The functions contained in this module will assist in harvesting data from event logs for various events.
Install-Module -Name PoShEventsIf you need to determine if a particular policy has applied to a user or computer, you can use the Get-GPOProcessingEvent function.
Get-GPOProcessingEvent -MaxEvents 10 | Out-GridViewThis command will show the last 10 group policy processing events on the local system in gridview. You can then sort or enter additional criteria in the gridview.
Logon failure events, those events with Ids of 4625 and 4771, can be found using the Get-LogonFailureEvent function.
The Get-PrintDocumentEvent function will show you all of the successful print jobs that the system has processed.
C:\PowerShell\Get-PrintDocumentEvent -ComputerName printsvc -MaxEvents 1 -Oldest
ComputerName : PRINTSVR
TimeCreated : 10/5/2017 8:12:05 AM
PrintJobId : 234
DocumentName : Print Document
UserName : <user name>
ClientMachineName : <system name>
PrinterName : <generic printer name>
PrinterPort : IP_<printer IP>
DocumentSizeBytes : 1557928
DocumentPageCount : 2Use Get-RemoteLogonEvent to show all remote desktop connections.
[This function needs to be refactored to use Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational. Also, auditing would need to be enabled for this function to useful.]
The Get-ServiceEvent function will query the specified system for all service control manager events for service operations, stop, and start events. You can then filter on a particular service name or service DisplayName.
PS C:\PowerShell\Temp> (Get-ServiceEvent).Where({$_.ServiceDisplayName -match "print"}) | Select-Object -Property TimeCreated,EventType,ServiceName,ServiceDisplayName,Message
TimeCreated : 9/12/2017 9:41:27 PM
EventType : ServiceOperations
ServiceName :
ServiceDisplayName : Printer Extensions and Notifications
Message : The Printer Extensions and Notifications service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not function
properly.
TimeCreated : 10/3/2017 10:42:18 PM
EventType : ServiceOperations
ServiceName : Spooler
ServiceDisplayName : Print Spooler
Message : The start type of the Print Spooler service was changed from auto start to demand start.
TimeCreated : 10/3/2017 10:42:20 PM
EventType : ServiceOperations
ServiceName : Spooler
ServiceDisplayName : Print Spooler
Message : The start type of the Print Spooler service was changed from demand start to auto start.You can quickly find out when a system was restarted and what process or user initiated the restart using the Get-SystemRestartEvent function.
Get-SystemRestartEvent -ComputerName DC1 -MaxEvents 10
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent