Exclude from powershell script

Priscilla Ferreira 21 Reputation points
2022-09-21T16:12:58.83+00:00

I am thinking of excluding an user from the script below, meaning excluding the "SRV08$" , may you please assist me on how I can update the following script to achieve this:

$hosts = @(  
'LOCALHOST'  
  
)  
  
foreach ($servidor in $hosts) {  
  
    $LogFilter = @{  
        LogName = 'SECURITY'  
        ID = 4663  
        }  
  
    $entradas = Get-WinEvent -FilterHashtable $LogFilter -ComputerName $servidor  
  
    $entradas | Foreach {   
           $entrada = [xml]$_.ToXml()  
        [array]$saida += New-Object PSObject -Property @{  
            DATA_HORA = $_.TimeCreated   
            USUARIO = $entrada.Event.EventData.Data[1]."#text"  
            ARQUIVO = $entrada.Event.EventData.Data[6]."#text"  
            EventID = $entrada.Event.System.EventID  
            HOST = $servidor  
            }          
           }   
  
}  
  
$exportar += $saida | Select DATA_HORA, USUARIO, ARQUIVO, @{Name='STATUS';Expression={  
            if ($_.EventID -eq '4663'){"DELETADO"}  
              
            }  
        }  
  
$data = (Get-Date -Format d) -replace "/", "-"  
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,403 questions
0 comments No comments
{count} votes

Accepted answer
  1. Rich Matheisen 45,111 Reputation points
    2022-09-21T18:28:26.113+00:00

    Try this:

    $hosts = @(  
        'LOCALHOST'  
    )  
      
    $LogFilter = @{  
        LogName = 'SECURITY'  
        ID      = 4663  
    }  
      
    $exportar = $hosts |  
                    ForEach-Object{  
                        $servidor = $_  
                        Get-WinEvent -FilterHashtable $LogFilter -ComputerName $_  
                            ForEach-Object{  
                                $entrada = [xml]$_.ToXml()  
                                [PSCustomObject]@{  
                                    DATA_HORA = $entrada.event.System.TimeCreated.SystemTime  
                                    USUARIO   = $entrada.Event.EventData.Data[1]."#text"  
                                    ARQUIVO   = $entrada.Event.EventData.Data[6]."#text"  
                                    EventID   = $entrada.Event.System.EventID  
                                    HOST      = $servidor  
                                }  
                            } |  
                                Where-Object {$_.USARIO -ne "SRV08$"} |  
                                    Select-Object DATA_HORA, USUARIO, ARQUIVO, @{Name = 'STATUS'; Expression = {if ($_.EventID -eq '4663') { "DELETADO" }}}  
                    }  
      
    $data = (Get-Date -Format d) -replace "/", "-"  
    
    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful