积极答复者
powershell如何组合查询用户名、日期、文件名查询文件服务器删除日志了?

问题
-
请问powershell如何组合查询用户名、日期、文件名查询文件服务器删除日志了?以下代码目前只能根据删除文件的大概名称来查询。能否联合用户名、日期查询了?
Get-WinEvent -FilterHashtable @{LogName = 'Security'; Id = 4663} | ForEach-Object {
$xml = [xml] $_.ToXml()
if ($xml.Event.EventData.Data[6].'#text' -like 'C:\Windows\servicing\Sessions\30661512*') {
$_ | Select-Object @{Name = 'SubjectUserName'; Expression = {$xml.Event.EventData.Data[1].'#text'}}, @{Name = 'ObjectName'; Expression= {$xml.Event.EventData.Data[6].'#text'}}
}
}
答案
-
你好,
请尝试用以下命令来进行组合测试
Get-WinEvent -FilterHashtable @{LogName = 'Security'; Id = 4663} | Where-Object {$_.TimeCreated.Date -eq (Get-Date -Year 2018 -Month 4 -Day 30).Date} | ForEach-Object { $xml = [xml] $_.ToXml() if ($xml.Event.EventData.Data[1].'#text' -like 'VDI*' -and $xml.Event.EventData.Data[6].'#text' -like 'C:\*') { $_ | Select-Object TimeCreated, @{Name = 'SubjectUserName'; Expression = {$xml.Event.EventData.Data[1].'#text'}}, @{Name = 'ObjectName'; Expression = {$xml.Event.EventData.Data[6].'#text'}} } }
Best Regards,
Frank
Please remember to mark the replies as an answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com- 已建议为答案 frank_songMicrosoft contingent staff, Moderator 2018年4月30日 8:50
- 已标记为答案 xcw 2018年5月2日 1:34
全部回复
-
你好,
Get-WinEvent -FilterHashtable @{LogName = 'Security'; Id = 4663} | ForEach-Object {
$xml = [xml] $_.ToXml()
if ($xml.Event.EventData.Data[6].'#text' -like 'path' -and $xml.Event.EventData.Data[1].'#text' -like '用?户§名?' -and $_.TimeCreated -eq (Get-Date -Year 2008 -Month 11 -Day 4)) {
$_ | Select-Object @{Name = 'SubjectUserName'; Expression = {$xml.Event.EventData.Data[1].'#text'}}, @{Name = 'ObjectName'; Expression = {$xml.Event.EventData.Data[6].'#text'}}
}
}
Get -date 后面 填写指定的日志生成的日期
Best Regards,
FrankPlease remember to mark the replies as an answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com -
您好,我参照上述的代码组合查询,执行后没有报错,光标在那里一闪一闪的,好多分钟过去了一直不显示执行结果,我去掉-and 及后面的代码,使用单项查询就有结果。
Get-WinEvent -FilterHashtable @{LogName = 'Security'; Id = 4663} | ForEach-Object {
$xml = [xml] $_.ToXml()
if ($xml.Event.EventData.Data[1].'#text' -like 'mo*' -and $xml.Event.EventData.Data[6].'#text' -like 'D:\模具钳工\*') {
$_ | Select-Object @{Name = '用户名'; Expression ={$xml.Event.EventData.Data[1].'#text'}},
@{Name = '删除的文件名'; Expression = {$xml.Event.EventData.Data[6].'#text'}},
@{Name = '删除日期'; Expression = {$_.TimeCreated}}
}
} -
你好,
在我的电脑上,运行结果如下:
建议你检查一下,用户名那一块先不用模糊搜索来测试一下。是否存在符合条件的日志。
Best Regards,
Frank
Please remember to mark the replies as an answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com -
你好,
请尝试用以下命令来进行组合测试
Get-WinEvent -FilterHashtable @{LogName = 'Security'; Id = 4663} | Where-Object {$_.TimeCreated.Date -eq (Get-Date -Year 2018 -Month 4 -Day 30).Date} | ForEach-Object { $xml = [xml] $_.ToXml() if ($xml.Event.EventData.Data[1].'#text' -like 'VDI*' -and $xml.Event.EventData.Data[6].'#text' -like 'C:\*') { $_ | Select-Object TimeCreated, @{Name = 'SubjectUserName'; Expression = {$xml.Event.EventData.Data[1].'#text'}}, @{Name = 'ObjectName'; Expression = {$xml.Event.EventData.Data[6].'#text'}} } }
Best Regards,
Frank
Please remember to mark the replies as an answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com- 已建议为答案 frank_songMicrosoft contingent staff, Moderator 2018年4月30日 8:50
- 已标记为答案 xcw 2018年5月2日 1:34