[파워쉘]윈도우 계정 생성 텔레그램 알람

 

# create_new_user_push.ps1 생성

$events=Get-WinEvent -FilterHashtable @ -MaxEvents 1



foreach($Event in $Events){



$eventXMLs = [xml]$Event.ToXml()



foreach($eventXML in $eventXMLs){



$logs = New-Object psobject -Property @{



newUser = $eventXML.Event.Eventdata.Data[0].'#text'

Server = $eventXML.Event.Eventdata.Data[1].'#text'

createuser = $eventXML.Event.Eventdata.Data[4].'#text'

}

}

}



$token = "################################"



$chatId = "#################"



$message = "서  버 : " + $logs.server + "`n"+ "생성계정 : " + $logs.createuser + "`n"+ $logs.newUser + " 계정을 생성하였습니다"



Invoke-RestMethod -Uri "https://api.telegram.org/bot$token/sendMessage?text=$message&chat_id=$chatId"

# 작업스케쥴러 등록
Schtasks /create /ru system /tn usercreatepush /tr "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -executionpolicy unrestricted -file c:\users\administrator\documents\create_new_user_push.ps1" /sc onevent /ec security /mo *[System/EventID=4720]



참고 : https://blogs.technet.microsoft.com/ashleymcglone/2013/08/28/powershell-get-winevent-xml-madness-getting-details-from-event-logs/
참고 : https://social.technet.microsoft.com/Forums/ie/ko-KR/ea3eae34-47e5-460b-8bf3-12519e2e694d/5108950629-49828529925146047084-5106050857-510604829253944?forum=win10itprogeneralKR