Event-log filtering

Anonymous
2021-07-30T17:54:25.913+00:00

Hello, I am new to powershell scripting. I need to retrieve logs that are for security, have the event id of 4659 and only filter/show the ones that the object is in C:\test, after that I want to display the account name and file path and time. Any ideas, I was thinking of using get event-log.

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,404 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. MotoX80 32,246 Reputation points
    2021-07-31T14:24:00.883+00:00

    Try this.

    $LookFor = 'c:\\test\\'
    $filter ='<QueryList>
      <Query Id="0" Path="Security">
        <Select Path="Security">*[System[(EventID=4659)]]</Select>
      </Query>
    </QueryList>'
    
    Get-WinEvent  -FilterXml $filter | Where-Object -Property Message -match $LookFor | foreach {
      [PSCustomObject]@{
            User = $_.properties[1].value
            File = $_.properties[6].value
        }
    }
     
    
    0 comments No comments