A collection of practical PowerShell utilities for Windows Server administration, security auditing, troubleshooting, and infrastructure automation.
Each script focuses on a specific real-world administration task and includes its own README with usage examples, requirements, and limitations.
| Script | Description |
|---|---|
| Get-FailedLogonAttempts | Investigate failed Windows logon attempts (Security Event ID 4625), including usernames, source IPs, logon types, and failure reasons. |
| Get-SuccessfulLogons | Audit successful Windows logons (Security Event ID 4624); filter console, RDP, network, and other logon types by name or ID. |
| Get-RdpSessionHistory | View Windows RDP session history, including logons, reconnects, disconnects, and logoffs. Supports filtering by user, time range, and event type, with CSV export. |
- Windows with a compatible version of PowerShell (see each script's README).
- Appropriate permissions to access the relevant Windows Event Logs.
- Administrator privileges may be required for reading Security event logs.
Check your current execution policy:
Get-ExecutionPolicyIf necessary, allow locally created scripts to run:
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSignedFor scripts downloaded from GitHub, you may need to unblock the file:
Unblock-File -Path .\script.ps1Review scripts before executing them. Organizational Group Policy settings may override local execution policy settings.
Each utility has its own README with instructions and examples. Open the script's folder to get started.
See the repository's LICENSE file, if present.