powershell system.object array to String - powershell

Question

I'm using the below code to pull the IP Address of the User (supplied at beginning of code) that had a failed logon attempt. The code works, but when I use GetType() the variable $ipp, it comes back as a Name is Object[] Base Type is System.Array I need this variable to be a string (I'm looking for the IP in a text file and removing it if it's found).
$ipp = Get-WinEvent -FilterHashtable #{LogName='Security';Id=4625;StartTime=$hours} |
Where-Object {$_.Properties[5].Value -like "*$userName*"} |
Select-Object -First 1 {$_.Properties[19].value}
I'm using PowerShell 5
Thanks
Kevin

Answer 1

Pre-warning: This will probably be your best bet for a full array of each bit of information from the bad attempt/lockout event. You can assign each object to a variable easily, check out the last line for some of the property names I use when checking locked accounts.
I have been doing a lot of this sort of stuff at work lately and came across a nice Microsoft demo. I unashamedly stole their script, works like a charm.
I hoped you were connecting to a domain controller but it looks like that event ID is for a bad attempt on the clients machine, not the DC.
Changed it a bit so you can slot it in after you have defined your $userName and left the Microsoft comments. Just check out line 87/88 as you may need to complete that if you encounter errors with your DC.
# Set up the lockout report
$report = #()
# Pick the DCs to crawl
$DCs = Get-ADDomainController -Filter * |
Select-Object HostName, IPv4Address, Site, OperatingSystem, OperationMasterRoles |
Out-Gridview -Title "Select the DCs to query" -PassThru |
Select-Object -ExpandProperty HostName
# Find the lockout stats for that user on all selected DCs
ForEach ($DC in $DCs) {
$report += Get-ADUser $userName -Server $DC -ErrorAction Continue `
-Properties cn, LockedOut, pwdLastSet, badPwdCount, badPasswordTime, lastLogon, lastLogoff, lastLogonTimeStamp, whenCreated, whenChanged | `
Select-Object *, #{name='DC';expression={$DC}}
}
$DCs = $report |
Select-Object `
DC, `
cn, `
LockedOut, `
pwdLastSet, `
#{name='pwdLastSetConverted';expression={[datetime]::fromFileTime($_.pwdlastset)}}, `
badPwdCount,
badPasswordTime, `
#{name='badPasswordTimeConverted';expression={[datetime]::fromFileTime($_.badPasswordTime)}}, `
lastLogon, `
#{name='lastLogonConverted';expression={[datetime]::fromFileTime($_.lastLogon)}}, `
lastLogoff, `
#{name='lastLogoffConverted';expression={[datetime]::fromFileTime($_.lastLogoff)}}, `
lastLogonTimeStamp, `
#{name='lastLogonTimestampConverted';expression={[datetime]::fromFileTime($_.lastLogonTimestamp)}}, `
whenCreated, `
whenChanged |
Out-GridView -Title "Select the DC to query event logs for lockouts" -PassThru
# Filter generated using Event Viewer GUI Custom View
# Logon/Lockout events in the last 24 hours
[xml]$xmlFilter = #"
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[System[(EventID=529 or EventID=644 or EventID=675 or EventID=676 or EventID=681 or EventID=4740 or EventID=4771) and TimeCreated[timediff(#SystemTime) <= 86400000]]]</Select>
</Query>
</QueryList>
"#
$Events = #()
ForEach ($DC in $DCs) {
"Getting events from $($DC.DC)"
# Must enable the firewall rule for remote EventLog management - CHECK WITH YOUR IT TEAM, THIS MAY BREACH YOUR COMPANY SECURITY POLICY
# Invoke-Command -ComputerName $DC.DC -ScriptBlock {Get-NetFirewallRule -Name *eventlog* | Where-Object {$_.Enabled -eq 'False'} | Enable-NetFirewallRule -Verbose}
### Filter for the userID in the event message properties
$Events += Get-WinEvent -ComputerName $DC.DC -FilterXML $xmlFilter
}
ForEach ($Event in $Events) {
# Convert the event to XML
$eventXML = [xml]$Event.ToXml()
# Iterate through each one of the XML message properties
For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++) {
# Append these as object properties
Add-Member -InputObject $Event -MemberType NoteProperty -Force `
-Name $eventXML.Event.EventData.Data[$i].name `
-Value $eventXML.Event.EventData.Data[$i].'#text'
}
}
# View the lockout details
$Events | Where-Object {$_.TargetUserName -eq $userName} | Select-Object TargetUserName, IPAddress, MachineName, TimeCreated | Out-GridView