Posted On January 6, 2020

PowerShell: Search for Failed Logins on Primary Domain Controller

kimconnect 0 comments
blog.KimConnect.com >> Codes >> PowerShell: Search for Failed Logins on Primary Domain Controller
# Quick Script to search for failed logins

$daysLimit=7
$userName="Bruce"
$todaysDate= Get-date
$pdc = (Get-ADDomain).PDCEmulator
#$allDCs = ((Get-ADForest).Domains | %{ Get-ADDomainController -Filter * -Server $_ }).Name

function getFailedLoginEvents{
param(
$dc,
$dayslimit,
$searchString
)

# Sanitize input
if($searchString[0] -ne "*"){$searchString="*"+$searchString}
if($searchString[$searchString.Length] -ne "*"){$searchString+="*"}

$results = Get-Eventlog security -Computer $pdc -InstanceId 4625 -After $todaysDate.AddDays(-$daysLimit) | `
Select TimeGenerated,ReplacementStrings|%{
if($_.ReplacementStrings[5] -like $searchString){
New-Object PSObject -Property @{
Source_Computer = $_.ReplacementStrings[13]
UserName = $_.ReplacementStrings[5]
IP_Address = $_.ReplacementStrings[19]
Date = $_.TimeGenerated
}
}
}
write-host $results;

if ($results){
return "$($results|ft -autosize|Out-String)";
}else{
return "$searchString not found.";
}
}

getFailedLoginEvents -dc $pdc -dayslimit $daysLimit -searchString $userName

Sample Result:

UserName     Source_Computer IP_Address  Date
-------- --------------- ---------- ----
Bruce.Leeeee DomainC-007 192.1.1.500 1/6/2020 1:03:33 AM
Bruce.Leeeee DomainC-007 192.1.1.500 1/6/2020 1:03:30 AM
Bruce.Leeeee DomainC-007 192.1.1.500 1/6/2020 1:01:24 AM
Bruce.Leeeee DomainC-007 192.1.1.500 1/6/2020 1:01:21 AM
Bruce.Leeeee DomainC-007 192.1.1.500 1/6/2020 1:00:10 AM

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

PowerShell: Stop Any Service on Windows!

Problem: some system protected services cannot be stopped. PS C:\Users\KingKong> stop-service msmpsvcStop-Service : Service 'Microsoft…

Basic HTML and HTML5: Create an Ordered List

<h2>CatPhotoApp</h2><main><p>Click here to view more <a href="#">cat photos</a>.</p><a href="#"><img src="https://bit.ly/fcc-relaxing-cat" alt="A cute orange cat lying…

Basic JavaScript: Manipulate Arrays With shift()

// Setupvar myArray = [["John", 23], ["dog", 3]];// Only change code below this line.var removedFromMyArray=myArray.shift();
Other project: DragonCoin.com