Quantcast
Channel: Windows PowerShell forum
Viewing all articles
Browse latest Browse all 21975

Fetch client IP addresses from the Netlogon.log file of all domain controllers in the domain

$
0
0

Hi,

The event ID 5807 is logged in the system logs of domain controllers as a result of which the IP addresses for the missing subnets are logged in Netlogon.log under %systemroot%/debug. The end goal is to fetch the IP addresses along with rest of the respective attributes from the Netlogon.log for all the domain controllers in the domain. I have the following script however, it gives me a 0KB file despite the fact that the Netlogon.log on the DC contains ample entries from last two months. 

function GetDomainControllers {
    $DCs=[system.directoryservices.activedirectory.domain]::GetCurrentDomain() | ForEach-Object {$_.DomainControllers} | ForEach-Object {$_.Name}
    return $DCs

}

function GetNetLogonFile ($server) {
    $path= '\\' + $server + '\c$\windows\debug\netlogon.log'
    try {$netlogon=get-content -Path $path -ErrorAction stop}
    catch { "Can't open $path"}
    #reverse the array's order to the end of the file
    [array]::Reverse($netlogon)
    $IPs=@()
    foreach ($line in $netlogon) {
        #split the line into pieces using a space as the delimiter
        $splitline=$line.split(' ')
        #Get the date stamp which is in the mm/dd format
        $logdate=$splitline[0]
        #split the date
        $logdatesplit=($logdate.split('/'))
        [int]$logmonth=$logdatesplit[0]
#last month and this month
        if (($logmonth -eq $thismonth) -or ($logmonth -eq $lastmonth)) {
            #only push it into an array if it matches an IP address format
            if ($splitline[5] -match '\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b'){
                $objuser = new-object system.object
                $objuser | add-member -type NoteProperty -name IPaddress -value $splitline[5]
                $objuser | add-member -type NoteProperty -name Computername -value $splitline[4]
                $objuser | add-member -type NoteProperty -name Server -value $server
                $objuser | add-member -type NoteProperty -name Date -value $splitline[0]
                $objuser | add-member -type NoteProperty -name Time -value $splitline[1]
                $IPs+=$objuser
            }
        } else {
            #break out of loop if the date is not this month or last month
            break
        }
    }
    return $IPs
}

#Get last month's date
$thismonth=(get-date).month
$lastmonth=((get-date).addmonths(-1)).month

#get all the domain controllers
$DomainControllers=GetDomainControllers
#Get the Netlogon.log from each DC
Foreach ($DomainController in $DomainControllers) {
    $IPsFromDC=GetNetLogonFile($DomainController)
    $allIPs+=$IPsFromDC
}

$allIPs | Sort-Object -Property IPaddress -Unique | Export-Csv "E:\bin\NetlogonIPs.csv"

PLEASE HELP!!


Viewing all articles
Browse latest Browse all 21975

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>