Get-WinEvent -FilterHashtable @{logname=Security; id=4771} | ForEach-Object {
[PSCustomObject]@{TimeCreated = $_.TimeCreated
EventID = $_.Id
AccountName = $_.Properties[0].Value
AccountDomain = $_.Properties[1].Value
LogonType = $_.Properties[2].Value
LogonIP= $_.Properties[6].Value
}} | Export-Csv -Path "C:\share\4771.csv" -NoTypeInformation
ThePropertiesarray contains the following elements:
- Properties[0]: The account name associated with the logon failure.
- Properties[1]: The domain name associated with the account that attempted the logon.
- Properties[2]: The logon type (interactive, network, batch, service, or remote interactive) associated with the logon failure.
- Properties[3]: The workstation name where the logon attempt originated from.
- Properties[4]: The error code associated with the logon failure.
- Properties[5]: The error message associated with the logon failure.
- Properties[6]: The IP address of the client that attempted the logon.
- Properties[7]: The port number used for the client connection.