Pulling down a list of users from the event log in Powershell.

[Garacesh]

Get-WinEvent -Computername $Name -FilterHashTable @{ProviderName="Microsoft-Windows-Security-Auditing"; ID="4624"} -MaxEvents 20

 

This should pull down the last 20 events on the remote machine that were generated by Microsoft Windows Security Auditing with the ID of 4624, which is Logon events. And it kind of does.

 

TimeCreated and ID come back great, it tells me the most recent one was 13/09/2013 11:57:56 and its ID was (as specified) 4624.. But that's all it tells me. It gives me no information about the actual user that logged on or any contents of the log at all, but from reading the Technet page about Get-WinEvent I can't see any any way to get the information I need.

 

Anybody happen to have done something similar to this that might be able to point me in the right direction?

[Garacesh]

Update: Figured it out. The 'Message' column being empty is a bug in Powershell v3 and the command works fine as Powershell v2..

How to just find out how to invoke a script in v2 not v3..

 

Powershell -Version 2 works, but won't run the script automatically. Even if the script is piped onto the command, it loads PS2 and then waits for more instructions.

 

Edit: If any mod sees this, this thread can be closed, I guess. I've posted a new thread with a better explanation of the help I need now that I've progressed. Thanks!

Edited September 16, 2013 by Garacesh