title: Powershell to count and group Event ID 4625?
body: <p>How can I get the total number of Event ID error 4625 and for each and every Windows Server in my AD domain using the below Powershell script?</p>
  <pre><code>$DCServers = Get-ADDomainController -filter * | select -ExpandProperty hostname
  
  $events = @()
  $totalCt = 0
  $servers = @()
  
  Foreach ($Server in $DCServers)
  {
      Write-Host &quot;Calling Get-WinEvent for $Server&quot;
      $serverEvents = Get-WinEvent -ComputerName $Server -FilterHashtable @{ logname = 'Security'; id = 4625 } -EA 0
      if (!$?)
      {
          Write-Host &quot;Get-WinEVent failure for $Server&quot;
          continue
      }
      if ($null -ne $serverEvents)
      {
          $totalCt += $serverEvents.Count
          $servers += [PsCustomObject] @{ $server = $serverEvents.Count }
          Write-Host $server $serverEvents.Count
      }
      
      $serverEvents | ForEach-Object {
          $events += [PsCustomObject] @{
              Date = $_.TimeCreated
              &quot;Event Id&quot; = $_.Id
              &quot;User Name&quot; = $_.Properties[6].Value + &quot;\&quot; + $_.Properties[5].Value ## fixed
              &quot;IPAddress&quot; = $_.Properties[21].Value
              &quot;FailureReason&quot; = (($_.message -split &quot;\n&quot;) | Select-String -Pattern &quot;Failure Reason:\s+(.+)&quot;).matches[0].groups[1].value
              &quot;Status Code&quot; = $_.message -split '\s{4}' | Select-String -Pattern &quot;Status&quot;
              &quot;Logon Type&quot; = $_.Properties[10].Value
              &quot;DC Logged On&quot; = $_.Properties[13].value ## this is &quot;workstation that processed the request&quot;, not the DC Logged On
          }
      }
      
  }
  
  $HTML = '&lt;h1&gt;Head&lt;/h1&gt;'
  $GetDate = Get-Date
  $Report = 'C:\clu\temp-4625.html'
  
  #convert the array of events to HTML
  $Events |
  Select-Object Date, &quot;Event Id&quot;, &quot;User Name&quot;, &quot;FailureReason&quot;, &quot;Status Code&quot;, &quot;DC Logged On&quot;, &quot;Logon Type&quot; |
  Convertto-html -head $HTML -PreContent &quot;&lt;H2&gt;Accounts that Failed to Log On&lt;/H2&gt;&quot;, &quot;&lt;H2&gt;$GetDate &lt;/H2&gt;&quot; -PostContent &quot;&lt;p&gt;&lt;/p&gt;Total 4625 records: $totalCt &lt;p&gt;&lt;/p&gt;&quot; |
  Out-File $Report -append
  
  Write-Host &quot;Total 4625 records: $totalCt&quot;
  Write-Host &quot;4625 records per server:&quot;
  $servers | ft -auto
  
  Write-Host &quot;4625 records grouped by user&quot;
  $events | group &quot;User Name&quot; | sort Count
  </code></pre>
  <p>The goal is to see which servers have Event 4625 and group it by the content to see which IP or AD account failed logins where possible?</p>