Fehlerhafte Anmeldeversuche protokollieren

<#
    Get local failed logon events for scheduled tasks, services, applications
#>
cls
$logfile = "$env:TEMP\$([io.Path]::GetRandomFileName())"  
do {
    $days = Read-Host "What time period (days) do you want to include in the log (press ENTER for 7 Days)?"  
    $days = @{$true=7;$false=$days}[$days -eq '']  
}until($days -match '\d+')  

# startdate back in time
$start = (get-date).AddDays(-$days).Date

write-host "`nRetrieving log information starting from $($start.toString('d')), please wait...`n" -F Green  

#region >> data collection <<

# scheduled tasks with logon failures
$data_tasks = Get-WinEvent -FilterHashtable @{Logname="Microsoft-Windows-TaskScheduler/Operational";Id=104;StartTime=$start}  
# Services with credential errors
$data_services = Get-WinEvent -FilterHashtable @{LogName="System";ProviderName = 'Service Control Manager';Level=2;Id=7038;StartTime=$start}  
# Generic Logon Events
$data_logonevents = Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625;StartTime=$start}  

#endregion

#region >> Log Output <<
@"  
Recent Scheduled Tasks with logon credential problems:`n$('='*60)  
$($data_tasks | ft TimeCreated,Message -AutoSize -Wrap | out-string)

Services with logon credential problems:`n$('='*60)  
$($data_services | ft TimeCreated,Message -AutoSize -Wrap | out-string)

Generic Logon errors:`n$('='*60)  
$($data_logonevents | ft TimeCreated,@{n='Application/Process';e={$_.Properties[18].Value}},@{n='Username';e={$_.Properties[6,5].Value -join '\'}} -AutoSize -Wrap | out-string)  
"@ | out-file $logfile -Encoding utf8  
#endregion

write-host "Opening log '$logfile'." -F Green  
start notepad $logfile