search

EvotecIT / PSWinReporting

This PowerShell Module has multiple functionalities, but one of the signature features of this module is the ability to parse Security logs on Domain Controllers providing easy to use access to AD Events.
MIT License
701 stars 69 forks source link

Type of table keys #76

Closed dakhama-mehdi closed 1 year ago

dakhama-mehdi commented 1 year ago

Edit,

Hello,

i'm still working for a new update version and dynamic update, but i have a question, some function is returned like Pscustom and other like Arraylist there are any explication ? exp : AdgroupEnumeration and AdLogsClearedSecurity

# ADGroupEnumeration = [ordered] @{Enabled = $false Events = @{Enabled = $true Events = 4798, 4799 LogName = 'Security' IgnoreWords = [ordered] @{} Fields = [ordered] @{'Computer' = 'Domain Controller' 'Action' = 'Action' 'TargetUserName' = 'Group Name' 'Who' = 'Who' 'Date' = 'When' 'ID' = 'Event ID' 'RecordID' = 'Record ID' 'GatheredFrom' = 'Gathered From' 'GatheredLogName' = 'Gathered LogName' } SortBy = 'When' } }

ADLogsClearedSecurity = [ordered]@{Enabled = $false Events = @{Enabled = $true Events = 1102, 1105 LogName = 'Security' Fields = [ordered] @{'Computer' = 'Domain Controller' 'Action' = 'Action' 'BackupPath' = 'Backup Path' 'Channel' = 'Log Type' 'Who' = 'Who' 'Date' = 'When' 'ID' = 'Event ID' 'RecordID' = 'Record ID' 'GatheredFrom' = 'Gathered From' 'GatheredLogName' = 'Gathered LogName' } SortBy = 'When' IgnoreWords = @{} Overwrite = [ordered] @{'Backup Path' = 'Backup Path', '', 'N/A' 'Who' = 'Event ID', 1105, 'Automatic Backup' } } }

when i check the type from $events.ADGroupEnumeration.getytype() i get Array but when i do it on ADLogsClearedSecurity i get PscustomObject, it's the script that changes and fills in this way or it's in the native logs ?

when or where this is decided on script or where ?

Thanks,

PrzemyslawKlys commented 1 year ago

If it's one object it will be PSCustomObject, if it's many objects it will be an array.