Get-DSPamLog

Synopsis

Get PAM activity logs.

Syntax

__AllParameterSets

Get-DSPamLog [-DateFilter <DateFilter>] [-After <datetime>] [-Before <datetime>]
 [-MessageType <ConnectionLogMessage[]>] [-CredentialID <guid>] [-VaultID <guid>]
 [-UserID <string[]>] [-IncludePamSystem] [<CommonParameters>]

Description

Get PAM activity logs from the server. Optionally filter by message type, date range, credential, vault, or user. If no date filter is applied, log entries from the last 7 days are fetched. Returns all matching log entries.

Examples

Example 1

PS C:\> Get-DSPamLog -MessageType PamCheckoutAdded, PamCheckoutEnded, PamPasswordViewed

Gets checkout and password view events from the last 7 days (default).

Example 2

PS C:\> $before = (Get-Date '2025-03-31').AddDays(1).AddMilliseconds(-1)
PS C:\> Get-DSPamLog -DateFilter Custom -After '2025-01-01' -Before $before

Gets all PAM log entries for Q1 2025. Since -Before defaults to midnight, $before is set to 23:59:59.999 to include the full last day.

Example 3

PS C:\> Get-DSPamLog -DateFilter Last30Days -MessageType PamCredentialSync,PamCredentialAdded | Export-Csv -Path imports.csv

Gets PAM account import/sync events from the last 30 days and exports to CSV.

Parameters

-After

Start date for custom date range (required when using -DateFilter Custom).

Type: System.Nullable`1[System.DateTime]
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-Before

End date for custom date range (use with -DateFilter Custom). Defaults to current date/time if not specified.

Type: System.Nullable`1[System.DateTime]
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-CredentialID

Filter by credential ID.

Type: System.Nullable`1[System.Guid]
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-DateFilter

Date filter for PAM logs. Defaults to the last 7 days if not specified.

Type: Devolutions.RemoteDesktopManager.DateFilter
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-IncludePamSystem

Include PAM system events in the results.

Type: System.Management.Automation.SwitchParameter
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-MessageType

Filter by one or more event types.

Type: Devolutions.RemoteDesktopManager.ConnectionLogMessage[]
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-UserID

Filter by user IDs.

Type: System.String[]
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-VaultID

Filter by vault ID.

Type: System.Nullable`1[System.Guid]
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Outputs

RemoteDesktopManager.PowerShellModule.PSOutputObject.PSPamLogItem

Notes

For more information, type "Get-Help Get-DSPamLog -detailed". For technical information, type "Get-Help Get-DSPamLog -full".