Quantcast
Channel: The Official Scripting Guys Forum! forum
Viewing all articles
Browse latest Browse all 15028

Need help in trying to extract user info from logon event ID 4672

$
0
0

I would like to extract the following information from the Message property:

  • Security Identifier
  • Account Name
  • Account Domain. 


So far what I have is:

$UserLastLogonEvent = Get-WinEvent -Computer misw7v-120 -FilterHashtable @{Logname='Security';ID=4672} -MaxEvents 1
$UserLastLogonEvent | Format-List 


The output is:



TimeCreated  : 6/22/2016 3:30:38 PM

ProviderName : Microsoft-Windows-Security-Auditing

Id           : 4672

Message      : Special privileges assigned to new logon.

               

               Subject:

                   Security ID:        

               S-1-5-22-67644591-240755714-2144928816-55394

                   Account Name:        jdoe

                   Account Domain:        BIGCORP

                   Logon ID:        0x1eb0edd

               

               Privileges:        SeSecurityPrivilege

                           SeBackupPrivilege

                           SeRestorePrivilege

                           SeTakeOwnershipPrivilege

                           SeDebugPrivilege

                           SeSystemEnvironmentPrivilege

                           SeLoadDriverPrivilege

                           SeImpersonatePrivilege 

I am trying to learn string manipulation using regex, but I am far from an expert and I would be eternally grateful to anyone who can help me in solving this problem. The data that I need to extract from the Message property in the output above is bolded. 

Thank you so much. 


Viewing all articles
Browse latest Browse all 15028

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>