title: WMI query to capture Interactive logon event for permanent consumer
body: <p>I'm a powershell newbie and I want to create a filter to capture the login of a human user. Looking at the documentation out there the most popular WMI query seems to be:</p>
  
  <pre><code>SELECT * FROM __InstanceCreationEvent WITHIN 15 WHERE TargetInstance
  ISA 'Win32_LogonSession' AND TargetInstance.LogonType = 2
  </code></pre>
  
  <p>This doesn't appear to work and I believe that an interactive logon should be of type 0 not 2. However, that still doesn't seem to work. Is there any filter you guys &amp; gals know of that works? </p>