Modified Get-LogUserAssist.ps1 to return Key LastWriteTime in ISO for…

…mat for easier sorting. Added analysis script to sort UserAssist data based on key LastWriteTime.

Analysis/log/Get-LogUserAssistValueByDate.ps1

@@ -0,0 +1,31 @@
+<#
+Get-LogUserAssistValueByDate.ps1
+Requires logparser.exe in path
+Returns UserAssist data sorted by KeyLastWritetime ascending
+
+This script expects files matching the *LogUserAssist.tsv pattern to be in the
+current working directory.
+#>
+
+
+if (Get-Command logparser.exe) {
+    $lpquery = @"
+    SELECT
+        User,
+        Subkey,
+        KeyLastWriteTime,
+        Value,
+        Count,
+        PSComputerName
+    FROM
+        *LogUserAssist.tsv
+    ORDER BY
+        KeyLastWriteTime ASC
+"@
+
+    & logparser -i:tsv -dtlines:0 -fixedsep:on -rtp:-1 "$lpquery"
+
+} else {
+    $ScriptName = [System.IO.Path]::GetFileName($MyInvocation.ScriptName)
+    "${ScriptName} requires logparser.exe in the path."
+}

Modules/Log/Get-LogUserAssist.ps1

@@ -97,7 +97,7 @@ Update-TypeData -TypeName Microsoft.Win32.RegistryKey -MemberType ScriptProperty
     }
     else {
         # Return datetime object:
-        [datetime]::FromFileTime($LastWriteTime)
+        Get-Date([datetime]::FromFileTimeUtc($LastWriteTime)) -Format yyyyMMddThh:mm:ss
     }
 }
 <# End MS Limited Public Licensed code #>