< Back
Get-LogonFailureEvent
Post
NAME Get-LogonFailureEvent
SYNOPSIS
This function searchs for logon failure events, those events with Ids of 4625 and 4771.
SYNTAX
Get-LogonFailureEvent [[-ComputerName] <String[]>] [[-Credential] <PSCredential>] [[-StartTime] <DateTime>]
[[-EndTime] <DateTime>] [[-MaxEvents] <Int64>] [-Oldest] [-Raw] [<CommonParameters>]
DESCRIPTION
This function searchs for logon failure events, those events with Ids of 4625 and 4771.
PARAMETERS
-ComputerName <String[]>
Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP)
address, or the fully qualified domain name of the computer. The default value is the local computer.
Required? false
Position? 0
Default value None
Accept pipeline input? True (ByPropertyName, ByValue)
Accept wildcard characters? false
-Credential <PSCredential>
Specifies a user account that has permission to perform this action. The default value is the current user.
Type a user name, such as User01 or Domain01\\User01. Or, enter a PSCredential object, such as one generated by
the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the
parameter name, you will be prompted for both a user name and a password.
Required? false
Position? 1
Default value None
Accept pipeline input? False
Accept wildcard characters? false
-EndTime <DateTime>
Specifies the end of the time period for the event log query.
Required? false
Position? 3
Default value None
Accept pipeline input? False
Accept wildcard characters? false
-MaxEvents <Int64>
Specifies the maximum number of events this function returns. Enter an integer. The default is to return all
the events in the logs.
Required? false
Position? 4
Default value None
Accept pipeline input? False
Accept wildcard characters? false
-Oldest [<SwitchParameter>]
Returns the events in oldest-first order. By default, events are returned in newest-first order.
Required? false
Position? named
Default value False
Accept pipeline input? False
Accept wildcard characters? false
-StartTime <DateTime>
Specifies the beginning of the time period for the event log query.
Required? false
Position? 2
Default value None
Accept pipeline input? False
Accept wildcard characters? false
-Raw [<SwitchParameter>]
Use this switch to provide the raw event log record for the function.
Required? false
Position? named
Default value False
Accept pipeline input? False
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
System.String[]
OUTPUTS
System.Object
NOTES
-------------------------- Example 1 --------------------------
PS C:\\> Get-LogonFailureEvent -ComputerName dc07 -MaxEvents 10 -Credential (Get-Credential) | Format-Table
-Property ComputerName,TimeCreated,TargetUserName,IPAddress,IpPort,LogonMethod,Reason
ComputerName TimeCreated TargetUserName IpAddress LogonMethod Reason
------------ ----------- -------------- --------- ----------- ------
DC1.contoso.com 5/11/2018 8:39:29 PM rtorn 192.168.1.22 Undetermined logon method 0x18
DC1.contoso.com 5/11/2018 8:39:27 PM tljones 192.168.1.18 Undetermined logon method 0x18
DC1.contoso.com 5/11/2018 8:39:27 PM ftpug 192.168.1.66 Undetermined logon method 0x18
DC1.contoso.com 5/11/2018 8:39:24 PM ftpug 192.168.1.66 Undetermined logon method 0x18
DC1.contoso.com 5/11/2018 8:38:51 PM WKSTN99$ 192.168.1.9 Network Account currently
disabled.
DC1.contoso.com 5/11/2018 8:37:41 PM jknoxville 192.168.1.67 Undetermined logon method 0x18
RELATED LINKS
Online Version: https://powershell.anovelidea.org/modul ... Event.html
SYNOPSIS
This function searchs for logon failure events, those events with Ids of 4625 and 4771.
SYNTAX
Get-LogonFailureEvent [[-ComputerName] <String[]>] [[-Credential] <PSCredential>] [[-StartTime] <DateTime>]
[[-EndTime] <DateTime>] [[-MaxEvents] <Int64>] [-Oldest] [-Raw] [<CommonParameters>]
DESCRIPTION
This function searchs for logon failure events, those events with Ids of 4625 and 4771.
PARAMETERS
-ComputerName <String[]>
Gets events from the event logs on the specified computer(s). Type the NetBIOS name, an Internet Protocol (IP)
address, or the fully qualified domain name of the computer. The default value is the local computer.
Required? false
Position? 0
Default value None
Accept pipeline input? True (ByPropertyName, ByValue)
Accept wildcard characters? false
-Credential <PSCredential>
Specifies a user account that has permission to perform this action. The default value is the current user.
Type a user name, such as User01 or Domain01\\User01. Or, enter a PSCredential object, such as one generated by
the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the
parameter name, you will be prompted for both a user name and a password.
Required? false
Position? 1
Default value None
Accept pipeline input? False
Accept wildcard characters? false
-EndTime <DateTime>
Specifies the end of the time period for the event log query.
Required? false
Position? 3
Default value None
Accept pipeline input? False
Accept wildcard characters? false
-MaxEvents <Int64>
Specifies the maximum number of events this function returns. Enter an integer. The default is to return all
the events in the logs.
Required? false
Position? 4
Default value None
Accept pipeline input? False
Accept wildcard characters? false
-Oldest [<SwitchParameter>]
Returns the events in oldest-first order. By default, events are returned in newest-first order.
Required? false
Position? named
Default value False
Accept pipeline input? False
Accept wildcard characters? false
-StartTime <DateTime>
Specifies the beginning of the time period for the event log query.
Required? false
Position? 2
Default value None
Accept pipeline input? False
Accept wildcard characters? false
-Raw [<SwitchParameter>]
Use this switch to provide the raw event log record for the function.
Required? false
Position? named
Default value False
Accept pipeline input? False
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
System.String[]
OUTPUTS
System.Object
NOTES
-------------------------- Example 1 --------------------------
PS C:\\> Get-LogonFailureEvent -ComputerName dc07 -MaxEvents 10 -Credential (Get-Credential) | Format-Table
-Property ComputerName,TimeCreated,TargetUserName,IPAddress,IpPort,LogonMethod,Reason
ComputerName TimeCreated TargetUserName IpAddress LogonMethod Reason
------------ ----------- -------------- --------- ----------- ------
DC1.contoso.com 5/11/2018 8:39:29 PM rtorn 192.168.1.22 Undetermined logon method 0x18
DC1.contoso.com 5/11/2018 8:39:27 PM tljones 192.168.1.18 Undetermined logon method 0x18
DC1.contoso.com 5/11/2018 8:39:27 PM ftpug 192.168.1.66 Undetermined logon method 0x18
DC1.contoso.com 5/11/2018 8:39:24 PM ftpug 192.168.1.66 Undetermined logon method 0x18
DC1.contoso.com 5/11/2018 8:38:51 PM WKSTN99$ 192.168.1.9 Network Account currently
disabled.
DC1.contoso.com 5/11/2018 8:37:41 PM jknoxville 192.168.1.67 Undetermined logon method 0x18
RELATED LINKS
Online Version: https://powershell.anovelidea.org/modul ... Event.html