Get-Winevent Part III: Querying the Event Log for Logons (Part D)

In Part A of this series ('Get-Winevent Part III Querying the Event Log for logons'), I worked with the 'where-object' cmdlet to filter through properties of specific logon event types. In Part B, I used '-filterhashtable' and 'findstr' to more quickly dig into the message field of logon events, utlimately producing a spreadsheet or database format of those events. In Part C, I presented code that enumerates all provider types for these events.  Then I used '-filterhashtable' with an array of multiple security EventIDs whose select 'Message' fields I searched with 'findstr' for specific properties relating to logons.  In this post (Part D),  I pull this all together, creating a timeline of multiple security EventIDs whose select 'Message' fields I pump into a spreadsheet for further analysis.


Here I get the desired 'logon' events into spreadsheet format:

$EventLogonIDs="4611","4624","4625","4634","4647","4648","4672","4774","4775","4908","4964"
$MultipleIDLogEntries=Get-WinEvent -FilterHashtable @{Logname='security';Id=@($EventLogonIDs)}
foreach ($item in  $MultipleIDLogEntries) {($item | Select TimeCreated, Message | fl * | findstr /G:search.lst) -replace"  ","" -join "," | out-file -append test5.csv }


where search.lst :

TimeCreated
Security ID:
Account Name:
Account Domain:
Logon ID:
Logon Type:
Logon GUID:
Process Name:

Now I get the desired 'sleep' events into spreadsheet format. (My original concern was understanding a why my Windows 7 PC spontaneously "resumes from sleep" by itself and seemingly commences a log-on.)

$EventLogonIDs="1","42"
$MultipleIDLogEntries=Get-WinEvent -FilterHashtable @{Logname='system';Id=@($EventLogonIDs)}
foreach ($item in  $MultipleIDLogEntries) {($item | Select TimeCreated, Message | fl * | findstr /I /G:search.lst) -replace"  ","" -join "," | out-file -append test6.csv }


where search.lst :

TimeCreated
sleep


Now I mux the two data sets and output the combined csv:

$a=gc .\test5.csv
$b=gc .\test6.csv
$c=$a+$b
$c | out-file test7.csv

Once I translate the csv to a spreadsheet's native format, add column headers, format the Date/Time Column (the unique identifier for our purposes) and sort by Date/Time, I have a story book of events for the muxed security (e.g. 'logon') and system (e.g. 'sleep') events:

Next we need to discuss how to add additional Security auditing events to our storybook in Part E.

Read More

Get-Winevent Part III: Querying the Event Log for Logons (Part C)

To list Opcodes, Event IDs, Event Descriptions from any group of provider's (e.g. Securit*) events, you can use:

$ProviderNames=get-winevent -listprovider microsoft-windows-Securit* | % {$_.Name}
$ProviderNames | % {((get-winevent -listprovider $_).events) | format-table @{Name="Opcode"; Expression = {$_.Opcode.Name}},ID,Description -auto -wrap}


To create a list of EventIDs from the Security Log for which want more information, we could download  "Windows 7 and Windows Server 2008 R2 Security Event Descriptions"   or we could select the string log from our provider query:

$ProviderNames | % {((get-winevent -listprovider $_).events) | format-table @{Name="Opcode"; Expression = {$_.Opcode.Name}},ID,Description | findstr "win:"} | out-file  SecurityIDs.txt
Select-string "log" -path SecurityIDs.txt | ft -auto Line

           4611 A trusted logon process has been registered with the Local ...
           4624 An account was successfully logged on....
           4625 An account failed to log on....
           4634 An account was logged off....
           4647 User initiated logoff:...
           4648 A logon was attempted using explicit credentials....
           4672 Special privileges assigned to new logon....
           4774 An account was mapped for logon....
           4775 An account could not be mapped for logon....
           4908 Special Groups Logon table modified....
           4964 Special groups have been assigned to a new logon....

Now we query all of our particular IDs in question using the search list for findstr below:

$LogonIDs="4611","4624","4625","4634","4647","4648","4672","4774","4775","4908","4964"
foreach ($item in $LogonIDs) {(Get-WinEvent -max 100 -FilterHashtable @{Logname='security';Id=$item} | Select TimeCreated,Message | fl * | findstr /G:search.lst) -replace"  "," " | out-file -append "$item.txt" }

where search.lst :

TimeCreated
Security ID:
Account Name:
Account Domain:
Logon ID:
Logon Type:
Logon GUID:
Process Name:

This gives us some hits for the EventID numbers in separate files which contain entries that look like this:

