FirstLogonCommands

FirstLogonCommands specifies commands to run the first time a user logs on to the computer. These commands run only once. FirstLogonCommands are not supported in Windows 10 in S mode.

Windows 10 doesn’t support setting a custom shell prior to OOBE. If you do, you won’t be able to deploy the resulting image.

When a user with administrative privileges logs in for the first time, these commands are run with elevated access privileges.

If you create a user account that does not include administrative privileges, the following commands may not run:

• If User Account Control is enabled, then when that user logs in for the first time, a dialog box appears, prompting the user with an option to allow an administrator to apply the commands. If the user selects Cancel, these commands don’t run.
• If User Account Control is disabled, these commands don’t run.

The commands run after logon, prior to showing the desktop.

If the command launches a separate system process, the system process will run independently of the commands. This enables you to create commands that terminate quickly, allowing the user to reach the desktop faster.

Other processes, such as services, are not restricted by FirstLogonCommands and will continue to start or to terminate independently.

This command now works like Microsoft-Windows-Shell-Setup-LogonCommands-AsynchronousCommand: all commands using these unattend settings are now started at the same time, and no longer wait for the previous command to finish.

When you add a script using FirstLogonCommands, it will be triggered on the next boot, even if you boot into audit mode using Ctrl+Shift+F3. If you plan to use audit mode later, add the following setting to skip this script automatically: Microsoft-Windows-Deployment-Reseal-Mode = Audit.

Child Elements

Setting	Description
SynchronousCommand	Specifies a command to run the first time a user logs on to the computer, its description, and the order in which it is run.

Valid Configuration Passes

Parent Hierarchy

Applies To

For a list of the Windows editions and architectures that this component supports, see Microsoft-Windows-Shell-Setup.

XML Example

The following XML output shows how to specify two commands to run after first logon.

Команда Log Command Window Output Log Command window output command

Копирует все входные и выходные данные из окна Команда в файл. Copies all input and output from the Command window into a file.

Синтаксис Syntax

Аргументы Arguments

filename
Необязательный элемент. Optional. Имя файла журнала. The name of the log file. По умолчанию этот файл создается в папке профиля пользователя. By default, the file is created in the user’s profile folder. Если такое имя файла уже существует, журнал добавляется в конец имеющегося файла. If the file name already exists, the log is appended to the end of the existing file. Если файл не указан, используется последний указанный файл. If no file is specified, the last file specified is used. Если предыдущий файл отсутствует, создается файл журнала по умолчанию с именем cmdline.log. If no previous file exists, a default log file is created, called cmdline.log.

Чтобы изменить расположение для сохранения файла журнала, введите полный путь. Если этот путь содержит пробелы, заключите его в кавычки. To change the location where the log file is saved, enter the full path of the file, surrounded by quotation marks if the path contains any spaces.

Коммутаторы Switches

/on /on
Необязательный параметр. Optional. Запускает ведение журнала для окна Команда в указанном файле, добавляя в него новые данные. Starts the log for the Command window in the specified file and appends the file with the new information.

/off /off
Необязательный параметр. Optional. Останавливает ведение журнала для окна Команда. Stops the log for the Command window.

/overwrite /overwrite
Необязательный параметр. Optional. Если указанный в аргументе filename файл совпадает с существующим файлом, он перезаписывается. If the file specified in the filename argument matches an existing file, the file is overwritten.

Комментарии Remarks

Если файл не указан, создается файл по умолчанию cmdline.log. If no file is specified, the file cmdline.log is created by default. По умолчанию эта команда имеет псевдоним Log. By default, the alias for this command is Log.

Примеры Examples

Этот пример создает файл журнала cmdlog и запускает ведение журнала команд. This example creates a new log file, cmdlog, and starts the command log.

Этот пример останавливает ведение журнала команд. This example stops logging commands.

Этот пример возобновляет ведение журнала команд в ранее использовавшемся файле. This example resumes the logging of commands in the previously used log file.

Windows Setup Log Files and Event Logs

Windows® Setup creates log files for all actions that occur during installation. If you are experiencing problems installing Windows, consult the log files to troubleshoot the installation.

WindowsВ Setup log files are available in the following directories:

Log location before Setup can access the drive.

Log location when Setup rolls back in the event of a fatal error.

Log location of Setup actions after disk configuration.

Used to log Plug and Play device installations.

Location of memory dump from bug checks.

Location of log minidumps from bug checks.

Location of Sysprep logs.

WindowsВ Setup Event Logs

WindowsВ Setup includes the ability to review the WindowsВ Setup performance events in the Windows Event Log viewer. This enables you to more easily review the actions that occurred during WindowsВ Setup and to review the performance statistics for different parts of WindowsВ Setup. You can filter the log so as to view only relevant items that you are interested in. The WindowsВ Setup performance events are saved into a log file that is named Setup.etl, which is available in the %WINDIR%\Panther directory of all installations. To view the logs, you must use the Event Viewer included with the Windows media that corresponds to the version of the customized image that you are building.

To view the logs on a computer that does not include the corresponding kit, you must run a script from the root of the media that installs the Event Trace for Windows (ETW) provider. From the command line, type:

where D is the drive letter of the Windows DVD media.

To view the WindowsВ Setup event logs

Start the Event Viewer, expand the Windows Logs node, and then click System.

In the Actions pane, click Open Saved Log and then locate the Setup.etl file. By default, this file is available in the %WINDIR%\Panther directory.

The log file contents appear in the Event Viewer.

To Export the log to a file

From the command line, use the Wevtutil or Tracerpt commands to save the log to an .xml or text file. For information about how to use these tools, see the command-line Help. The following commands show examples of how to use the tools:

Windows : logoff from command line

We can logoff a user session by clicking on the Logoff button in the start menu. We can logoff from command prompt(CMD) too using shutdown command. You need to run the below command.

Shutdown is a Windows in-built command. We don’t have to install it separately. Note that we can run this command from windows Run window also. This command works on all windows editions. (XP, Vista, Server 2k3/2k8, Windows 7)

There’s another command Logoff which also serves the same purpose. This command can be used to logoff sessions on the remote computers also. Find syntax below for this.

To logoff on the current system

This does not accept user name and passwords so it uses the credentials of the current logged in user on the host system.

How to force logoff without waiting for user confirmation to terminate the running applications?

The above commands do forced logoffs.В They kill all the applications one by one and at the end logs off the user.

If I want to login from command line, how do I set it up?

Open Task manager, click on Users, Right Click, manage user account, it will open control panel. It the path above, open cmd from here. shutdown -l to log out.
Login again. It works.

need to logoff but cannot

i need to log out from anther user with the user name
sameing like that…
logoff username:moss /server:172.19.19.50

Get-Event Log

Gets the events in an event log, or a list of the event logs, on the local computer or remote computers.

Syntax

Description

The Get-EventLog cmdlet gets events and event logs from local and remote computers. By default, Get-EventLog gets logs from the local computer. To get logs from remote computers, use the ComputerName parameter.

You can use the Get-EventLog parameters and property values to search for events. The cmdlet gets events that match the specified property values.

PowerShell cmdlets that contain the EventLog noun work only on Windows classic event logs such as Application, System, or Security. To get logs that use the Windows Event Log technology in Windows Vista and later Windows versions, use Get-WinEvent .

Get-EventLog uses a Win32 API that is deprecated. The results may not be accurate. Use the Get-WinEvent cmdlet instead.

Examples

Example 1: Get event logs on the local computer

This example displays the list of event logs that are available on the local computer. The names in the Log column are used with the LogName parameter to specify which log is searched for events.

The Get-EventLog cmdlet uses the List parameter to display the available logs.

Example 2: Get recent entries from an event log on the local computer

This example gets recent entries from the System event log.

The Get-EventLog cmdlet uses the LogName parameter to specify the System event log. The Newest parameter returns the five most recent events.

Example 3: Find all sources for a specific number of entries in an event log

This example shows how to find all of the sources that are included in the 1000 most recent entries in the System event log.

The Get-EventLog cmdlet uses the LogName parameter to specify the System log. The Newest parameter selects the 1000 most recent events. The event objects are stored in the $Events variable. The $Events objects are sent down the pipeline to the Group-Object cmdlet. Group-Object uses the Property parameter to group the objects by source and counts the number of objects for each source. The NoElement parameter removes the group members from the output. The Sort-Object cmdlet uses the Property parameter to sort by the count of each source name. The Descending parameter sorts the list in order by count from highest to lowest.

Example 4: Get error events from a specific event log

This example gets error events from the System event log.

The Get-EventLog cmdlet uses the LogName parameter to specify the System log. The EntryType parameter filters the events to show only Error events.

Example 5: Get events from an event log with an InstanceId and Source value

This example gets events from the System log for a specific InstanceId and Source.

The Get-EventLog cmdlet uses the LogName parameter to specify the System log. The InstanceID parameter selects the events with the specified Instance ID. The Source parameter specifies the event property.

Example 6: Get events from multiple computers

This command gets the events from the System event log on three computers: Server01, Server02, and Server03.

The Get-EventLog cmdlet uses the LogName parameter to specify the System log. The ComputerName parameter uses a comma-separated string to list the computers from which you want to get the event logs.

Example 7: Get all events that include a specific word in the message

This command gets all the events in the System event log that contain a specific word in the event’s message. It’s possible that your specified Message parameter’s value is included in the message’s content but isn’t displayed on the PowerShell console.

The Get-EventLog cmdlet uses the LogName parameter to specify the System event log. The Message parameter specifies a word to search for in the message field of each event.

Example 8: Display the property values of an event

This example shows how to display all of an event’s properties and values.

The Get-EventLog cmdlet uses the LogName parameter to specify the System event log. The Newest parameter selects the most recent event object. The object is stored in the $A variable. The object in the $A variable is sent down the pipeline to the Select-Object cmdlet. Select-Object uses the Property parameter with an asterisk ( * ) to select all of the object’s properties.

