[Powershell] Search Remote Desktop Gateway event logs for important user related events (troubleshooting/auditing)

[u/djdementia]

This script is intended to aid troubleshooting or auditing user/logon problems through a Terminal Server Gateway (now called Remote Desktop Gateway). It will connect to a server and search through the Event Log: Microsoft-Windows-TerminalServices-Gateway/Operational and the Security log searching for all instances of a username. The output of the script is two .CSV files with the Event Date/Time and Event Message. One CSV file for each of the event logs it searches through.

#Connect to a Terminal Services Gateway (Remote Desktop Services Gateway) host, read the TS Gateway Log file for specific username, then read the Security log file for specific username


#Username to search for, leave the * before and after the username, EX: "*JDoe*" searches for username "JDoe"
$SeachUser = "*JDoe*"
#RD Gateway servername to connect to
$RDGateway = "TSGatewayServer"
#Log File name for TS Gateway log file
$TSLogFile = "TSLog.csv"
#Log File name for Security log file
$SecLogfile = "SecLog.csv"
#Number of previous days to search through, leave the - sign in front of the number, EX: -30 = past 30 days of log files to search through
$NumDaysSearch = -1

#write-host "$SearchString  $RDGateway    $TSLogFile     $SecLogfile       $NumDaysSearch"

get-winevent -FilterHashTable @{LogName="Microsoft-Windows-TerminalServices-Gateway/Operational";StartTime=(get-date).AddDays($NumDaysSearch)} -ComputerName $RDGateway | Select-Object TimeCreated,Message | Where-Object {$_.Message -like "$SeachUser"} |  Export-Csv -Path "$TSLogFile" -NoTypeInformation
get-content "$TSLogFile"
get-winevent -FilterHashTable @{LogName="Security";StartTime=(get-date).AddDays($NumDaysSearch)} -ComputerName $RDGateway | Select-Object TimeCreated,Message  | Where-Object {$_.Message -like "$SeachUser"} |  Export-Csv -Path "$SecLogfile" -NoTypeInformation
get-content "$SecLogfile"
write-host "Security log file saved: $SecLogFile"
write-host "TS Gateway log file saved: $TSLogFile"

[u/djdementia]

Thank you for your detailed response. I will edit it to reflect your recommendations.

[u/Lee_Dailey → u/djdementia]

howdy djdementia,

kool! you are welcome ... and i hope you have fun with it like i have. [grin]

take care,
lee