maxxi/PS-WindowsEventActivity
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: maxxi:upload-etikett-gdrive
Branches Tags
maxxi:main maxxi:upload-etikett-gdrive
..
compare: maxxi:main
Branches Tags
maxxi:main maxxi:upload-etikett-gdrive

1 Commits
upload-eti ... main

Author SHA1 Message Date
maxxi
2c16caf0be removed unnecessary comments 2026-03-30 23:22:17 +02:00
1 changed files with 1 additions and 7 deletions
Expand all files Collapse all files

8
Get-WindowsEventActivity.ps1
View File

@@ -13,7 +13,6 @@ param(
$Error.Clear() $Error.Clear()
#region Interrogate Windows event logs
## Query all event logs to search ## Query all event logs to search
$logs = (Get-WinEvent -ListLog '*' -ErrorAction SilentlyContinue | Where-Object {$_.RecordCount}).LogName $logs = (Get-WinEvent -ListLog '*' -ErrorAction SilentlyContinue | Where-Object {$_.RecordCount}).LogName
## Filter event logs based on my timeframe ## Filter event logs based on my timeframe
@@ -25,9 +24,7 @@ $FilterTable = @{
$winEvents = Get-WinEvent -FilterHashTable $FilterTable -ErrorAction SilentlyContinue | Sort-Object -Property TimeCreated $winEvents = Get-WinEvent -FilterHashTable $FilterTable -ErrorAction SilentlyContinue | Sort-Object -Property TimeCreated
$winEvents | Export-Csv -Path '.\LogActivity-eventlogs.csv' -Append $winEvents | Export-Csv -Path '.\LogActivity-eventlogs.csv' -Append
## Output to CSV maybe here
#endregion
#region Interrogate text files
## Find all local volumes ## Find all local volumes
$drives = (Get-PSDrive -PSProvider FileSystem -Scope Local -ErrorAction SilentlyContinue).where({ $_.Root -match '\w{1}:\\$'}) | Select-Object -ExpandProperty Root $drives = (Get-PSDrive -PSProvider FileSystem -Scope Local -ErrorAction SilentlyContinue).where({ $_.Root -match '\w{1}:\\$'}) | Select-Object -ExpandProperty Root
$drives = "C:\" $drives = "C:\"
@@ -36,6 +33,3 @@ $searchPattern = $LogFileExtension | ForEach-Object { "*.$_" }
Get-ChildItem -Path $drives -Include $searchPattern -Recurse -File -ErrorAction SilentlyContinue | Get-ChildItem -Path $drives -Include $searchPattern -Recurse -File -ErrorAction SilentlyContinue |
Where-Object { Where-Object {
$_.LastWriteTime -ge $StartTimestamp -and $_.LastWriteTime -le $EndTimestamp } | Export-Csv -Path '.\LogActivity-textlogs.csv' -Append $_.LastWriteTime -ge $StartTimestamp -and $_.LastWriteTime -le $EndTimestamp } | Export-Csv -Path '.\LogActivity-textlogs.csv' -Append
## Find all of the text files with the last write time within my timeframe
## Output to CSV?
#endregion