Hi,
I am new to PS. I want to use PS to search the security event log for failed logins and have it output the account name that failed the login, the date/time it occurred, and the reason. Those are the only things I wanted shown.
If I run the following command
GET-EVENTLOG -Logname Security -InstanceId 4625 | export-csv C:\failed.csv
then I get output that had date/time and 4625 events but the Username field is empty for some reason. I would like to know the username that failed the login.
Similary I want to run a command to capture the date/time and username of successful login attempts and have the output only be the date/time and username of the succesful login.
Please help.