Quick & Dirty scripting tools – the following Powershell script will dump the last X minutes of issued claims on an ADFS server (Assuming Auditing of Issued Claims has been turned on in the AD FS Management MMC).
$timeView=-5if($Args.count -gt 0) {$timeView=$args[0]}$StartTime = (Get-Date).AddMinutes($timeView)$output=Get-WinEvent -FilterHashtable @{
LogName = “Security”;
StartTime = $StartTime;
ID = 501}$output |fl
“Total issued claims:$($output.Count) $($timeView) minute view”