从windwos 事件日志中导出客户端登录事件和IP地址

打开Windows power sheel 命令行工具，然后执行下面内容

Get-WinEvent -FilterHashtable @{LogName='Security';Id=4624,4648,4625} | ForEach-Object {
    $xml = [xml]$_.ToXml()
    $ip = $xml.Event.EventData.Data | Where-Object Name -eq 'IpAddress' | Select-Object -ExpandProperty '#text'
    if($ip) {
        [PSCustomObject]@{
            Time=$_.TimeCreated
            ID=$_.Id
            IP=$ip
        }
    }
} | Format-Table -AutoSize | Out-File -FilePath "C:\clientip.txt" -Encoding UTF8

执行完成后，打开c:\clientip.txt 就能看到登录IP和时间的清单