Windows Server 2019 查询最近7天远程登录源 IP 地址（含 RDP 和网络登录）

脚本1，显示最近7天登录的账号和ip，不去重复

执行ps脚本之前需要先执行Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process -Force

或者Set-ExecutionPolicy RemoteSigned -Force

# 计算7天前的日期$startTime = (Get-Date).AddDays(-7)# 查询安全日志中最近7天的4624事件（成功登录）$events = Get-WinEvent -LogName Security -FilterXPath \"*[System[EventID=4624 and TimeCreated[@SystemTime>=\'$($startTime.ToUniversalTime().ToString(\'o\'))\']]]\"# 提取登录类型3（网络登录）和10（远程桌面/RDP）的IP$events | ForEach-Object { $data = $_.Properties $logonType = $data[8].Value $ip = $data[18].Value $user = $data[5].Value if ($logonType -eq 10 -or $logonType -eq 3) { [PSCustomObject]@{ Time = $_.TimeCreated User = $user IPAddress = $ip LogonType = $logonType } }} | Sort-Object Time -Descending | Format-Table -AutoSize

脚本2，显示最近7天登录ip，去重复，不显示账号

执行ps脚本之前需要先执行

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process -Force

或者Set-ExecutionPolicy RemoteSigned -Force

$startTime = (Get-Date).AddDays(-7)$events = Get-WinEvent -LogName Security -FilterXPath \"*[System[EventID=4624 and TimeCreated[@SystemTime>=\'$($startTime.ToUniversalTime().ToString(\'o\'))\']]]\"$ipList = $events | ForEach-Object { $data = $_.Properties $logonType = $data[8].Value $ip = $data[18].Value if ($logonType -eq 10 -or $logonType -eq 3 -and $ip) { $ip }} | Sort-Object -Unique\"最近7天登录的IP地址：\"$ipList