Get DC logon events
Tue Jul 28 2020
$DCs = Get-ADDomainController -Filter *
$StartDate = (Get-Date).AddDays(-1)
$CalculatedProperties = @{
LogonType = @{N = 'LogonType'; E = { $_.ReplacementStrings[8] } }
User = @{N = 'User'; E = { $_.ReplacementStrings[5] } }
Hostname = @{N = 'Hostname'; E = { $_.ReplacementStrings[11] } }
}
$LogonEventsProperties = 'EventID', `
'TimeGenerated', `
$CalculatedProperties.LogonType, `
$CalculatedProperties.User, `
$CalculatedProperties.Hostname
$LogOnEvents = @()
foreach ($DC in $DCs) {
$LogOnEvents += Get-Eventlog -LogName Security -ComputerName $DC.Hostname -after $startDate | `
Where-Object { $_.eventID -eq 4624 }
}
$LogOnEvents | `
Select-Object $LogonEventsProperties | `
Where-Object { $_.Hostname -ne '-' -and $_.User -notlike '*$' } | `
Out-GridView