Posted On September 21, 2022

PowerShell: Search Windows Event Logs

kimconnect 0 comments
blog.KimConnect.com >> Codes , Windows >> PowerShell: Search Windows Event Logs
# searchWindowsEventsLog.ps1

$computername=$env:computername
$logType='Security'
$eventId=4732
$daysBack=365
$limit=9999
$messageLike="*Remote Desktop Users*"

function searchWindowsEvents{
    param(
        $computername=$env:computername
        $logType='Security'
        $eventId=4732
        $daysBack=365
        $limit=9999
        $messageLike="*Remote Desktop Users*"    
    )    

    $filter=@{
        LogName=$logType
        ID=$eventId
        StartTime=[datetime]::Now.AddDays(-$daysBack)
    }
    
    $events=Get-WinEvent -FilterHashTable $filter -ComputerName $computername -EA Ignore|select -first $limit
    $events|?{$_.Message -like $messageLike}
}

searchWindowsEvents $computername $logType $eventId $daysBack $limit $messageLike

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

PowerShell: Microsoft Exchange to Require that all Senders are Authenticated

In this scenario, the business decision is to limit exposure of certain internal accounts to…

PowerShell: WinSCP Module

$username='bongo' $port=20202 $remoteHost='dev-sftp.kimconnect.net' $privateKey='C:\scripts\keys\testkey.ppk' $remoteRoot='/' $downloadFolder='D:\downloads' $remoteDirectory='/var/www/sftp.kimconnect.net' $currentDirectory=$remoteDirectory $localFolder=(New-Object -ComObject Shell.Application).NameSpace('shell:Downloads').Self.Path $appName='winscp' function includePowerShellWrapper($appName){ #…

How to Install Asterisk on Ubuntu

su[enter root password]cd /tempwget apt-get install build-essential wget libssl-dev libncurses5-dev libnewt-dev libxml2-dev linux-headers-$(uname -r) libsqlite3-dev…