How to use PowerShell to parse Security Event Logs and flag brute-force attempts. Brute-force attacks are a constant threat to modern IT environments. Let's walk through how to use PowerShell to parse Security Event Logs, detect repeated failed logons, and flag potential brute-force activity. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. Enable logon auditing across endpoints. First, confirm that Security auditing is enabled. Without proper logging, detection is impossible. Use Group Policy to enable Audit Logon for both Success and Failure events. Navigate to Computer Configuration, then Advanced Audit Policy Configuration, and enable logon auditing under Logon/Logoff. This ensures events such as 4625 for failed logons and 4624 for successful logons are recorded. After that, verify the Security log size to prevent overwriting critical events. Parse failed logons with PowerShell. Next, open PowerShell as Administrator and query Event ID 4625 from the Security log. Filter results to a defined timeframe, such as the last 24 hours. Extract the TimeCreated and Message fields, then parse usernames and source network addresses using pattern matching. Once extracted, export the results to CSV for reporting or investigation. At this stage, you now have structured failed logon data ready for analysis. Identify brute-force patterns and trigger alerts. Next, group failed attempts by source IP or username. Apply a threshold, such as 10 failed attempts, to flag suspicious activity. Adjust this number based on your risk tolerance. For example, some organizations may use five failed attempts within 10 minutes, depending on their security requirements. When a threshold is met, write detection results to the Windows Registry. This allows RMM platforms to monitor and trigger alerts. You can also log a warning event in the Application log, or create a firewall rule to block offending external IP addresses. Finally, account for edge cases. In Active Directory environments, failed logon events are typically recorded on domain controllers rather than individual workstations, so consider running the script centrally or using event forwarding. Exclude known service accounts or trusted synchronization tools to reduce false positives. Confirm scripts run with Administrator or System privileges to ensure registry and firewall updates succeed. For more information, check out our official blog post on how to use PowerShell to parse Security Event Logs and flag brute-force attempts, linked in the description below.