windows 安全核查脚本系列

安全核查-核查登录日志

$startDate = (Get-Date).AddMonths(-6)
$endDate = Get-Date

$eventLog = Get-WinEvent -FilterHashtable @{
LogName = ‘Security’
ID = 4624
StartTime = $startDate
EndTime = $endDate
} -EA SilentlyContinue

if (KaTeX parse error: Expected '}', got 'EOF' at end of input: …{ foreach (event in $eventLog) {
$timeCreated = $event.TimeCreated
$userName = $event.Properties[5].Value
$ipAddress = $event.Properties[18].Value
$logonType = $event.Properties[8].Value

    Write-Host "Time Created: $timeCreated"
    Write-Host "Username: $userName"
    Write-Host "IP Address: $ipAddress"
    Write-Host "Logon Type: $logonType"
    Write-Host "-----------------------------"
}

} else {
Write-Host “No login events found in the last 6 months.”
}