Link to home
Start Free TrialLog in
Avatar of McKnife
McKnifeFlag for Germany

asked on

Get-Winevent script that shows detailed event info

Hi experts!

I am trying to "harvest" certain eventlog information from the log "Microsoft-Windows-AppLocker/EXE and DLL" of a win 2008 R2 server. I would like to get only events of EventID 8004 and it should tell me what user caused the event.

So far I have
get-winevent -logname "Microsoft-Windows-AppLocker/EXE and DLL" |. Where-Object{$_.id -eq 8004} |fl userid,message,TimeCreated

Open in new window

What I get shows the user SID - I don't know how to use powershell to get the name instead. Furthermore, I would like to get only events of today or even better only the last one of this type - I don't see how.

My goal is to attach an event triggered task to these events that starts this script which fetches the last event and sends a mail which has the output as body.

Can anyone help out?
ASKER CERTIFIED SOLUTION
Avatar of SubSun
SubSun
Flag of India image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of McKnife

ASKER

Thanks. Will be able to test it on friday.
Avatar of McKnife

ASKER

At home, in my hyper-v lab on server 2012, it works, but it shows no message text. No idea why. But that is not your code's fault as server 2008 R2 used with my line showed a message text.
Avatar of McKnife

ASKER

You're right, it's a bug. And on the connect page, people are not even sure what it is... I added a workaround @ms connect:
--
Confirming.

It goes away when you select the format to be en-us. It was de-de at my server 2012 RTM.
For a test I had to reopen Powershell ISE after switching the format to en-us.
--
Avatar of McKnife

ASKER

Excellent work, thank you. I added a |fl to line 5 to make it more readable.
Hope to be able to do this on my own in the future :)