Registrar y mostrar un evento en PowerShell cuando se crea un usuario | Operating systems, scripting, PowerShell and security

PowerShell

#Ejecutar PowerShell como administrador
Register-WmiEvent -Query "select * from __InstanceCreationEvent where TargetInstance isa 'Win32_NtLogEvent' and TargetInstance.logfile = 'Security' and (TargetInstance.EventCode = '4720')" -Action {Write-Host $event.SourceEventArgs.NewEvent.TargetInstance.insertionstrings}

#Ejecutar PowerShell como administrador

Register-WmiEvent -Query "select * from __InstanceCreationEvent where TargetInstance isa 'Win32_NtLogEvent' and TargetInstance.logfile = 'Security' and (TargetInstance.EventCode = '4720')" -Action {Write-Host $event.SourceEventArgs.NewEvent.TargetInstance.insertionstrings}

Registrar y mostrar un evento en PowerShell cuando se crea un usuario (PowerShell)

LIBRO DE POWERSHELL

LO ÚLTIMO

VÍDEOS