Link to home
Start Free TrialLog in
Avatar of J0rtIT
J0rtITFlag for Venezuela, Bolivarian Republic of

asked on

Convert String into PS Object

Got the following String:
A user account was created.

   Security ID:      S-1-5-21-1939622638-3900933924-917146771-500
   Account Name:      Administrator
   Account Domain:      T
   Logon ID:      0x6112e

New Account:
   Security ID:      S-1-5-21-1939622638-3900933924-917146771-1105
   Account Name:      prueba2
   Account Domain:      T

   SAM Account Name:   prueba2
   Display Name:      Prueba2
   User Principal Name:
   Home Directory:      -
   Home Drive:      -
   Script Path:      -
   Profile Path:      -
   User Workstations:   -
   Password Last Set:   %%1794
   Account Expires:      %%1794
   Primary Group ID:   513
   Allowed To Delegate To:   -
   Old UAC Value:      0x0
   New UAC Value:      0x15
   User Account Control:   
   User Parameters:   -
   SID History:      -
   Logon Hours:      %%1793

Additional Information:
   Privileges      -

Open in new window

I'd like to extract
1str line =>  in a string variable "Action"
Under subject, want the string variable "Account Name", this case Administrator
and on New Account => prueba2.

tried to swing over Regex but I haven't figured it out yet
Subject: [\r\n]+([^\r\n]+)

Open in new window

Avatar of oBdA

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of J0rtIT


Thank you OBDA, I was thinking what would you think about it haha.
Thank you!

is there any change to do it with Get-EventLog ? (it was the one I was using)
Avatar of oBdA

Get-EventLog is a legacy cmdlet; Get-WinEvent is more powerful.
If you're after the -After and/or -Before arguments from Get-EventLog, you can just add the StartTime and EndTime keys to the FilterHashTable.
Avatar of J0rtIT


Alrighty! I see that, I didn't know that I thought it was the other way around. :) Thank you Obda!