{"id":4647,"date":"2020-05-14T04:43:51","date_gmt":"2020-05-14T04:43:51","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=4647"},"modified":"2022-12-02T03:27:26","modified_gmt":"2022-12-02T03:27:26","slug":"reporting-on-event-id-logon-4624-and-7001-with-powershell","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/reporting-on-event-id-logon-4624-and-7001-with-powershell","title":{"rendered":"Reporting on Event ID ( logon ) 4624 and 7001 with Powershell"},"content":{"rendered":"\n

Find users who have physically logged into a machine 7001<\/p>\n\n\n

\n\t
param(    [alias("CN")]    $ComputerName="localhost")$UserProperty = @{n="User";e={(New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])}}$TypeProperty = @{n="Action";e={if($_.EventID -eq 7001) {"Logon"} else {"Logoff"}}}$TimeProperty = @{n="Time";e={$_.TimeGenerated}}$MachineNameProperty = @{n="MachinenName";e={$_.MachineName}}foreach ($computer in $ComputerName) {    Get-EventLog System -Source Microsoft-Windows-Winlogon -ComputerName $computer | select $UserProperty,$TypeProperty,$TimeProperty,$MachineNameProperty}<\/code><\/pre> 
 <\/div> <\/div><\/div>\n\n\n\n
Find users who have authenticated with different login types<\/p>\n\n\n
\n\t
 
get-eventlog -ComputerName "localhost" -logname \u2019security\u2019 -instanceid 4624 -after (get-date).adddays(-10) | % {     [array] $login += [pscustomobject] @{            account = $_.replacementstrings[5]        time = $_.timewritten        type = $_.replacementstrings[8]        ip = $_.replacementstrings[18]}} $login | ft -auto <\/code><\/pre> 
 <\/div> <\/div><\/div>\n","protected":false},"excerpt":{"rendered":"
Find users who have physically logged into a machine 7001 Find users who have authenticated with different login types<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4647","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t