Example 9: Get events from an event log using a source and event ID

This example gets events for a specified Source and Event ID.

The Get-EventLog cmdlet uses the LogName parameter to specify the Application event log. The Source parameter specifies the application name, Outlook. The objects are sent down the pipeline to the Where-Object cmdlet. For each object in the pipeline, the Where-Object cmdlet uses the variable $_.EventID to compare the Event ID property to the specified value. The objects are sent down the pipeline to the Select-Object cmdlet. Select-Object uses the Property parameter to select the properties to display in the PowerShell console.

Example 10: Get events and group by a property

The Get-EventLog cmdlet uses the LogName parameter to specify the System log. The UserName parameter includes the asterisk ( * ) wildcard to specify a portion of the user name. The event objects are sent down the pipeline to the Group-Object cmdlet. Group-Object uses the Property parameter to specify that the UserName property is used to group the objects and count the number of objects for each user name. The NoElement parameter removes the group members from the output. The objects are sent down the pipeline to the Select-Object cmdlet. Select-Object uses the Property parameter to select the properties to display in the PowerShell console.

Example 11: Get events that occurred during a specific date and time range

This example gets Error events from the System event log for a specified date and time range. The Before and After parameters set the date and time range but are excluded from the output.

The Get-Date cmdlet uses the Date parameter to specify a date and time. The DateTime objects are stored in the $Begin and $End variables. The Get-EventLog cmdlet uses the LogName parameter to specify the System log. The EntryType parameter specifies the Error event type. The date and time range is set by the After parameter and $Begin variable and the Before parameter and $End variable.

Parameters

Gets events that occurred after a specified date and time. The After parameter date and time are excluded from the output. Enter a DateTime object, such as the value returned by the Get-Date cmdlet.

Log file location	Description

Type:	DateTime
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

Indicates that this cmdlet returns a standard System.Diagnostics.EventLogEntry object for each event. Without this parameter, Get-EventLog returns an extended PSObject object with additional EventLogName, Source, and InstanceId properties.

To see the effect of this parameter, pipe the events to the Get-Member cmdlet and examine the TypeName value in the result.

Type:	SwitchParameter
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

Indicates that this cmdlet returns the output as strings, instead of objects.

Type:	SwitchParameter
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

Gets events that occurred before a specified date and time. The Before parameter date and time are excluded from the output. Enter a DateTime object, such as the value returned by the Get-Date cmdlet.

Type:	DateTime
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

This parameter specifies a remote computer’s NetBIOS name, Internet Protocol (IP) address, or a fully qualified domain name (FQDN).

If the ComputerName parameter isn’t specified, Get-EventLog defaults to the local computer. The parameter also accepts a dot ( . ) to specify the local computer.

The ComputerName parameter doesn’t rely on Windows PowerShell remoting. You can use Get-EventLog with the ComputerName parameter even if your computer is not configured to run remote commands.

Type:	String [ ]
Aliases:	Cn
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

Specifies, as a string array, the entry type of the events that this cmdlet gets.

The acceptable values for this parameter are:

• Error
• Information
• FailureAudit
• SuccessAudit
• Warning

Type:	String [ ]
Aliases:	ET
Accepted values:	Error, Information, FailureAudit, SuccessAudit, Warning
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

Specifies the index values to get from the event log. The parameter accepts a comma-separated string of values.

Type:	Int32 [ ]
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

Specifies the Instance IDs to get from the event log. The parameter accepts a comma-separated string of values.

Type:	Int64 [ ]
Position:	1
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

Displays the list of event logs on the computer.

Type:	SwitchParameter
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

Specifies the name of one event log. To find the log names use Get-EventLog -List . Wildcard characters are permitted. This parameter is required.

Type:	String
Aliases:	LN
Position:	0
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	True

Specifies a string in the event message. You can use this parameter to search for messages that contain certain words or phrases. Wildcards are permitted.

Type:	String
Aliases:	MSG
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	True

Begins with the newest events and gets the specified number of events. The number of events is required, for example -Newest 100 . Specifies the maximum number of events that are returned.

Type:	Int32
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False

Specifies, as a string array, sources that were written to the log that this cmdlet gets. Wildcards are permitted.

Type:	String [ ]
Aliases:	ABO
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	True

Specifies, as a string array, user names that are associated with events. Enter names or name patterns, such as User01 , User* , or Domain01\User* . Wildcards are permitted.

Type:	String [ ]
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	True

Inputs

None

You cannot pipe input to Get-EventLog .

Outputs

System.Diagnostics.EventLogEntry. System.Diagnostics.EventLog. System.String

If the LogName parameter is specified, the output is a collection of System.Diagnostics.EventLogEntry objects.

If only the List parameter is specified, the output is a collection of System.Diagnostics.EventLog objects.

If both the List and AsString parameters are specified, the output is a collection of System.String objects.

Notes

The cmdlets Get-EventLog and Get-WinEvent are not supported in the Windows Preinstallation Environment (Windows PE).