timeout /t 10800

# Define the output path
$outputPath = "C:\Temp\NetworkEvents.csv"

# Define the Event IDs for Connection (10000) and Disconnection (10001)
$eventIds = @(10000, 10001)

Write-Host "Fetching network events... this may take a moment." -ForegroundColor Cyan

# Query the NetworkProfile Operational log
$events = Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-NetworkProfile/Operational'
    Id      = $eventIds
} -ErrorAction SilentlyContinue

if ($events) {
    $results = $events | ForEach-Object {
        # Determine the status based on Event ID
        $status = if ($_.Id -eq 10000) { "Connected" } else { "Disconnected" }
        
        # Extract the Network Name from the event message
        # Use regex to pull the name string inside the event properties
        $networkName = $_.Properties[0].Value

        [PSCustomObject]@{
            Timestamp   = $_.TimeCreated
            EventID     = $_.Id
            Status      = $status
            NetworkName = $networkName
            User        = $_.UserId
        }
    }

    # Export to CSV
    $results | Export-Csv -Path $outputPath -NoTypeInformation
    Write-Host "Success! Log saved to: $outputPath" -ForegroundColor Green
}
else {
    Write-Host "No connection/disconnection events found." -ForegroundColor Yellow
}