Skip to content

Instantly share code, notes, and snippets.

@raphaelcarlosr

raphaelcarlosr/Get-RdpLogonEvent.ps1

Forked from awakecoding/Get-RdpLogonEvent.ps1
Created September 8, 2022 03:18
Show Gist options
  • Save raphaelcarlosr/1cf8e12d5dbfe917a17ec61975f0ceb5 to your computer and use it in GitHub Desktop.
Save raphaelcarlosr/1cf8e12d5dbfe917a17ec61975f0ceb5 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @awakecoding awakecoding created this gist Sep 7, 2022.
    40 changes: 40 additions & 0 deletions Get-RdpLogonEvent.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,40 @@
    function Get-RdpLogonEvent
    {
    [CmdletBinding()]
    param(
    [Int32] $Last = 10
    )

    $RdpInteractiveLogons = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    ProviderName='Microsoft-Windows-Security-Auditing'
    ID='4624'
    LogonType='10' # RemoteInteractive
    } | Select-Object -First $Last

    $RdpNetworkLogons = @()
    foreach ($RdpInteractiveLogon in $RdpInteractiveLogons) {
    $RdpNetworkLogon = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    ProviderName='Microsoft-Windows-Security-Auditing'
    ID='4624'
    LogonType='3' # Network
    } | Where-Object {
    ($_.TimeCreated -lt $RdpInteractiveLogon.TimeCreated) -and
    ($_.Properties[5].Value -eq $RdpInteractiveLogon.Properties[5].Value)
    } | Select-Object -First 1
    $RdpNetworkLogons += $RdpNetworkLogon
    }

    $RdpNetworkLogons | ForEach-Object {
    [PSCustomObject] @{
    EventTime = $_.TimeCreated
    UserName = $_.Properties[5].Value
    DomainName = $_.Properties[6].Value
    AuthPackage = $_.Properties[10].Value
    SourceAddress = $_.Properties[18].Value
    }
    }
    }

    # Get-RdpLogonEvent -Last 10 | Format-Table