eventlog-management.ps1

# Event log queries and log size/retention management snippets for Windows security logs.
# Full write-up: https://www.securityscriptographer.com/2026/06/powershell-event-log-management-for.html
# Part of https://github.com/SecurityScriptographer/defensive-toolkit - generated by repo_sync.py, do not edit here.

# --- Discover the log you actually want ---

Get-WinEvent -ListLog * |
    Where-Object RecordCount -gt 0 |
    Sort-Object RecordCount -Descending |
    Select-Object -First 25 LogName, RecordCount, IsEnabled, LogMode

# --- Build the filter on the server side ---

# Failed logons in the last hour
Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4625
    StartTime = (Get-Date).AddHours(-1)
} -ErrorAction SilentlyContinue

# Errors and warnings from System log, last 24 hours
Get-WinEvent -FilterHashtable @{
    LogName   = 'System'
    Level     = 2, 3   # Error, Warning
    StartTime = (Get-Date).AddDays(-1)
} -ErrorAction SilentlyContinue

# --- Project the properties you care about ---

Get-WinEvent -FilterHashtable @{
    LogName = 'Security'; Id = 4625; StartTime = (Get-Date).AddHours(-1)
} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated,
                  @{Name='User';      Expression={ $_.Properties[5].Value }},
                  @{Name='Domain';    Expression={ $_.Properties[6].Value }},
                  @{Name='Reason';    Expression={ $_.Properties[8].Value }},
                  @{Name='SourceIP';  Expression={ $_.Properties[19].Value }},
                  @{Name='WorkstationName'; Expression={ $_.Properties[13].Value }}

# --- Turn failed logons into a brute-force triage table ---

$dcs = (Get-ADDomainController -Filter *).HostName

Invoke-Command -ComputerName $dcs -ScriptBlock {
    Get-WinEvent -FilterHashtable @{
        LogName = 'Security'; Id = 4625; StartTime = (Get-Date).AddHours(-6)
    } -ErrorAction SilentlyContinue |
        Select-Object @{N='DC';E={$env:COMPUTERNAME}},
                      @{N='User';E={ $_.Properties[5].Value }},
                      @{N='SourceIP';E={ $_.Properties[19].Value }}
} | Group-Object User, SourceIP | Where-Object Count -gt 10 | Sort-Object Count -Descending

# --- Inspect the current state, then size per channel ---

Get-WinEvent -ListLog * |
    Where-Object RecordCount -gt 0 |
    Select-Object LogName,
                  @{N='MaxMB';      E={ [math]::Round($_.MaximumSizeInBytes/1MB,1) }},
                  @{N='PercentFull';E={ [math]::Round(($_.FileSize/$_.MaximumSizeInBytes)*100,1) }},
                  LogMode, IsEnabled |
    Sort-Object PercentFull -Descending |
    Format-Table -AutoSize

# --- Resize and change retention with wevtutil ---

# Set Security log to 4 GB, circular overwrite (default mode)
wevtutil sl Security /ms:4294967296

# Switch retention to AutoBackup (archive full log, start a fresh one)
wevtutil sl Security /ms:4294967296 /rt:false /ab:true

# Set Sysmon to 4 GB
wevtutil sl 'Microsoft-Windows-Sysmon/Operational' /ms:4294967296

# --- Roll out via Group Policy and watch for runaway logs ---

$threshold = 80
Get-WinEvent -ListLog * |
    Where-Object { $_.RecordCount -gt 0 -and $_.MaximumSizeInBytes -gt 0 } |
    ForEach-Object {
        $percent = ($_.FileSize / $_.MaximumSizeInBytes) * 100
        if ($percent -ge $threshold) {
            [PSCustomObject]@{
                Host = $env:COMPUTERNAME; LogName = $_.LogName
                PercentFull = [math]::Round($percent,1)
                MaxMB = [math]::Round($_.MaximumSizeInBytes/1MB,1)
            }
        }
    }