The following LogParser.exe command\u00a0 will query Windows NT Securiy log with EventID 529 and parse the data into %computername%_security_logons_failed_529.xml.<\/p>\n
\r\n\r\nLogParser "SELECT TimeGenerated AS LogonDate, EXTRACT_TOKEN(Strings, 0, '|')AS Username,EXTRACT_TOKEN(Strings, 3, '|')AS LogonType,EXTRACT_TOKEN(Strings, 4, '|')AS LogonProcess, EXTRACT_TOKEN(Strings, 11, '|')AS Source INTO %computername%_security_logons_failed_529.xml FROM Security WHERE EventID = 529"\r\n\r\n<\/pre>\n<\/p>\n
\r\n\r\n<ROOT DATE_CREATED="2007-07-04 09:03:53" CREATED_BY="Microsoft Log Parser V2.2">\r\n- <ROW>\r\n<LogonDate>2007-06-18 13:33:50<\/LogonDate>\r\n<Username>Ivan1980<\/Username>\r\n<LogonType>seclogon<\/LogonType>\r\n<LogonProcess>Negotiate<\/LogonProcess>\r\n<Source>-<\/Source>\r\n<\/ROW>\r\n- <ROW>\r\n<LogonDate>2007-06-22 15:35:06<\/LogonDate>\r\n<Username>a-ws-admin<\/Username>\r\n<LogonType>NtLmSsp<\/LogonType>\r\n<LogonProcess>NTLM<\/LogonProcess>\r\n<Source>192.168.50.188<\/Source>\r\n<\/ROW>\r\n- <ROW>\r\n<LogonDate>2007-06-22 15:35:06<\/LogonDate>\r\n<Username>a-ws-admin<\/Username>\r\n<LogonType>NtLmSsp<\/LogonType>\r\n<LogonProcess>NTLM<\/LogonProcess>\r\n<Source>192.168.50.188<\/Source>\r\n<\/ROW>\r\n- <ROW>\r\n<LogonDate>2007-06-22 15:35:07<\/LogonDate>\r\n<Username>a-ws-admin<\/Username>\r\n<LogonType>NtLmSsp<\/LogonType>\r\n<LogonProcess>NTLM<\/LogonProcess>\r\n<Source>192.168.50.188<\/Source>\r\n<\/ROW>\r\n- <ROW>\r\n<LogonDate>2007-06-22 15:35:07<\/LogonDate>\r\n<Username>a-ws-admin<\/Username>\r\n<LogonType>NtLmSsp<\/LogonType>\r\n<LogonProcess>NTLM<\/LogonProcess>\r\n<Source>192.168.50.188<\/Source>\r\n<\/ROW>\r\n<\/ROOT>\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"The following LogParser.exe command\u00a0 will query Windows NT Securiy log with EventID 529 and parse the data into %computername%_security_logons_failed_529.xml. LogParser "SELECT TimeGenerated AS LogonDate, EXTRACT_TOKEN(Strings, 0, ‘|’)AS Username,EXTRACT_TOKEN(Strings, 3, ‘|’)AS LogonType,EXTRACT_TOKEN(Strings, 4, ‘|’)AS LogonProcess, EXTRACT_TOKEN(Strings, 11, ‘|’)AS Source INTO %computername%_security_logons_failed_529.xml FROM Security WHERE EventID = 529"<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-9","post","type-post","status-publish","format-standard","hentry","category-logparser"],"_links":{"self":[{"href":"https:\/\/www.networknet.nl\/apps\/wp\/wp-json\/wp\/v2\/posts\/9","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.networknet.nl\/apps\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.networknet.nl\/apps\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.networknet.nl\/apps\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.networknet.nl\/apps\/wp\/wp-json\/wp\/v2\/comments?post=9"}],"version-history":[{"count":3,"href":"https:\/\/www.networknet.nl\/apps\/wp\/wp-json\/wp\/v2\/posts\/9\/revisions"}],"predecessor-version":[{"id":927,"href":"https:\/\/www.networknet.nl\/apps\/wp\/wp-json\/wp\/v2\/posts\/9\/revisions\/927"}],"wp:attachment":[{"href":"https:\/\/www.networknet.nl\/apps\/wp\/wp-json\/wp\/v2\/media?parent=9"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.networknet.nl\/apps\/wp\/wp-json\/wp\/v2\/categories?post=9"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.networknet.nl\/apps\/wp\/wp-json\/wp\/v2\/tags?post=9"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}