Function smtpMessage($smtpTo, $smtpJob, $smtpBody,$smtpAttch) { $pcDomain = (Get-WmiObject Win32_ComputerSystem).Domain $emailDevice = "$env:COMPUTERNAME" + '.' + "$pcDomain" #Fucntion variables. $emailSmtpServer = "mail.aeroinc.net" $emailSmtpServerPort = "587" $emailSmtpUser = "scripts@aeroinc.net" $emailSmtpPass = "Aisnet@3387" $emailMessage = New-Object System.Net.Mail.MailMessage $emailMessage.From = "scripts@aeroinc.net" $emailMessage.To.Add( "$smtpTo" ) $emailMessage.Subject = " $emailDevice - $smtpJob" $emailMessage.IsBodyHtml = $true $emailMessage.Body = @"

$smtpBody

"@ # $emailMessage.Attachments.Add($smtpAttch) #Action. $SMTPClient = New-Object System.Net.Mail.SmtpClient( $emailSmtpServer , $emailSmtpServerPort ) $SMTPClient.Credentials = New-Object System.Net.NetworkCredential( $emailSmtpUser , $emailSmtpPass ); $SMTPClient.Send( $emailMessage ) $emailMessage.Dispose(); } #Slow script execution $slow = Test-Connection 216.82.160.254 -count 2 $adminEmail = "cms@aerocomputing.com" $adminPhone = "8159905729@email.uscc.net" #Create log directories if not present. $kasRoot = "C:\kworking" $logRoot = "C:\kworking\logs" if(!(Test-Path $kasRoot)){ New-Item -ItemType "directory" -Path "c:\kworking\" } if(!(Test-Path $logRoot)){ New-Item -ItemType "directory" -Path "c:\kworking\logs" } $time = (get-date).AddMinutes(-1) $date = get-date -f hh-mm-tt-MM-dd-yyyy $log = "C:\kworking\logs\logon-$date.html" Add-Content "$log" "" Add-Content "$log" "" $event = Get-WinEvent -FilterHashtable @{logname='security'; id=4624} -MaxEvents 100 | Where-Object {$_.properties[8].value -eq 2 -or $_.properties[8].value -eq 10 -or $_.properties[8].value -eq 7} $who = "$($event[0].properties[6].Value)"+"\"+"$($event[0].properties[5].Value)" foreach($i in $event){ $who = "$($i.properties[6].Value)"+"\"+"$($i.properties[5].Value)" Add-Content "$log" "" } Add-Content "$log" "
TimeTypeUsernameProcessIP
$($i.TimeCreated)$($i.properties[8].Value)$who$($i.properties[17].Value)$($i.properties[18].Value)
" $body = Get-Content $log #smtpMessage "$adminPhone" "" "$date $who $where" smtpMessage "$adminEmail" "Server Login Alert - $date" "$body" #$remove = remove-item -force $log #$debug = add-content C:\scripts\logon.debug.txt "$error" #$debug = add-content C:\scripts\logon.debug.txt "Where: $env:COMPUTERNAME.$env:USERDNSDOMAIN
Who: $who
From: $from"