Solved

Unable to display time in the powershell script parsing Event Log ?

Posted on 2016-09-13
4
45 Views
Last Modified: 2016-09-13
Hi People,

Can anyone here please help as to why the script below can display the rest of the column but not the time column ?

Get-ADComputer -LDAPFilter "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" | Get-EventLog -LogName Security 4720,4722,4725 |
 Select-Object EventId, Time, @{ 
   n='AccountName';
   e={ ($_.message -replace '\n', ' ') -replace '.*?account name:\t+([^\s]+).*', '$1' } 
 }, @{
   n='TargetAccount';
   e={ ($_.message -replace '\n', ' ') -replace '.*account name:\t+([^\s]+).*', '$1' } 
 } 

Open in new window


Am I missing anything here ?
0
Comment
  • 2
  • 2
4 Comments
 
LVL 83

Expert Comment

by:oBdA
ID: 41797345
The events returned don't have a property "Time". Try "TimeGenerated" instead.
1
 
LVL 7

Author Comment

by:Senior IT System Engineer
ID: 41797360
OBDA,

Thanks for the clarification,

somehow the pipe does not work ?

Get-EventLog : The input object cannot be bound to any parameters for the command either because the command does not take pipeline input or the input and its properties do not match any of the parameters that take
pipeline input.
0
 
LVL 83

Accepted Solution

by:
oBdA earned 500 total points
ID: 41797366
Sorry, didn't verify that part.
The ComputerName argument doesn't accept pipeline input, so you'll need a ForEach-Object:
Get-ADComputer -LDAPFilter "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" |
	ForEach-Object {
		"Processing $($_.DNSHostName) ..." | Write-Host
		Get-EventLog -ComputerName $_.DNSHostName -LogName Security 4720, 4722, 4725 |
		Select-Object -Property `
			EventId,
			TimeGenerated,
			@{n='AccountName'; e={ ($_.message -replace '\n', ' ') -replace '.*?account name:\t+([^\s]+).*', '$1' }},
			@{n='TargetAccount'; e={ ($_.message -replace '\n', ' ') -replace '.*account name:\t+([^\s]+).*', '$1' }}
	}

Open in new window

1
 
LVL 7

Author Closing Comment

by:Senior IT System Engineer
ID: 41797375
You are awesome man !
Thanks
0

Join & Write a Comment

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
In this article, I will show you HOW TO: Perform a Physical to Virtual (P2V) Conversion the easy way from a computer backup (image).
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now