Powershell when to like match and NOT!

[darkgen]

Another silly pickle; I'm trying to pull the last logon event based on the netlogon type and a domain account BUT ignoring a specific (or potentially a number of specific accounts).

Here is what I have, which pulls last domain account entry

$GetEventEntry = Get-Winevent -ComputerName $computer -FilterHashtable @{Logname='security'; ID=4624; StartTime=(Get-Date).addDays(-32)} | where {($_.properties[8].value -eq 2 -or $_.properties[8].value -eq 10) -and ($_.properties[6].value -like "domainname")}|  Select-Object $properties | Select-Object -First 1

This pulls the last domain entry as expected. However; I then wish to ignore where it also matches a specific account so have added another condition as follows:

$GetEventEntry = Get-Winevent -ComputerName $computer -FilterHashtable @{Logname='security'; ID=4624; StartTime=(Get-Date).addDays(-32)} | where {($_.properties[8].value -eq 2 -or $_.properties[8].value -eq 10) -and ($_.properties[6].value -like "domainname" -and $_.properties[6].value -notmatch "accounttoignore")}|  Select-Object $properties | Select-Object -First 1

But it still pulls the accounttoignore as the last domain entry.

Hmm.

 

[Washout]

Just ran that on one of our servers here - you've used the same field for the account you're trying not to match as the domain, 6. Looks like account should be 5!

 

[darkgen]

So let me unpick that.

$_.properties[6].value can be DOMAIN\ACCOUNT

I would like to only pull the last entry when it matches it is a DOMAIN account; just not DOMAIN\accounttoignore

AND I just clocked what you meant; use 6 to determine if domain and then 5 for the account match.

 

[Washout]

So let me unpick that.

$_.properties[6].value can be DOMAIN\ACCOUNT

I would like to only pull the last entry when it matches it is a DOMAIN account; just not DOMAIN\accounttoignore

AND I just clocked what you meant; use 6 to determine if domain and then 5 for the account match.

Yeah, or you could, if you wanted to only use 6 say something like -notlike "*\$accounttoignore"