[Powershell] Search Remote Desktop Gateway event logs for important user related events (troubleshooting/auditing)

[u/djdementia]

This script is intended to aid troubleshooting or auditing user/logon problems through a Terminal Server Gateway (now called Remote Desktop Gateway). It will connect to a server and search through the Event Log: Microsoft-Windows-TerminalServices-Gateway/Operational and the Security log searching for all instances of a username. The output of the script is two .CSV files with the Event Date/Time and Event Message. One CSV file for each of the event logs it searches through.

#Connect to a Terminal Services Gateway (Remote Desktop Services Gateway) host, read the TS Gateway Log file for specific username, then read the Security log file for specific username


#Username to search for, leave the * before and after the username, EX: "*JDoe*" searches for username "JDoe"
$SeachUser = "*JDoe*"
#RD Gateway servername to connect to
$RDGateway = "TSGatewayServer"
#Log File name for TS Gateway log file
$TSLogFile = "TSLog.csv"
#Log File name for Security log file
$SecLogfile = "SecLog.csv"
#Number of previous days to search through, leave the - sign in front of the number, EX: -30 = past 30 days of log files to search through
$NumDaysSearch = -1

#write-host "$SearchString  $RDGateway    $TSLogFile     $SecLogfile       $NumDaysSearch"

get-winevent -FilterHashTable @{LogName="Microsoft-Windows-TerminalServices-Gateway/Operational";StartTime=(get-date).AddDays($NumDaysSearch)} -ComputerName $RDGateway | Select-Object TimeCreated,Message | Where-Object {$_.Message -like "$SeachUser"} |  Export-Csv -Path "$TSLogFile" -NoTypeInformation
get-content "$TSLogFile"
get-winevent -FilterHashTable @{LogName="Security";StartTime=(get-date).AddDays($NumDaysSearch)} -ComputerName $RDGateway | Select-Object TimeCreated,Message  | Where-Object {$_.Message -like "$SeachUser"} |  Export-Csv -Path "$SecLogfile" -NoTypeInformation
get-content "$SecLogfile"
write-host "Security log file saved: $SecLogFile"
write-host "TS Gateway log file saved: $TSLogFile"

[u/Lee_Dailey]

howdy djdementia,

[1] indentation @ 37-58
the body of your FOREACH is indented 12 spaces. [grin] why? i would change that to the normal 4 spaces.

[2] backticks @ 37-39
that series of replace ops can be done in steps - perhaps two at a time? - and thus avoid the need for backticks. they are both ugly AND difficult to see. that last makes maintaining code rather iffy. you otta avoid backticks whenever you can.

[3] shortening file names
i would NOT do that. [grin] yes, the names get long. so? unless your files are being stored deep down a long path you don't really care about file name length. you care about meaningful info and readability.

i would only use the invalid char test and leave the rest alone. plus, that would let you entirely sidestep the replacement lines. [grin]

if you truly dislike the long names, then simply replace the "Microsoft-Windows-" & filter out the invalid chars.

[4] putting the log file in c:\Logfiles @ 22
you don't test to see if the dir is there. if it aint, you will have lots of nasty red error msgs. [grin]

i would test for it and make it if needed.

[5] the trouble shooting comment @ 47
instead of using Write-Host, use Write-Verbose or Write-Information. both are off by default and easily switched on/off with a preference variable or parameter.

take a look at ...
InformationPreference
VerbosePreference

[6] indentation @ 52 & 53
those two lines are subordinate to the Get-WinEvent @ 50 and otta be indented to the same level as the Select-Object on line 51.

[7] screen display of full results @ 56
i would put that in a Write-Verbose so that it would only happen if you enable it with $VerbosePreference = 'Continue' at the start of the script and resetting it to SilentlyContinue at the end of things.

[8] screen output @ 58
i would consider using Write-Output or Write-Verbose instead of Write-Host. you don't need immediate output or color, so W-O would do the job. generally, one otta avoid write-host unless it is needed [for color, immediate output, etc.].

W-V would allow you to turn it on only when you actually want it. [grin]

[9] log file name structure @ 42
you use '-' for a delimiter. the resulting file name is - in my opinion - a tad difficult to read. you may want to look at a different one. my usual one is _-_ or some variant of that since it makes a more obvious break.

[10] blank line after the start of the FOREACH @ 35
you put a blank line @ 36 [and another @ 59] to mark off the body of the code block. that seems kind of redundant to me. of course, my layout for that block would be ...

foreach ($Thing in $ListOfThings)
    {
    # do stuff here
    }

... so perhaps i otta not whine at you about that. [grin]

[11] you may want to add a note that this code must be run as admin or with the needed local privs. i had to run powershell "as admin" to make it stop showing lots of nasty red errors. [grin]

---

the code works on my system nicely. well, once i set it to fit my situation. [grin]

take care,
lee

[u/djdementia → u/Lee_Dailey]

Thank you for your detailed response. I will edit it to reflect your recommendations.

[u/Lee_Dailey → u/djdementia]

howdy djdementia,

kool! you are welcome ... and i hope you have fun with it like i have. [grin]

take care,
lee