forked from 12Knocksinna/Office365itpros
-
Notifications
You must be signed in to change notification settings - Fork 0
/
ReportAuditRecFailedSignIn.PS1
28 lines (26 loc) · 1.77 KB
/
ReportAuditRecFailedSignIn.PS1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
# ReportAuditRecFailedSignIn.PS1
# https://github.com/12Knocksinna/Office365itpros/blob/master/ReportAuditRecFailedSignIn.PS1
# Example used in Chapter 21 of Office 365 for IT Pros
$Records = (Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date).AddDays(+1) -Operations UserLoginFailed -SessionCommand ReturnLargeSet -ResultSize 5000 -Formatted)
If ($Records.Count -eq 0) {
Write-Host "No audit records found for failed logins." }
Else {
Write-Host "Processing" $Records.Count "audit records..."
$Report = [System.Collections.Generic.List[Object]]::new()
ForEach ($Rec in $Records) {
$AuditData = ConvertFrom-Json $Rec.Auditdata
$ReportLine = [PSCustomObject]@{
TimeStamp = $Rec.CreationDate
User = $AuditData.UserId
Action = $AuditData.Operation
Status = $AuditData.ResultStatus
IpAddress = $AuditData.ActorIpAddress
Error = $AuditData.LogonError
UserAgent = $AuditData.ExtendedProperties.value[0] }
$Report.Add($ReportLine) }
}
$Report | Sort User, Timestamp | Select Timestamp, User, IpAddress, UserAgent
# An example script used to illustrate a concept. More information about the topic can be found in the Office 365 for IT Pros eBook https://gum.co/O365IT/
# and/or a relevant article on https://office365itpros.com or https://www.petri.com. See our post about the Office 365 for IT Pros repository # https://office365itpros.com/office-365-github-repository/ for information about the scripts we write.
# Do not use our scripts in production until you are satisfied that the code meets the need of your organization. Never run any code downloaded from the Internet without
# first validating the code in a non-production environment.