Quantcast
Channel: PowerShell.com – PowerShell Scripts, Tips, Forums, and Resources
Viewing all articles
Browse latest Browse all 6937

Get-WinEvent output to 1 Table vs a Table for each event it finds

$
0
0

I like to know how to have my output  into 1 Table -vs- a separate Table for each event it collects .   I would like it get 1 of the newest items from Each Domain Controller when a alert is triggered.

$Report= "c:\Temp\Account_Expired_Disabled_Email.html" 

$DC = "DC1","DC2"

#Account is Disabled or Password has Expired Report.
# $header = "<H3>User Account is Disabled  or  Password has Expired "+(get-date -f D)+"</H3>" 
$GetDate = (get-date -f D)

$HTML=@"
<title>Account is Disabled or Password has Expired Report.</title>
<style>
BODY{font-family:Verdana; background-color:white;} 
TABLE{border-width: 1px;border-style:solid;border-color: black;border-collapse: collapse;} 
TH{font-size:1em; border-width: 1px;padding: 5px;border-style: solid;border-color: black;background-color:#C2B8AF} 
TD{border-width: 1px;padding: 5px;border-style:  solid;border-color: black;background-color:#F6F8FC} 
H2{color: #457dcf;font-family: Arial, Helvetica, sans-serif;font-size: medium; margin-left: 55px;
</style>
"@

$_logontype = @{
    2 = "Interactive  2"
    3 = "Network  3"
    4 = "Batch 4 "
    5 = "Service  5"
    7 = "Unlock  7"
    8 = "NetworkCleartext  8"
    9 = "NewCredentials  9"
    10 = "RemoteInteractive  10"
    11 = "CachedInteractive  11"
}

Foreach ($Server in $DC) {

 Get-WinEvent -ComputerName $Server -Max 1 -FilterHashtable @{logname='Security'; id=4625} |

ForEach-Object {

  
   $Event = New-Object PSObject | Select-Object Date,"Event Id", "User Name","FaliureReason", "Status Code", "DC Logged On", "Logon Type"
   $Event.Date = $_.TimeCreated
   $Event."Event Id" = $_.Id
   $Event."User Name" = $_.Properties[5].Value + "\" + $_.Properties[6].Value
   $Event."FaliureReason" = (($_.message -split "\n") | Select-String -Pattern "Failure Reason:\s+(.+)").matches[0].groups[1].value
   $Event."Status Code" = $_.message -split '\s{4}' | Select-String -Pattern "Status"
   $Event."Logon Type" =  $_logontype[ [int] $_.Properties[10].Value ]
   $Event."DC Logged On" = $_.properties[13].value
  

$Event | Select-Object Date, "Event Id","User Name","FaliureReason","Status Code", "DC Logged On", "Logon Type" | Convertto-html -head $HTML -body "<H2>User Account is Disabled or Password has Expired or Locked Out</H2>", "<H2>$GetDate </H2>" | Out-File $Report -append

    }

  }

 

 

 

 

 


Viewing all articles
Browse latest Browse all 6937

Trending Articles