How to access security event logs

Steps to obtain the list of security event logs.

• Identify the domain from which you want to retrieve the report.
• Identify the LDAP attributes you need to fetch the report.
• Identify the primary DC to retrieve the report.
• Compile the script.
• Execute it in Windows PowerShell.

Sample Windows PowerShell script

get-eventlog security

This will give the list of all the security logs

get-eventlog security -newest 50

This will give the list of the 50 most recent security event logs.

get-eventlog security -newest 100 |
  where \{$_.entrytype -eq `
    "FailureAudit"\}

This gives the 100 most recent security event logs pertaining to event failures.

Sample output:

To obtain the report,

• Login to ADAudit Plus web console as an administrator.
• Navigate to the Reports tab to view more than 20 different report categories on the left pane.
• Under each of these categories, you will find a multitude of reports arranged in a logical fashion.
• To view a particular report, just navigate to the report or use "/" to search for reports using keywords.
• For example, to view a report on logon failures, navigate to Reports -> User Logon Reports -> Logon Failures
• You may use the Export As option to export the report in any of the preferred formats (CSV, PDF, HTML, CSVDE and XLSX).