https://evotec.xyz/fr/tags/get-eventsEvotec Main Websitehttps://evotec.xyz/fr/blog/restoring-recovering-powershell-scripts-from-event-logsA few days ago, I was asked to take a look at PowerShell Malware. While I don’t know much about malware, my curiosity didn’t let me skip on this occasion, and I was handed over WindowsPowerShell.evtx file. Ok, that’s not what I expected! I wanted PowerShell .ps1 files that I can read and assess? Well, you play with the cards you were dealt with. What I was handed over was PowerShell Event Log. PowerShell writes whatever you execute, and it thinks it is risky, to Windows PowerShell Operation Event Log.Fri, 28 Aug 2020 15:39:28 GMThttps://evotec.xyz/fr/blog/restoring-recovering-powershell-scripts-from-event-logsevent logget-eventspowershellpowershellmanagerpseventviewerWindowshttps://evotec.xyz/fr/blog/active-directory-how-to-track-down-why-and-where-the-user-account-was-locked-outI’ve been working with Windows Events for a while now. One of the things I did to help me diagnose problems and reporting on Windows Events was to write PSEventViewer to help to parse the logs and write PSWinReporting to help monitor (with use of PSEventViewer) Domain Controllers for events that happen across the domain. It’s handy and I, get those excellent daily reports of what happened while I was gone.Thu, 24 Jan 2019 15:25:31 GMThttps://evotec.xyz/fr/blog/active-directory-how-to-track-down-why-and-where-the-user-account-was-locked-outactive directoryevent viewerget-eventsget-wineventpowershellpseventviewerpswinreportingwindowswindows serverhttps://evotec.xyz/fr/blog/working-with-windows-events-with-powershellAs you may (and should) know Event Log is your first place to look for explanations on why server/client is…Mon, 28 May 2018 09:28:21 GMThttps://evotec.xyz/fr/blog/working-with-windows-events-with-powershellActive Directoryevent viewerExchangeget-eventsget-wineventmicrosoftpowershellwindowshttps://evotec.xyz/fr/blog/get-eventslibrary-ps1-monitoring-events-powershellThis event library (Get-EventsLibrary.ps1) is PowerShell script that parses Security (mostly) logs on Domain Controllers. It has few reports capabilities…Thu, 19 Apr 2018 09:48:35 GMThttps://evotec.xyz/fr/blog/get-eventslibrary-ps1-monitoring-events-powershellactive directoryaddomain controllerget-eventsmonitoringpowershellWindows