Windows命令行查询远程登录失败记录

biubiu(づ￣3￣)づ╭～

已于 2023-05-19 10:17:54 修改

阅读量761

点赞数

文章标签： windows

于 2023-05-19 10:11:15 首次发布

本文链接：https://blog.csdn.net/huangrongkun_/article/details/130575634

版权

打开Windows PowerShell执行命令，CMD命令行执行命令会报错；
查询的成功记录会保存到c:\success.xlsx文件
查询的失败记录会保存到c:\fail.xlsx文件

#查询远程近3天登录成功记录
$StartTime = (Get-Date).AddDays(-3)
$AllEntries = Get-WinEvent -FilterHashtable @{ LogName='Security';StartTime = $StartTime;Id=4624}
$AllEntries | Foreach {$entry = [xml]$_.ToXml();[array]$Output += New-Object PSObject -Property @{TimeCreated = $_.TimeCreated;IPAddress = $entry.SelectSingleNode("//*[@Name='IpAddress']").innerxml;TargetUserName = $entry.SelectSingleNode("//*[@Name='TargetUserName']").innerxml}}
$Output | Select TimeCreated,TargetUserName,IPAddress | findstr /v " -" > c:\success.xlsx

#查询远程近3天登录失败记录
$StartTime = (Get-Date).AddDays(-3)
$AllEntries = Get-WinEvent -FilterHashtable @{ LogName='Security';StartTime = $StartTime;Id=4625}
$AllEntries | Foreach {$entry = [xml]$_.ToXml();[array]$Output += New-Object PSObject -Property @{TimeCreated = $_.TimeCreated;IPAddress = $entry.SelectSingleNode("//*[@Name='IpAddress']").innerxml;TargetUserName = $entry.SelectSingleNode("//*[@Name='TargetUserName']").innerxml}}
$Output | Select TimeCreated,TargetUserName,IPAddress > c:\fail.xlsx

#查询活跃的链接
netstat -ano | findstr /i "ESTABLISHED"

#查询监听的端口
netstat -ano | findstr /i "LISTENING"