WMI query to capture Interactive logon event for permanent consumer
<p>I'm a powershell newbie and I want to create a filter to capture the login of a human user. Looking at the documentation out there the most popular WMI query seems to be:</p>

<pre><code>SELECT * FROM __InstanceCreationEvent WITHIN 15 WHERE TargetInstance
ISA 'Win32_LogonSession' AND TargetInstance.LogonType = 2
</code></pre>

<p>This doesn't appear to work and I believe that an interactive logon should be of type 0 not 2. However, that still doesn't seem to work. Is there any filter you guys &amp; gals know of that works? </p>