PS C:\ps1> more 4624.txt
TimeCreated : 7/2/2011 7:25:59 PM
                  Security ID:        S-1-5-18
                  Account Name:        RMFVPC$
                  Account Domain:        RMFDEVELOPMENT
                  Logon ID:        0x3e7
              Logon Type:            5
                  Security ID:        S-1-5-18
                  Account Name:        SYSTEM
                  Account Domain:        NT AUTHORITY
                  Logon ID:        0x3e7
                  Logon GUID:        {00000000-0000-0000-0000-000000000000}
                  Process Name:        C:\Windows\System32\services.exe
....
But this type of query isn't very fast. So we can tuck our array of events inside a '-FilterHashtable' array and then query the message field with 'findstr':

$LogonIDs="4611","4624","4625","4634","4647","4648","4672","4774","4775","4908","4964"
$MultipleIDLogEntries=Get-WinEvent -max 100 -FilterHashtable @{Logname='security';Id=@($LogonIDs)}
($MultipleIDLogEntries | Select TimeCreated,Message | fl * | findstr /G:search.lst) -replace" "," " | out-file -append Events_all.txt

This output also contain entries that look like this:

PS C:\ps1> more Events_all.txt
TimeCreated : 7/2/2011 7:25:59 PM
                  Security ID:        S-1-5-18
                  Account Name:        SYSTEM
                  Account Domain:        NT AUTHORITY
                  Logon ID:        0x3e7
TimeCreated : 7/2/2011 7:25:59 PM
                  Security ID:        S-1-5-18
                  Account Name:        RMFVPC$
                  Account Domain:        RMFDEVELOPMENT
                  Logon ID:        0x3e7
              Logon Type:            5
                  Security ID:        S-1-5-18
                  Account Name:        SYSTEM
                  Account Domain:        NT AUTHORITY
                  Logon ID:        0x3e7
                  Logon GUID:        {00000000-0000-0000-0000-000000000000}
                  Process Name:        C:\Windows\System32\services.exe

But what we really need is a way to parse this output into a csv... so on to  Get-Winevent Part III: Querying the Event Log for Logons (Part D)

Read More

Get-Winevent Part III: Querying the Event Log for Logons (Part B)

This is a long post that I've edited from a answer I gave on Stack Overflow.  Although the post is about how to audit logon information in the Security log of Windows 7, it is also about discovering methods to extract critical information from the 'Message' field of a "Logon Type" (ID=4624).  




Get-WinEvent -max 100 | where { $_.Message | findstr /C:"Logon Type"}  | Select Message | fl * | findstr /C:"Logon Type"

  Logon Type:            5
  Logon Type:            7
  Logon Type:            7
  Logon Type:            7
  Logon Type:            7
  Logon Type:            5
  ...

Get-WinEvent Security -max 100 | Select ID,Level,Message | where { $_.Message | findstr /C:"Logon Type"}  | ft -auto -wrap | more

  Id Level Message
  -- ----- -------
4624     0 An account was successfully logged on.

           Subject:
               Security ID:        S-1-5-18
               Account Name:        RMFVPC$
               Account Domain:        RMFDEVELOPMENT
               Logon ID:        0x3e7

           Logon Type:            5
....
Now I introduce '-FilterHashtable' parameter which greatly speeds up queries. Below are two commands which do essentially the same thing in about the same period of time:

Get-WinEvent -max 100 -FilterHashtable @{Logname='security';ID=4624} | ft TimeCreated,MachineName,Message -auto -wrap | more

Get-WinEvent -max 100 -FilterHashtable @{Logname='security';ID=4624} | Select TimeCreated,MachineName,Message | ft -auto -wrap | more

TimeCreated           MachineName Message
-----------           ----------- -------
6/29/2011 12:36:35 PM rmfvpc      An account was successfully logged on.

                                  Subject:
                                      Security ID:        S-1-5-18
                                      Account Name:        RMFVPC$
                                      Account Domain:        RMFDEVELOPMENT
                                      Logon ID:        0x3e7

                                  Logon Type:            5
...

Get-WinEvent -max 100 -FilterHashtable @{Logname='security';ID=4624} | Select TimeCreated,MachineName,Message | Select-string "Logon Type" | more

@{TimeCreated=06/29/2011 12:36:35; MachineName=rmfvpc; Message=An account was successfully logged on.

Subject:
    Security ID:        S-1-5-18
    Account Name:        RMFVPC$
    Account Domain:        RMFDEVELOPMENT
    Logon ID:        0x3e7

Logon Type:            5
...
This last script allows me to dump pre-selected information from the logon events Message field into a spreadsheet. Very useful.

 $LogonTypes=Get-WinEvent -FilterHashtable @{Logname='security';Id=4624}
 foreach ($item in $LogonTypes) {($item | Select TimeCreated, Message | fl * | findstr /G:search.lst) -replace"  ","" -join "," | out-file -append test3.csv }

where search.lst :

TimeCreated
Security ID:
Account Name:
Account Domain:
Logon ID:
Logon Type:
Logon GUID:
Process Name:

The result is a spreadsheet that looks like this:

However, what I need is to be able to search the message field of multiple 'logon' events types...so on to

Get-Winevent Part III: Querying the Event Log for Logons (Part C)

Read More