• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 328
  • Last Modified:

Powershell to look for logon on a remote PC

I need a fast and efficient way to look for the logon event for a specific user, lets call them janedoe, on a list of remote PC's.

To explain further, there are 4 PC's and I want to look at the event logs of those every day to see if janedoe logged on to any of those devices.

I would rather not have to connect to the event viewer for each of these PC's every day, so I was hoping to script it.  I figure Powershell can do this.

Can anyone help out?
0
southpau1
Asked:
southpau1
1 Solution
 
SubsunCommented:
Try with Get-EventLog..
GC C:\Server.txt | % {
Get-EventLog -LogName security -InstanceId 4624 -ComputerName $_ -After (Get-Date).Adddays(-1) | 
    Select-Object -Property MachineName,timegenerated,
    @{n="AccountName";e = {$_.replacementstrings[5]}},
    @{n="AccountDomain";e = {$_.replacementstrings[6]}},
    @{n="WorkstationName" ; e = {$_.replacementstrings[13]}} |
    ? {$_.AccountName -eq "janedoe"}
} | Export-Csv C:\Report.csv -NTI

Open in new window

C:\Server.txt format..
ServerA
ServerB
ServerC

Open in new window

0
 
southpau1Author Commented:
Looks great, thanks!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now