+ Post New Thread
Results 1 to 2 of 2
Scripts Thread, Pulling down a list of users from the event log in Powershell. in Coding and Web Development; Get-WinEvent -Computername $Name -FilterHashTable @{ProviderName="Microsoft-Windows-Security-Auditing"; ID="4624"} -MaxEvents 20 This should pull down the last 20 events on the remote machine ...
  1. #1


    Join Date
    Jan 2012
    Posts
    2,614
    Thank Post
    934
    Thanked 350 Times in 266 Posts
    Rep Power
    212

    Pulling down a list of users from the event log in Powershell.

    Get-WinEvent -Computername $Name -FilterHashTable @{ProviderName="Microsoft-Windows-Security-Auditing"; ID="4624"} -MaxEvents 20

    This should pull down the last 20 events on the remote machine that were generated by Microsoft Windows Security Auditing with the ID of 4624, which is Logon events. And it kind of does.

    TimeCreated and ID come back great, it tells me the most recent one was 13/09/2013 11:57:56 and its ID was (as specified) 4624.. But that's all it tells me. It gives me no information about the actual user that logged on or any contents of the log at all, but from reading the Technet page about Get-WinEvent I can't see any any way to get the information I need.

    Anybody happen to have done something similar to this that might be able to point me in the right direction?

  2. #2


    Join Date
    Jan 2012
    Posts
    2,614
    Thank Post
    934
    Thanked 350 Times in 266 Posts
    Rep Power
    212
    Update: Figured it out. The 'Message' column being empty is a bug in Powershell v3 and the command works fine as Powershell v2..
    How to just find out how to invoke a script in v2 not v3..

    Powershell -Version 2 works, but won't run the script automatically. Even if the script is piped onto the command, it loads PS2 and then waits for more instructions.

    Edit: If any mod sees this, this thread can be closed, I guess. I've posted a new thread with a better explanation of the help I need now that I've progressed. Thanks!
    Last edited by Garacesh; 16th September 2013 at 04:01 PM.

SHARE:
+ Post New Thread

Similar Threads

  1. Administrator locked out of user files when students logged in
    By jgcracknell in forum Windows Server 2008 R2
    Replies: 0
    Last Post: 14th October 2011, 01:07 PM
  2. Replies: 2
    Last Post: 1st July 2009, 10:46 AM
  3. [Video] The Future of Telephones... from the GPO (pre BT)
    By mattx in forum Jokes/Interweb Things
    Replies: 1
    Last Post: 29th May 2009, 02:38 PM
  4. List of users
    By leco in forum MIS Systems
    Replies: 3
    Last Post: 26th January 2009, 01:46 PM
  5. List of users logged on a workstation
    By sLiDeR in forum Windows
    Replies: 6
    Last Post: 4th December 2007, 12:40 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •