I like to know how to have my output into 1 Table -vs- a separate Table for each event it collects . I would like it get 1 of the newest items from Each Domain Controller when a alert is triggered.
$Report= "c:\Temp\Account_Expired_Disabled_Email.html"
$DC = "DC1","DC2"
#Account is Disabled or Password has Expired Report.
# $header = "<H3>User Account is Disabled or Password has Expired "+(get-date -f D)+"</H3>"
$GetDate = (get-date -f D)
$HTML=@"
<title>Account is Disabled or Password has Expired Report.</title>
<style>
BODY{font-family:Verdana; background-color:white;}
TABLE{border-width: 1px;border-style:solid;border-color: black;border-collapse: collapse;}
TH{font-size:1em; border-width: 1px;padding: 5px;border-style: solid;border-color: black;background-color:#C2B8AF}
TD{border-width: 1px;padding: 5px;border-style: solid;border-color: black;background-color:#F6F8FC}
H2{color: #457dcf;font-family: Arial, Helvetica, sans-serif;font-size: medium; margin-left: 55px;
</style>
"@
$_logontype = @{
2 = "Interactive 2"
3 = "Network 3"
4 = "Batch 4 "
5 = "Service 5"
7 = "Unlock 7"
8 = "NetworkCleartext 8"
9 = "NewCredentials 9"
10 = "RemoteInteractive 10"
11 = "CachedInteractive 11"
}
Foreach ($Server in $DC) {
Get-WinEvent -ComputerName $Server -Max 1 -FilterHashtable @{logname='Security'; id=4625} |
ForEach-Object {
$Event = New-Object PSObject | Select-Object Date,"Event Id", "User Name","FaliureReason", "Status Code", "DC Logged On", "Logon Type"
$Event.Date = $_.TimeCreated
$Event."Event Id" = $_.Id
$Event."User Name" = $_.Properties[5].Value + "\" + $_.Properties[6].Value
$Event."FaliureReason" = (($_.message -split "\n") | Select-String -Pattern "Failure Reason:\s+(.+)").matches[0].groups[1].value
$Event."Status Code" = $_.message -split '\s{4}' | Select-String -Pattern "Status"
$Event."Logon Type" = $_logontype[ [int] $_.Properties[10].Value ]
$Event."DC Logged On" = $_.properties[13].value
$Event | Select-Object Date, "Event Id","User Name","FaliureReason","Status Code", "DC Logged On", "Logon Type" | Convertto-html -head $HTML -body "<H2>User Account is Disabled or Password has Expired or Locked Out</H2>", "<H2>$GetDate </H2>" | Out-File $Report -append
}
}