HelpCache/IpamIpAuditEvent.cdxml-help.xml
|
<?xml version = "1.0" encoding = "utf-8" ?>
<helpItems schema="maml"> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"><command:details><command:name>Get-IpamIpAddressAuditEvent</command:name><maml:description><maml:para>Gets all IP address audit events in IPAM. </maml:para></maml:description><maml:copyright><maml:para /></maml:copyright><command:verb>Get</command:verb><command:noun>IpamIpAddressAuditEvent</command:noun><dev:version /></command:details><maml:description><maml:para>The Get-IpamIpAddressAuditEvent cmdlet gets all IP address audit events from an IP Address management (IPAM) server over a time interval. IPAM enables IP address tracking through correlation of DHCP lease events on managed DHCP servers with user and machine authentication events on managed domain controllers and Network Policy Server (NPS) servers. You can search correlated events by IP address, client ID, hostname, or username. Use DCHP events between a start date and an end date to correlate data. The data returned includes data for both the start date and the end date.</maml:para><maml:para>The cmdlet returns only the top 10,000 rows if the query results exceed more than 10,000 rows. A warning occurs when this happens. Narrow the search criteria to limit the results. </maml:para></maml:description><command:syntax><command:syntaxItem><maml:name>Get-IpamIpAddressAuditEvent</maml:name><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>EndDate</maml:name><maml:description><maml:para>Specifies the end date, as a DateTime object, for which to get the event data. To get a DateTime object, use the Get-Date cmdlet and specify the date in DD/MM/YYYY format.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>StartDate</maml:name><maml:description><maml:para>Specifies the start date as a DateTime object. To get a DateTime object, use the Get-Date cmdlet and specify the date in DD/MM/YYYY format.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue></command:parameter><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>UserName</maml:name><maml:description><maml:para>Specifies an array of user names. Use this parameter to search correlated events by username. Searching by user's domain name is not supported. Logon events are included in this search because user names are not specified in DHCP lease events.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter></command:syntaxItem><command:syntaxItem><maml:name>Get-IpamIpAddressAuditEvent</maml:name><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>CorrelateLogonEvents</maml:name><maml:description><maml:para>Indicates that the cmdlet correlates logon events. Use this parameter to include or exclude user and machine events from domain controllers and NPS servers. If you specify this parameter, logon events are included in the correlated set of events retrieved by this cmdlet. </maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>EndDate</maml:name><maml:description><maml:para>Specifies the end date, as a DateTime object, for which to get the event data. To get a DateTime object, use the Get-Date cmdlet and specify the date in DD/MM/YYYY format.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>HostName</maml:name><maml:description><maml:para>Specifies an array of host names. Use this parameter to search correlated events by host name. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">String</command:parameterValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>StartDate</maml:name><maml:description><maml:para>Specifies the start date as a DateTime object. To get a DateTime object, use the Get-Date cmdlet and specify the date in DD/MM/YYYY format.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue></command:parameter></command:syntaxItem><command:syntaxItem><maml:name>Get-IpamIpAddressAuditEvent</maml:name><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>CorrelateLogonEvents</maml:name><maml:description><maml:para>Indicates that the cmdlet correlates logon events. Use this parameter to include or exclude user and machine events from domain controllers and NPS servers. If you specify this parameter, logon events are included in the correlated set of events retrieved by this cmdlet. </maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>EndDate</maml:name><maml:description><maml:para>Specifies the end date, as a DateTime object, for which to get the event data. To get a DateTime object, use the Get-Date cmdlet and specify the date in DD/MM/YYYY format.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>IpAddress</maml:name><maml:description><maml:para>Specifies an IP address. Use this parameter to search correlated events by IPv4 address. The cmdlet does not support IPv6 address tracking. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">String</command:parameterValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>StartDate</maml:name><maml:description><maml:para>Specifies the start date as a DateTime object. To get a DateTime object, use the Get-Date cmdlet and specify the date in DD/MM/YYYY format.