$explorerprocesses = @(Get-WmiObject -Query "Select * FROM Win32_Process WHERE Name='explorer.exe'" -ErrorAction SilentlyContinue) if ($explorerprocesses.Count -eq 0) { "No explorer process found / Nobody interactively logged on" } else { foreach ($i in $explorerprocesses) { $Username = $i.GetOwner().User $Domain = $i.GetOwner().Domain $pscomputername = (gwmi win32_networkadapterconfiguration -Filter 'index=10').pscomputername if($pscomputername -eq $i.PSComputerName) { $ipaddress = gwmi win32_networkadapterconfiguration -Filter 'index=10' | select -Property ipaddress } $Domain + "\" + $Username +" "+"ip&mac:"+$ipaddress.ipaddress+ " logged on $($i.PSComputerName) since: " + ($i.ConvertToDateTime($i.CreationDate)) } }