Skip to content

Instantly share code, notes, and snippets.

@TiloGit

TiloGit/dump-win-access-log.ps1

Created March 3, 2022 00:51
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save TiloGit/30f221eb0164aece7f9e4e37ec76756a to your computer and use it in GitHub Desktop.
Save TiloGit/30f221eb0164aece7f9e4e37ec76756a to your computer and use it in GitHub Desktop.
Download ZIP
Simple export of win access log failures as csv
Raw
dump-win-access-log.ps1
$result = Get-EventLog -LogName Security -InstanceId 4625 |
ForEach-Object {
[PSCustomObject]@{
Time = $_.TimeGenerated
Machine = $_.ReplacementStrings[6]
User = $_.ReplacementStrings[5]
Access = $_.ReplacementStrings[10]
SourceAddr = $_.ReplacementStrings[19]
}
}
$result | Select-Object Time, SourceAddr, Machine, User, Access | Export-Csv -NoTypeInformation -Path .\Access_Log.csv
@TiloGit
Copy link
Author

TiloGit commented Mar 3, 2022

based on https://stackoverflow.com/a/58049059/1747983 and info from https://livebook.manning.com/book/powershell-deep-dives/chapter-6/37

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment