Show all remote interactive logons since boot

# Get "Begin session arbitration" events. Don't get for reconnects, just logons
Get-WinEvent -FilterHashtable @{ ProviderName = 'Microsoft-Windows-TerminalServices-LocalSessionManager' ; Id = 41 }|select-object -Property TimeCreated,@{n='User';e={$_.Properties[0].Value}},@{n='SessionId';e={$_.Properties[1].Value}}

## Or only since boot
Get-WinEvent -FilterHashtable @{ ProviderName = 'Microsoft-Windows-TerminalServices-LocalSessionManager' ; Id = 41 ; StartTime = (Get-CimInstance -ClassName Win32_OperatingSystem|select-object -expand LastBootUpTime)}|select-object -Property TimeCreated,@{n='User';e={$_.Properties[0].Value}},@{n='SessionId';e={$_.Properties[1].Value}}