Discover Top Posts Tagged with #get-winevent

Retrieve Certificate from Event log binary data

As I was looking into some errors in my event log I found that I had a number of certificate errors in the event log. In order to investigate this further I wanted to take a look at the certificate in the event log. There are a number of tools available to extract this from the event log but I wanted to be able to automate this in the future so I settled on writing this in PowerShell. I had the…

View On WordPress

#Binary #Certificate #EventLog #Get-WinEvent #Hexadecimal #PowerShell #ToByte #WriteAllBytes #[System.Convert]#[System.Io.File]

PSBlogweek: PowerShell logging in the Windows Event log

This post is part of the #PSBlogWeek PowerShell blogging series. #PSBlogWeek is a regular event where anyone interested in writing great content about PowerShell is welcome to volunteer for. The purpose is to pool our collective PowerShell knowledge together over a 5-day period and write about a topic that anyone using PowerShell may benefit from. #PSBlogWeek is a Twitter hashtag so feel free to…

View On WordPress

#Event Log #Get-WinEvent #Logging #New-EventLog #PowerShell #PowerShell.org #PSBlogWeek #Write-EventLog

Tracking When Users Log on and off From a Computer

I’ve been writing some white papers for Netwrix recently and thought I’d take a snippet from one of those and share with you here. It was a small part of the How to Track User Activity with AD Auditing and PowerShell white paper but I believe it showed a great way to pull data from event logs that isn’t so easily gotten.

The task at hand was when a couple audit policies were enabled and apply to…

View On WordPress

#event logs #Get-WinEvent

Quicktip: Use Windows Defender to scan a file or folder

As I was experimenting with the new PowerShell 5.0 cmdlets for Windows Defender I noticed that there is no parameter for starting a custom scan. As a workaround I used the mpcmdrun.exe tool to initiate the scan. For example the following code will execute a custom scan on C:\Temp: & "$($env:programfiles)\Windows Defender\mpcmdrun.exe" -Scan -ScanType 3 -File 'C:\Temp' This allows for scanning a…

View On WordPress

#Custom Scan #Get-WinEvent #Logging #Microsoft-Windows-Windows Defender/Operational #MpCmdRun.exe #Windows Defender

Quickie: Manage Event Logs via PowerShell

Here’s another module that I put together for a project I’ve been working on simply called EventLog. This module is pretty basic and includes the functions Enable/Disable/Save/Clear/Test which do exactly what you’d think they’d do.

This module is useful especially when dealing with the Applications and Services event logs. Since some of those logs are disabled by default you may need a way to…

View On WordPress

#event logs #Get-WinEvent

Aid Troubleshooting by Finding All Changes Within a Timeframe

Download this script on the Technet Script Repository

Here’s a script I built over a few weeks that’s helped me countless times track down those hard-to-reach problems. This script attempts to find all activity that happened on a computer within a certain timeframe. There are times where we’ve all discovered some crazy problem on a computer where we’re not quite sure where to look first. The only…

View On WordPress

#event logs #Get-WinEvent #log files

Powershell: Search all Event Logs Within a Specific Timeframe

There are times when I’m asked to help troubleshoot some random, obscure problem that only occurs on the third Tuesday of every other month. No one can figure it out and no one has a clue what’s going on. The only thing they know is that it happened at some certain time. One of the first activities any good admin does is check the logs at that time. What went on? What went wrong? Here’s how I do…

View On WordPress

#event logs #Get-WinEvent #Write-Progress

#get-winevent

Trending Tags

Recently Viewed Tags

#get-winevent