Event-log filtering

Question

Hello, I am new to powershell scripting. I need to retrieve logs that are for security, have the event id of 4659 and only filter/show the ones that the object is in C:\test, after that I want to display the account name and file path and time. Any ideas, I was thinking of using get event-log.

Answer 1

Try this.

$LookFor = 'c:\\test\\'
$filter ='<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4659)]]</Select>
  </Query>
</QueryList>'

Get-WinEvent  -FilterXml $filter | Where-Object -Property Message -match $LookFor | foreach {
  [PSCustomObject]@{
        User = $_.properties[1].value
        File = $_.properties[6].value
    }
}