Albert Widjaja
asked on
Need some help in modifying Powershell script to go through event logs on multiple computers
Hi All,
Can anyone please assist me to modify the below script to accommodate multiple input of servers for specific criteria of Event logged ?
because when I saved the file from above code into:
it is failed.
Thanks in advance.
Can anyone please assist me to modify the below script to accommodate multiple input of servers for specific criteria of Event logged ?
Param (
[string[]]$listOfServers,
[string]$discoverDC,
[string]$eventLogName,
[string]$stringToSearchFor,
[bool]$table,
[bool]$list
)
If ($discoverDC.ToUpper() -eq "LOCALDOMAIN") {
$listOfServers = ([system.directoryservices.activedirectory.Domain]::GetCurrentDomain()).DomainControllers | ?{$_.IPAddress –ne $null} | %{$_.Name}
}
If ($discoverDC.ToUpper() -eq "LOCALSITE") {
$adSiteLocalComputer = [System.DirectoryServices.ActiveDirectory.ActiveDirectorySite]::GetComputerSite().Name
$listOfServers = ([system.directoryservices.activedirectory.Domain]::GetCurrentDomain()).DomainControllers | ?{$_.IPAddress –ne $null -And $_.SiteName -eq $adSiteLocalComputer} | %{$_.Name}
}
$relatedEvents = @()
$listOfServers | %{
$relatedEventsOnServer = Get-WinEvent -ComputerName $($_) -LogName $eventLogName | ?{ $_.Message -match $stringToSearchFor}
$relatedEvents += $relatedEventsOnServer
}
If ($table) {
$relatedEvents | FT Id, MachineName, LogName, TimeCreated, Message -AutoSize
} Else {
$relatedEvents | FL Id, MachineName, LogName, TimeCreated, Message
}
because when I saved the file from above code into:
Search-EventLog-For-String.ps1 -listOfServers (Get-AdDomain | Get-AdDomainController) -eventLogName Security -stringToSearchFor "DOMAIN\Administrator" -table $true
it is failed.
Thanks in advance.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER