Get-CimInstance Win32_LogonSession | ForEach-Object { $luid = [uint64]$_.LogonId $high = $luid -shr 32 $low = $luid -band 0xFFFFFFFF $luidHex = ('{0:X8}.{1:X8}' -f $high, $low) $type = switch ([int]$_.LogonType) { 0 {"System"} 2 {"Interactive"} 3 {"Network"} 4 {"Batch"} 5 {"Service"} 7 {"Unlock"} 8 {"NetworkCleartext"} 9 {"NewCredentials"} 10 {"RemoteInteractive"} 11 {"CachedInteractive"} 12 {"CachedRemoteInteractive"} 13 {"CachedUnlock"} default {"Unknown"} } $users = Get-CimAssociatedInstance -InputObject $_ -Association Win32_LoggedOnUser foreach ($user in $users) { [PSCustomObject]@{ LogonId = $luidHex LogonType = $type User = "$($user.Domain)\$($user.Name)" StartTime = $_.StartTime } } } | Sort-Object LogonId