使用Powershell，我只想为用户过滤eventID 4771的安全事件日志。不适用于客户端计算机。
我的代码为我提供了客户端计算机和用户登录尝试失败的结果。我有兴趣看到仅用户失败的登录尝试。
$ns = @{e = "http://schemas.microsoft.com/win/2004/08/events/event"}
#$Events = Get-WinEvent -FilterHashtable @{Logname = "Security" ;StartTime=(get-date).AddDays(-1); ID = 4768,4771;keywords='8010000000000000'} -ErrorAction SilentlyContinue
$Events = Get-WinEvent -FilterHashtable @{Logname = "Security" ;StartTime=(get-date).AddDays(-2); ID = 4771;keywords='8010000000000000'} -ErrorAction SilentlyContinue
$results = foreach($evt in $events)
{
$xml = [xml]$evt.ToXml()
$TUserName= Select-Xml -Xml $xml -Namespace $ns -XPath "//e:Data[@Name='TargetUserName']/text()" |
Select-Object -ExpandProperty Node | Select-Object -ExpandProperty Value
$TargetUserName = $TUserName | Where-Object { $_ –notcontains "-AA-" -or $_ –notcontains "-BB-" -or $_ –notcontains "-CC-" -or $_ –notcontains "-DD-"}
$Status = Select-Xml -Xml $xml -Namespace $ns -XPath "//e:Data[@Name='Status']/text()" |
Select-Object -ExpandProperty Node | Select-Object -ExpandProperty Value
$IPAddress = Select-Xml -Xml $xml -Namespace $ns -XPath "//e:Data[@Name='IpAddress']/text()" |
Select-Object -ExpandProperty Node | Select-Object -ExpandProperty Value
$IP = $IPAddress.Split(':')[-1]
Switch ($Status)
{
"0x6"
{
$ReasonforLoginfailure = "Unknown user name"
}
"0x18"
{
$ReasonforLoginfailure = "Incorrect Password"
}
}
$IPPort = Select-Xml -Xml $xml -Namespace $ns -XPath "//e:Data[@Name='IpPort']/text()" |
Select-Object -ExpandProperty Node | Select-Object -ExpandProperty Value
New-Object -TypeName PSObject -Property @{UserID = ($TargetUserName).Replace("$","")
HostName = $Hostname
IPAddress = $IP
Port = $IPPort
'TimeCreated in EST' = [System.TimeZoneInfo]::ConvertTimeBySystemTimeZoneId($evt.TimeCreated, [System.TimeZoneInfo]::Local.Id, 'Eastern Standard Time')
EventID = $evt.ID
Status = $Status
'Reason for Login failure' = $ReasonforLoginfailure
DomainName = $DC
}
}
对于计算机帐户，该TargetUserName字段将以结尾$，因此只需对其进行过滤：
if($TargetUserName -like '*$'){
# it's a computer
# continue to the next event in the loop
continue
}
本文收集自互联网，转载请注明来源。
如有侵权，请联系 [email protected] 删除。
我来说两句