Asked by:
login failed attempt powershell script

Question
-
Hi Guys,
I need your help. I need powershell script to get login attempt report into csv file. is there any script ?
Thanks in advanced
I have made this script but i don't know where and what am i missing in this script, It is not working:-
#> Param( [array]$ServersToQuery = (hostname), [datetime]$StartTime = "January 1, 1970" ) foreach ($Server in $ServersToQuery) { $LogFilter = @{ LogName = 'Security' ID = 4625, 644, 681, 529 StartTime = $StartTime } $AllEntries = Get-WinEvent -LogName "Security" -FilterHashtable $LogFilter -ComputerName $Server $AllEntries | Foreach { $entry = [xml]$_.ToXml() [array]$Output += New-Object PSObject -Property @{ TimeCreated = $_.TimeCreated Computer = $entry.Event.EventData.SubjectUserName User = $entry.Event.EventData.TargetDomainName logontype = $entry.Event.EventData.LogonType IPAddress = $entry.Event.EventData.IpAddress EventID = $entry.Event.System.EventID ServerName = $Server } } } $FilteredOutput += $Output | Select TimeCreated, Computer, User, logontype, IPAddress, ServerName @{Name='Action';Expression={ if ($_.EventID -eq '4625'){"Unknown user name or Bad password"} if ($_.EventID -eq '529'){"Unknown user name or Bad password"} if ($_.EventID -eq '644'){"User Account Locked Out"} if ($_.EventID -eq '681'){"The logon to account: %2 by: %1 from workstation: %3 failed"} } } $FilePath = "$env:C:\RDP_Report.csv" $FilteredOutput | Sort TimeCreated | Export-Csv $FilePath -NoTypeInformation Write-host "Writing File: $FilePath" -ForegroundColor Cyan Write-host "Done!" -ForegroundColor Cyan #End
When i run this script it is giving following error:-
I am not good in powershell. it is just copy from another script, and edit the event log and other information.
Original script is here :-
https://gallery.technet.microsoft.com/scriptcenter/Remote-Desktop-Connection-3fe225cd
- Edited by Barinder Singh1989 Saturday, December 15, 2018 8:26 PM
- Moved by Bill_Stewart Friday, March 15, 2019 3:13 PM This is not "fix/debug/rewrite my script for me" forum
Saturday, December 15, 2018 7:30 PM
All replies
-
Please look in the Gallery for scripts that do this. You appear to have copied a script. You also have not told us what errors you are receiving.
When posting code in the forum you must use the code posting tool provided to prevent unreadable posts and to make the script available for copying. Edit your original post and fix this.
\_(ツ)_/
Saturday, December 15, 2018 8:12 PM -
You cannot use both "Logname" parameter and the same in the hash.
Start simple. Run each line of the code in the loop until you understand how it works. After you understand the code then you can add the loop and eventually create the PS1 file.
\_(ツ)_/
Saturday, December 15, 2018 8:16 PM -
You cannot use both "Logname" parameter and the same in the hash.
Start simple. Run each line of the code in the loop until you understand how it works. After you understand the code then you can add the loop and eventually create the PS1 file.
\_(ツ)_/
Thanks for you response. I have added the error log. I am not good in powershell. It is just copy From another script. Afterr verify data, i have edit logs information and changes the event ID.
The Original Script is here :-
https://gallery.technet.microsoft.com/scriptcenter/Remote-Desktop-Connection-3fe225cd
It is working well to get RDP logs. I just change event logs id, and path.
If you can add in this script, it would be great.
Thanks
Saturday, December 15, 2018 8:25 PM -
Thank you. Please do not post screenshots as they are unreadable in most browsers. Just copy the exception and post it in a code block.
I took a quick look at your code and it is a collection of very bad guesses. Almost every line has an issue.
Do as I suggested and build the code one line at a time from the inside of the loop to the outside. Inspect each object that you retrieve or use to be sure you understand the object and its structure. By doing this you will learn a tremendous amount about coding and PowerShell.
Start by making Get-WinEvent return the events you need for one computer. Just copy pieces of your code an test by pasting at a prompt. Start with this part of your code:
$LogFilter = @{ LogName = 'Security' ID = 4625, 644, 681, 529 StartTime = $StartTime } Get-WinEvent -LogName "Security" -FilterHashtable $LogFilter
Inspect and fix the errors until you can do a simple query.
\_(ツ)_/
Saturday, December 15, 2018 8:45 PM -
Another hint - always fix the errors one at a time starting with the first one returned.
\_(ツ)_/
Saturday, December 15, 2018 8:48 PM -
Here is the part that will most confuse you.
Get-WinEvent -FilterHashtable $LogFilter | ForEach-Object { $event = ([xml]$_.ToXml()).Event [pscustomobject]@{ Computer = $event.System.Computer EventID = [int]$event.System.EventID Action = $actions[[int]$event.System.EventID] TimeCreated = [datetime]$event.System.TimeCreated.SystemTime SubjectUserName = $event.SelectSingleNode('//*[@Name="SubjectUserName"]').'#text' TargetDomainName = $event.SelectSingleNode('//*[@Name="TargetDomainName"]').'#text' LogonType = [int]$event.SelectSingleNode('//*[@Name="LogonType"]').'#text' IpAddress = $event.SelectSingleNode('//*[@Name="IpAddress"]').'#text' } }
Coding to the event log and XML is a very advanced programming task. If you do not know basic programming or the Windows API/Classes and XML this will be a complete mystery.
To learn use your search engine to find documents and articles explaining what is being done.
\_(ツ)_/
Saturday, December 15, 2018 10:00 PM -
You are right Sir.Coding to the event log and XML is a very advanced programming task. I have started the learn powershell scripting. however it will take some time. but i need this script urgently.Sunday, December 16, 2018 3:22 PM
-
I have given you the answers and examples of what you need to know. I cannot teach you how to use the information. Learning PowerShell is your responsibility. If this is a critical need then I suggest that you consider hiring a consultant to work with you on this.
Microsoft Virtual Academy - Getting Started with Microsoft PowerShell
\_(ツ)_/
- Edited by jrv Sunday, December 16, 2018 4:23 PM
Sunday, December 16, 2018 4:22 PM -
Well, Thanks. Sir. I have just complete the script. and it worked successfully. I know i need to learn my self. it is enough that you give me your valuable time and really it is to helpful. Thank for your help.Sunday, December 16, 2018 4:49 PM