Forum Discussion
Dillon Brown
Nov 21, 2017Former Employee
Query for computer start events
Hi everyone,
I'm trying to assist a customer with a query in Log Analytics to see whenever computers were turned on, by computer and by day.
I think I am on the right track in the Security Event ...
- Nov 21, 2017Hi Here we go search in (SecurityEvent) EventID == 4624 | summarize WindowsStartCount = count() by Computer, bin(TimeGenerated, 1d)
Dillon Brown
Nov 21, 2017Former Employee
Ok, got it. Thank you so much for your time! I have run across your blog posts researching other cases as well, very much appreciate your contributions!
Nov 21, 2017
Thanks!