如何获取在Windows上卸载应用程序的用户的用户名？

Question

我想解析Windows事件日志以列出已在设备上卸载的每个软件以及由谁。

这里是我想出了到现在为止：

• 匹配的事件1040（applciation卸载）：

---

PowerShell -ExecutionPolicy ByPass -Command "Get-WinEvent -FilterHashTable @{logname=’application’; id=1040; StartTime=(get-date).AddDays(-1)} | select timecreated, level, id, message, ProviderName, User | Export-Csv -Append C:\BCM\eventerr.csv -notype" 

• 获得 “用户”，在给定的事件：

---

Get-WinEvent -MaxEvents 10 | foreach { 
     $sid = $_.userid; 
     if($sid -eq $null) { return; } 
     $objSID = New-Object System.Security.Principal.SecurityIdentifier($sid); 
     $objUser = $objSID.Translate([System.Security.Principal.NTAccount]); 
     Write-Host $objUser.Value; 
    } 

但它首先outputing错误：

Error: Attempted to perform an unauthorized operation.. At line:1 char:1 + Get-WinEvent -MaxEvents 10 | foreach { + ~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Get-WinEvent], Exception + FullyQualifiedErrorId : LogInfoUnavailable,Microsoft.PowerShell.Commands.GetWinEvent‌​Command

然后输出2个的用户列表...

编辑：下面是无用的，因为我自从意识到第二个命令行没有（总是）输出正确的结果...

我试图将这些结合起来：

PowerShell -ExecutionPolicy ByPass -Command "Get-WinEvent -MaxEvents 10 -FilterHashTable @{logname=’application’; id=1040; StartTime=(get-date).AddDays(-1)} | select timecreated, level, id, message, ProviderName, User | foreach {$sid = $_.userid; if($sid -eq $null) { return; } $objSID = New-Object System.Security.Principal.SecurityIdentifier($sid); $objUser = $objSID.Translate([System.Security.Principal.NTAccount]); Write-Host $objUser.Value;}| Export-Csv -Append C:\BCM\eventerr.csv -notype" 

但我得到这个错误在PowerShell窗口：

At line:1 char:325 + ... rityIdentifier(); AD\user = S-1-5-21-935981524-3360503449-101602611-2988 ... + ~ An expression was expected after '('. + CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException + FullyQualifiedErrorId : ExpectedExpression

有人可以帮我解决这个问题吗？提前:)

Answer 1

这里

感谢你的两个功能结合使用：

Get-WinEvent -FilterHashTable @{logname='application'; id=1040; StartTime=(get-date).AddDays(-10)} | % { 
    $objSID = New-Object System.Security.Principal.SecurityIdentifier ($_.userid) 
    $objUser = $objSID.Translate([System.Security.Principal.NTAccount]) 
    [pscustomobject]@{ 
     User = $objUser.Value 
     timecreated = $_.timecreated 
     level = $_.level 
     id = $_.id 
     message = $_.message 
     ProviderName = $_.ProviderName 
    } 
} | Export-Csv -Append C:\BCM\eventerr.csv -notype 

这里，它是一个非常长的oneliner：

PowerShell -ExecutionPolicy ByPass -Command "Get-WinEvent -FilterHashTable @{logname='application'; id=1040; StartTime=(get-date).AddDays(-10)} | % {$objSID = New-Object System.Security.Principal.SecurityIdentifier ($_.userid); $objUser = $objSID.Translate([System.Security.Principal.NTAccount]);[pscustomobject]@{User = $objUser.Value;timecreated = $_.timecreated;level = $_.level;id = $_.id;message = $_.message;ProviderName = $_.ProviderName}} | Export-Csv -Append C:\BCM\eventerr.csv -notype"