none
How often does person X login to server Y? RRS feed

  • Question

  • I have a virtual server running Windows 2008 but is being replaced with 2016 shortly.

    I need to be able to run a simple script and export the result to a file which will show me when a specific AD user account logged into a specific Windows Server, I have tried....

    Get-Eventlog -computername ServerY -LogName Security -InstanceID 4624

    this gives me everylog in for all users, how do I specify one particular user and how do I export the results?

    Many thanks

    Tuesday, May 22, 2018 10:56 AM

Answers

  • Well seeing as this forum is dead with no one looking I managed to find the answer for anyone else that may be interested.  Run this script on the server your interested in

    get-eventlog -logname security -computername FRED-SERVER -instanceID 4624 | Where {$_.message -match "Account Name:\s*FRED1"} > c:\temp\FRED1.txt

    This will look on server "FRED-SERVER" for specific user account "FRED1" and export the login records.  If no entry is found the export log file will be empty

    • Marked as answer by john tru Wednesday, May 23, 2018 10:47 AM
    Wednesday, May 23, 2018 10:47 AM