Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- $domainControllers = Get-ADDomainController -Filter *
- $eventIDs = 39,40,41
- $regex = [regex]::new("User:.*")
- $results = @()
- foreach ($dc in $domainControllers) {
- Write-Host "Querying $($dc.Name)..."
- $events = Get-WinEvent -ComputerName $dc -FilterHashtable @{LogName='System';Id=$eventIDs} | where {$_.ProviderName -eq "Microsoft-Windows-Kerberos-Key-Distribution-Center"} | Select-Object TimeCreated, Id, Message, MachineName
- $results += $events
- }
- $arr = @()
- foreach ($event in $results) {
- $msg = ($regex.Match($event.message).Value).replace("User: ","").replace('$','').Trim()
- $obj = [pscustomobject]@{
- Computer = $event.machineName
- Time = $event.timecreated
- ID = $event.ID
- Message = $msg
- }
- $arr += $obj
- }
- $arr | sort time -desc | ft
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement