EventViewerX/Examples/Query-EventTypes.ps1 at master · EvotecIT/EventViewerX · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
Import-Module PSEventViewer -Force

$Authentication = New-EVXFilter -Type ActiveDirectoryAuthentication
$Authentication.Fields | Get-Member -MemberType Property

Get-EVXEvent `
    -Type ADUserLogonFailed, ADUserLockouts `
    -MachineName DC01, DC02 `
    -TimePeriod Last24Hours `
    -ReadMode StructuredDataAndMessage `
    -Where { $_.Who -notlike 'NT AUTHORITY\*' } `
    -MaxEvents 500 |
    Select-Object TimeCreated, TypeName, MachineName, UserName, IpAddress

Get-EVXEvent `
    -Type ADSMBServerAuditV1 `
    -MachineName DC01, DC02 `
    -TimePeriod Last3Days `
    -ResolveDns `
    -DnsTimeoutMs 1000 `
    -DnsMaxConcurrency 8 |
    Select-Object When, Computer, ClientAddress, ClientDNSName,
        ClientDnsResolutionStatus