☰

修改 Query-InsecureLDAPBinds.ps1

tag-icon • tag-icon windows powershell
修改 Query-InsecureLDAPBinds.ps1

試圖找出如何添加此腳本找到的時間變量

https://github.com/russelltomkins/Active-Directory/blob/master/Query-InsecureLDAPBinds.ps1

我嘗試在 $user 的行下添加各種變體$Time = $eventXML.event.System.TimeCreatedSystemTime，但沒有任何運氣，而且我不確定如何添加此資訊。

$Row.Time = $Time





 # Prepare Variables
    Param (
            [parameter(Mandatory=$false,Position=0)][String]$ComputerName = "localhost",
            [parameter(Mandatory=$false,Position=1)][Int]$Hours = 24)

    # Create an Array to hold our returnedvValues
    $InsecureLDAPBinds = @()

    # Grab the appropriate event entries
    $Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{Logname='Directory Service';Id=2889; StartTime=(get-date).AddHours("-$Hours")}

    # Loop through each event and output the 
    ForEach ($Event in $Events) { 
        $eventXML = [xml]$Event.ToXml()

        # Build Our Values
        $Client = ($eventXML.event.EventData.Data[0])
        $IPAddress = $Client.SubString(0,$Client.LastIndexOf(":")) #Accomodates for IPV6 Addresses
        $Port = $Client.SubString($Client.LastIndexOf(":")+1) #Accomodates for IPV6 Addresses
        $User = $eventXML.event.EventData.Data[1]
        Switch ($eventXML.event.EventData.Data[2])
            {
            0 {$BindType = "Unsigned"}
            1 {$BindType = "Simple"}
            }

        # Add Them To a Row in our Array
        $Row = "" | select IPAddress,Port,User,BindType
        $Row.IPAddress = $IPAddress
        $Row.Port = $Port
        $Row.User = $User
        $Row.BindType = $BindType

        # Add the row to our Array
        $InsecureLDAPBinds += $Row
    }
    # Dump it all out to a CSV.
    Write-Host $InsecureLDAPBinds.Count "records saved to .\InsecureLDAPBinds.csv for Domain Controller" $ComputerName
    $InsecureLDAPBinds | Export-CSV -NoTypeInformation .\InsecureLDAPBinds.csv

答案1

您可以在事件本身中取得它，而無需解析 XML：

$Time = $Event.TimeCreated

相關內容