Answered by:
I want to any event log to check which users has been access services & which time

Question
-
Hello Support,
I want to event log list url sot that help to understand ADFS troubleshooting.
Sunday, September 25, 2016 5:36 AM
Answers
-
Hum... Well this sample list on a WAP server the list of connections to published websites:
Get-WinEvent -FilterHashtable @{LogName="Microsoft-Windows-WebApplicationProxy/Admin";ID=14027} -ComputerName ADFS01 | ForEach-Object { New-Object -TypeName psobject -Property @{ TimeCreated = $_.TimeCreated PublishedWebsite = $_.Properties[4].Value UserName = $_.Properties[6].Value UserAgentString = $_.Properties[7].Value } } | Format-Table TimeCreated,PublishedWebsite,UserName,UserAgentString -AutoSize #Output #TimeCreated PublishedWebsite UserName UserAgentString #----------- ---------------- -------- --------------- #10/1/2016 12:06:17 AM https://web.piaudonn.com/claimy/ piaudonnmsdn@piaudonn.com Mozilla/5.0 (Windows NT 10.0; WOW... #9/23/2016 7:02:26 PM https://web.piaudonn.com/claimy/ piaudonnmsdn@piaudonn.com Mozilla/5.0 (Windows NT 10.0; WOW... #9/21/2016 11:56:02 PM https://web.piaudonn.com/claimy/ piaudonnmsdn@piaudonn.com Mozilla/5.0 (Windows NT 10.0; WOW... #9/21/2016 11:55:33 PM https://web.piaudonn.com/claimy/ piaudonnmsdn@piaudonn.com Mozilla/5.0 (Windows NT 10.0; WOW... #5/26/2015 5:18:31 PM https://web.piaudonn.com/wif1/ piaudonnmsdn@ad.piaudonn.com Mozilla/5.0 (Windows NT 6.3; WOW6...
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.
- Edited by Pierre Audonnet [MSFT]Microsoft employee Saturday, October 1, 2016 12:41 AM
- Proposed as answer by Pierre Audonnet [MSFT]Microsoft employee Tuesday, October 11, 2016 10:33 AM
- Marked as answer by Pierre Audonnet [MSFT]Microsoft employee Thursday, October 13, 2016 4:13 PM
Saturday, October 1, 2016 12:41 AM
All replies
-
Do you mean applications published through the WAP or just list the requested tokens on a given ADFS server?
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.
Sunday, September 25, 2016 7:47 PM -
Hello Support,
Yes
Tuesday, September 27, 2016 3:46 PM -
Hum... Well this sample list on a WAP server the list of connections to published websites:
Get-WinEvent -FilterHashtable @{LogName="Microsoft-Windows-WebApplicationProxy/Admin";ID=14027} -ComputerName ADFS01 | ForEach-Object { New-Object -TypeName psobject -Property @{ TimeCreated = $_.TimeCreated PublishedWebsite = $_.Properties[4].Value UserName = $_.Properties[6].Value UserAgentString = $_.Properties[7].Value } } | Format-Table TimeCreated,PublishedWebsite,UserName,UserAgentString -AutoSize #Output #TimeCreated PublishedWebsite UserName UserAgentString #----------- ---------------- -------- --------------- #10/1/2016 12:06:17 AM https://web.piaudonn.com/claimy/ piaudonnmsdn@piaudonn.com Mozilla/5.0 (Windows NT 10.0; WOW... #9/23/2016 7:02:26 PM https://web.piaudonn.com/claimy/ piaudonnmsdn@piaudonn.com Mozilla/5.0 (Windows NT 10.0; WOW... #9/21/2016 11:56:02 PM https://web.piaudonn.com/claimy/ piaudonnmsdn@piaudonn.com Mozilla/5.0 (Windows NT 10.0; WOW... #9/21/2016 11:55:33 PM https://web.piaudonn.com/claimy/ piaudonnmsdn@piaudonn.com Mozilla/5.0 (Windows NT 10.0; WOW... #5/26/2015 5:18:31 PM https://web.piaudonn.com/wif1/ piaudonnmsdn@ad.piaudonn.com Mozilla/5.0 (Windows NT 6.3; WOW6...
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.
- Edited by Pierre Audonnet [MSFT]Microsoft employee Saturday, October 1, 2016 12:41 AM
- Proposed as answer by Pierre Audonnet [MSFT]Microsoft employee Tuesday, October 11, 2016 10:33 AM
- Marked as answer by Pierre Audonnet [MSFT]Microsoft employee Thursday, October 13, 2016 4:13 PM
Saturday, October 1, 2016 12:41 AM