查看windows mstsc远程登陆日志(client ip)
发布时间:2020-12-13 21:09:31 所属栏目:Windows 来源:网络整理
导读:最近有个需求,要看一下windows MSTSC的登陆日志。 测试环境: win10 参考: https://social.technet.microsoft.com/Forums/windows/en-US/efabde54-be5e-4be2-bf1b-b146934047e1/logging-ip-adderess-during-remote-desktop-connection?forum=winserverTS H
最近有个需求,要看一下windows MSTSC的登陆日志。 测试环境: win10 参考: https://social.technet.microsoft.com/Forums/windows/en-US/efabde54-be5e-4be2-bf1b-b146934047e1/logging-ip-adderess-during-remote-desktop-connection?forum=winserverTS Hi,You may view the Remote Desktop connection client ip address information in the following logs: Event ViewerApplications and Services LogsMicrosoftWindowsTerminalServices-LocalSessionManager Event ViewerApplications and Services LogsMicrosoftWindowsTerminalServices-RemoteConnectionManager Event ViewerWindows LogsSecurity (Event ID: 4624,Logon Type: 10) -TP powersherll: 找不到出处了,运行之后在当前目录生成登陆日志。 <# .SYNOPSIS This script reads the event log "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" from multiple servers and outputs the human-readable results to a CSV. This data is not filterable in the native Windows Event Viewer. Version: November 9,2016 .DESCRIPTION This script reads the event log "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" from multiple servers and outputs the human-readable results to a CSV. This data is not filterable in the native Windows Event Viewer. NOTE: Despite this log's name,it includes both RDP logins as well as regular console logins too. Author: Mike Crowley https://BaselineTechnologies.com .EXAMPLE ? .RDPConnectionParser.ps1 -ServersToQuery Server1,Server2 -StartTime "November 1" .LINK https://MikeCrowley.us/tag/powershell #> Param( [array]$ServersToQuery = (hostname),[datetime]$StartTime = "January 1,1970" ) foreach ($Server in $ServersToQuery) { $LogFilter = @{ LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' ID = 21,23,24,25 StartTime = $StartTime } $AllEntries = Get-WinEvent -FilterHashtable $LogFilter -ComputerName $Server $AllEntries | Foreach { $entry = [xml]$_.ToXml() [array]$Output += New-Object PSObject -Property @{ TimeCreated = $_.TimeCreated User = $entry.Event.UserData.EventXML.User IPAddress = $entry.Event.UserData.EventXML.Address EventID = $entry.Event.System.EventID ServerName = $Server } } } $FilteredOutput += $Output | Select TimeCreated,User,ServerName,IPAddress,@{Name='Action';Expression={ if ($_.EventID -eq '21'){"logon"} if ($_.EventID -eq '22'){"Shell start"} if ($_.EventID -eq '23'){"logoff"} if ($_.EventID -eq '24'){"disconnected"} if ($_.EventID -eq '25'){"reconnection"} } } $Date = (Get-Date -Format s) -replace ":","." $FilePath = "$env:USERPROFILEDesktop$Date`_RDP_Report.csv" $FilteredOutput | Sort TimeCreated | Export-Csv $FilePath -NoTypeInformation Write-host "Writing File: $FilePath" -ForegroundColor Cyan Write-host "Done!" -ForegroundColor Cyan #End (编辑:李大同) 【声明】本站内容均来自网络,其相关言论仅代表作者个人观点,不代表本站立场。若无意侵犯到您的权利,请及时与联系站长删除相关内容! |
相关内容
- 修改Windows 10 Universal Applications中每个应用程序的内
- 如何在Windows Vista上编译为Linux / Unix编写的C源代码(给
- windows-7 – Windows部署服务的远程管理控制台
- 在Windows下使用C的UTC时间戳(以毫秒为单位)
- DOS命令重定向到文件截断输出
- windows – 确保UDP中的数据包顺序
- 像Windows中的免费源代码浏览器和编辑器一样的源洞察
- windows-server-2008 – 具有高磁盘时间百分比的非常活跃的
- coffeescript – 用于window.location.search的sinon存根
- Window Mysql5.7免安装版配置