Exporting the Get-EventLog to .CSV ?

Ask your PowerShell-related questions, including questions on cmdlet development!
Forum rules
Do not post any licensing information in this forum.

Any code longer than three lines should be added as code using the 'Select Code' dropdown menu or attached as a file.
This topic is 5 years and 9 months old and has exceeded the time allowed for comments. Please begin a new topic or use the search feature to find a similar but newer topic.
Locked
User avatar
ITEngineer
Posts: 216
Last visit: Thu Mar 23, 2023 5:45 pm
Has voted: 4 times

Exporting the Get-EventLog to .CSV ?

Post by ITEngineer »

People,

I need some assistance here to modify the below PowerShell script to pull some information from the Security EventLog ID 4624, 4625, 4723 and 4724... using the below PowerShell script:

Code: Select all

Get-ADComputer -LDAPFilter "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" | ForEach-Object {
    "Processing $($_.DNSHostName) ..." | Write-Host
    Get-Eventlog -logname "Security" -ComputerName $_.Name | where {($_.eventID -eq 4624) -or ($_.eventID -eq 4625) -or ($_.eventID -eq 4723) -or ($_.eventID -eq 4724) } | select timegenerated,message | ft -Wrap
}
The script above is working, but there is no way to export it to .CSV file with the below column:
DomainController, Time generated, Account Name, Workstation Name, Logon Type
I will make sure that it is executed using The PowerShell ISE on the Domain Controllers Run as Administrator under the Enterprise Admins credentials to work.

Thanks in advance.
/* IT Engineer */
jvierra
Posts: 15439
Last visit: Tue Nov 21, 2023 6:37 pm
Answers: 30
Has voted: 4 times
Been upvoted: 33 times

Re: Exporting the Get-EventLog to .CSV ?

Post by jvierra »

Start with:'
]b]help Get-WinEvent -online[/b]

Read the Examples very carefully.
User avatar
ITEngineer
Posts: 216
Last visit: Thu Mar 23, 2023 5:45 pm
Has voted: 4 times

Re: Exporting the Get-EventLog to .CSV ?

Post by ITEngineer »

jvierra wrote: Mon Jun 04, 2018 2:26 am Start with:'
]b]help Get-WinEvent -online[/b]

Read the Examples very carefully.
OK, I then come up with the below modified script:

Code: Select all

Get-ADComputer -LDAPFilter "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" | ForEach-Object {
	"Processing $($_.DNSHostName) ..." | Write-Host
	Get-WinEvent -ComputerName $_.Name -FilterHashTable @{ LogName = "Security"; ID = 4625; Data = "DOMAIN\First.Lastname" } -MaxEvents 100
} | Export-Csv -Path C:\4625.csv -NoTypeInformation -UseCulture
Is that correct or why there is no result ?
/* IT Engineer */
jvierra
Posts: 15439
Last visit: Tue Nov 21, 2023 6:37 pm
Answers: 30
Has voted: 4 times
Been upvoted: 33 times

Re: Exporting the Get-EventLog to .CSV ?

Post by jvierra »

The username is not one property. It is stored in two properties. You can only select one.

@{ LogName = "Security"; ID = 4625; Data = "First.Lastname" }[\b]
This topic is 5 years and 9 months old and has exceeded the time allowed for comments. Please begin a new topic or use the search feature to find a similar but newer topic.
Locked