4

I want to export only event id 4624 from Security

Code below exports all event from security (i want only 4624);

WEVTUtil query-events Security /rd:true /format:text > %~dp0Logins.txt /q:"<EventID>4624</EventID>"

When all 4624 events exported i want filter only events with:

<Data Name='LogonProcessName'>User32 </Data>

This will be RDP logs with IP, because logs in "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" dont have IP (only username) :( I heard this is because RDP connection is TLS secured...

acid magic
  • 387
  • 1
  • 3
  • 10

1 Answers1

4

I want to export only Event ID 4624 from Security

WEVTUtil query-events Security /rd:true /format:text > "%~dp0Logins.txt"<EventID>4624</EventID>"

You are using the wrong format for the /q option.

Use the following command line:

wevtutil qe Security "/q:*[System [(EventID=4648)]]" /rd:true /f:text > "%~dp0Logins.txt"

How do I restrict the filter to Event ID 4624 containing User32?

When all 4624 events exported I want filter only events with:

<Data Name='LogonProcessName'>User32 </Data>

Use the following command line:

wevtutil qe Security "/q:*[System [(EventID=4648)]]" /rd:true | findstr User32 >nul && wevtutil qe Security "/q:*[System [(EventID=4648)]]" /f:text /rd:true > "%~dp0Logins.txt"

Code based on the following source link.

Source How to use wevtutil command to get event details if it only comply with specific text or word

Further Reading

Community
  • 1
  • 1
DavidPostill
  • 7,734
  • 9
  • 41
  • 60
  • Thanks, filter works well! Can you please fix %~dp0Logins.txt issue for folders with spaces in names? – acid magic Sep 26 '16 at 22:13
  • It seems only first example works, but filtering isnt :/ – acid magic Sep 27 '16 at 19:17
  • @acidmagic What is the exact command line you are running? Is there an error? Does it work if you just output to a file called `Logins.txt`? – DavidPostill Sep 27 '16 at 19:19
  • `wevtutil qe Security "/q:*[System [(EventID=4624)]]" /rd:true /c:1| findstr User32 >nul && wevtutil qe Security "/q:*[System [(EventID=4624)]]" /f:text /rd:true /c:1 > "%~dp0logs.txt"` And am not getting any output (logs.txt) User32 exists in event 4624 – acid magic Sep 27 '16 at 20:44
  • Please try removing both occurrences of `/c:1` Answer updated – DavidPostill Sep 27 '16 at 20:54
  • same thing :( i get logs.txt output with all events 4624 (with or without user32 string) – acid magic Nov 09 '16 at 02:15