{"id":377,"title":"Windows Server 2019'da oturum a\u00e7ma\/kapama olaylar\u0131n\u0131 alma","content":"<p><strong>Script ne yapar:<\/strong><\/p>\n<ul>\n<li>\u2705 Ba\u015far\u0131l\u0131\/ba\u015far\u0131s\u0131z giri\u015fleri g&ouml;sterir<\/li>\n<li>\u2705 Oturum kapatma olaylar\u0131n\u0131 izler<\/li>\n<li>\u2705 RDP, konsol, network giri\u015flerini ay\u0131rt eder<\/li>\n<li>\u2705 Kaynak IP adreslerini g&ouml;sterir<\/li>\n<li>\u2705 &Ouml;zet istatistikler sunar<\/li>\n<li>\u2705 CSV'ye aktarma se&ccedil;ene\u011fi<\/li>\n<\/ul>\n<p><strong>Kullan\u0131m &ouml;rnekleri:<\/strong><\/p>\n<pre><code class=\"language-powershell\">Temel kullan\u0131m (son 30 g&uuml;n)\n.\\script.ps1\n\nSon 7 g&uuml;n&uuml; g&ouml;ster\n.\\script.ps1 -GunSayisi 7\n\nBelirli bir kullan\u0131c\u0131 i&ccedil;in\n.\\script.ps1 -KullaniciAdi \"john.doe\"\n\nSon 90 g&uuml;n, belirli kullan\u0131c\u0131\n.\\script.ps1 -GunSayisi 90 -KullaniciAdi \"admin\"\n<\/code><\/pre>\n<p><strong>&Ouml;nemli notlar:<\/strong><\/p>\n<ul>\n<li>PowerShell'i <strong>y&ouml;netici olarak<\/strong> &ccedil;al\u0131\u015ft\u0131rmal\u0131s\u0131n\u0131z<\/li>\n<li>Security event log'lar\u0131na eri\u015fim gereklidir<\/li>\n<li>Sistem hesaplar\u0131 (SYSTEM, NETWORK SERVICE vb.) otomatik filtrelenir<\/li>\n<\/ul>\n<p>Script, t&uuml;m oturum aktivitelerini detayl\u0131 \u015fekilde g&ouml;sterecek ve iste\u011fe ba\u011fl\u0131 olarak CSV format\u0131nda kaydedebilecektir.<\/p>\n<pre class=\"language-markup\"><code>param(\n    [int]$GunSayisi = 365,\n    [string]$KullaniciAdi = \"*\"\n)\n\nWrite-Host \"========================================\" -ForegroundColor Cyan\nWrite-Host \"Windows Server Oturum Aktivite Raporu\" -ForegroundColor Cyan\nWrite-Host \"========================================\" -ForegroundColor Cyan\nWrite-Host \"\"\n\n$BaslangicTarihi = (Get-Date).AddDays(-$GunSayisi)\n\nWrite-Host \"Tarih Aral\u0131\u011f\u0131: $($BaslangicTarihi.ToString('dd.MM.yyyy HH:mm')) - $(Get-Date -Format 'dd.MM.yyyy HH:mm')\" -ForegroundColor Yellow\nWrite-Host \"Loglar taran\u0131yor, l&uuml;tfen bekleyin...\" -ForegroundColor Yellow\nWrite-Host \"\"\n\n# Event ID'ler:\n# 4624 - Ba\u015far\u0131l\u0131 oturum a&ccedil;ma\n# 4625 - Ba\u015far\u0131s\u0131z oturum a&ccedil;ma\n# 4634 - Oturum kapatma\n# 4647 - Kullan\u0131c\u0131 taraf\u0131ndan oturum kapatma\n# 4648 - Farkl\u0131 kimlik bilgileriyle oturum a&ccedil;ma\n\n$EventIDs = @(4624, 4625, 4634, 4647, 4648)\n\ntry {\n    $Olaylar = Get-WinEvent -FilterHashtable @{\n        LogName = 'Security'\n        ID = $EventIDs\n        StartTime = $BaslangicTarihi\n    } -ErrorAction SilentlyContinue | ForEach-Object {\n        $Olay = $_\n        $KullaniciAdiBilgi = \"\"\n        $OturumTipi = \"\"\n        $Durum = \"\"\n        \n        switch ($Olay.Id) {\n            4624 { \n                $Durum = \"Ba\u015far\u0131l\u0131 Giri\u015f\"\n                $KullaniciAdiBilgi = $Olay.Properties[5].Value\n                $OturumTipi = switch ($Olay.Properties[8].Value) {\n                    2 { \"Interaktif (Konsol)\" }\n                    3 { \"Network\" }\n                    4 { \"Batch\" }\n                    5 { \"Service\" }\n                    7 { \"Unlock\" }\n                    8 { \"NetworkCleartext\" }\n                    9 { \"NewCredentials\" }\n                    10 { \"RemoteInteractive (RDP)\" }\n                    11 { \"CachedInteractive\" }\n                    default { \"Di\u011fer ($($Olay.Properties[8].Value))\" }\n                }\n            }\n            4625 { \n                $Durum = \"Ba\u015far\u0131s\u0131z Giri\u015f\"\n                $KullaniciAdiBilgi = $Olay.Properties[5].Value\n                $OturumTipi = \"Ba\u015far\u0131s\u0131z Deneme\"\n            }\n            4634 { \n                $Durum = \"Oturum Kapatma\"\n                $KullaniciAdiBilgi = $Olay.Properties[1].Value\n                $OturumTipi = \"Logoff\"\n            }\n            4647 { \n                $Durum = \"Kullan\u0131c\u0131 &Ccedil;\u0131k\u0131\u015f\u0131\"\n                $KullaniciAdiBilgi = $Olay.Properties[1].Value\n                $OturumTipi = \"User Initiated\"\n            }\n            4648 { \n                $Durum = \"Farkl\u0131 Kimlik ile Giri\u015f\"\n                $KullaniciAdiBilgi = $Olay.Properties[5].Value\n                $OturumTipi = \"Explicit Credentials\"\n            }\n        }\n        \n        if ($KullaniciAdi -ne \"*\" -and $KullaniciAdiBilgi -notlike \"*$KullaniciAdi*\") {\n            return\n        }\n        \n        if ($KullaniciAdiBilgi -match '^(SYSTEM|ANONYMOUS|LOCAL SERVICE|NETWORK SERVICE)$') {\n            return\n        }\n        \n        [PSCustomObject]@{\n            Zaman = $Olay.TimeCreated\n            EventID = $Olay.Id\n            Durum = $Durum\n            KullaniciAdi = $KullaniciAdiBilgi\n            OturumTipi = $OturumTipi\n            BilgisayarAdi = $Olay.MachineName\n            KaynakIP = if ($Olay.Properties[18].Value) { $Olay.Properties[18].Value } else { \"N\/A\" }\n        }\n    }\n    \n\n    if ($Olaylar) {\n        $Olaylar = $Olaylar | Sort-Object Zaman -Descending\n        \n        Write-Host \"Toplam Olay Say\u0131s\u0131: $($Olaylar.Count)\" -ForegroundColor Green\n        Write-Host \"\"\n        \n        $Olaylar | Format-Table -AutoSize @(\n            @{Label=\"Tarih\/Saat\"; Expression={$_.Zaman.ToString(\"dd.MM.yyyy HH:mm:ss\")}; Width=20}\n            @{Label=\"Durum\"; Expression={$_.Durum}; Width=25}\n            @{Label=\"Kullan\u0131c\u0131\"; Expression={$_.KullaniciAdi}; Width=20}\n            @{Label=\"Oturum Tipi\"; Expression={$_.OturumTipi}; Width=25}\n            @{Label=\"Kaynak IP\"; Expression={$_.KaynakIP}; Width=15}\n        )\n        \n        Write-Host \"`n========================================\" -ForegroundColor Cyan\n        Write-Host \"&Ouml;ZET \u0130STAT\u0130ST\u0130KLER\" -ForegroundColor Cyan\n        Write-Host \"========================================\" -ForegroundColor Cyan\n        \n        $Olaylar | Group-Object Durum | ForEach-Object {\n            Write-Host \"$($_.Name): $($_.Count)\" -ForegroundColor Yellow\n        }\n        \n        Write-Host \"`nEn Aktif Kullan\u0131c\u0131lar:\" -ForegroundColor Cyan\n        $Olaylar | Group-Object KullaniciAdi | Sort-Object Count -Descending | Select-Object -First 5 | ForEach-Object {\n            Write-Host \"  $($_.Name): $($_.Count) olay\" -ForegroundColor White\n        }\n        \n        Write-Host \"`n\" -NoNewline\n        $Cevap = Read-Host \"Sonu&ccedil;lar\u0131 CSV dosyas\u0131na kaydetmek ister misiniz? (E\/H)\"\n        if ($Cevap -eq 'E') {\n            $DosyaYolu = \"C:\\LoginActivity_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv\"\n            $Olaylar | Export-Csv -Path $DosyaYolu -NoTypeInformation -Encoding UTF8\n            Write-Host \"Rapor kaydedildi: $DosyaYolu\" -ForegroundColor Green\n        }\n        \n    } else {\n        Write-Host \"Belirtilen kriterlere uygun olay bulunamad\u0131.\" -ForegroundColor Red\n    }\n    \n} catch {\n    Write-Host \"HATA: $($_.Exception.Message)\" -ForegroundColor Red\n    Write-Host \"Not: Bu scripti y&ouml;netici olarak &ccedil;al\u0131\u015ft\u0131rman\u0131z gerekebilir.\" -ForegroundColor Yellow\n}\n\nWrite-Host \"`n\u0130\u015flem tamamland\u0131.\" -ForegroundColor Green<\/code><\/pre>","excerpt":"Windows Server 2019'da oturum a\u00e7ma\/kapama olaylar\u0131n\u0131 alma","created_at":"2026-01-05 12:59:55","updated_at":"2026-09-07 08:40:53","category_id":6,"view_count":434,"reading_time":3,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2026-01-05 09:59:55","featured_image":"\/uploads\/images\/2026\/01\/695b8b969cf1f_1767607190.png","slug":"windows-server-2019-da-oturum-acma-kapama-olaylarini-alma","category_name":"Sistem","category_slug":"sistem"}