Saturday, May 11, 2013

Windows Event Log Query Resources

 

Event Selection - MSDN

Advanced XML Filtering  - by Ned Pyle

Authoring Event Rules in OpsMgr – by  christow

 

Example:

# XPath compound filter
$filter=@"
*[System[(EventID=4624)]] and
*[EventData[Data[@Name='TargetUserName'] and (Data='$targetusername')]]
"
@

# collect all events
$events=@()
$username=Get-Username
$domain=[system.directoryservices.activedirectory.domain]::GetCurrentDomain()
Foreach($dc in $domain.DomainControllers){
$events+=Get-WinEvent -LogName security -FilterXPath $filter -ComputerName $dc
}