远程 PowerShell，查找最近 5 个用户登录

我尝试在安全事件发生后以管理员身份查看企业计算机上的最后 5 个登录事件。我进行了初步调查，并试图找到一种方法来快速列出潜在的“嫌疑人”名单。

我已经能够生成列出日志文件的输出，但在您通常会看到的帐户名称下\域名\用户名我只得到输出“SYSTEM”或类似的输出。

如果我最近远程连接到机器，它会拉动我的\域名\用户名并且显示没有问题。

理想情况下，我想制作一个脚本，从网络上的计算机中提取登录事件，并列出最近登录的人员和时间。

这是我到目前为止所拥有的：

Get-EventLog -LogName security -InstanceId 4624 -ComputerName $_Computer -Newest 5 | Export-Csv C:\Users\username\Documents\filename

这使用速度更快Get-WinEventcmdlet 和-FilterHashtable参数可以加快速度并添加更多选择器。您可能想删除一些过滤器 - 这是很久以前为另一个项目编写的。 [grin]

#requires -RunAsAdministrator

# there REALLY otta be a way to get this list programmatically
$LogonTypeTable = [ordered]@{
    '0' = 'System'
    '2' = 'Interactive'
    '3' = 'Network'
    '4' = 'Batch'
    '5' = 'Service'
    '6' = 'Proxy'
    '7' = 'Unlock'
    '8' = 'NetworkCleartext'
    '9' = 'NewCredentials'
    '10' = 'RemoteInteractive'
    '11' = 'CachedInteractive'
    '12' = 'CachedRemoteInteractive'
    '13' = 'CachedUnlock'
    }
$EventLevelTable = [ordered]@{
    LogAlways = 0
    Critical = 1
    Error = 2
    Warning = 3
    Informational = 4
    Verbose = 5
    }


$WantedLogonTypes = @(2, 3, 10, 11)
$AgeInDays = 15
$StartDate = (Get-Date).AddDays(-$AgeInDays)

$ComputerName = $env:COMPUTERNAME
$GWE_FilterHashTable = @{
    Logname = 'Security'
    ID = 4624
    StartTime = $StartDate
    #Level  = 2
    }
$GWE_Params = @{
    FilterHashtable = $GWE_FilterHashTable
    ComputerName = $ComputerName
    MaxEvents = 100
    }
$RawLogonEventList = Get-WinEvent @GWE_Params

$LogonEventList = foreach ($RLEL_Item in $RawLogonEventList)
    {
    $LogonTypeID = $RLEL_Item.Properties[8].Value
    if ($LogonTypeID -in $WantedLogonTypes)
        {
        [PSCustomObject]@{
            LogName = $RLEL_Item.LogName
            TimeCreated = $RLEL_Item.TimeCreated
            UserName = $RLEL_Item.Properties[5].Value
            LogonTypeID = $LogonTypeID
            LogonTypeName = $LogonTypeTable[$LogonTypeID.ToString()]
            }
        }
    }

$NewestLogonPerUser = $LogonEventList |
    Sort-Object -Property UserName |
    Group-Object -Property UserName |
    ForEach-Object {
        if ($_.Count -gt 1)
            {
            $_.Group[0]
            }
            else
            {
            $_.Group
            }
        }

$NewestLogonPerUser

我的系统上的当前输出...

LogName       : Security
TimeCreated   : 2019-01-24 1:50:44 PM
UserName      : ANONYMOUS LOGON
LogonTypeID   : 3
LogonTypeName : Network

LogName       : Security
TimeCreated   : 2019-01-24 1:50:50 PM
UserName      : [MyUserName]
LogonTypeID   : 2
LogonTypeName : Interactive