Skip to content

Instantly share code, notes, and snippets.

@jkbryan

jkbryan/LogParser-Servers-User.sql

Created March 8, 2019 21:09
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jkbryan/c4854c2608e988c03cf0618cc7e6bbb2 to your computer and use it in GitHub Desktop.
Save jkbryan/c4854c2608e988c03cf0618cc7e6bbb2 to your computer and use it in GitHub Desktop.
Download ZIP
Find strings like 'jon' or 'dave' in the security event log of the servers named DC01.OHOLICS.NET, DC03.OHOLICS.NET and DC03.OHOLICS.NET
Raw
LogParser-Servers-User.sql
SELECT * INTO C:\TEMP\Output\output.csv
FROM \\DC01.OHOLICS.NET\security;\\DC02.OHOLICS.NET\security;\\DC03.OHOLICS.NET\security
WHERE TimeWritten > TIMESTAMP ( '2009-01-01 01:00:00', 'yyyy-MM-dd hh:mm:ss' ) AND SourceName = 'Microsoft-Windows-Security-Auditing' AND
( Strings LIKE '%jon%' OR strings LIKE '%dave%')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment