Powershell监控操作系统用户账号事件并预警

最新推荐文章于 2023-08-08 01:25:15 发布

ydneyepa

最新推荐文章于 2023-08-08 01:25:15 发布

阅读量799

点赞数

CC 4.0 BY-SA版权

本文链接：https://blog.youkuaiyun.com/u012144969/article/details/11731919

这篇博客详细介绍了如何利用PowerShell脚本来监控操作系统的用户登录事件，从而实现及时的预警机制。通过分析和处理登录信息，可以提高系统安全性和运维效率。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

urn string
function get_login_user
{
$users=query user
$lists=New-Object system.Collections.ArrayList
for($i=1;$i -lt $users.Count;$i++)
{
$user = $users[$i] -replace(' ',' ')
while($user.indexof(' ') -gt 0)
{
$user = $user -replace(' ',' ')
}
if($user.indexof(' ') -eq 0 -or $user.indexof('>') -eq 0)
{
$user=$user.substring(1)
}
$user=$user -split(' ')
$list=New-Object psobject
#$time=$user[5]+" "+$user[6]
Add-Member -Name name -Value $user[0] -MemberType NoteProperty -InputObject $list
Add-Member -Name status -Value $user[3] -MemberType NoteProperty -InputObject $list
#Add-Member -Name time -Value $time -MemberType NoteProperty -InputObject $list
$lists +=@($list )
}
$loginUser = $lists | ?{$_.status -eq '运行中'} | select name
foreach($userName in $loginUser)
{
if($userNames -eq $null)
{
$userNames=$userName.name
}
else
{
$userNames=$userNames + ',' + $userName.name
}
}
return $userNames
}
#endregion
#region Login-Succ-Notice 成功登录事件
function Login-Succ-Notice
{
$loginInfo=Get-WinEvent -logname security -maxevents 10 | ? {$_.id -eq 4624} | select timecreated,message
if($loginInfo -eq $null)
{
break
}
if(($loginInfo.gettype()).isarray)
{
$time=$loginInfo[0].timecreated
$message=$loginInfo[0].message
}
else
{
$time=$loginInfo.timecreated

$message=$loginInfo.message

huihui.cn/share/9414299
huihui.cn/share/9414332
huihui.cn/share/9414364
huihui.cn/share/9414392
huihui.cn/share/9414423
huihui.cn/share/9414454
huihui.cn/share/9414489
huihui.cn/share/9414521
huihui.cn/share/9414547
huihui.cn/share/9414578
huihui.cn/share/9414625
huihui.cn/share/9414656
huihui.cn/share/9414683
huihui.cn/share/9414715
huihui.cn/share/9414743
huihui.cn/share/9414769
huihui.cn/share/9414802
huihui.cn/share/9414832
huihui.cn/share/9414864
huihui.cn/share/9414893
huihui.cn/share/9414920
huihui.cn/share/9414962
huihui.cn/share/9414999
huihui.cn/share/9415038
huihui.cn/share/9415116
huihui.cn/share/9415078
huihui.cn/share/9415152
huihui.cn/share/9415202
huihui.cn/share/9415239
huihui.cn/share/9415348
huihui.cn/share/9415392
huihui.cn/share/9415426
huihui.cn/share/9415461
huihui.cn/share/9415507
huihui.cn/share/9415543
huihui.cn/share/9415574
huihui.cn/share/9415609
huihui.cn/share/9415640
huihui.cn/share/9415672
huihui.cn/share/9416054
huihui.cn/share/9416099
huihui.cn/share/9416137
huihui.cn/share/9416409
huihui.cn/share/9416446
huihui.cn/share/9416478
huihui.cn/share/9416515
huihui.cn/share/9416573
huihui.cn/share/9417233
huihui.cn/share/9417278
huihui.cn/share/9417339
huihui.cn/share/9417392
huihui.cn/share/9417440
huihui.cn/share/9417540
huihui.cn/share/9417597
huihui.cn/share/9417664
huihui.cn/share/9417715
huihui.cn/share/9417817
huihui.cn/share/9417932
huihui.cn/share/9417973
huihui.cn/share/9418029
x889.com/forum.php?mod=viewthread&tid=60713
x889.com/forum.php?mod=viewthread&tid=60714
x889.com/forum.php?mod=viewthread&tid=60715
x889.com/forum.php?mod=viewthread&tid=60716
x889.com/forum.php?mod=viewthread&tid=60717
x889.com/forum.php?mod=viewthread&tid=60718
x889.com/forum.php?mod=viewthread&tid=60719
x889.com/forum.php?mod=viewthread&tid=60720
x889.com/forum.php?mod=viewthread&tid=60721
x889.com/forum.php?mod=viewthread&tid=60722
x889.com/forum.php?mod=viewthread&tid=60723
x889.com/forum.php?mod=viewthread&tid=60724
x889.com/forum.php?mod=viewthread&tid=60725
x889.com/forum.php?mod=viewthread&tid=60726
x889.com/forum.php?mod=viewthread&tid=60727
x889.com/forum.php?mod=viewthread&tid=60728
x889.com/forum.php?mod=viewthread&tid=60729
x889.com/forum.php?mod=viewthread&tid=60730
x889.com/forum.php?mod=viewthread&tid=60731
x889.com/forum.php?mod=viewthread&tid=60732
x889.com/forum.php?mod=viewthread&tid=60733
x889.com/forum.php?mod=viewthread&tid=60734
x889.com/forum.php?mod=viewthread&tid=60735
x889.com/forum.php?mod=viewthread&tid=60736
x889.com/forum.php?mod=viewthread&tid=60737
x889.com/forum.php?mod=viewthread&tid=60738
x889.com/forum.php?mod=viewthread&tid=60739
x889.com/forum.php?mod=viewthread&tid=60740
x889.com/forum.php?mod=viewthread&tid=60741
x889.com/forum.php?mod=viewthread&tid=60742
x889.com/forum.php?mod=viewthread&tid=60743
x889.com/forum.php?mod=viewthread&tid=60744
xiangqu.com/product/detail/206085.html
xiangqu.com/product/detail/206108.html
xiangqu.com/product/detail/206115.html
xiangqu.com/product/detail/206126.html
xiangqu.com/product/detail/206165.html
xiangqu.com/product/detail/206188.html
xiangqu.com/product/detail/206202.html
xiangqu.com/product/detail/206211.html