Get-WinEvent -FilterHashtable @{LogName = 'Security'; Id = 4725} | ForEach-Object {
$xml = [xml] $_.ToXml()
$_ | Select-Object @{Name = 'Name'; Expression = {$xml.Event.EventData.Data[0].'#text'}}, TimeCreated
} | Group-Object Name | Select-Object Name, @{Name = 'TimeCreated'; Expression = {$_.Group.TimeCreated | Sort-Object | Select-Object -Last 1}} |
Where-Object {$_.TimeCreated -le (Get-Date).AddDays(-1)} | ForEach-Object {
try {
if (!(Get-ADUser -Identity $_.Name).Enabled) {
Remove-ADUser -Identity $_.Name -Confirm:$false -WhatIf
}
}
catch {
}
}
报错：
Get-WinEvent : 无法检索到有关 Security 日志的信息。错误: 尝试执行未经授权的操作。。
所在位置 D:\jiaoben\根据安全日志自动删除禁用账户.ps1:1 字符: 1
+ Get-WinEvent -FilterHashtable @{LogName = 'Security'; Id = 4725} | ForEach-Objec ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-WinEvent], Exception
+ FullyQualifiedErrorId : LogInfoUnavailable,Microsoft.PowerShell.Commands.GetWinEventCommand
Get-WinEvent : 在 localhost 计算机上没有与“Security”匹配的事件日志。
所在位置 D:\jiaoben\根据安全日志自动删除禁用账户.ps1:1 字符: 1
+ Get-WinEvent -FilterHashtable @{LogName = 'Security'; Id = 4725} | ForEach-Objec ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Security:String) [Get-WinEvent],
Exception
+ FullyQualifiedErrorId : NoMatchingLogsFound,Microsoft.PowerShell.Commands.GetWinEventCommand
运行：Get-WinEvent -FilterHashtable @{LogName = 'Security'; Id = 4725} 此条命令是可以显示出日志信息的。
