PTah
52 lines
1.6 KiB
PowerShell
52 lines
1.6 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Просмотр недавних 4624 с полями для диагностики RDP-login-monitor.
|
|
.EXAMPLE
|
|
.\Show-Rdp4624Recent.ps1
|
|
.\Show-Rdp4624Recent.ps1 -Minutes 30 -User papatramp
|
|
#>
|
|
[CmdletBinding()]
|
|
param(
|
|
[int]$Minutes = 15,
|
|
[string]$User = '',
|
|
[int]$MaxEvents = 50
|
|
)
|
|
|
|
$start = (Get-Date).AddMinutes(-$Minutes)
|
|
Write-Host "Security 4624 since $($start.ToString('yyyy-MM-dd HH:mm:ss')) (local time)" -ForegroundColor Cyan
|
|
|
|
$events = @(Get-WinEvent -FilterHashtable @{
|
|
LogName = 'Security'
|
|
Id = 4624
|
|
StartTime = $start
|
|
} -MaxEvents $MaxEvents -ErrorAction SilentlyContinue)
|
|
|
|
if ($events.Count -eq 0) {
|
|
Write-Host 'No 4624 events in window.'
|
|
exit 0
|
|
}
|
|
|
|
function Get-EvProp($Event, [string]$Name) {
|
|
$xml = [xml]$Event.ToXml()
|
|
$n = $xml.Event.EventData.Data | Where-Object { $_.Name -eq $Name } | Select-Object -First 1
|
|
if ($null -eq $n) { return '-' }
|
|
return [string]$n.'#text'
|
|
}
|
|
|
|
$rows = foreach ($ev in $events) {
|
|
$u = Get-EvProp $ev 'TargetUserName'
|
|
if ($User -and $u -notlike "*$User*") { continue }
|
|
[pscustomobject]@{
|
|
TimeCreated = $ev.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss')
|
|
RecordId = $ev.RecordId
|
|
User = $u
|
|
LogonType = Get-EvProp $ev 'LogonType'
|
|
IpAddress = Get-EvProp $ev 'IpAddress'
|
|
Workstation = Get-EvProp $ev 'WorkstationName'
|
|
Process = Get-EvProp $ev 'LogonProcessName'
|
|
}
|
|
}
|
|
|
|
$rows | Format-Table -AutoSize
|
|
Write-Host "`nTip: monitor log — Select-String -Path 'C:\ProgramData\RDP-login-monitor\Logs\*.log' -Pattern 'Notify:|Skip 4624|Notify dedup'"
|