Powershell 安全日志 Get-EventLog

发布于 2024-10-17 13:26:02 字数 1094 浏览 6 评论 0原文

我正在尝试在 powershell 中写一些东西，并且对 powershell 来说是全新的，我需要帮助。我想做的是从安全日志中获取信息。具体来说，用户在过去两周内的最后一次登录。到目前为止，我的代码是根据最近 100 个事件获取事件 ID 4624 的登录信息。这不仅返回了用户，还返回了计算机。如何将结果限制为仅限两周内的用户？这可能吗？

$eventList = @()
Get-EventLog "Security" -After $Date `
    | Where -FilterScript {$_.EventID -eq 4624 -and $_.ReplacementStrings[4].Length -gt 10} `
    | foreach-Object {
        $row = "" | Select UserName, LoginTime
        $row.UserName = $_.ReplacementStrings[5]
        $row.LoginTime = $_.TimeGenerated
        $eventList += $row
        }
$eventList

编辑：用代码解决

$Date = [DateTime]::Now.AddDays(-14)
$Date.tostring("MM-dd-yyyy"), $env:Computername
$eventList = @()
Get-EventLog "Security" -After $Date `
    | Where -FilterScript {$_.EventID -eq 4624 -and $_.ReplacementStrings[4].Length -gt 10 -and $_.ReplacementStrings[5] -notlike "*$"} `
    | foreach-Object {
        $row = "" | Select UserName, LoginTime
        $row.UserName = $_.ReplacementStrings[5]
        $row.LoginTime = $_.TimeGenerated
        $eventList += $row
        }
$eventList

原文

I am trying to write something up in powershell and completely new to powershell, I need help. What I'm trying to do is get information from the Security Log. Specifically, the last login for users over the last two weeks. The code that I have so far is getting login's for the event ID 4624 based on the last 100 events. This is also returning not just users but computers as well. How can I limit the results to just users over a period of two weeks? Is this even possible?

$eventList = @()
Get-EventLog "Security" -After $Date `
    | Where -FilterScript {$_.EventID -eq 4624 -and $_.ReplacementStrings[4].Length -gt 10} `
    | foreach-Object {
        $row = "" | Select UserName, LoginTime
        $row.UserName = $_.ReplacementStrings[5]
        $row.LoginTime = $_.TimeGenerated
        $eventList += $row
        }
$eventList

EDIT: Solved with code

$Date = [DateTime]::Now.AddDays(-14)
$Date.tostring("MM-dd-yyyy"), $env:Computername
$eventList = @()
Get-EventLog "Security" -After $Date `
    | Where -FilterScript {$_.EventID -eq 4624 -and $_.ReplacementStrings[4].Length -gt 10 -and $_.ReplacementStrings[5] -notlike "*$"} `
    | foreach-Object {
        $row = "" | Select UserName, LoginTime
        $row.UserName = $_.ReplacementStrings[5]
        $row.LoginTime = $_.TimeGenerated
        $eventList += $row
        }
$eventList

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

梅倚清风 2024-10-24 13:26:02

使用 -before 和 -after 参数按日期过滤日志。使用 get-help get-eventlog -full 查看所有参数。

回复收藏 0 原文

向地狱狂奔 2024-10-24 13:26:02

用户的最后一次登录存储在 Active Directory 中。似乎从那里提取它比咀嚼事件日志要容易得多。

回复收藏 0 原文

生生漫 2024-10-24 13:26:02

使用 PowerShell 搜索 Active Directory：

Import-Module ActiveDirectory

Get-QADComputer -ComputerRole DomainController | foreach {
(Get-QADUser -Service $_.Name -SamAccountName username).LastLogon.Value
} | Measure-Latest

Use PowerShell to search the Active Directory:

Import-Module ActiveDirectory

Get-QADComputer -ComputerRole DomainController | foreach {
(Get-QADUser -Service $_.Name -SamAccountName username).LastLogon.Value
} | Measure-Latest

回复收藏 0 原文

~没有更多了~