Powershell How to query the Windows log _powershell

The forum was asked how to use the PowerShell script query file modified audit log, beans Server did not open this function, but try to write a similar script can query the log, and output the corresponding XML content.

The basic method is get-winevent, you can specify the corresponding EventID, get the list. If you want to get the specific content of this event, you need to change the XML content of the different events.

Like what

$Events = get-winevent-computername syddc01-filterhashtable @{logname= ' security '; id=4771}-maxevents 1 
$eventXML = [XML] $Event. TOXML () 

Based on this idea, if I want to get the latest 20 4771 event logs and output the results

$Events = get-winevent-computername syddc01-filterhashtable @{logname= ' security '; id=4771}-maxevents Parse     
       
Out of the event message data       
ForEach ($Event in $Events) {       
  # Convert the event to XML       
  $eventXML = [XML] $Event. To XML ()       
  # Iterate through each one of the XML message properties for       
  ($i =0; $i-lt $eventXML. Event.EventData.Data.Co Unt $i + +) { 
    
       
    # Append these as Object properties       
    add-member-inputobject $Event-membertype noteproperty-force-name $ eventxml.event.eventdata.data[$i].name-value $eventXML. event.eventdata.data[$i]. ' #text '      
  }       
}       
  
   
$events | Select message, targetusername, ipaddress,timecreated | Out-gridview 

Sometimes, there are a lot of events, and I want to limit that time. Do not use Where-object way to filter, or wait until the end of time is not necessarily the result.
We need to filter through a hash table.

$endtime =get-date
$starttime = $endtime. AddMinutes ( -1) 
$eventcritea = @{logname= ' security '; id=4740; Starttime= $starttime; endtime= $endtime}

Another common way is to filter logs by Xmlfilter

First, we can customize an XPath through the Event Viewer

Because it is a different event, his eventdata result is not the same, so I made some changes.

[XML] $xmlFilter = @ "<QueryList> <query id=" 0 "path=" Application "> <select path=" Application ">*[s ystem[(eventid=1002) and Timecreated[timediff (@SystemTime) <= 604800000]]]</select> </Query> </ Querylist> "@ #Get-winevent-computername $DC. Dc-logname Security-filterxpath "*[system[(eventid=529 or eventid=644 or eventid=675 or eventid=676 or EventID=681 or Ev  entid=4625) and Timecreated[timediff (@SystemTime) <= 86400000]] "#-maxevents $Events = Get-winevent-computername Syddc01-filterxml $xmlFilter ForEach ($Event in $Events) {# Convert the Event to XML $eventXML = [XM L] $Event. TOXML () # Iterate through each one of the XML message properties for ($i =0; $i-lt $eventXML. Ev Ent. EventData.Data.Count; $i + +) {# Append these as Object properties Add-member-inputobject $Event-membertype Notepr Operty-force-name "App"-value $eventXML. event.eventdata.data[5]}       
} $Events | Select Message, APP, providername, timecreated | 
 Out-gridview

The results are as follows

Finally give an example, I want to get lockout user information and where they are locked, this log we look at 4771 or 4740. 4771 of the log too much, the query is too slow, so here I have 4740 for example.

Eventcritea = @{logname= ' security '; id=4740} $Events =get-winevent-computername (get-addomain). Pdcemulator-  Filterhashtable $eventcritea # $Events = get-winevent-computername syddc01-filterxml $xmlfilter # Parse out The event message Data ForEach ($Event in $Events) {# Convert the event to XML $eventXML = [XM L] $Event. TOXML () # Iterate through each one of the XML message properties for ($i =0; $i-lt $eventXML . Event.EventData.Data.Count; $i + +) {# Append these as Object properties Add-member-inputobject $Event-membertype Notepr Operty-force-name $eventXML. event.eventdata.data[$i].name-value $eventXML. event.eventdata.data[$i]. ' #text '}} $events | Select Targetusername,timecreated, targetDomainName | 
Out-gridview-title lockoutstatus break; Search-adaccount-lockedout | Foreach-object {unlock-adaccount-identity $_.distinguishedname}

This article comes from "Mapo tofu" blog