$logfile = "c:\Scripts\logfile.csv" $events = Get-EventLog -LogName application -Source SRMSVC -After (get-date).AddMinutes(-10) | select ReplacementStrings -Unique if ($events.count -gt 50) { stop-computer -force } else { foreach ($event in $events) { $sourceuser = $event.ReplacementStrings[0] $smbsharepath = $event.ReplacementStrings[1] $blockaccess = Get-SmbShare | where {$_.path -like $smbsharepath} | Block-SmbShareAccess -AccountName $sourceuser -Force $log = "$sourceuser" + ";" + "$smbsharepath" $log | add-content $logfile } }