Forum Discussion

Eric_Egolf's avatar
Eric_Egolf
6 years ago

Monitoring Logoff/Logon Events for Anomalies

Background - We have a fairly large citrix environment(70 customers, 1200 users). Each customer has 1 or more xenapp servers depending on how many users. The environment is setup in a manner that o...
  • Cole_McDonald's avatar
    Cole_McDonald
    6 years ago

    Sure... I'm using this as a datasource targeting isWindows() called "Active Directory Failed Login Count" 

    try {
    $events = Get-WinEvent                  `
        -ComputerName    ##system.sysname## `
        -ErrorAction     SilentlyContinue   `
        -FilterHashtable @{
            LogName   = "Security"
            Id        = 4625
            StartTime = (get-date).AddMinutes(-5)
        }                                  `
        | where Message -Match "0xC000006D"
} catch {
        $events = @()
}

"$($events.count)"

    No warranty for the code, use at your own risk.  Please note the use of backtick line continuation for readbility.

Cole_McDonald's avatar
Cole_McDonald
Icon for Professor rankProfessor
6 years ago

Happy to help.  Can I ask specifically what you're using for your criteria?  If it's useful, I'd love to see how you end up performing your metrics.  I have other thoughts as well showing average session duration, average number of processes started during a given session, normal logon/logoff times / username/guid.  These can be instances linked to servers that the user has access to.  If you have server specific access defined in AD, you can even use get-adcomputer and get-aduser to show if anyone trying to log in is part of the AD, but doesn't have access to that particular server.  Basically, looking for anything anomalous that could be used to alert for possible security issues.  Stay paranoid, stay safe :)/emoticons/smile@2x.png 2x" title=":)" width="20">