Summarize failed logons
Documentation: Microsoft Learn
The FilterHashtable pins the Security channel and event ID 4625 with a start time one day back, so the log service performs the selection rather than the pipeline.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-WinEvent -FilterHashtable @{LogName= "Security";Id= 4625;StartTime=(Get-Date).AddDays(- 1)} | Select-Object TimeCreated,MachineName,Message- Stage 1Get-WinEvent
-FilterHashtable - Stage 2Select-Object
Positional values or no named parameters
How it works
The FilterHashtable pins the Security channel and event ID 4625 with a start time one day back, so the log service performs the selection rather than the pipeline. Each surviving record contributes its timestamp, the machine that logged it, and the message body carrying the account name and source details.
Adapting it
Group the results on a substring pulled from Message, or switch to Get-WinEvent -FilterXPath when the query needs to filter on the target account name, which a filter hashtable cannot express.
Requirements
Administrator rights or Event Log Readers membership on each target.
If the result is unexpected
A failed-logon summary has missing users or inflated counts.
Event fields vary by event type and querying the wrong log or time window changes the dataset.
- Inspect one raw event and map its named fields before aggregating by account.
Validate the result
The summary total reconciles with the filtered events and includes the observation window.
Keep the check reliable
Keep event IDs and field mappings explicit instead of relying on a fixed property index.
