88 lines
3.6 KiB
PowerShell
88 lines
3.6 KiB
PowerShell
# $share = "\\aps-mysql01.aps.local\RdpLog\$env:COMPUTERNAME"
|
||
|
||
# Megosztott mappa a szerver neve szerint
|
||
$share = "\\aps-mysql01.aps.local\RdpLog\$env:COMPUTERNAME"
|
||
if (-not (Test-Path $share)) {
|
||
New-Item -Path $share -ItemType Directory -Force
|
||
}
|
||
|
||
# Funkció a logok kigyűjtésére
|
||
function Get-RDPEvents {
|
||
param (
|
||
[string]$LogName,
|
||
[int[]]$EventIDs
|
||
)
|
||
|
||
Get-WinEvent -LogName $LogName |
|
||
Where-Object { $_.Id -in $EventIDs } |
|
||
ForEach-Object {
|
||
$message = $_.Message
|
||
$sessionID = $null
|
||
$ursachencode = $null
|
||
$userName = $null
|
||
|
||
# 1️⃣ SessionID és Ursachencode regexből
|
||
if ($message -match "Sitzung ""?(\d+)""?.*Ursachencode: (\d+)") {
|
||
$sessionID = [long]$matches[1]
|
||
$ursachencode = [long]$matches[2]
|
||
}
|
||
elseif ($message -match 'Sitzungs-ID:\s*(\d+)') {
|
||
$sessionID = [long]$matches[1]
|
||
}
|
||
|
||
# 2️⃣ UserName: property[0]-ból
|
||
if ($_.Properties.Count -ge 1 -and $_.Properties[0].Value -match "\S") {
|
||
$userName = $_.Properties[0].Value
|
||
}
|
||
|
||
# 3️⃣ Ha nincs property-ben, Message-ből APS\ mintával
|
||
if (-not $userName -and $message -match '(APS\\[^\s"]+)') {
|
||
$userName = $matches[1]
|
||
}
|
||
|
||
# 4️⃣ 1149-es Event ID (auth) regex kiegészítés
|
||
if (-not $userName -and $message -match 'Benutzer:\s*(\S+)') {
|
||
$userName = $matches[1]
|
||
}
|
||
|
||
[PSCustomObject]@{
|
||
ServerName = $env:COMPUTERNAME
|
||
LogName = $LogName
|
||
EventID = $_.Id
|
||
SessionID = $sessionID
|
||
Ursachencode = $ursachencode
|
||
Level = $_.LevelDisplayName
|
||
UserName = $userName
|
||
Message = $message
|
||
TimeCreated = $_.TimeCreated
|
||
}
|
||
}
|
||
}
|
||
|
||
# 1️⃣ UserName események (auth / reconnect) — SessionID-vel
|
||
$userEvents = Get-RDPEvents -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" -EventIDs 24,25,1149
|
||
|
||
# 2️⃣ Disconnect események
|
||
$disconnectEvents = Get-RDPEvents -LogName "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" -EventIDs 39,40
|
||
|
||
# 3️⃣ SessionID alapján hozzárendeljük a UserName-t a disconnect eseményekhez
|
||
$disconnectEvents | ForEach-Object {
|
||
$matchingUser = $userEvents | Where-Object { $_.SessionID -eq $_.SessionID } | Sort-Object TimeCreated -Descending | Select-Object -First 1
|
||
if ($matchingUser) { $_.UserName = $matchingUser.UserName }
|
||
}
|
||
|
||
# 4️⃣ Összesítés más logokkal
|
||
$remoteEvents = Get-RDPEvents -LogName "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" -EventIDs 1006,1026
|
||
$termDDEvents = Get-RDPEvents -LogName "System" -EventIDs 56 | Where-Object { $_.Message -like "*TermDD*" }
|
||
$brokerClientEvents = Get-RDPEvents -LogName "Microsoft-Windows-TerminalServices-SessionBroker-Client/Operational" -EventIDs 1000,1001
|
||
$brokerManagerEvents = Get-RDPEvents -LogName "Microsoft-Windows-TerminalServices-SessionBroker-Manager/Operational" -EventIDs 1000,1001
|
||
|
||
# 5️⃣ Összesítés
|
||
$allEvents = $userEvents + $disconnectEvents + $remoteEvents + $termDDEvents + $brokerClientEvents + $brokerManagerEvents
|
||
|
||
# CSV-be mentés
|
||
$filename = Join-Path $share ("RDP_Log_" + (Get-Date -Format "yyyyMMdd_HHmmss") + ".csv")
|
||
$allEvents | Export-Csv $filename -NoTypeInformation -Encoding UTF8
|
||
|
||
Write-Host "RDP log export kész: $filename"
|