you in advance!

any thoughts @member @member?

~Not sure, but could it be you are running the script more than 60 minutes after the user has logged on?~

Edit: Nope, looking into the code further I don’t think that is it. What you can try is changing this line:

[array]$securityEvents = @( Get-WinEvent -FilterHashtable $securityFilter -ErrorAction SilentlyContinue)

Remove the -ErrorAction SilentlyContinue part. Then if there is an error actually reading the log that should show up.

Hi Ton,

Many thanks for your reply!

I’ve adjusted the script, the output shows the correct output but I’m still seeing an error when running the script manually.

I’ll keep an eye on my automated script action to see if that works better now.

As far as I’m aware:

The automated script generates the same output. Which you should be able to see in the audit log.

However, the email output attachment will prioritize errors. More specifically, stderr streams are prioritized over stdout.

I’d suggest that if you are modifying the script, modify the scripts to prevent error throws and write-errorThe error suggests that there were indeed no security events found. If you do not get any when running the script manually either, it would suggest either a permissions issue or that logging of these events is disabled somehow.

@member yer the expert, somewhere in the back of my mind there is a little voice saying this may have to be enabled first?

Sounds like a permission error to me if it works on the same/machine user if run manually

Continue reading and comment on the thread ‘Help Needed with ‘Analyze Logon Duration’ Script: Auto-Action Issue and Incomplete Output’.  Not a member? Join Here!