我是 PowerShell 新手，您能帮助我获取 azure VM 的登录和注销用户信息吗？问题是当我在事件日志中检查时，帐户名称显示为空，我可以看到帐户名称。试过...

我是 PowerShell 新手，您能帮我获取 Azure VM 的登录和注销用户信息吗？问题是，当我在事件日志中检查时，帐户名称显示为空，我可以看到帐户名称。尝试使用 UserId 检查，但没有成功。使用以下内容作为 参考 。需要获取帐户名称（登录到 VM 的人）以及登录和注销时间

目前在虚拟机上运行此脚本，但最终要求是使用笔记本电脑上的 PowerShell 收集虚拟机的信息

# Define the time range for the query
$startTime = (Get-Date).AddDays(-1)  # Last 7 days
$endTime = Get-Date

# Get logon events (Event ID 4624)
$logonEvents = Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id = 4624
    StartTime = $startTime
    EndTime = $endTime
}

# Get logoff events (Event ID 4634)
$logoffEvents = Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id = 4634
    StartTime = $startTime
    EndTime = $endTime
}

# Create a custom object to store the results
$results = @()

# Process logon events
foreach ($logonEvent in $logonEvents) {
    $accountName = ($logonEvent.Properties | Where-Object {$_.Id -eq 5}).Value
    $logonTime = $logonEvent.TimeCreated

    # Find the corresponding logoff event
    $logoffEvent = $logoffEvents | Where-Object {
        ($_.Properties | Where-Object {$_.Id -eq 5}).Value -eq $accountName -and
        $_.TimeCreated -gt $logonTime
    } | Select-Object -First 1

    $logoffTime = $logoffEvent.TimeCreated

    # Add the result to the array
    $results += [PSCustomObject]@{
        AccountName = $accountName
        UserLogonTime = $logonTime
        UserLogoffTime = $logoffTime
    }
}

# Display the results as a table
$results | Format-Table -AutoSize