{"id":75,"date":"2007-02-16T12:00:00","date_gmt":"2007-02-16T20:00:00","guid":{"rendered":"http:\/\/testblog.sapien.com\/index.php\/2007\/02\/16\/more-fast-furious-remote-event-logs\/"},"modified":"2007-02-16T12:00:00","modified_gmt":"2007-02-16T20:00:00","slug":"more-fast-furious-remote-event-logs","status":"publish","type":"post","link":"https:\/\/dev.sapien.com\/blog\/2007\/02\/16\/more-fast-furious-remote-event-logs\/","title":{"rendered":"More Fast & Furious: Remote Event Logs"},"content":{"rendered":"

The other day<\/a>, I demonstrated a fast &furious way to check eventlogs on the local computer. Unfortunately the Get-Eventlog cmdlet doesn’t have a remote computer option. To get event logs from remote computers, you need to use Get-WMIObject. Unfortunately,this requires a bit more work.<\/p>\n

Here’s the code you would need to run:<\/p>\n

$computer=”MyServer”
foreach ($log in (Get-WmiObject win32_nteventlogfile -computer $computer | Select-Object logfilename)) {
Write-Host -fore Green -back Black $log.logfilename ;
$query=”Select Eventcode,Eventtype,Logfile,Message,TimeGenerated from win32_NTLogEvent where logfile=’”+$log.logfilename+”’”;
Get-WmiObject -query $query -computer $computer | Select-Object EventCode,EventType,LogFile,Message,TimeGenerated -first 10 | More
} <\/font><\/p>\n

Hardly a friendly one-liner. Parsing out the eventlog file names is a little more cumbersome:<\/p>\n

Get-WmiObject win32_nteventlogfile -computer $computer | Select-Object logfilename<\/font><\/p>\n

But once I have them, I can build a query:<\/p>\n

$query=”Select Eventcode,Eventtype,Logfile,Message,TimeGenerated from win32_NTLogEvent where logfile=’”+$log.logfilename+”’”;<\/font>
And then run Get-WMIObject, again selecting just the information I want and piping it to More:<\/p>\n

Get-WmiObject -query $query -computer $computer | Select-Object EventCode,EventType,LogFile,Message,TimeGenerated -first 10 | More<\/font><\/p>\n

I tried using the query directly, but the -query parameter didn’t like $log.logfilename. Since having a separate query worked, I moved on.<\/p>\n

If you run this, it will look fine at first glance. But then you’ll realize you didn’ t see anything from Security eventlog. To access the Security Eventlog, you need to specify the Security Privilege. Unfortunately, the Get-WMIObject cmdlet has no such provision. The way around this is to use a WMISearcher object and enable privileges. You’ll also need to specify the remote computer in the scope.path:<\/p>\n

$searcher=new-object WMISearcher<\/font><\/p>\n

$searcher.Scope.Options.EnablePrivileges=1<\/font><\/p>\n

$searcher.scope.path=\$computer\\root\\cimv2<\/font><\/p>\n

Here’s what the modified code would look like:<\/p>\n

$computer=”dc01”
$searcher=new-object WMISearcher
$searcher.Scope.Options.EnablePrivileges=1
$searcher.scope.path=”\$computer\\root\\cimv2”
foreach ($log in (Get-WmiObject win32_nteventlogfile -computer $computer | Select-Object logfilename)) {
Write-Host -fore Green -back Black $log.logfilename ;
$query=”Select Eventcode,Eventtype,Logfile,Message,TimeGenerated from win32_NTLogEvent where logfile=’”+$log.logfilename+”’”
$searcher.query=$query
$searcher.get() | Select-Object EventCode,EventType,LogFile,Message,TimeGenerated -first 5 | More
} <\/font><\/p>\n

This should work, assuming you are running this with domain admin credentials. If you need to specify alternate credentials, then you not only have to pass them to the Get-WMIObject, but you also need to define them for the searcher object. But here’s the problem: the Get-WMIObject wants a secure string password, but the searcher object can only take plain text. I tried passing the results of ConvertFrom-SecureString as the searcher password, but no-go.<\/p>\n

Eventually this is what I came up with:<\/p>\n

$computer=”dc01”
$username=”mydomain\\administrator”
#password has to be entered as clear text
$pw=Read-Host “Enter the password you’ll need”
#but credential requires secure string
$securepw=ConvertTo-SecureString $pw -AsPlainText -Force
$cred=new-object -typename System.Management.Automation.PSCredential -argumentlist $username,$securepw
$searcher=new-object WMISearcher
$searcher.Scope.Options.EnablePrivileges=1
$searcher.scope.path=”\$computer\\root\\cimv2”
$searcher.scope.options.username=$cred.Username
$searcher.scope.options.password=$pw <\/font><\/p>\n

foreach ($log in (Get-WmiObject win32_nteventlogfile -computer $computer -credential $cred| Select-Object logfilename)) {
Write-Host -fore Green -back Black $log.logfilename ;
$query=”Select Eventcode,Eventtype,Logfile,Message,TimeGenerated from win32_NTLogEvent where logfile=’”+$log.logfilename+”’”
$searcher.query=$query
$searcher.get() | Select-Object EventCode,EventType,LogFile,Message,TimeGenerated -first 5 | More
}<\/font> <\/p>\n

As you can see, hardly a fast & furious solution and far from elegant.  The password you enter will be displayed as plain text. But this gets the job done. Although, if your logs are too big you might get a quota violation.  I’ll have to deal with that later. <\/p>\n

This task would be a whole lot easier if Get-Eventlog could query remote computers, or Get-WMIObject could set privileges. Actually, it would be great if both cmdlets could be enhanced to povide these features.<\/p>\n<\/p>\n

Technorati tags: PowerShell<\/a>, Scripting<\/a>, Cmdlet<\/a>, Functions<\/a>, EventLogs<\/a>, WMI<\/a><\/div>\n

 <\/p>\n

 <\/p>\n

del.icio.us tags: PowerShell<\/a>, Scripting<\/a>, Cmdlet<\/a>, Functions<\/a>, EventLogs<\/a>, WMI<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"

The other day, I demonstrated a fast &furious way to check eventlogs on the local computer. Unfortunately the Get-Eventlog cmdlet doesn’t have a remote computer option. To get event logs from remote computers, you need to use Get-WMIObject. Unfortunately,this requires a bit more work.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[25],"tags":[],"class_list":["post-75","post","type-post","status-publish","format-standard","hentry","category-windows-powershell"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/75","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=75"}],"version-history":[{"count":0,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/75\/revisions"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=75"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=75"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=75"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}