An- und Abmelde Ereignisse mit Powershell auslesen

if ($PSVersionTable.PSVersion.Major -lt 4){write-host "ERROR: Minimum Powershell Version 4.0 is required!" -F Yellow; return}   
Import-Module ActiveDirectory

workflow Get-LastLogonEvents {
param(
    [parameter(mandatory=$false)][string]$SamAccountname = '*',  
    [parameter(mandatory=$false)][int]$MaxDays = 14,
    [parameter(mandatory=$false)][int]$timeout = 500,
    [parameter(mandatory=$false)][int]$throttlelimit = 5
)
    
    function Send-Ping {
        param([string]$device,[int]$delay)
        $ping = New-Object System.Net.NetworkInformation.Ping
        if($ping.Send($device,$delay).Status -ne "Success"){  
            return $false
        }else{
            return $true
        }
    }
    
    function Get-Serverlogs([string]$server,$SamAccountname){
        try{
            if ((Send-Ping $server $timeout)){
                Get-WinEvent -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4624)] and EventData[(Data[@Name='Logontype'] and (Data=2 or Data=10) and (Data[@Name='TargetDomainName'] != 'Window Manager' and Data[@Name='TargetDomainName'] != 'Font Driver Host' ))] or System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4647)]]" -LogName Security -ComputerName $server -EA Stop | ?{$_.TimeCreated -ge (get-date).AddDays(-$using:MaxDays)} | %{  
                    $xml = [xml]$_.toXML()
                    $username = $xml.Event.EventData.Data | ?{$_.Name -eq 'TargetUserName'} | %{$_.'#text'}  
                    if ($username -like $SamAccountname){
                        $ip = $xml.Event.EventData.Data | ?{$_.Name -eq 'IPAddress'} | %{$_.'#text'}  
                        $type = $xml.Event.EventData.Data | ?{$_.Name -eq 'LogonType'} | %{$_.'#text'}  
                        $logontype = @{"4647"="Logoff";"4624"=$(if($type -eq "10"){"Logon(Remote)"}else{"Logon"})}[$xml.Event.System.EventId]  
                        [pscustomobject]@{Server=$server;UserName=$username;Time=$_.TimeCreated;LogonType=$logontype;IP=$ip}
                    }
                }
            }
        }catch{}
    }
    # Fetch all computers with server operating system from AD
    $servers = Get-ADComputer -Filter {Operatingsystem -like "*Server*"} | select -Expand DNSHostName  

    # initiate parallel workflow over all servers
    foreach -parallel -throttlelimit $throttlelimit ($s in $servers){
        # call function to fetch filtered security eventlog from server
        Get-Serverlogs -server $s -SamAccountname $SamAccountname
    }
}
Get-LastLogonEvents -MaxDays 90 -SamAccountName 'Administrator' | sort Time -Descending | ft Server,Username,Time,LogonType,IP -GroupBy Server  

$servers = Get-ADComputer -Filter {Name -eq "testserver"} | select -Expand DNSHostName   

$servers = get-adcomputer -Filter * | ?{$_.Name -eq "testserver"} | select -Expand DNSHostName   

Windows PowerShell
Copyright (C) 2012 Microsoft Corporation. Alle Rechte vorbehalten.

PS C:\Users\######> if ($PSVersionTable.PSVersion.Major -lt 4){write-host "ERROR: Minimum Powershell Versio 
n 4.0 is required!" -F Yellow; return}  
ERROR: Minimum Powershell Version 4.0 is required!
PS C:\Users\#####> Import-Module ActiveDirectory
PS C:\Users\#####> workflow Get-LastLogonEvents {
>> param(
>>     [parameter(mandatory=$false)][string]$SamAccountname = '*',  
>>     [parameter(mandatory=$false)][int]$MaxDays = 14,
>>     [parameter(mandatory=$false)][int]$timeout = 500,
>>    # [parameter(mandatory=$false)][int]$throttlelimit = 5
>> )
>>
In Zeile:5 Zeichen:54
+     [parameter(mandatory=$false)][int]$timeout = 500,
+                                                      ~
Ausdruck nach "," fehlt.  
In Zeile:1 Zeichen:30
+ workflow Get-LastLogonEvents {
+                              ~
Schließende "}" fehlt im Anweisungsblock.  
    + CategoryInfo          : ParserError: (:) , ParentContainsErrorRecordException
    + FullyQualifiedErrorId : MissingExpressionAfterToken

PS C:\Users\#####>     function Send-Ping {
>>         param([string]$device,[int]$delay)
>>         $ping = New-Object System.Net.NetworkInformation.Ping
>>         if($ping.Send($device,$delay).Status -ne "Success"){  
>>             return $false
>>         }else{
>>             return $true
>>         }
>>     }
>>
PS C:\Users\#####>     function Get-Serverlogs([string]$server,$SamAccountname){
>>         try{
>>             if ((ping $server,$timeout)){
>>                 Get-WinEvent -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventI  
D=4624)] and EventData[(Data[@Name='Logontype'] and (Data=2 or Data=10) and Data[@Name='TargetDomainName'] != 'Window Ma  
nager')] or System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4647)]]" -LogName Security -Comput  
erName $server -EA Stop | ?{$_.TimeCreated -ge (get-date).AddDays(-$using:MaxDays)} | %{
>>                     $xml = [xml]$_.toXML()
>>                     $username = $xml.Event.EventData.Data | ?{$_.Name -eq 'TargetUserName'} | %{$_.'#text'}  
>>                     if ($username -like $SamAccountname){
>>                         $ip = $xml.Event.EventData.Data | ?{$_.Name -eq 'IPAddress'} | %{$_.'#text'}  
>>                         $type = $xml.Event.EventData.Data | ?{$_.Name -eq 'LogonType'} | %{$_.'#text'}  
>>                         $logontype = @{"4647"="Logoff";"4624"=$(if($type -eq "10"){"Logon(Remote)"}else{"Logon"})}[$x  
ml.Event.System.EventId]
>>                         [pscustomobject]@{Server=$server;UserName=$username;Time=$_.TimeCreated;LogonType=$logontype;
IP=$ip}
>>                     }
>>                 }
>>             }
>>         }catch{}
>>     }
>>     # Fetch all computers with server operating system from AD
>>     $servers = Get-ADComputer -Filter {Operatingsystem -like "*Server*"} | select -Expand DNSHostName  
>>
PS C:\Users\Administrator.#####>     # initiate parallel workflow over all servers
PS C:\Users\Administrator.#####>     # foreach -parallel -throttlelimit $throttlelimit ($s in $servers){
PS C:\Users\Administrator.#####>         # call function to fetch filtered security eventlog from server
PS C:\Users\Administrator.#####>         Get-Serverlogs -server $s -SamAccountname $SamAccountname
PS C:\Users\Administrator.#####>     }
In Zeile:1 Zeichen:5
+     }
+     ~
Unerwartetes Token "}" in Ausdruck oder Anweisung.  
    + CategoryInfo          : ParserError: (:) , ParentContainsErrorRecordException
    + FullyQualifiedErrorId : UnexpectedToken

PS C:\Users\Administrator.#####> }
In Zeile:1 Zeichen:1
+ }
+ ~
Unerwartetes Token "}" in Ausdruck oder Anweisung.  
    + CategoryInfo          : ParserError: (:) , ParentContainsErrorRecordException
    + FullyQualifiedErrorId : UnexpectedToken

PS C:\Users\Administrator.#####> Get-LastLogonEvents -MaxDays 90 -SamAccountName 'Administrator' | sort Time -Descending 
 | ft Server,Username,Time,LogonType,IP -GroupBy Server