docouto
/ win-srv-logon-history.ps1
Created
June 2, 2022 10:55
— forked from fredericmohr/win-srv-logon-history.ps1
Windows Server PS: Security Log Logon/Logoff Event Reporter
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Source: https://gallery.technet.microsoft.com/Log-Parser-to-Identify-8aac36bd | |
| # Authors: Ryan DeVries, Drew Bonasera, Scott Smith | |
| # Rochester Institute of Technology - Computer System Forensics | |
| # Variables | |
| # Reads the hostname, sets to the local hostname if left blank | |
| $hostname = read-host "Enter the IP or hostname of the computer you wish to scan (Leave blank for local)" | |
| if ($hostname.length -eq 0){$hostname = $env:computername} | |
| # Reads the start date, sets to 1/1/2000 if left blank |