Posted On January 6, 2020

PowerShell: Search for Failed Logins on Primary Domain Controller

kimconnect 0 comments
blog.KimConnect.com >> Codes >> PowerShell: Search for Failed Logins on Primary Domain Controller
# Quick Script to search for failed logins

$daysLimit=7
$userName="Bruce"
$todaysDate= Get-date
$pdc = (Get-ADDomain).PDCEmulator
#$allDCs = ((Get-ADForest).Domains | %{ Get-ADDomainController -Filter * -Server $_ }).Name

function getFailedLoginEvents{
param(
$dc,
$dayslimit,
$searchString
)

# Sanitize input
if($searchString[0] -ne "*"){$searchString="*"+$searchString}
if($searchString[$searchString.Length] -ne "*"){$searchString+="*"}

$results = Get-Eventlog security -Computer $pdc -InstanceId 4625 -After $todaysDate.AddDays(-$daysLimit) | `
Select TimeGenerated,ReplacementStrings|%{
if($_.ReplacementStrings[5] -like $searchString){
New-Object PSObject -Property @{
Source_Computer = $_.ReplacementStrings[13]
UserName = $_.ReplacementStrings[5]
IP_Address = $_.ReplacementStrings[19]
Date = $_.TimeGenerated
}
}
}
write-host $results;

if ($results){
return "$($results|ft -autosize|Out-String)";
}else{
return "$searchString not found.";
}
}

getFailedLoginEvents -dc $pdc -dayslimit $daysLimit -searchString $userName

Sample Result:

UserName     Source_Computer IP_Address  Date
-------- --------------- ---------- ----
Bruce.Leeeee DomainC-007 192.1.1.500 1/6/2020 1:03:33 AM
Bruce.Leeeee DomainC-007 192.1.1.500 1/6/2020 1:03:30 AM
Bruce.Leeeee DomainC-007 192.1.1.500 1/6/2020 1:01:24 AM
Bruce.Leeeee DomainC-007 192.1.1.500 1/6/2020 1:01:21 AM
Bruce.Leeeee DomainC-007 192.1.1.500 1/6/2020 1:00:10 AM

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

PowerShell: List All Hyper-V Snapshots of All VMs in All Clusters in Domain

# listHyperVSnapshots.ps1 $clusterName='*' function listAllHyperVSnapshots([string[]]$clusterName){ function includeRSAT{ $ErrorActionPreference='stop' [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 #$rsatWindows7x32='https://download.microsoft.com/download/4/F/7/4F71806A-1C56-4EF2-9B4F-9870C4CFD2EE/Windows6.1-KB958830-x86-RefreshPkg.msu' $rsatWindows7x64='https://download.microsoft.com/download/4/F/7/4F71806A-1C56-4EF2-9B4F-9870C4CFD2EE/Windows6.1-KB958830-x64-RefreshPkg.msu' $rsatWindows81='https://download.microsoft.com/download/1/8/E/18EA4843-C596-4542-9236-DE46F780806E/Windows8.1-KB2693643-x64.msu' $rsat1709…

PowerShell: Generate Report of Users and Computers That Have Not Logged On for X Days

# AccountsNotLoginXDays.ps1# Set days$lastLogonDaysExceeding = 120# Gather Users$daysRange = (get-date).adddays(-$lastLogonDaysExceeding)$users=Get-ADUser -properties * -filter {(enabled -eq…

Basic HTML and HTML5: Add Placeholder Text to a Text Field

<h2>CatPhotoApp</h2><main><p>Click here to view more <a href="#">cat photos</a>.</p><a href="#"><img src="https://bit.ly/fcc-relaxing-cat" alt="A cute orange cat lying…