Get-Winevent - Filter by ObjectName

[lennartingemannnielsen]

Hello,

Pretty simple:

I need a PS script for listing all folder/file audits on a share and its subfolders.
It should get all security event with ID: 4663 where the Objectname / Filepath contains:

“H:\adf_data\Vejle” and all the subfolders and files under the Vejle folder.

And then export the output in a pretty readable format.

Can anybody point me in the right direction?

[Neally]

@lennartingemannnielsen

Can anybody point me in the right direction?

What have you tried so far?

[lennartingemannnielsen]

Nothing really, I’m not an expert on PS.
And I’ve tried googling it, but can’t seem to find that exact script.

[Neally]

@lennartingemannnielsen

I’m not an expert on PS

me neither, doesn’t stop me from trying…

something like this?

$query = @"
<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4663)]]</Select>
  </Query>
</QueryList>
"@

Get-WinEvent -computername 'localhost' -LogName Security -FilterXPath $query |
where message -match "H:\\adf_data\\Vejle"