19 lines
573 B
PowerShell
19 lines
573 B
PowerShell
|
$days = 5
|
||
|
|
$obj = @()
|
||
|
|
$fw = Get-WinEvent "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"
|
||
|
|
foreach ($temp_fw in $fw) {
|
||
|
|
if ($temp_fw.id -eq 2097) { # 2004
|
||
|
|
$type = "Added Rule"
|
||
|
|
}
|
||
|
|
elseif ($temp_fw.id -eq 2006) {
|
||
|
|
$type = "Deleted Rule"
|
||
|
|
}
|
||
|
|
$port = $temp_fw.Properties[7] | select -ExpandProperty value
|
||
|
|
$name = $temp_fw.Properties[1] | select -ExpandProperty value
|
||
|
|
$obj += [PSCustomObject]@{
|
||
|
|
Time = $temp_fw.TimeCreated;
|
||
|
|
Type = $type;
|
||
|
|
Port = $port;
|
||
|
|
Name = $name}
|
||
|
|
}
|
||
|
|
$obj | Where-Object time -gt (Get-Date).AddDays(-$days)
|