$exportFileName = "SMBv1Audit_$($(get-date).ToString('yyyyMMdd-HHmmss')).csv"
$exportFilePath = "c:\temp\"
$exportFileFull = $exportFilePath+$exportFileName
$evtxPathOrName = "E:\Logs\ForwardedEvents.evtx"


$lstADDomain = @()
$lstADDomain += $(Get-ADDomain).Forest
$lstADDomain += $(Get-ADDomain).ChildDomains

$lstDC = @()

foreach($ADDomain in $lstADDomain){
    $lstDC += $(Get-ADDomain -server:$ADDomain).ReadOnlyReplicaDirectoryServers
    $lstDC += $(Get-ADDomain -server:$ADDomain).replicadirectoryservers
}


$lstADCpt = @()

foreach($ADDomain in $lstADDomain){
    Write-Output "List computers in: $ADDomain"
    $lstADCpt += Get-ADComputer -filter * -Properties Name, DNSHostName, OperatingSystem, OperatingSystemVersion, Enabled, LastLogonDate, lastLogonTimestamp -Server $ADDomain | select Name, DNSHostName, OperatingSystem, OperatingSystemVersion, Enabled, LastLogonDate, lastLogonTimestamp
}


$LogsRAW3000 = ""
$LogClear3000 = @()
$LogsRAW3000 = Get-WinEvent -FilterHashtable @{path = $($evtxPathOrName);LogName = 'ForwardedEvents'; ID = 3000} | Select-Object *



foreach($log in $LogsRAW3000){

    $objLog = New-Object System.object
    $objLog | Add-Member -name ‘TimeCreated’ -MemberType NoteProperty -Value $log.TimeCreated
    $objLog | Add-Member -name ‘ClientSMBv1_IP’ -MemberType NoteProperty -Value $log.Properties[0].Value
    $objLog | Add-Member -name ‘ServerSMBv1_Name’ -MemberType NoteProperty -Value $log.MachineName

    if($lstDC | Where-Object{$_ -eq $log.MachineName}){
        $objLog | Add-Member -name ‘IsDC’ -MemberType NoteProperty -Value $true
    }else{
        $objLog | Add-Member -name ‘IsDC’ -MemberType NoteProperty -Value $false
    }

    $revers = ""
    $revers = Resolve-DnsName $log.Properties[0].Value -Type PTR -erroraction SilentlyContinue
    if($revers){
        $objLog | Add-Member -name ‘ClientRevers’ -MemberType NoteProperty -Value $($revers).NameHost
    }else{
        #$objLog | Add-Member -name ‘ClientRevers’ -MemberType NoteProperty -Value "NoRevers"

        if(!$($evt.ClientSMBv1_IP -like "1*")){      
            $objLog | Add-Member -name ‘ClientRevers’ -MemberType NoteProperty -Value $log.Properties[0].Value
        }else{
            $objLog | Add-Member -name ‘ClientRevers’ -MemberType NoteProperty -Value "NoRevers"
        }
    }

    $LogClear3000 += $objLog
}

$LogClear3000 | export-csv -Path $exportFileFull -NoTypeInformation -Encoding UTF8