Notify via Email on user login with Public IP with Event ID 21 Using PowerShell script


PowerShell script for Windows Server. This script is used for fire and Email notification on any user login via Public IP.

Steps:

1. Save the script with the name EmailNotification.ps1.

2. Create a Basic Task via Task Scheduler. Enter Name for Task.

3. Select the Trigger option "When a specific event is logged"

4. Select option as below.


5. On Action Select "Start a specific program" and browse the EmailNotification.ps1 file.

6. Save the task.

Script: 

# Define the SMTP server details and user credentials

$smtpServer = "SMTP server" # SMTP.GMAIL.COM

$smtpUsername = "SMTP username"

$smtpPassword = "password for authentication"

$smtpSecurePassword = ConvertTo-SecureString -String $smtpPassword -AsPlainText -Force

$smtpCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $smtpUsername, $smtpSecurePassword

$from = "from@example.com"

$to = "to@example.com"


# Define Regex variable for Local IP range. 

# This link will help you: https://www.analyticsmarket.com/freetools/ipregex

$lan = "^192\.168\.10\.([1-9]|[1-9]\d|1\d\d|2[0-4]\d|25[0-4])$" # LOCAL LAN


$logName = "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"

$sourceName = "Microsoft-Windows-TerminalServices-LocalSessionManager"


$event = Get-WinEvent -LogName $logName -FilterXPath "*[System[(EventID=21) and Provider[@Name='$sourceName']]]" -MaxEvents 1

$message = $event.Message


# Extract the important details from the event

    $Username = $event.Properties[0].Value

    $SessionID = $event.Properties[1].Value

    $datetime = $event.TimeCreated.ToString("yyyy-MM-dd hh:mm:ss tt")

    $ipAddress = [IPAddress]([regex]::Matches($message, "\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b").Value)


If ($ipAddress -match $lan) 

{

Write-Output "User login with Local IP"

} 

Else 

{

Write-Output "User login with Public IP"

$body = "<b>User Login Sucessful on Host:</b> $env:COMPUTERNAME<br>`r`n<b>User Name:</b> $Username<br>`r`n<b>Session ID:</b> $SessionID<br>`r`n<b>IP Address:</b> $ipAddress<br>`r`n<b>Date & Time:</b> $datetime<br>"

Send-MailMessage -From $from -To $to -Subject "User $Username Loggedin with External IP $ipAddress" -Body $body -BodyAsHtml -SmtpServer $smtpServer -Credential $smtpCredential

}


Post your review in a comment.

Comments

Post a Comment

Popular posts from this blog

How to Enable Recycle Bin on Mapped drive.

Image
How to Enable Recycle Bin on Mapped Drive. Here is the solution for enabling Recycle Bin on Mapped Drive. I have tested it in My existing environment Windows Server 2019 and Windows Server 2012 and it's running fine.  Step 1. Press Win+R and type regedit and hit the enter key. Step 2. Goto " HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions " Step 3. Press Right Click on Mouse and Create New Key under FolderDescriptions and paste  " {9147E464-33A6-48E2-A3C9-361EFD417DEF} " as value. Step 4. After creating the key Right Click under  " {9147E464-33A6-48E2-A3C9-361EFD417DEF} " and Create New REG_DWORD-32Bit with Name = Category and set Value to 4. Step 5. Create New String with Name = RelativePath and set the value to Y:\  (Note: Replace volume letter Y with your existing letter. ) Step 6.  Create New String with Name = Name  and set the  value to YDrive Step 7. Goto " HKCU\Software\Microsoft\Windows\CurrentVersion\Exp...
Read more

How To Setup Internet Access Priority With Multiple Networks On Windows

Image
How To Setup Internet Access Priority With Multiple Networks On Windows If you are using multiple NIC's (Network Adapters) to access more than one network, it gets tricky from where you internet connection comes from. Here is one such scenario and solution to make Microsoft Windows prioritize internet connection from a particular network over the other. In my example setup I have one LAN connection (192.168.0.1) and one  WiFi  connection  (192.168.1.1) and would like Windows to use internet from my fixed-line broadband connected via LAN. To get started with configuring the internet access priority on your Windows computer, follow the steps below : Setup Network Card Priority at  Control Panel -> Network and Internet -> Network Connections -> Advanced menu –> Advanced settings . However, the above will not prioritize the internet access. To achieve that "Right-click on your  network  adapter " and click "Properties". Clic...
Read more

Fix: Documents Folder opens automatically at Windows Startup.

Image
Fix: Documents Folder opens automatically at Windows Startup Some often report this strange but quite annoying issue. While logging in to the computer, the Computer folder or the Documents folder opens automatically at Windows Startup . Unless you have placed its shortcut in the Startup folder, the most likely cause of this issue is the  incorrect or duplicated Usernit value in the Windows Registry. The fix for this problem does exists, but it requires modifying the registry. Serious problems might occur if you modify the registry incorrectly. Therefore, it is essential you follow these steps carefully. For added protection, back up the registry before you modify it or else create a  system restore point  first. Then, you can restore or revert if the changes are not what you expected. Documents folder opens automatically If when you start your  Windows 8  | 7, the This PC / Computer or Documents folder opens up automatically at start-up, first check...
Read more