raandree

$sessions = klist sessions
$pattern = '\[(\d+)\] Session \d \d:(?<LowPart>0)x(?<HighPart>[a-f0-9]+)'

$sessions = foreach ($line in $sessions)
{
    if ($line -match $pattern)
    {
        New-Object PSObject -Property @{
            LowPart = $Matches.LowPart
            HighPart = $Matches.HighPart

raandree

$code = @'
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading.Tasks;

namespace Test

raandree

$t1 = [datetime]::Today.AddHours(4).ToString('s')
$e = $null
$FilterXML = @"
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
(*[EventData[
Data[@Name="TargetDomainName"] != "Window Manager" and
Data[@Name="TargetDomainName"] != "Font Driver Host" and
Data[@Name="TargetDomainName"] != "NT AUTHORITY"

raandree

<#
        .SYNOPSIS
        Registers a scheduled job to run the specified script on a schedule.

        .DESCRIPTION
        This script registers a scheduled job to run the specified script on a schedule. It can register the
        job to run as local system or as the user who called this script.

        .PARAMETER At
        The time at which the job should be triggered. The format is 24 hours like 21:00.