# ====================================================================================================
# 
# NAME: MonitorFailedLoginAttempts.ps1
# 
# AUTHOR: Yan Pan
# DATE  : 11/4/2007
# 
# COMMENT: This script captures failed login attempts.
# =====================================================================================================

$query = "SELECT * FROM AUDIT_LOGIN_FAILED"
$sqlnamespace = "root\Microsoft\SqlServer\ServerEvents\MSSQLSERVER"
$selections= "HostName","NTUserName","SQLInstance","Success","IsSystem","RequestID", `
"DatabaseID","DatabaseName","ComputerName","SessionLoginName","SPID","NTDomainName", `
"LoginName","StartTime","ApplicationName","EventSequence","PostTime","ClientProcessID", `
"Error","TextData"

Get-WMIEvent $query $sqlnamespace $selections