Powershell监控操作系统用户账号事件并预警

$ip=get-serverip
$loginedUser=get_login_user
$operateUser=cut-string $message '主题:' '目标帐户:'
$operateUser=cut-string $operateUser '帐户名:' '帐户域:'
$operateUser=$operateUser -replace('帐户名:'，'')
$delUser=$message.substring($message.indexof('目标帐户:'))
$delUser=cut-string $delUser '帐户名:' '帐户域:'
$delUser=$delUser -replace('帐户名:'，'')
$Body="<table width='700' border='1' cellpadding='0' cellspacing='0' style='font-size:13px;'>
<tr  style='background:#39F'>
<td>服务器</td>
<td>操作账号</td>
<td>被删除账号</td>
<td>操作时间</td>
<td>已登录账号</td>
</tr>
<tr>
<td>$ip</td>
<td>$operateUser</td>
<td>$delUser</td>
<td>$time</td>
<td>$loginedUser</td>
</tr>
</table>"
try
{
Send-Mail "Delete on $ip" $Body
}
catch
{
ac -Path c:UserNotice.log -Value "[ $time Delete] $error[0]"
}
}
#endregion
#region Software-Setup-Notice 软件安装事件
function Software-Setup-Notice
{
$softinfo=Get-WinEvent -logname setup -maxevents 10 | ? {$_.id -eq 1610} | select timecreated，message
if($softinfo -eq $null)
{
break
}
if(($softinfo.gettype()).isarray)
{
$time=$softinfo[0].timecreated
$time=$softinfo[0].tostring()
$message=$softinfo[0].message
}
else
{
$time=$softinfo.timecreated
$time=$time.tostring()
$message=$softinfo.message
}
$ip=get-serverip
$loginedUser=get_login_user
$Body="<table width='700' border='1' cellpadding='0' cellspacing='0' style='font-size:13px;'>
<tr  style='background:#39F'>
<td>服务器</td>
<td>已登录账号</td>
<td>安装时间</td>
<td>安装信息</td>
</tr>
<tr>
<td>$ip</td>
<td>$loginedUser</td>
<td>$time</td>
<td>$message</td>
</tr>
</table>"
try
{
Send-Mail 'Setup on $ip' $Body
}
catch
{
ac -Path c:UserNotice.log -Value "[ $time Setup] $error[0]"
}
}
#endregion
#region Main 入口函数
function Main{
param(
$str，
$script:code
)
if($str -eq $null)
{
Write-Warning 参数丢失!
sleep 2
break
}
if($str -eq 'login')
{
Login-Succ-Notice
}
if($str -eq 'cancel')
{
Cancel-Succ-Notice
}
if($str -eq 'add')
{
Create-User-Notice
}
if($str -eq 'delete')
{
Delete-User-Notice
}
if($str -eq 'setup')
{
Software-Setup-Notice
}
}
#endregion
main $args[0] $args[1]