Login / out history extraction from 2008R2 Event Logs with a PowerShell script?

Question

Hi folks,
I think I'm asking something similar to a few other posts, but instead of hijacking their threads, I thought I'd start my own.
As the subject suggests, I'm trying to extract from a 2008R2 server's Event logs a table of users and their respective login / out events. Not just asking AD for their last login times, but a list of login / out events.
So far, I'm using:
Get-EventLog -logname security -Newest 1000 | where {$_.eventID -eq 4624 -or 4634 }
but the list is long, and contains host authentication connections as well as users. I believe I need something like the ability to filter on "user is domain user", or "user is not a computer", or similar, and then pipe it to Export-CSV,
but the data is not a CSV file, but more like Text. ie:
Index : 87290035
EntryType : SuccessAudit
InstanceId : 5156
Message : The Windows Filtering Platform has permitted a connection.
Application Information:
Process ID: 1688
Application Name: \device\harddiskvolume2\windows\system32\dns.exe
Network Information:
Direction: %%14592
Source Address: 192.168.xx.xx
Source Port: 53
Destination Address: 192.168.xx.xx
Destination Port: 44242
Protocol: 17
Filter Information:
Filter Run-Time ID: 66055
Layer Name: %%14610
Layer Run-Time ID: 44
Category : (12810)
CategoryNumber : 12810
ReplacementStrings : {1688, \device\harddiskvolume2\windows\system32\dns.exe, %%14592, 192.168.xx.xx...}
Source : Microsoft-Windows-Security-Auditing
TimeGenerated : 28/01/2011 4:46:35 PM
TimeWritten : 28/01/2011 4:46:35 PM
UserName :
Why is that even coming up as a result?
Ideally, I would like a CSV file containing these columns:
User,timestamp,computer,logon/off
I've thought about adding a script to the Group Policy where it runs on local machines and appends details to a file on a network share, but I think I would prefer to run this locally, perhaps periodically as a script.
-- Ebor Administrator

Answer 1

Thanks Matthew for the links. While I was initially thinking that's looking rather complicated, and my solution was simplistic in comparison, I'm finding (with no surprises, really) that things can get rather complicated quickly. If only parsing was easier
(or if only they didn't use "Here-Strings" instead, using normal Strings... </grumble>), as it's now looking at almost ten lines (mostly for readability).
In short, I'm now looking at:
Get-ADUser -Filter * -SearchBase "OU=Users,OU=Ebor Computing,DC=Ebor,DC=Local" | Sort-Object | ForEach-Object -Process {
$UserName = $_.SamAccountName
$MsgQuery="*" + $UserName + "*"
$EventID = $_.EventID
$Events = Get-EventLog -logname security -Message $MsgQuery | where {$_.EventID -eq 4624 -or $_.EventID -eq 4634} | ForEach-Object -Process {
$SrcAddr = "Unknown"
$idx = $_.message.IndexOf("Source Network Address:")
if ($idx -gt 0) {$SrcAddr = $_.message.substring($idx+23,15).trim()}
$UserName+","+$SrcAddr+","+$EventID+","+$_.TimeGenerated | Out-File -FilePath $UserName"_login_events.csv" -Append
Eeuuw... don't know why that was parsed as it was above... Either way, this takes a very long time, but gives a separate file for each user and goes back the entire length of the Event Log's history for reporting purposes.
Noting that I had to query AD for the users thus has to run from the AD Powershell, instead of the normal PS, as I don't know the appropriate module load command to get a normal PS to work with AD. Keeping this limitation in mind, I think it works, but needs
some tweaking for formatting and output I think.
I'm tempted to create an RODC for this to run on, but what else does the DC do, really? May as well warm up the CPU for an hour or so ;-) I guess one of the improvements could be to determine if the cycles are being taken up with poor String parsing, or
with AD querying. Another would be to add some comments... ;-)
-- Ebor Administrator