說明

使用 Windows 事件檢視器 (Event Viewer) 時，逐一尋找並點擊事件查看詳情往往讓人感到不便。若不想下載其他軟體來匯出日誌，可以考慮使用 PowerShell，以表格形式快速呈現事件數據，這樣的方式對於初步問題排查非常實用且高效。

作法

使用PowerShell Get-WinEvent這個功能，從本機和遠端電腦上的事件記錄檔和事件追蹤記錄檔取得事件。
用管理者權限開啟PowerShell

1. 到powershell輸入以下指令可以看到全部Channel

PS C:\WINDOWS\system32> Get-WinEvent -ListLog * | Format-List -Property LogName

LogName : Windows PowerShell
LogName : System
LogName : Security
LogName : PowerBiosServerLog
LogName : OutLog
LogName : OneApp_IGCC
...

2. 前一章介紹過XML搜尋，這裡把前一章的語法逐步套入
   Get-WinEvent -FilterXml '(裡面塞XML)'

PS C:\WINDOWS\system32> Get-WinEvent -FilterXml '<QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[(EventID=4624 or EventID=4625)]]</Select></Query></QueryList>'


   ProviderName: Microsoft-Windows-Security-Auditing

TimeCreated                      Id LevelDisplayName Message
-----------                      -- ---------------- -------
9/17/2024 8:00:25 PM           4624 Information      An account was successfully logged on....
9/17/2024 8:00:25 PM           4624 Information      An account was successfully logged on....
9/17/2024 7:52:31 PM           4624 Information      An account was successfully logged on....

3. 上一章講到針對登入日誌，我們會看LogonType及AuthenticationPackageName，這個語法只能以在第幾個位置去過濾，如下圖，位置在8跟10
   

Get-WinEvent -FilterXml '
<QueryList>
    <Query Id="0" Path="Security">
        <Select Path="Security">
            *[System[(
                EventID=4624
            ) and 
            (TimeCreated[timediff(@SystemTime) &lt;= 3600000])]]
        </Select>
    </Query>
</QueryList>
' |
Select-Object Id, TimeCreated, 
@{Name="LogonType"; Expression={$_.Properties[8].Value}}, 
@{Name="AdditionalInfo"; Expression={$_.Properties[10].Value}}

Output

PS C:\Windows\system32> Get-WinEvent -FilterXml '
>> <QueryList>
>>     <Query Id="0" Path="Security">
>>         <Select Path="Security">
>>             *[System[(
>>                 EventID=4624
>>             ) and
>>             (TimeCreated[timediff(@SystemTime) &lt;= 3600000])]]
>>         </Select>
>>     </Query>
>> </QueryList>
>> ' |
>> Select-Object Id, TimeCreated,
>> @{Name="LogonType"; Expression={$_.Properties[8].Value}},
>> @{Name="AdditionalInfo"; Expression={$_.Properties[10].Value}}

  Id TimeCreated           LogonType AdditionalInfo
  -- -----------           --------- --------------
4624 9/20/2024 11:40:38 AM        10 Negotiate
4624 9/20/2024 11:40:33 AM         2 Negotiate
4624 9/20/2024 11:40:33 AM         2 Negotiate
4624 9/20/2024 11:40:31 AM         3 NTLM
4624 9/20/2024 11:40:31 AM         3 NTLM
4624 9/20/2024 11:38:07 AM         5 Negotiate
4624 9/20/2024 11:34:17 AM         3 Kerberos
4624 9/20/2024 11:29:36 AM         5 Negotiate
4624 9/20/2024 11:23:29 AM         3 NTLM
4624 9/20/2024 11:23:06 AM         5 Negotiate
4624 9/20/2024 11:22:30 AM         3 NTLM
4624 9/20/2024 11:08:06 AM         5 Negotiate
4624 9/20/2024 10:58:48 AM         5 Negotiate
4624 9/20/2024 10:53:05 AM         5 Negotiate
4624 9/20/2024 10:53:00 AM         3 NTLM
4624 9/20/2024 10:51:41 AM         3 NTLM

REF

黑暗執行緒-實用小工具 - 查誰在偷連我的 Windows？
https://blog.darkthread.net/blog/ps-list-logon-events/