Question

我希望能够检查远程计算机的用户登录/注销会话和时间，并且我从stackoverflow获得了以下代码，但我无法弄清楚如何告诉脚本检查远程计算机：

$UserProperty = @{n="User";e={(New-Object System.Security.Principal.SecurityIdentifier  
$_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])}}
$TypeProperty = @{n="Action";e={if($_.EventID -eq 7001) {"Logon"} else {"Logoff"}}}
$TimeProeprty = @{n="Time";e={$_.TimeGenerated}}

Get-EventLog System -Source Microsoft-Windows-Winlogon | select $UserProperty,$TypeProperty,$TimeProeprty

我确实投入了一个$ Computername变量和一个Foreach循环语句，如下所示，试图让它在远程计算机上运行，但是它一直在检查我所在的本地系统，而不是远程系统：

$Computername = Read-Host "Enter Computername Here"

Foreach $Computer in $Computername

    {
        $UserProperty = @{n="User";e={(New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])}}
        $TypeProperty = @{n="Action";e={if($_.EventID -eq 7001) {"Logon"} else {"Logoff"}}}
        $TimeProeprty = @{n="Time";e={$_.TimeGenerated}}

        Get-EventLog System -Source Microsoft-Windows-Winlogon | select $UserProperty,$TypeProperty,$TimeProeprty
    }

Answer 1

我知道这是一个老问题，但没有接受过任何答案。其中一个问题是脚本没有显示用户登录的机器。无论如何，我把它修好了（包括错字）。

Get-LogonHistory.ps1：

param(
    [alias("CN")]
    $ComputerName="localhost"
)

$UserProperty = @{n="User";e={(New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])}}
$TypeProperty = @{n="Action";e={if($_.EventID -eq 7001) {"Logon"} else {"Logoff"}}}
$TimeProperty = @{n="Time";e={$_.TimeGenerated}}
$MachineNameProperty = @{n="MachinenName";e={$_.MachineName}}

foreach ($computer in $ComputerName) {
    Get-EventLog System -Source Microsoft-Windows-Winlogon -ComputerName $computer | select $UserProperty,$TypeProperty,$TimeProperty,$MachineNameProperty
}

这样，它将显示用户登录的机器。可以将多个远程计算机传递到命令行，每个远程计算机之间使用逗号（无空格）。

Answer 2

您需要使用Get-EventLog cmdlet的ComputerName参数：

Get-EventLog -ComputerName $Computer System -Source Microsoft-Windows-Winlogon `
    | select $UserProperty,$TypeProperty,$TimeProeprty

此外，您的$TimeProeprty变量中似乎有拼写错误。

Answer 3

您没有将计算机名传递给循环中的任何命令。所以它只是在$ computerName中为多个对象循环执行相同的命令尝试将最后一行更改为：

 Get-EventLog System -Source Microsoft-Windows-Winlogon -ComputerName $computer | select $UserProperty,$TypeProperty,$TimeProperty

如果这不起作用，请确保您的foreach循环传递正确的数据：

$computerName | Foreach-Object{Write-Host $_}

这应显示您尝试运行此计算机的每台计算机的计算机名称。

但是看起来你正试图为一台计算机运行它，所以删除Foreach循环并在select语句之前将-ComputerName $computername添加到Get-Eventlog命令的末尾

Answer 4

有点修改及其工作

# Specify the location you want the report to be saved
$filelocation = "C:\report.csv"

[void][System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic') 
[string]$Computer = [Microsoft.VisualBasic.Interaction]::InputBox("Enter     ComputerName", "Computer Name", "Computer Name")
[int]$DayPrompt = [Microsoft.VisualBasic.Interaction]::InputBox("Enter Number of Days to     check", "Days to Check", "15")
$Days = $DayPrompt
cls

$Result = @()
Write-Host "Gathering Event Logs, this can take awhile..."
$ELogs = Get-EventLog System -Source Microsoft-Windows-WinLogon -After (Get-Date).AddDays(-    $Days) -ComputerName $Computer
If ($ELogs)
{ Write-Host "Processing..."
ForEach ($Log in $ELogs)
{ If ($Log.InstanceId -eq 7001)
{ $ET = "Logon"
}
ElseIf ($Log.InstanceId -eq 7002)
{ $ET = "Logoff"
}
Else
{ Continue
}
$Result += New-Object PSObject -Property @{
Time = $Log.TimeWritten
'Event Type' = $ET
User = (New-Object System.Security.Principal.SecurityIdentifier $Log.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])
}
}
$Result | Select Time,"Event Type",User | Sort Time -Descending | Export-CSV $filelocation
Write-Host "Done look at $filelocation"
}
Else
{ Write-Host "Problem with $Computer."
Write-Host "If you see a 'Network Path not found' error, try starting the Remote Registry service on that computer."
Write-Host "Or there are no logon/logoff events (XP requires auditing be turned on)"
}

Answer 5

基于https://gallery.technet.microsoft.com/Log-Parser-to-Identify-8aac36bd

Get-Eventlog -LogName Security | where {$_.EventId -eq "4624"} | select-object @{Name="User"
;Expression={$_.ReplacementStrings[5]}} | sort-object User -unique

您可以从ReplacementStrings获取其他信息。您还可以在Get-Eventlog命令中指定远程计算机。

Answer 6

# Specify the location you want the report to be saved
$filelocation = "C:\Path\report.csv"

[void][System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic') 
[string]$Computer = [Microsoft.VisualBasic.Interaction]::InputBox("Enter     ComputerName", "Computer Name", "Computer Name")
[int]$DayPrompt = [Microsoft.VisualBasic.Interaction]::InputBox("Enter Number of Days to     check", "Days to Check", "15")
$Days = $DayPrompt
cls

$Result = @()
Write-Host "Gathering Event Logs, this can take awhile..."
$ELogs = Get-EventLog System -Source Microsoft-Windows-WinLogon -After (Get-Date).AddDays(-    $Days) -ComputerName $Computer
If ($ELogs)
{ Write-Host "Processing..."
ForEach ($Log in $ELogs)
{ If ($Log.InstanceId -eq 7001)
{ $ET = "Logon"
}
ElseIf ($Log.InstanceId -eq 7002)
{ $ET = "Logoff"
}
Else
{ Continue
}
$Result += New-Object PSObject -Property @{
Time = $Log.TimeWritten
'Event Type' = $ET
User = (New-Object System.Security.Principal.SecurityIdentifier $Log.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])
}
}
$Result | Select Time,"Event Type",User | Sort Time -Descending | Export-CSV $filelocation -  TypeInformation
Write-Host "Done."
}
Else
{ Write-Host "Problem with $Computer."
Write-Host "If you see a 'Network Path not found' error, try starting the Remote Registry service on that computer."
Write-Host "Or there are no logon/logoff events (XP requires auditing be turned on)"
}

使用Powershell的用户登录/注销信息

6 个答案: