add pode and api scripts

Scripts/Get-EventTS.psm1

@@ -0,0 +1,63 @@
+function Get-EventTS {
+<#
+.SYNOPSIS
+Parsing remote and local Windows Events Terminal Services
+.DESCRIPTION
+Example:
+Get-EventTS localhost -connect # User authentication succeeded
+Get-EventTS localhost -logon # Shell start notification received
+Get-EventTS localhost -logoff # Session logoff succeeded
+Get-EventTS localhost -disconnect # Session has been disconnected
+Get-EventTS localhost -reconnect # Session reconnection succeeded
+.LINK
+https://github.com/Lifailon
+#>
+Param (
+$srv="localhost",
+[switch]$connect,
+[switch]$logon,
+[switch]$logoff,
+[switch]$disconnect,
+[switch]$reconnect
+)
+if ($connect) {
+$RDPAuths = Get-WinEvent -ComputerName $srv -LogName "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" `
+-FilterXPath '<QueryList><Query Id="0"><Select>*[System[EventID=1149]]</Select></Query></QueryList>'
+[xml[]]$xml = $RDPAuths | Foreach {$_.ToXml()}
+$EventData = Foreach ($event in $xml.Event) {
+New-Object PSObject -Property @{
+"Connection Time" = (Get-Date ($event.System.TimeCreated.SystemTime) -Format 'yyyy-MM-dd hh:mm K')
+"User Name" = $event.UserData.EventXML.Param1
+"User Address" = $event.UserData.EventXML.Param3
+"Event ID" = $event.System.EventID
+}} 
+$EventData | Out-Gridview -Title "TS-Remote-Connection-Manager to server $srv"
+}
+
+if (!($connect)) {
+if ($logon) {
+$FilterXPath = '<QueryList><Query Id="0"><Select>*[System[EventID=21]]</Select></Query></QueryList>'
+}
+if ($logoff) {
+$FilterXPath = '<QueryList><Query Id="0"><Select>*[System[EventID=23]]</Select></Query></QueryList>'
+}
+if ($disconnect) {
+$FilterXPath = '<QueryList><Query Id="0"><Select>*[System[EventID=24]]</Select></Query></QueryList>'
+}
+if ($reconnect) {
+$FilterXPath = '<QueryList><Query Id="0"><Select>*[System[EventID=25]]</Select></Query></QueryList>'
+}
+$RDPAuths = Get-WinEvent -ComputerName $srv -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" `
+-FilterXPath $FilterXPath
+[xml[]]$xml = $RDPAuths | Foreach {$_.ToXml()}
+$EventData = Foreach ($event in $xml.Event) {
+New-Object PSObject -Property @{
+"Connection Time" = (Get-Date ($event.System.TimeCreated.SystemTime) -Format 'yyyy-MM-dd hh:mm K')
+"User Name" = $event.UserData.EventXML.User
+"User ID" = $event.UserData.EventXML.SessionID
+"User Address" = $event.UserData.EventXML.Address
+"Event ID" = $event.System.EventID
+}}
+$EventData | Out-Gridview -Title "TS-Local-Session-Manager to server $srv"
+}
+}