daily pastebin goal
62%
SHARE
TWEET

Generate List of RDS logon and logoff events

anonit May 24th, 2015 (edited) 66 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. # Generates a csv file of RDS Logons on given servers.
  2.  
  3. <#
  4. This will list:
  5.  
  6. Date/Time , logon or logoff, Event ID, Username, SessionID, Source IPAddress, Computer user logged onto.
  7.  
  8. Eg:
  9.  
  10. 2015-04-28T15:38:22,23,logoff,andrewst,6,,Server08
  11. 2015-04-28T15:36:37,23,logoff,sheffieldd,3,,Server10
  12. 2015-04-28T15:30:40,21,logon,ryank,4,172.16.0.122,Server08
  13. 2015-04-28T15:21:13,23,logoff,powelll,8,,Server09
  14. 2015-04-28T15:12:35,21,logon,sheffieldd,3,172.16.0.138,Server10
  15.  
  16. The output can be sorted by date / Time.  The date / time is specifically in this format to make sorting easier.  Logoff events have no IP address associated.  For best results, use the File -> Open option in Excel to import the file as a Comma separated file.
  17.  
  18.  
  19. Parameters:
  20. ComputerList - list of computer names or IP Addresses to check
  21. OutputFile - the csv that will be written to
  22. DomainName - the domain name (will be removed from output to make analysis easier
  23. #>
  24.  
  25. $outputFile="\\server11\audit\RDSLogons.csv"
  26. $ComputerList="Server08","Server09","Server10"
  27. $DomainName="QLDPAPER"
  28.  
  29.  
  30.  
  31. ## This will get the Event ID 23 and 21 from LocalSessionManager logs of a list of given computers and export them.
  32.  
  33. $TodaysDate=get-date -UFormat "%Y%m%d"
  34. $TodaysTime=get-date -UFormat "%H%M"
  35. $TempFile1="$env:TEMP`\Userlogons$TodaysDate$TodaysTime.csv1"
  36. $TempFile2="$env:TEMP`\Userlogons$TodaysDate$TodaysTime.csv2"
  37. $TempFile3="$env:TEMP`\Userlogons$TodaysDate$TodaysTime.csv3"
  38.  
  39. ## Create the date time object.  We will overwrite this data, but using this object gives us the structure.
  40. $datetimeobject=new-object DateTime
  41.  
  42. ## Delete the outputFile
  43. remove-item $outputFile
  44.  
  45. Foreach ($Computer in $ComputerList)
  46. {
  47.     ## Cycle through each server and get the LocalSessionManager logs, where the event ID is 23 or 21.  Export to CSV.
  48.     get-winevent -logname *LocalSessionManager* -computername $Computer | select timecreated, id, message, $Computer | where-object {($_.id -eq "23") -or ($_.id -eq "21")} | export-csv $TempFile1 -notypeinformation
  49.  
  50.     ## Import the first file skipping the first line to remove the headers.
  51.     get-content $TempFile1 | select -skip 1 | set-content $TempFile2
  52.    
  53.    
  54.    
  55.     ## Remove the unnecessary CRLF, domain, extraneous detail
  56.     [STRING]$StringCleanup=[io.file]::ReadAllText($TempFile2)
  57.     $StringCleanup=$StringCleanup -replace ":`\r`\n`\r`\nUser: ","`",`""
  58.     $StringCleanup=$StringCleanup -replace "$DomainName\\",""
  59.     $StringCleanup=$StringCleanup -replace "`\r`\nSession ID: ","`",`""
  60.     $StringCleanup=$StringCleanup -replace "`\r`\nSource Network Address: ","`",`""
  61.     $StringCleanup=$StringCleanup -replace "Remote Desktop Services: Session logon succeeded","logon"
  62.     $StringCleanup=$StringCleanup -replace "Remote Desktop Services: Session logoff succeeded","logoff"
  63.     $StringCleanup=$StringCleanup -replace "Remote Desktop Services: Session logoff succeeded","logoff"
  64.    
  65.     ## Add the header again and export
  66.     $StringCleanup='"Date","EVENTID","Event","User","SessionID","IP","Server"' + "`r`n"+$StringCleanup
  67.     $StringCleanup | out-file $Tempfile3 -force
  68.  
  69.  
  70.     ## The date time is still a separate item:  EG:  25/05/2015 8:00:25 AM
  71.     ## Convert this into a datetime object and cast as sortable (ISO8601)
  72.     ## Do this per line
  73.     $ResetDateTime=Import-csv $TempFile3
  74.     $ResetDateTime | foreach-object {
  75.         $newdate=[datetime]::ParseExact($_.date,"d/MM/yyyy h:mm:ss tt",[System.Globalization.CultureInfo]::InvariantCulture,[System.Globalization.DateTimeStyles]::none)
  76.         $newdate=$newdate.GetDateTimeFormats('s')
  77.  
  78.         ## Create a new item to hold the line, remove the <space>,<space> errors introduced in converting the time
  79.         [string]$outputtowrite=$newdate+","+$_.EventID+","+$_.Event+","+$_.User+","+$_.SessionID+","+$_.IP+","+$Computer
  80.         $outputtowrite=$outputtowrite -replace " , ",","
  81.        
  82.         ## Output the file
  83.         $outputtowrite | out-file $outputFile -append
  84.  
  85.     }
  86. }
RAW Paste Data
Top