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue></command:parameter></command:syntaxItem><command:syntaxItem><maml:name>Get-IpamIpAddressAuditEvent</maml:name><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>CorrelateLogonEvents</maml:name><maml:description><maml:para>Indicates that the cmdlet correlates logon events. Use this parameter to include or exclude user and machine events from domain controllers and NPS servers. If you specify this parameter, logon events are included in the correlated set of events retrieved by this cmdlet. </maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>ClientId</maml:name><maml:description><maml:para>Specifies an array of client IDs. Use this parameter to search for audit events by MAC address. You may use dashes (-) in the client ID but they are not required. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">String</command:parameterValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>EndDate</maml:name><maml:description><maml:para>Specifies the end date, as a DateTime object, for which to get the event data. To get a DateTime object, use the Get-Date cmdlet and specify the date in DD/MM/YYYY format.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>StartDate</maml:name><maml:description><maml:para>Specifies the start date as a DateTime object. To get a DateTime object, use the Get-Date cmdlet and specify the date in DD/MM/YYYY format.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue></command:parameter></command:syntaxItem></command:syntax><command:parameters><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue><dev:type><maml:name>CimSession[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>ClientId</maml:name><maml:description><maml:para>Specifies an array of client IDs. Use this parameter to search for audit events by MAC address. You may use dashes (-) in the client ID but they are not required. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">String</command:parameterValue><dev:type><maml:name>String</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>CorrelateLogonEvents</maml:name><maml:description><maml:para>Indicates that the cmdlet correlates logon events. Use this parameter to include or exclude user and machine events from domain controllers and NPS servers. If you specify this parameter, logon events are included in the correlated set of events retrieved by this cmdlet. </maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>EndDate</maml:name><maml:description><maml:para>Specifies the end date, as a DateTime object, for which to get the event data. To get a DateTime object, use the Get-Date cmdlet and specify the date in DD/MM/YYYY format.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue><dev:type><maml:name>DateTime</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>HostName</maml:name><maml:description><maml:para>Specifies an array of host names. Use this parameter to search correlated events by host name. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">String</command:parameterValue><dev:type><maml:name>String</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>IpAddress</maml:name><maml:description><maml:para>Specifies an IP address. Use this parameter to search correlated events by IPv4 address. The cmdlet does not support IPv6 address tracking. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">String</command:parameterValue><dev:type><maml:name>String</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>StartDate</maml:name><maml:description><maml:para>Specifies the start date as a DateTime object. To get a DateTime object, use the Get-Date cmdlet and specify the date in DD/MM/YYYY format.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue><dev:type><maml:name>DateTime</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue><dev:type><maml:name>Int32</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>UserName</maml:name><maml:description><maml:para>Specifies an array of user names. Use this parameter to search correlated events by username. Searching by user's domain name is not supported. Logon events are included in this search because user names are not specified in DHCP lease events.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue><dev:type><maml:name>String[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter></command:parameters><command:inputTypes><command:inputType><dev:type><maml:name></maml:name><maml:uri></maml:uri><maml:description><maml:para /></maml:description></dev:type><maml:description></maml:description></command:inputType></command:inputTypes><command:returnValues><command:returnValue><dev:type><maml:name>IpamIpAuditEvent</maml:name><maml:uri></maml:uri><maml:description><maml:para /></maml:description></dev:type><maml:description><maml:para> Represents an IP address audit event in IPAM </maml:para></maml:description></command:returnValue></command:returnValues><command:terminatingErrors /><command:nonTerminatingErrors /><command:examples><command:example><maml:title>Example 1: Get all IP address audit events</maml:title><maml:introduction><maml:para></maml:para></maml:introduction><dev:code>PS C:\> $Today = Get-DatePS C:\>$LastMonth = $Today.AddDays(-30)PS C:\>$IpamIpAddressAuditEvents = Get-IpamIpAuditEvent -StartDate $LastMonth -EndDate $Today </dev:code><dev:remarks><maml:para>This command gets all IP address audit events between a start date and an end date. The command gets only DHCP lease data. The command stores the results in the variable named .$IpamIpAddressAuditEvents</maml:para></dev:remarks><command:commandLines><command:commandLine><command:commandText /></command:commandLine></command:commandLines></command:example><command:example><maml:title>Example 2: Get all IP address audit events for an end date and a start date</maml:title><maml:introduction><maml:para></maml:para></maml:introduction><dev:code>PS C:\> $Today = Get-DatePS C:\>$LastMonth=$Today.AddDays(-30)PS C:\>$IpamIpAddressAuditEvents = Get-IpamIpAuditEvent -StartDate $LastMonth -EndDate $Today -IpAddress 10.10.1.1 </dev:code><dev:remarks><maml:para>This command gets all IP address audit events for a given IP address, between a start date and an end date. This command searches only DHCP lease events. The command stores the results in the variable named $IpamIpAddressAuditEvents.</maml:para></dev:remarks><command:commandLines><command:commandLine><command:commandText /></command:commandLine></command:commandLines></command:example><command:example><maml:title>Example 3: Get all IP address audit events, user events, and logon events for an end date and a start date</maml:title><maml:introduction><maml:para></maml:para></maml:introduction><dev:code>PS C:\> $Today = Get-DatePS C:\>$LastMonth=$today.AddDays(-30)PS C:\>$IpamIpAddressAuditEvents = Get-IpamIpAuditEvent -StartDate $lastMonth -EndDate $today -IpAddress 10.10.1.1 -CorrelateLogonEvents </dev:code><dev:remarks><maml:para>This command gets all IP address audit events for a given IP address, between a start date and an end date. The command includes user and machine logon events from DC and NPS by using the CorrelateLogonEvents parameter. The command stores the results in the variable named $IpamIpAddressAuditEvents.</maml:para></dev:remarks><command:commandLines><command:commandLine><command:commandText /></command:commandLine></command:commandLines></command:example><command:example><maml:title>Example 4: Get all IP address audit events by MAC address</maml:title><maml:introduction><maml:para></maml:para></maml:introduction><dev:code>PS C:\> $Today = Get-DatePS C:\>$LastMonth=$Today.AddDays(-30)PS C:\>$IpamIpAddressAuditEvents = Get-IpamIpAuditEvent -StartDate $LastMonth -EndDate $Today -ClientId "AA:BB:CC:DD:EE:FF" -CorrelateLogonEvents </dev:code><dev:remarks><maml:para>This command gets all IP address audit events for a client ID, between a start date and an end date. The command includes user and machine log-on events from DC and NPS by using the CorrelateLogonEvents parameter. The command stores the results in the variable named $IpamIpAddressAuditEvents.</maml:para></dev:remarks><command:commandLines><command:commandLine><command:commandText /></command:commandLine></command:commandLines></command:example><command:example><maml:title>Example 5: Get all IP address audit events by hostname</maml:title><maml:introduction><maml:para></maml:para></maml:introduction><dev:code>PS C:\> $Today = Get-DatePS C:\>$LastMonth=$Today.AddDays(-30)PS C:\>$IpamIpAddressAuditEvents = Get-IpamIpAuditEvent -StartDate $LastMonth -EndDate $Today -HostName client1.contoso.com -CorrelateLogonEvents </dev:code><dev:remarks><maml:para>This command gets all IP address audit events for a given hostname, between a start date and an end date. Also include user and machine log-on events from DC and NPS by using -CorrelateLogonEvents option. The command stores the results in the variable named $IpamIpAddressAuditEvents.</maml:para></dev:remarks><command:commandLines><command:commandLine><command:commandText /></command:commandLine></command:commandLines></command:example><command:example><maml:title>Example 6: Get all IP address audit events by username</maml:title><maml:introduction><maml:para></maml:para></maml:introduction><dev:code>PS C:\> $Today = Get-DatePS C:\>$LastMonth=$Today.AddDays(-30)PS C:\>$IpamIpAddressAuditEvents = Get-IpamIpAuditEvent -StartDate $LastMonth -EndDate $Today -HostName client1.contoso.com </dev:code><dev:remarks><maml:para>This command gets all IP address audit events for a username, between a start date and an end date. Since username is available only from authentication data, this data is always included while querying for audit events based on username. The command stores the results in the variable named $IpamIpAddressAuditEvents.