Teams Unlock/Lock

TeamsLocks.ps1

#Requires -Version 5.0

<#
.SYNOPSIS 
    Teams Unlock/Lock Events - Gets unlock and lock events from Microsoft Teams logs file. 
    Can be used to trace interactive logins.
.PARAMETER TargetUser
    User to get logs for
.NOTES
    Author: Zane Gittins
    Last Updated: 3/11/2020
#>

param (
    [Parameter(Mandatory=$true, Position=0)][string]$TargetUser,
    [Parameter(Mandatory=$false, Position=1)][string]$CSVPath = "Output.csv"
)

class Record {
    [string]$Timestamp = ""
    [string]$Message   = ""

}

function Get-TeamsData {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true, Position=0)][string]$LogPath
    )

    $TeamsLogContent = Get-Content $LogPath
    $Records = @()

    for ($i = 0; $i -le $TeamsLogContent.Length; $i++ ) {

        $NewRecord            = [Record]::new()
        $RecordArray          = $TeamsLogContent[$i] -split "--"
        $NewRecord.Timestamp  = $RecordArray[0]
        $NewRecord.Message    = $RecordArray[2]

        if($NewRecord.Message -like "*locked*") {
            $Records += $NewRecord
        }

        [int]$Complete = ($i/$TeamsLogContent.Length) * 100
        Write-Progress -Activity "Parsing Logs" -Status "$Complete% Complete:" -PercentComplete $Complete
    }

    return $Records

}

$Path = "C:\Users\" + $TargetUser + "\AppData\Roaming\Microsoft\Teams\logs.txt"
$Records = Get-TeamsData -LogPath $Path
$Records | Export-Csv -Path $CSVPath -NoTypeInformation