PoShEvents

The functions contained in this module will assist in harvesting data from event logs for various events.

Installing the Module

Install-Module -Name PoShEvents

Group Policy Processing Events

If you need to determine if a particular policy has applied to a user or computer, you can use the Get-GPOProcessingEvent function.

Get-GPOProcessingEvent -MaxEvents 10 | Out-GridView

This command will show the last 10 group policy processing events on the local system in gridview. You can then sort or enter additional criteria in the gridview.

Logon Failure Events

Logon failure events, those events with Ids of 4625 and 4771, can be found using the Get-LogonFailureEvent function.

Document Printing

The Get-PrintDocumentEvent function will show you all of the successful print jobs that the system has processed.

C:\PowerShell\Get-PrintDocumentEvent -ComputerName printsvc -MaxEvents 1 -Oldest

ComputerName      : PRINTSVR
TimeCreated       : 10/5/2017 8:12:05 AM
PrintJobId        : 234
DocumentName      : Print Document
UserName          : <user name>
ClientMachineName : <system name>
PrinterName       : <generic printer name>
PrinterPort       : IP_<printer IP>
DocumentSizeBytes : 1557928
DocumentPageCount : 2

Remote Desktop Connection Activity

Use Get-RemoteLogonEvent to show all remote desktop connections. [This function needs to be refactored to use Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational. Also, auditing would need to be enabled for this function to useful.]

Service Events

The Get-ServiceEvent function will query the specified system for all service control manager events for service operations, stop, and start events. You can then filter on a particular service name or service DisplayName.

PS C:\PowerShell\Temp> (Get-ServiceEvent).Where({$_.ServiceDisplayName -match "print"}) | Select-Object -Property TimeCreated,EventType,ServiceName,ServiceDisplayName,Message

TimeCreated        : 9/12/2017 9:41:27 PM
EventType          : ServiceOperations
ServiceName        :
ServiceDisplayName : Printer Extensions and Notifications
Message            : The Printer Extensions and Notifications service is marked as an interactive service.  However,
                     the system is configured to not allow interactive services.  This service may not function
                     properly.

TimeCreated        : 10/3/2017 10:42:18 PM
EventType          : ServiceOperations
ServiceName        : Spooler
ServiceDisplayName : Print Spooler
Message            : The start type of the Print Spooler service was changed from auto start to demand start.

TimeCreated        : 10/3/2017 10:42:20 PM
EventType          : ServiceOperations
ServiceName        : Spooler
ServiceDisplayName : Print Spooler
Message            : The start type of the Print Spooler service was changed from demand start to auto start.

System Restarts

You can quickly find out when a system was restarted and what process or user initiated the restart using the Get-SystemRestartEvent function.

Get-SystemRestartEvent -ComputerName DC1 -MaxEvents 10