Posted On September 21, 2022

PowerShell: Search Windows Event Logs

kimconnect 0 comments
blog.KimConnect.com >> Codes , Windows >> PowerShell: Search Windows Event Logs
# searchWindowsEventsLog.ps1

$computername=$env:computername
$logType='Security'
$eventId=4732
$daysBack=365
$limit=9999
$messageLike="*Remote Desktop Users*"

function searchWindowsEvents{
    param(
        $computername=$env:computername
        $logType='Security'
        $eventId=4732
        $daysBack=365
        $limit=9999
        $messageLike="*Remote Desktop Users*"    
    )    

    $filter=@{
        LogName=$logType
        ID=$eventId
        StartTime=[datetime]::Now.AddDays(-$daysBack)
    }
    
    $events=Get-WinEvent -FilterHashTable $filter -ComputerName $computername -EA Ignore|select -first $limit
    $events|?{$_.Message -like $messageLike}
}

searchWindowsEvents $computername $logType $eventId $daysBack $limit $messageLike

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Post

PowerShell: Windows System Discovery – Deprecated

<# windows-localhost-discovery-v0.11.ps1 Purpose: scan the local or remote Windows machine for general system resources, security…

Desktop Virtualization Consideration

Information security would greatly improve with centralized desktop and data management. Early Launch Antimalware Detection,…

Installing DotNet 3.5 on Windows with Restricted Internet Access

# Set Windows Source files # Assuming that a Windows ISO / DVD Rom have…
Other project: DragonCoin.com