Powershell and using get-eventlog

powershell

I am trying to create a script that pulls failed log on attempts for certain events in the past 24 hours but I cant figure out how to pull the account information out. User is Null all the time so info is blank BUT when I look in the general tab I can see "Account Information".

I would like to pull and add what it shows in the XML view under "event data" which is TargetUserName. How can I get this done? What I have so far works fine but I need the username info and what my script pulls is always blank.

System – windows server 2008 R2 Log I am pulling from is security log with event ID's 4625,4768,4771,4772 for the past 24 hours.

My code:

get-eventlog Security 4625,4768,4771,4772 -after ((get-date).addDays(-1))| export-csv

Best Answer

Try the following, it will extract TargetUserName from the event's message and add it as new column to original event. You will now be able to export it to c:\temp\yourlog.csv or wherever you need to.

get-eventlog Security 4625,4768,4771,4772 -after ((get-date).addDays(-1)) | % {
     $TargetUserName = $_.message.split("`n") | Select-String "Account Name:"; 
     $_ | Add-Member -MemberType NoteProperty -Name TargetUserName -Value $TargetUserName[0];
     $_ } | Export-CSV "c:\temp\yourlog.csv" -notypeinformation
Related Topic