Skip to content

Instantly share code, notes, and snippets.

@laymanstake
Last active June 17, 2024 14:51
Show Gist options
  • Save laymanstake/a4184e7dd75d7cf68d303e6436b1fb4e to your computer and use it in GitHub Desktop.
Save laymanstake/a4184e7dd75d7cf68d303e6436b1fb4e to your computer and use it in GitHub Desktop.
To fetch specific event from all domain controllers Security logs
# Get list of all domain controllers
$Dcs = Get-ADDomainController -filter *
#Target last 7 days logs
$StartDate = (Get-Date).AddDays(-7)
# Can change event ID here
$eventId = 4738
$count = $dcs.count
$i = 0
$EventJobs = @()
$Events = @()
ForEach($dc in $dcs){
$i++
Write-Host "Working on $($i)/$($count) $($dc.Hostname)"
$job = Start-Job -scriptblock {
Param ($StartDate, $DC, $EventId)
try{
Get-WinEvent -ComputerName $Dc.HostName -FilterHashtable @{
LogName = "Security"
Id = $EventId
StartTime = $startDate
}
} catch {
Write-Host "Unable to get logs from $($Dc.Hostname)"
}
} -argumentlist $startDate, $Dc, $EventId
$EventJobs += $Job
}
# Wait for all jobs to complete
$null = $EventJobs | Wait-Job
# Collect results from completed jobs
foreach ($job in $EventJobs) {
$Events += Receive-Job -Job $job
}
$events | Select-Object TimeCreated, Id, Message, ProviderName, LogName, MachineName | Export-csv -nti c:\temp\selogs.csv
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment