Get users logins on windows server with powershell-CodePudding

I am creating a script to get user logins on the server.I do it through powershell and the event viewer. The problem is that the script returns the users and other "users" of the system and I only need the real users.

______
User
______
AR01
system
dvm-01
system
AR01
AR04
AR15
system

I thought about creating a condition so that it only selects users that start with AR, but I don't know how to do it.

Any ideas? Thanks!

Get-WinEvent  -Computer MyServerName -FilterHashtable @{Logname='Security';ID=4624} -MaxEvents 2000|
    select @{N='User';E={$_.Properties[5].Value}}, TimeCreated | export-csv -Path C:\Users\AR001\Desktop\filename.csv -NoTypeInformation

CodePudding user response：

You can simply use a Where-Object once you have extracted your data from the message.

Just add this:

Where-Object -Property User -Match -Value "AR"

before you try to export to the CSV.

Try this complete command:

Get-WinEvent  -Computer MyServerName -FilterHashtable @{Logname='Security';ID=4624} -MaxEvents 2000 | Where-Object -Property User -Match -Value "AR"
select @{N='User';E={$_.Properties[5].Value}}, TimeCreated | export-csv -Path C:\Users\AR001\Desktop\filename.csv -NoTypeInformation