wevtutil logontype 옵션

@echo off

 

REM (C) 2008 Microsoft Corporation

REM All Rights Reserved

set outputfile=%temp%\interactive-logon-events.xml

if "%1" NEQ "" set outputfile=%1

 

REM The next command is all one line and has no carriage returns

REM The only spaces in the XPath are around the AND keywords

wevtutil qe Security /q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and Task=12544 and (EventID=4624)] and EventData[Data[@Name='LogonType']='2']]" /e:Events > %outputfile%

start %outputfile%

set outputfile=

로그온 이벤트 저장 (원격 접속 logontype=10)

wevtutil qe Security /q:"*[System[(EventID=4624)] and EventData[Data[@Name='LogonType']='10']]" /f:text  > result.txt