AD Failed Logons

Retrieval of Failed Logon Attempts from Windows Security Event Log using PowerShell

by

Monitoring failed logon attempts is crucial for ensuring the security of a Windows environment. PowerShell provides a robust way to automate the retrieval of such information from the Security event log, enabling efficient auditing and analysis. Let’s delve into the script:

# Retrieve failed logon attempts from Security event log
$FailedLogonEvents = Get-EventLog -LogName Security | Where-Object { $_.EventID -eq 4625 }

# Display the details of failed logon attempts
$FailedLogonEvents | Format-List

Explanation:

  1. Retrieving Failed Logon Attempts: The script uses Get-EventLog cmdlet to retrieve events from the Security event log.
  2. Filtering Failed Logon Events: The Where-Object cmdlet filters the events to include only those with EventID equal to 4625, which corresponds to failed logon attempts.
  3. Displaying Event Details: The script then formats and displays the details of the failed logon events using Format-List.

By executing this PowerShell script, administrators can easily obtain and review failed logon attempts from the Security event log, facilitating security monitoring and incident response.

 

Leave a Comment