How to Audit Windows Active Directory (AD) Logon Events Using PowerShell

Monitoring user logon activity is a fundamental requirement for securing Windows Active Directory environments. Whether you are investigating a compromised account, tracking employee hours, or fulfilling compliance requirements, you need a reliable way to query logon events. Using PowerShell, administrators can programmatically extract and filter these events from the Domain Controller’s Security event log without digging through the graphical Event Viewer.

Understanding AD Logon Event IDs

Before querying the logs, you must understand the relevant Event IDs generated by the Windows Security subsystem on a Domain Controller:

• Event ID 4624: An account was successfully logged on.
• Event ID 4625: An account failed to log on (invalid credentials).

Note: To capture these events, your Group Policy must have “Audit Logon Events” enabled under Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration.

How to Query Logon Events with PowerShell

The Get-WinEvent cmdlet is the most efficient way to query Windows event logs. It is significantly faster than the older Get-EventLog cmdlet because it allows the server to filter the logs before returning the data.

To query successful logons (4624) for a specific user over the last 7 days, open an elevated PowerShell prompt on the Domain Controller (or via a remote session) and run:

$TargetUser = "jdoe"
$StartDate = (Get-Date).AddDays(-7)

# Create a fast XML filter query
$FilterXML = @"
<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID=4624) and TimeCreated[@SystemTime>='$($StartDate.ToString("o"))']]]
      and
      *[EventData[Data[@Name='TargetUserName']='$TargetUser']]
    </Select>
  </Query>
</QueryList>
"@

# Execute the query
$LogonEvents = Get-WinEvent -FilterXml $FilterXML

# Format the output
$LogonEvents | Select-Object TimeCreated, 
    @{Name='User';Expression={$_.Properties[5].Value}},
    @{Name='Source IP';Expression={$_.Properties[18].Value}},
    @{Name='Logon Type';Expression={$_.Properties[8].Value}} | Format-Table -AutoSize

Understanding the Output

The script uses XML filtering to rapidly search thousands of logs. The output extracts the TimeCreated, the TargetUserName, the IpAddress (Source IP), and the LogonType.

The Logon Type is crucial for understanding how the user authenticated:

• Type 2: Interactive logon (local console).
• Type 3: Network logon (accessing a shared folder).
• Type 10: RemoteInteractive (RDP session).

By automating this script, administrators can quickly generate compliance reports or feed the output into alerting systems to detect anomalous logon behavior across the Active Directory environment.