Get-IpamIpAddressAuditEvent
Get-IpamIpAddressAuditEvent
Gets all IP address audit events in IPAM.
Syntax
Parameter Set: ByClientId
Get-IpamIpAddressAuditEvent -ClientId <String> -EndDate <DateTime> -StartDate <DateTime> [-AsJob] [-CimSession <CimSession[]> ] [-CorrelateLogonEvents] [-ThrottleLimit <Int32> ] [ <CommonParameters>]
Parameter Set: ByHostName
Get-IpamIpAddressAuditEvent -EndDate <DateTime> -HostName <String> -StartDate <DateTime> [-AsJob] [-CimSession <CimSession[]> ] [-CorrelateLogonEvents] [-ThrottleLimit <Int32> ] [ <CommonParameters>]
Parameter Set: ByIpAddress
Get-IpamIpAddressAuditEvent -EndDate <DateTime> -IpAddress <String> -StartDate <DateTime> [-AsJob] [-CimSession <CimSession[]> ] [-CorrelateLogonEvents] [-ThrottleLimit <Int32> ] [ <CommonParameters>]
Parameter Set: ByUserName
Get-IpamIpAddressAuditEvent -EndDate <DateTime> -StartDate <DateTime> -UserName <String[]> [-AsJob] [-CimSession <CimSession[]> ] [-ThrottleLimit <Int32> ] [ <CommonParameters>]
Detaillierte Beschreibung
The Get-IpamIpAddressAuditEvent cmdlet gets all IP address audit events from an IP Address management (IPAM) server over a time interval. IPAM enables IP address tracking through correlation of DHCP lease events on managed DHCP servers with user and machine authentication events on managed domain controllers and Network Policy Server (NPS) servers. You can search correlated events by IP address, client ID, hostname, or username. Use DCHP events between a start date and an end date to correlate data. The data returned includes data for both the start date and the end date.
The cmdlet returns only the top 10,000 rows if the query results exceed more than 10,000 rows. A warning occurs when this happens. Narrow the search criteria to limit the results.
Parameter
-AsJob
Aliasse |
Keiner |
Erforderlich? |
false |
Position? |
named |
Standardwert |
Keiner |
Pipelineeingaben akzeptieren? |
false |
Platzhalterzeichen akzeptieren? |
false |
-CimSession<CimSession[]>
Führt das Cmdlet in einer Remotesitzung oder auf einem Remotecomputer aus. Geben Sie einen Computernamen oder ein Sitzungsobjekt ein, z. B. die Ausgabe eines Cmdlets New-CimSession oder Get-CimSession. Der Standardwert ist die aktuelle Sitzung auf dem lokalen Computer.
Aliasse |
Session |
Erforderlich? |
false |
Position? |
named |
Standardwert |
Keiner |
Pipelineeingaben akzeptieren? |
false |
Platzhalterzeichen akzeptieren? |
false |
-ClientId<String>
Specifies an array of client IDs. Use this parameter to search for audit events by MAC address. You may use dashes (-) in the client ID but they are not required.
Aliasse |
Keiner |
Erforderlich? |
true |
Position? |
named |
Standardwert |
Keiner |
Pipelineeingaben akzeptieren? |
True (ByPropertyName) |
Platzhalterzeichen akzeptieren? |
false |
-CorrelateLogonEvents
Indicates that the cmdlet correlates logon events. Use this parameter to include or exclude user and machine events from domain controllers and NPS servers. If you specify this parameter, logon events are included in the correlated set of events retrieved by this cmdlet.
Aliasse |
Keiner |
Erforderlich? |
false |
Position? |
named |
Standardwert |
Keiner |
Pipelineeingaben akzeptieren? |
false |
Platzhalterzeichen akzeptieren? |
false |
-EndDate<DateTime>
Specifies the end date, as a DateTime object, for which to get the event data. To get a DateTime object, use the Get-Date cmdlet and specify the date in DD/MM/YYYY format.
Aliasse |
Keiner |
Erforderlich? |
true |
Position? |
named |
Standardwert |
Keiner |
Pipelineeingaben akzeptieren? |
True (ByPropertyName) |
Platzhalterzeichen akzeptieren? |
false |
-HostName<String>
Specifies an array of host names. Use this parameter to search correlated events by host name.
Aliasse |
Keiner |
Erforderlich? |
true |
Position? |
named |
Standardwert |
Keiner |
Pipelineeingaben akzeptieren? |
True (ByPropertyName) |
Platzhalterzeichen akzeptieren? |
false |
-IpAddress<String>
Specifies an IP address. Use this parameter to search correlated events by IPv4 address. The cmdlet does not support IPv6 address tracking.
Aliasse |
Keiner |
Erforderlich? |
true |
Position? |
named |
Standardwert |
Keiner |
Pipelineeingaben akzeptieren? |
True (ByPropertyName) |
Platzhalterzeichen akzeptieren? |
false |
-StartDate<DateTime>
Specifies the start date as a DateTime object. To get a DateTime object, use the Get-Date cmdlet and specify the date in DD/MM/YYYY format.
