Add six-month domain and broker monitoring

scripts/Get-SguBrokerLog.ps1

@@ -0,0 +1,81 @@
+#Requires -Version 5.1
+[CmdletBinding()]
+param(
+    [datetime]$Since = (Get-Date).AddDays(-183),
+    [datetime]$Until = (Get-Date),
+    [string]$UserName,
+    [ValidateSet('Critical','Error','Warning','Information','Verbose')]
+    [string]$Level,
+    [int[]]$EventId,
+    [string]$Text,
+    [string]$MonitoringRoot = 'C:\ProgramData\SGU\Monitoring',
+    [string]$BrokerEventLogName = 'SGU Auth Broker',
+    [string]$OutputCsv
+)
+
+$ErrorActionPreference = 'Stop'
+$events = [Collections.Generic.List[object]]::new()
+$eventNames = @{
+    900 = 'BrokerStarted'
+    1000 = 'AuthenticationAuthorized'
+    1001 = 'AuthenticationRejected'
+    1002 = 'AuthenticationUnavailable'
+    1003 = 'AuthenticationInvalidRequest'
+    1100 = 'SguAuthenticationAccepted'
+    1101 = 'SguAuthenticationTimeout'
+    1102 = 'SguAuthenticationNetworkFailure'
+    1200 = 'ProfileEnrichmentCompleted'
+    1201 = 'ProfileHtmlUnexpected'
+    1202 = 'ProfileEnrichmentTimeout'
+    1203 = 'ProfileEnrichmentFailure'
+    1204 = 'ProfilePageUnavailable'
+    1300 = 'DirectorySynchronizationFailure'
+    1301 = 'DirectoryOptionalMetadataFailure'
+    1302 = 'DirectoryGroupMembershipFailure'
+}
+
+# Keep these reads unfiltered. Besides making archived and current logs behave
+# identically, this avoids the Windows Server 2025 ForwardedEvents query defect.
+if (Get-WinEvent -ListLog $BrokerEventLogName -ErrorAction SilentlyContinue) {
+    Get-WinEvent -LogName $BrokerEventLogName -ErrorAction SilentlyContinue |
+        Where-Object { $_.TimeCreated -ge $Since -and $_.TimeCreated -le $Until } |
+        ForEach-Object { $events.Add($_) }
+}
+
+$brokerArchiveRoot = Join-Path $MonitoringRoot 'Archive\Broker'
+Get-ChildItem -LiteralPath $brokerArchiveRoot -Filter '*.evtx' -File -ErrorAction SilentlyContinue |
+    Where-Object LastWriteTime -ge $Since.AddDays(-1) |
+    ForEach-Object {
+        try {
+            Get-WinEvent -Path $_.FullName -Oldest -ErrorAction Stop |
+                Where-Object { $_.TimeCreated -ge $Since -and $_.TimeCreated -le $Until } |
+                ForEach-Object { $events.Add($_) }
+        }
+        catch {
+            Write-Warning "Could not read broker archive $($_.FullName): $($_.Exception.Message)"
+        }
+    }
+
+$result = @($events | Where-Object {
+    (-not $UserName -or $_.Message -like "*$UserName*") -and
+    (-not $Level -or $_.LevelDisplayName -eq $Level) -and
+    (-not $EventId -or $_.Id -in $EventId) -and
+    (-not $Text -or $_.Message -like "*$Text*")
+} | Sort-Object TimeCreated -Descending | ForEach-Object {
+    [pscustomobject]@{
+        TimeCreated = $_.TimeCreated
+        Level = $_.LevelDisplayName
+        EventId = $_.Id
+        EventName = $eventNames[[int]$_.Id]
+        Provider = $_.ProviderName
+        Message = $_.Message
+    }
+})
+
+if ($OutputCsv) {
+    $resolvedOutput = [IO.Path]::GetFullPath($OutputCsv)
+    New-Item -ItemType Directory -Path (Split-Path $resolvedOutput -Parent) -Force | Out-Null
+    $result | Export-Csv -LiteralPath $resolvedOutput -NoTypeInformation -Encoding UTF8
+}
+
+$result