Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Powershell to look for logon on a remote PC

Posted on 2013-10-30
2
Medium Priority
?
313 Views
Last Modified: 2013-11-17
I need a fast and efficient way to look for the logon event for a specific user, lets call them janedoe, on a list of remote PC's.

To explain further, there are 4 PC's and I want to look at the event logs of those every day to see if janedoe logged on to any of those devices.

I would rather not have to connect to the event viewer for each of these PC's every day, so I was hoping to script it.  I figure Powershell can do this.

Can anyone help out?
0
Comment
Question by:southpau1
2 Comments
 
LVL 40

Accepted Solution

by:
Subsun earned 2000 total points
ID: 39612709
Try with Get-EventLog..
GC C:\Server.txt | % {
Get-EventLog -LogName security -InstanceId 4624 -ComputerName $_ -After (Get-Date).Adddays(-1) | 
    Select-Object -Property MachineName,timegenerated,
    @{n="AccountName";e = {$_.replacementstrings[5]}},
    @{n="AccountDomain";e = {$_.replacementstrings[6]}},
    @{n="WorkstationName" ; e = {$_.replacementstrings[13]}} |
    ? {$_.AccountName -eq "janedoe"}
} | Export-Csv C:\Report.csv -NTI

Open in new window

C:\Server.txt format..
ServerA
ServerB
ServerC

Open in new window

0
 
LVL 7

Author Closing Comment

by:southpau1
ID: 39654498
Looks great, thanks!
0

Featured Post

WatchGuard Case Study: NCR

With business operations for thousands of customers largely depending on the internal systems they support, NCR can’t afford to waste time or money on security products that are anything less than exceptional. That’s why they chose WatchGuard.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The Windows functions GetTickCount and timeGetTime retrieve the number of milliseconds since the system was started. However, the value is stored in a DWORD, which means that it wraps around to zero every 49.7 days. This article shows how to solve t…
There are times when we need to generate a report on the inbox rules, where users have set up forwarding externally in their mailbox. In this article, I will be sharing a script I wrote to generate the report in CSV format.
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.
Screencast - Getting to Know the Pipeline
Suggested Courses

971 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question