Aug
24
24
Get user logons and logoffs from securitylog using powershell
Posted by jbjorkman on August 24, 2010 underDeprecated: preg_replace() [function.preg-replace]: The /e modifier is deprecated, use preg_replace_callback instead in /var/www/myfoto.se/jbits.se/blog/wp-includes/formatting.php on line 82
Powershell
To filter out actual users logging on or off a mahine either via console or rdp the following powershell command can be used:
et-eventlog -log security | where {$_.EventID -match '528|538|540'} | select-object TimeGenerated,@{Name="Action";Expression={([regex]::match($_.Message.ToString(),'.*(?<action>(Logon|Logoff)):.*').Groups["action"]).Value.Trim()}},@{Name="User";Expression={([regex]::match($_.Message.ToString(),'.*User Name: *(?<uname>.*)').Groups["uname"]).Value.Trim()}},@{Name="Type";Expression={([regex]::match($_.Message.ToString(),'.*Logon Type:\s*(?<type>.*)').Groups["type"]).Value.Trim()}} | where {$_.Type -eq 2 -or $_.Type -eq 10}
Add A Comment
You must be logged in to post a comment.