McKnife
asked on
Get-Winevent script that shows detailed event info
Hi experts!
I am trying to "harvest" certain eventlog information from the log "Microsoft-Windows-AppLock er/EXE and DLL" of a win 2008 R2 server. I would like to get only events of EventID 8004 and it should tell me what user caused the event.
So far I have
My goal is to attach an event triggered task to these events that starts this script which fetches the last event and sends a mail which has the output as body.
Can anyone help out?
I am trying to "harvest" certain eventlog information from the log "Microsoft-Windows-AppLock
So far I have
get-winevent -logname "Microsoft-Windows-AppLocker/EXE and DLL" |. Where-Object{$_.id -eq 8004} |fl userid,message,TimeCreated
What I get shows the user SID - I don't know how to use powershell to get the name instead. Furthermore, I would like to get only events of today or even better only the last one of this type - I don't see how.My goal is to attach an event triggered task to these events that starts this script which fetches the last event and sends a mail which has the output as body.
Can anyone help out?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
At home, in my hyper-v lab on server 2012, it works, but it shows no message text. No idea why. But that is not your code's fault as server 2008 R2 used with my line showed a message text.
In win 2012 we have PS 3.0 which probably causing it..
See this thread..
http://social.technet.microsoft.com/Forums/windowsserver/en-US/12467b47-c1e6-4208-bbbf-9fec9b4b8111/getwinevent-has-no-message-data-when-using-powershell-3-
See this thread..
http://social.technet.microsoft.com/Forums/windowsserver/en-US/12467b47-c1e6-4208-bbbf-9fec9b4b8111/getwinevent-has-no-message-data-when-using-powershell-3-
ASKER
You're right, it's a bug. And on the connect page, people are not even sure what it is... I added a workaround @ms connect:
--
Confirming.
It goes away when you select the format to be en-us. It was de-de at my server 2012 RTM.
For a test I had to reopen Powershell ISE after switching the format to en-us.
--
--
Confirming.
It goes away when you select the format to be en-us. It was de-de at my server 2012 RTM.
For a test I had to reopen Powershell ISE after switching the format to en-us.
--
ASKER
Excellent work, thank you. I added a |fl to line 5 to make it more readable.
Hope to be able to do this on my own in the future :)
Hope to be able to do this on my own in the future :)
ASKER