Book Image

Windows Server Automation with PowerShell Cookbook - Fifth Edition

By : Thomas Lee
Book Image

Windows Server Automation with PowerShell Cookbook - Fifth Edition

By: Thomas Lee

Overview of this book

The Windows Server Automation with PowerShell Cookbook is back with a new edition, featuring over 100 PowerShell recipes that will make your day-to-day work easier. This book is designed to help you learn how to install, configure and use PowerShell 7.2 effectively. To start with, we’ll look at how to install and configure PowerShell 7.2, along with useful new features and optimizations, and show you how the PowerShell compatibility solution bridges the gap to older versions of PowerShell. We’ll also be covering a wide range of fundamental and more advanced use cases, including how to create a VM and set up an Azure VPN, as well as looking at how to back up to Azure. As you progress, you’ll explore topics such as using PowerShell to manage networking and DHCP in Windows Server, objects in Active Directory, Hyper-V, and Azure. We’ll also take a closer look at WSUS, containers and see how to handle modules that are not directly compatible with PowerShell 7. Finally, you’ll also learn how to use some powerful tools to diagnose and resolve issues with Windows Server. By the end of this PowerShell book, you’ll know how to use PowerShell 7.2 to automate tasks on Windows Server 2022 with ease, helping your Windows environment to run faster and smoother.
Table of Contents (17 chapters)
15
Other Books You May Enjoy
16
Index

Discovering logon events in the Event Log

Each time you attempt to log on to Windows, whether you are successful or not, Windows logs the attempt in the Security log. These log events can help determine who logged into a computer and when.

Windows defines several different logon types. A logon type of 2 indicates a local console login (logging on to a physical host), while a logon type of 10 indicates logon over RDP. Other logon types include service logon (type 5), batch or scheduled task (type 4), and console unlock (type 7).

You can read more detail in this article: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc787567(v=ws.10). Note that this document is somewhat outdated, and Microsoft has not updated it for later versions of Windows. With that said, the information continues to be correct.

In this recipe, you use PowerShell to examine the Security event log and look at the logon events.

Getting ready

You run this recipe on DC1, a domain controller...