MonitorEventLogs PowerShell Module

Overview

The MonitorEventLogs PowerShell module allows users to monitor Windows Event Logs for specified event IDs across multiple computers. It utilizes parallel processing with PowerShell jobs to efficiently collect and report event log data.

Features

• Query event logs from local and remote computers.
• Filter logs by Event IDs, Log Name, and Start Time.
• Parallel processing for faster data collection.
• Error handling for unreachable servers.

Function: Get-TargetEventLogs

Parameters

• -EventIds (Mandatory)

  • Type: int[]
  • Description: List of Event IDs to search for in the event logs.

• -ComputerNames (Optional)

  • Type: string[]
  • Default: $env:COMPUTERNAME
  • Description: Target computer(s) to query. Defaults to the local machine.

• -LogName (Optional)

  • Type: string
  • Default: Application
  • Description: The name of the event log to search (e.g., Application, System).

• -StartTime (Optional)

  • Type: datetime
  • Default: Current time minus 5 minutes
  • Description: The starting point in time for querying logs.

Example Usage

# Query Event ID 1000 in the Application log on the local machine from the past 30 minutes
Get-TargetEventLogs -EventIds 1000 -StartTime (Get-Date).AddMinutes(-30)

# Query Event IDs 4624 and 4625 from the Security log on multiple servers
Get-TargetEventLogs -EventIds 4624, 4625 -LogName Security -ComputerNames Server01, Server02

Error Handling

• The function tests connectivity to each specified computer before querying.
• If a server is unreachable, it logs the error without interrupting the entire process.

Requirements

• Windows PowerShell 5.1 or later
• Appropriate permissions to access event logs on remote computers

Installation

1. Copy MonitorEventLogs.psm1 to a module directory (e.g., C:\Program Files\WindowsPowerShell\Modules\MonitorEventLogs).
2. Import the module in your PowerShell session:

   Import-Module MonitorEventLogs

Enabling File Access Monitoring in Windows for Individual Files

This guide explains how to enable file access monitoring in Windows to track when a specific file is accessed, moved, or deleted.

Prerequisites

• Administrator privileges
• Windows Pro, Enterprise, or Server editions (Audit policies are not available in Home editions)

---

1. Enable Audit Object Access Policy

1. Press Win + R, type secpol.msc, and press Enter to open Local Security Policy.
   (If unavailable, use gpedit.msc for Group Policy Editor or configure via command line.)

2. Navigate to:
   Security Settings → Local Policies → Audit Policy

3. Double-click Audit object access.

4. Check Success and Failure to log both successful and failed access attempts.

5. Click OK.

---

2. Configure File Auditing for the Target File

1. Right-click the file or folder you want to monitor and select Properties.

2. Go to the Security tab and click Advanced.

3. In the Advanced Security Settings window, go to the Auditing tab.

4. Click Add, then click Select a principal.

5. Enter Everyone (or a specific user/group to monitor) and click OK.

6. In the Basic permissions, check:

   • Read (to monitor opening the file)
   • Write (to monitor changes)
   • Delete (to track deletion)
   • Full control (for all access types)

7. Click OK to apply.

---

3. Monitor File Move or Delete Operations

Moving or deleting a file triggers Write or Delete permissions in auditing. To specifically monitor these:

1. Repeat the steps above for the parent folder of the file.

2. Enable auditing on the folder with the Delete subfolders and files and Delete permissions.

---

4. View Access Logs in Event Viewer

1. Press Win + R, type eventvwr.msc, and press Enter.

2. Navigate to:
   Windows Logs → Security

3. Look for Event ID 4663 (File access attempt) and Event ID 4656 (Handle request for the file).

4. Details will include the user, timestamp, and type of access.

---

Additional Notes

• Enabling auditing can generate many logs. Be selective with files/folders to monitor.
• For more advanced monitoring, consider using Sysinternals Process Monitor or third-party tools for real-time alerts.

---

By following this guide, you'll effectively monitor file access, moves, and deletions on Windows.

Author

Guy McDowell

---

For any issues or contributions, please contact the author.