Last active
June 17, 2024 14:51
-
-
Save laymanstake/a4184e7dd75d7cf68d303e6436b1fb4e to your computer and use it in GitHub Desktop.
To fetch specific event from all domain controllers Security logs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Get list of all domain controllers | |
$Dcs = Get-ADDomainController -filter * | |
#Target last 7 days logs | |
$StartDate = (Get-Date).AddDays(-7) | |
# Can change event ID here | |
$eventId = 4738 | |
$count = $dcs.count | |
$i = 0 | |
$EventJobs = @() | |
$Events = @() | |
ForEach($dc in $dcs){ | |
$i++ | |
Write-Host "Working on $($i)/$($count) $($dc.Hostname)" | |
$job = Start-Job -scriptblock { | |
Param ($StartDate, $DC, $EventId) | |
try{ | |
Get-WinEvent -ComputerName $Dc.HostName -FilterHashtable @{ | |
LogName = "Security" | |
Id = $EventId | |
StartTime = $startDate | |
} | |
} catch { | |
Write-Host "Unable to get logs from $($Dc.Hostname)" | |
} | |
} -argumentlist $startDate, $Dc, $EventId | |
$EventJobs += $Job | |
} | |
# Wait for all jobs to complete | |
$null = $EventJobs | Wait-Job | |
# Collect results from completed jobs | |
foreach ($job in $EventJobs) { | |
$Events += Receive-Job -Job $job | |
} | |
$events | Select-Object TimeCreated, Id, Message, ProviderName, LogName, MachineName | Export-csv -nti c:\temp\selogs.csv | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment