SharpGetUserLoginIPRPC使用

SharpGetUserLoginIPRPC.exe localhost all
SharpGetUserLoginIPRPC.exe test.com\administrator:password@123@192.168.1.1 ""Event/System/TimeCreated/@SystemTime >= '2022-01-26T02:30:39' and Event/System/TimeCreated/@SystemTime <= '2022-01-26T02:31:00'""

获得本地登录日志

SharpGetUserLoginIPRPC.exe localhost all

远程查看日志

SharpGetUserLoginIPRPC.exe hdh.com\administrator:password.@10.211.55.9 all

当然这里账户输入普通用户权限也行，但是需要对应电脑域用户的