</maml:para></dev:remarks><command:commandLines><command:commandLine><command:commandText /></command:commandLine></command:commandLines></command:example></command:examples><maml:relatedLinks><maml:navigationLink><maml:linkText>Online Version:</maml:linkText><maml:uri>http://go.microsoft.com/fwlink/?LinkID=309419</maml:uri></maml:navigationLink><maml:navigationLink><maml:linkText>Remove-IpamIpAddressAuditEvent</maml:linkText><maml:uri /></maml:navigationLink></maml:relatedLinks></command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"><command:details><command:name>Remove-IpamIpAddressAuditEvent</command:name><maml:description><maml:para>Removes IP address audit events from the IPAM database. </maml:para></maml:description><maml:copyright><maml:para /></maml:copyright><command:verb>Remove</command:verb><command:noun>IpamIpAddressAuditEvent</command:noun><dev:version /></command:details><maml:description><maml:para>The Remove-IpamIpAddressAuditEvent cmdlet permanently removes all IP address audit events, including the events collected on the date identified by the EndDate parameter, from the IP Address Management (IPAM) database. </maml:para></maml:description><command:syntax><command:syntaxItem><maml:name>Remove-IpamIpAddressAuditEvent</maml:name><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>Force</maml:name><maml:description><maml:para>Forces the command to run without asking for user confirmation.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>EndDate</maml:name><maml:description><maml:para>Specifies the end date, in YYYY/MM/DD.hh:mm:ss format, for which to delete the event data. The cmdlet deletes all event data up to, and including, this date. The value cannot be the same as the current date. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>Confirm</maml:name><maml:description><maml:para>Prompts you for confirmation before running the cmdlet.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>WhatIf</maml:name><maml:description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para></maml:description></command:parameter></command:syntaxItem></command:syntax><command:parameters><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue><dev:type><maml:name>CimSession[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases=""><maml:name>EndDate</maml:name><maml:description><maml:para>Specifies the end date, in YYYY/MM/DD.hh:mm:ss format, for which to delete the event data. The cmdlet deletes all event data up to, and including, this date. The value cannot be the same as the current date. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">DateTime</command:parameterValue><dev:type><maml:name>DateTime</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>Force</maml:name><maml:description><maml:para>Forces the command to run without asking for user confirmation.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue><dev:type><maml:name>Int32</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>Confirm</maml:name><maml:description><maml:para>Prompts you for confirmation before running the cmdlet.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue>false</dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>WhatIf</maml:name><maml:description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue>false</dev:defaultValue></command:parameter></command:parameters><command:inputTypes><command:inputType><dev:type><maml:name></maml:name><maml:uri></maml:uri><maml:description><maml:para /></maml:description></dev:type><maml:description></maml:description></command:inputType></command:inputTypes><command:returnValues><command:returnValue><dev:type><maml:name>IpamIpAuditEvent</maml:name><maml:uri></maml:uri><maml:description><maml:para /></maml:description></dev:type><maml:description><maml:para> Represents an IP address audit event in IPAM </maml:para></maml:description></command:returnValue></command:returnValues><command:terminatingErrors /><command:nonTerminatingErrors /><command:examples><command:example><maml:title>Example 1: Remove all event data</maml:title><maml:introduction><maml:para></maml:para></maml:introduction><dev:code>PS C:\>$Today = Get-DatePS C:\>Remove-IpamIpAuditEvent -EndDate $Today Confirm All Event catalog data up to and including the date selected by you will be deleted permanently. Do you want to continue? [Y] Yes [N] No [S] Suspend [?] Help (default is "Y"):Y </dev:code><dev:remarks><maml:para>This command removes all IP address audit event data prior to today. </maml:para></dev:remarks><command:commandLines><command:commandLine><command:commandText /></command:commandLine></command:commandLines></command:example></command:examples><maml:relatedLinks><maml:navigationLink><maml:linkText>Online Version:</maml:linkText><maml:uri>http://go.microsoft.com/fwlink/?LinkID=309438</maml:uri></maml:navigationLink><maml:navigationLink><maml:linkText>Get-IpamIpAddressAuditEvent</maml:linkText><maml:uri /></maml:navigationLink></maml:relatedLinks></command:command> </helpItems> |