Failed to get Event-Data Field Data in PowerShell

Question

I am trying to get a specific Datafield (FailureReason) from the Event 4625 to a CSV field.

I have analyzed the event schema with the following code:

(Get-WinEvent -ListProvider Microsoft-Windows-Security-Auditing).Events |
    Where-Object {$_.Id -eq 4625}

which results in:

Id          : 4625
Version     : 0
LogLink     : System.Diagnostics.Eventing.Reader.EventLogLink
Level       : System.Diagnostics.Eventing.Reader.EventLevel
Opcode      : System.Diagnostics.Eventing.Reader.EventOpcode
Task        : System.Diagnostics.Eventing.Reader.EventTask
Keywords    : {}
Template    : 

Description : Fehler beim Anmelden eines Kontos.

              Antragsteller:
                Sicherheits-ID:     %1
                Kontoname:      %2
                Kontodomäne:        %3
                Anmelde-ID:     %4

              Anmeldetyp:           %11

              Konto, für das die Anmeldung fehlgeschlagen ist:
                Sicherheits-ID:     %5
                Kontoname:      %6
                Kontodomäne:        %7

              Fehlerinformationen:
                Fehlerursache:      %9
                Status:         %8
                Unterstatus::       %10

              Prozessinformationen:
                Aufrufprozess-ID:   %18
                Aufrufprozessname:  %19

              Netzwerkinformationen:
                Arbeitsstationsname:    %14
                Quellnetzwerkadresse:   %20
                Quellport:      %21

              Detaillierte Authentifizierungsinformationen:
                Anmeldeprozess:     %12
                Authentifizierungspaket:    %13
                Übertragene Dienste:    %15
                Paketname (nur NTLM):   %16
                Schlüssellänge:     %17

With this output I know the data fieldname is "FailureReason" or $_.properties[9]. I tried both variants in the following code snippet:

Get-WinEvent -FilterHashtable @{Path="c:	emp	est.evtx";} -ErrorAction SilentlyContinue |
    # which are the interesting Events in the Eventlog?
    Where-Object {($_.id -eq "4625")} |
    ForEach-Object {
        if ($_.Id -eq  4625) {
            # which extended Fields from the Eventlog are needed for further investigations?
            # example: how does the eventlog schema looks like?
            # can be examined with (Get-WinEvent -ListProvider Microsoft-Windows-Security-Auditing).Events | Where-Object {$_.Id -eq 4625}
            $SelectorStrings = [string[]]@(
                'Event/EventData/Data[@Name="TargetUserName"]',
                'Event/EventData/Data[@Name="TargetDomainName"]',
                'Event/EventData/Data[@Name="WorkstationName"]',
                'Event/EventData/Data[@Name="IpAddress"]',
                'Event/EventData/Data[@Name="IpPort"]',
                'Event/EventData/Data[@Name="LogonType"]',
                'Event/EventData/Data[@Name="FailureReason"]'
            )
            $PropertySelector = [System.Diagnostics.Eventing.Reader.EventLogPropertySelector]::new($SelectorStrings)

            $TargetUserName, $TargetDomainName, $WorkstationName, $IpAddress, $IpPort, $LogonType, $Remark, $FailureReason = $_.GetPropertyValues($PropertySelector)
            $Remark ="Failed Login !"
            #Create the PSCustomObject from the given Fieldnames
            [PSCustomObject]@{
                TimeCreated   = $_.TimeCreated
                UserName      = $TargetUserName
                Domain        = $TargetDomainName
                ComputerName  = $WorkstationName
                IPAddress     = $IpAddress
                Port          = $IpPort
                LogonType     = $LogonType
                Remark        = $Remark
                FailureReason = $FailureReason
                Message       = ($_.Message).Split(".")[0]
                #Export everything to CSV-File
            } | Export-Csv -NoTypeInformation -Force -Encoding UTF8 -Path 'c:	emp\failedlogin.csv' -Append
        }
    }

As result, all fields in the CSV file are filled, except the field "FailureReason". After that I changed the code to get the value of the field "ProcessId" with the same result, the CSV field then is empty, too.

Remark: The code is normaly much more complex, I reduced it to the required part.

Mark Wragg · Accepted Answer

You filter for 7 properties with $SelectorStrings but then try to populate 8 variables. I think you need to remove $remark from this line:

$TargetUserName, $TargetDomainName, $WorkstationName, $IpAddress, $IpPort, $LogonType, $Remark, $FailureReason = $_.GetPropertyValues($PropertySelector)

Should be:

$TargetUserName, $TargetDomainName, $WorkstationName, $IpAddress, $IpPort, $LogonType, $FailureReason = $_.GetPropertyValues($PropertySelector)

I think the FailureReason value was going in to the $Remark variable which you were then immediately replacing in the line that follows it.

As a further aside if you move the | Export-CSV.. part to occur after the closing } of the ForEach-Object then you can do away with using -Append.

Failed to get Event-Data Field Data in PowerShell

Answers (1)

Related Questions