Networknet archive Blog

Log Parser: Export Security Event ID 529 to XML

Originally published Last updated

The following LogParser.exe command queries the Windows NT Security log for Event ID 529 and writes the results to %computername%_security_logons_failed_529.xml.

Code1 line
1

LogParser "SELECT TimeGenerated AS LogonDate, EXTRACT_TOKEN(Strings, 0, '|')AS Username,EXTRACT_TOKEN(Strings, 3, '|')AS LogonType,EXTRACT_TOKEN(Strings, 4, '|')AS LogonProcess, EXTRACT_TOKEN(Strings, 11, '|')AS Source INTO %computername%_security_logons_failed_529.xml FROM Security WHERE EventID = 529"

Captured XML output

XML37 lines
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

<ROOT DATE_CREATED="2007-07-04 09:03:53" CREATED_BY="Microsoft Log Parser V2.2">
- <ROW>
<LogonDate>2007-06-18 13:33:50</LogonDate>
<Username>Ivan1980</Username>
<LogonType>seclogon</LogonType>
<LogonProcess>Negotiate</LogonProcess>
<Source>-</Source>
</ROW>
- <ROW>
<LogonDate>2007-06-22 15:35:06</LogonDate>
<Username>a-ws-admin</Username>
<LogonType>NtLmSsp</LogonType>
<LogonProcess>NTLM</LogonProcess>
<Source>192.168.50.188</Source>
</ROW>
- <ROW>
<LogonDate>2007-06-22 15:35:06</LogonDate>
<Username>a-ws-admin</Username>
<LogonType>NtLmSsp</LogonType>
<LogonProcess>NTLM</LogonProcess>
<Source>192.168.50.188</Source>
</ROW>
- <ROW>
<LogonDate>2007-06-22 15:35:07</LogonDate>
<Username>a-ws-admin</Username>
<LogonType>NtLmSsp</LogonType>
<LogonProcess>NTLM</LogonProcess>
<Source>192.168.50.188</Source>
</ROW>
- <ROW>
<LogonDate>2007-06-22 15:35:07</LogonDate>
<Username>a-ws-admin</Username>
<LogonType>NtLmSsp</LogonType>
<LogonProcess>NTLM</LogonProcess>
<Source>192.168.50.188</Source>
</ROW>
</ROOT>