Access Security Event Logs with PowerShell

Executive Summary: Use Windows PowerShell to examine Windows Security event logs. With PowerShell you can retrieve Security events by type, narrow in on a list of properties, sort events, and retrieve and organize details about an event.

Every administrator knows that protecting security is a vital, but time-consuming, job. Windows collects a mountain of data in its Windows Security event logs; the task of sorting through all that data is something you’d want to automate. You can use the Windows PowerShell console to access the Windows Security event logs and then monitor the event logs to guard against network and asset intrusion. I’ll show you how to retrieve specific events and how to display information about those events. If you’re not familiar with using PowerShell to access the Security event log, take a look at my Windows VIP article, “PowerShell Makes Security Log Access Easy,” April 2008 (InstantDoc ID 98667). To run scripts against the Security event log, you must be logged on as administrator. (For more PowerShell resources, see the Learning Path.) . . .