18 lines
575 B
PowerShell
18 lines
575 B
PowerShell
$logfile = "c:\Scripts\logfile.csv"
|
|
$events = Get-EventLog -LogName application -Source SRMSVC -After (get-date).AddMinutes(-10) | select ReplacementStrings -Unique
|
|
if ($events.count -gt 50)
|
|
{
|
|
stop-computer -force
|
|
}
|
|
else
|
|
{
|
|
foreach ($event in $events)
|
|
{
|
|
$sourceuser = $event.ReplacementStrings[0]
|
|
$smbsharepath = $event.ReplacementStrings[1]
|
|
|
|
$blockaccess = Get-SmbShare | where {$_.path -like $smbsharepath} | Block-SmbShareAccess -AccountName $sourceuser -Force
|
|
$log = "$sourceuser" + ";" + "$smbsharepath"
|
|
$log | add-content $logfile
|
|
}
|
|
} |