Search for logon events in Security events using powershell
Revision as of 10:39, 2 February 2018 by Michael.mast (talk | contribs)
Get-EventLog -LogName 'Security' -InstanceId 4624 | select timegenerated,@{Label="User";Expression={$_.replacementStrings[5]}},@{Label="Machine";Expression={$_.replacementStrings[18]}} | where {($_.User -notlike "*$*")
To search specific date ranges, add the following
Get-EventLog -LogName 'Security' -InstanceId 4624 -After (date).AddDays(-1)...