Aliasse |
Keiner |
Erforderlich? |
true |
Position? |
named |
Standardwert |
Keiner |
Pipelineeingaben akzeptieren? |
True (ByPropertyName) |
Platzhalterzeichen akzeptieren? |
false |
-ThrottleLimit<Int32>
Gibt die maximale Anzahl von gleichzeitigen Vorgängen an, die zum Ausführen dieses Cmdlets eingerichtet werden können. Wenn dieser Parameter ausgelassen oder der Wert 0
eingegeben wird, berechnet Windows PowerShell® einen optimalen Drosselungsgrenzwert für das Cmdlet basierend auf der Anzahl der CIM-Cmdlets, die auf dem Computer ausgeführt werden. Die Drosselungsgrenze gilt nur für das aktuelle Cmdlet und nicht für die Sitzung oder den Computer.
Aliasse |
Keiner |
Erforderlich? |
false |
Position? |
named |
Standardwert |
Keiner |
Pipelineeingaben akzeptieren? |
false |
Platzhalterzeichen akzeptieren? |
false |
-UserName<String[]>
Specifies an array of user names. Use this parameter to search correlated events by username. Searching by user's domain name is not supported. Logon events are included in this search because user names are not specified in DHCP lease events.
Aliasse |
Keiner |
Erforderlich? |
true |
Position? |
named |
Standardwert |
Keiner |
Pipelineeingaben akzeptieren? |
True (ByPropertyName) |
Platzhalterzeichen akzeptieren? |
false |
<CommonParameters>
Dieses Cmdlet unterstützt die allgemeinen Parameter: -Verbose, -Debug, -ErrorAction, -ErrorVariable, -OutBuffer, -OutVariable. Weitere Informationen finden Sie unter about_CommonParameters (https://go.microsoft.com/fwlink/p/?LinkID=113216).
Eingaben
Der Eingabetyp ist der Typ der Objekte, die über die Pipeline an das Cmdlet übergeben werden können.
Ausgaben
Der Ausgabetyp ist der Typ der Objekte, die vom Cmdlet ausgegeben werden.
IpamIpAuditEvent
Represents an IP address audit event in IPAM
Beispiele
Example 1: Get all IP address audit events
This command gets all IP address audit events between a start date and an end date. The command gets only DHCP lease data. The command stores the results in the variable named .$IpamIpAddressAuditEvents
PS C:\> $Today = Get-DatePS C:\>$LastMonth = $Today.AddDays(-30)PS C:\>$IpamIpAddressAuditEvents = Get-IpamIpAuditEvent -StartDate $LastMonth -EndDate $Today
Example 2: Get all IP address audit events for an end date and a start date
This command gets all IP address audit events for a given IP address, between a start date and an end date. This command searches only DHCP lease events. The command stores the results in the variable named $IpamIpAddressAuditEvents.
PS C:\> $Today = Get-DatePS C:\>$LastMonth=$Today.AddDays(-30)PS C:\>$IpamIpAddressAuditEvents = Get-IpamIpAuditEvent -StartDate $LastMonth -EndDate $Today -IpAddress 10.10.1.1
Example 3: Get all IP address audit events, user events, and logon events for an end date and a start date
This command gets all IP address audit events for a given IP address, between a start date and an end date. The command includes user and machine logon events from DC and NPS by using the CorrelateLogonEvents parameter. The command stores the results in the variable named $IpamIpAddressAuditEvents.
PS C:\> $Today = Get-DatePS C:\>$LastMonth=$today.AddDays(-30)PS C:\>$IpamIpAddressAuditEvents = Get-IpamIpAuditEvent -StartDate $lastMonth -EndDate $today -IpAddress 10.10.1.1 -CorrelateLogonEvents
Example 4: Get all IP address audit events by MAC address
This command gets all IP address audit events for a client ID, between a start date and an end date. The command includes user and machine log-on events from DC and NPS by using the CorrelateLogonEvents parameter. The command stores the results in the variable named $IpamIpAddressAuditEvents.
PS C:\> $Today = Get-DatePS C:\>$LastMonth=$Today.AddDays(-30)PS C:\>$IpamIpAddressAuditEvents = Get-IpamIpAuditEvent -StartDate $LastMonth -EndDate $Today -ClientId "AA:BB:CC:DD:EE:FF" -CorrelateLogonEvents
Example 5: Get all IP address audit events by hostname
This command gets all IP address audit events for a given hostname, between a start date and an end date. Also include user and machine log-on events from DC and NPS by using -CorrelateLogonEvents option. The command stores the results in the variable named $IpamIpAddressAuditEvents.
PS C:\> $Today = Get-DatePS C:\>$LastMonth=$Today.AddDays(-30)PS C:\>$IpamIpAddressAuditEvents = Get-IpamIpAuditEvent -StartDate $LastMonth -EndDate $Today -HostName client1.contoso.com -CorrelateLogonEvents
Example 6: Get all IP address audit events by username
This command gets all IP address audit events for a username, between a start date and an end date. Since username is available only from authentication data, this data is always included while querying for audit events based on username. The command stores the results in the variable named $IpamIpAddressAuditEvents.
PS C:\> $Today = Get-DatePS C:\>$LastMonth=$Today.AddDays(-30)PS C:\>$IpamIpAddressAuditEvents = Get-IpamIpAuditEvent -StartDate $LastMonth -EndDate $Today -HostName client1.contoso.com