Question

使用Powershell我只想为用户过滤eventID 4771的安全事件日志。不适用于客户端计算机。

我最后得到的代码为我提供了客户端计算机和用户登录尝试失败的结果。我有兴趣看到仅用户失败的登录尝试。

$ns = @{e = "http://schemas.microsoft.com/win/2004/08/events/event"}

#$Events = Get-WinEvent -FilterHashtable @{Logname = "Security" ;StartTime=(get-date).AddDays(-1); ID = 4768,4771;keywords='8010000000000000'} -ErrorAction SilentlyContinue
$Events = Get-WinEvent -FilterHashtable @{Logname = "Security" ;StartTime=(get-date).AddDays(-2); ID = 4771;keywords='8010000000000000'} -ErrorAction SilentlyContinue
$results = foreach($evt in $events)
    {
    $xml = [xml]$evt.ToXml()

    $TUserName= Select-Xml -Xml $xml -Namespace $ns -XPath "//e:Data[@Name='TargetUserName']/text()" |
                       Select-Object -ExpandProperty Node | Select-Object -ExpandProperty Value
    $TargetUserName = $TUserName | Where-Object { $_ –notcontains "-AA-" -or $_ –notcontains "-BB-" -or $_ –notcontains "-CC-" -or $_ –notcontains "-DD-"}

    $Status = Select-Xml -Xml $xml -Namespace $ns -XPath "//e:Data[@Name='Status']/text()" |
                       Select-Object -ExpandProperty Node | Select-Object -ExpandProperty Value

    $IPAddress = Select-Xml -Xml $xml -Namespace $ns -XPath "//e:Data[@Name='IpAddress']/text()" |
                       Select-Object -ExpandProperty Node | Select-Object -ExpandProperty Value

    $IP = $IPAddress.Split(':')[-1]

    Switch ($Status)
        {
        "0x6"
            {
            $ReasonforLoginfailure = "Unknown user name"
            }
        "0x18"
            {
            $ReasonforLoginfailure = "Incorrect Password"
            }
        } 

    $IPPort = Select-Xml -Xml $xml -Namespace $ns -XPath "//e:Data[@Name='IpPort']/text()" |
                       Select-Object -ExpandProperty Node | Select-Object -ExpandProperty Value

    New-Object -TypeName PSObject -Property @{UserID = ($TargetUserName).Replace("$","")
                       HostName = $Hostname
                       IPAddress = $IP
                       Port = $IPPort
                       'TimeCreated in EST' = [System.TimeZoneInfo]::ConvertTimeBySystemTimeZoneId($evt.TimeCreated, [System.TimeZoneInfo]::Local.Id, 'Eastern Standard Time')
                       EventID = $evt.ID
                       Status = $Status
                       'Reason for Login failure' = $ReasonforLoginfailure
                       DomainName = $DC
                       }        
    }

Answer 1

对于计算机帐户，TargetUserName字段将以$结尾，因此只需对其进行过滤：

if($TargetUserName -like '*$'){
    # it's a computer
    # continue to the next event in the loop
    continue
}

过滤事件ID 4771

1 个答案: