check_logons.ps1 doesn't seem to be working reliable. In provided example it fails to detect Administrator logon, even though it is not in -ignoreUsers parameter, and Temp directory was cleared.
check_logons = cmd /c echo scripts\check_logons.ps1 $ARG1$ $ARG2$ $ARG3$ $ARG4$ ; exit($lastexitcode) | powershell.exe -command -
[nagios@ip-172-31-27-244.eu-central-1.compute.internal ~]$ /usr/local/nagios/libexec/check_nrpe -H 192.168.102.12 -t 200 -c check_logons -a "-id nagios" "-logonType 3,10" "-debug"
DEBUG: Temp location C:\Windows\TEMP\nagios
DEBUG: EventIndex: 194574877 Time: 2020-07-03 18:16:24+02:00 IP: 172.31.63.79 User: Administrator LogonType: 10
DEBUG: EventIndex: 194574872 Time: 2020-07-03 18:16:23+02:00 IP: - User: DWM-6 LogonType: 2
DEBUG: EventIndex: 194574871 Time: 2020-07-03 18:16:23+02:00 IP: - User: DWM-6 LogonType: 2
DEBUG: EventIndex: 194574867 Time: 2020-07-03 18:16:22+02:00 IP: - User: Administrator LogonType: 3
OK - Processed 4 logs
check_logons.ps1doesn't seem to be working reliable. In provided example it fails to detect Administrator logon, even though it is not in-ignoreUsersparameter, and Temp directory was cleared.