Have Geek Brain

Using PowerShell and WMI to Read the Security Log

I am creating a script to read a security log from multiple computers. I can read the security log from my local machine without issue when using the Get-EventLog command, but the problem with it is that I cannot run it on the remote machine (script for powershell v1). The command below never returns any results, although it works fine with any other LogFile:

gwmi -Class Win32_NTLogEvent | where {$ _. LogFile -eq "Security"}

I've done some research and there seems to be an impersonation issue, but the -Impersonation option for Get-WmiObject doesn't seem to be implemented. Anyway, around this problem? The solution can run Get-EventLog on a remote computer, or deal with an issue issue to access the security log. Thanks to

+1


a source to share


2 answers


You can use .NET directly instead of going through WMI. The script block below will give you the first security log entry



$logs = [System.Diagnostics.EventLog]::GetEventLogs('computername')
$security = $logs | ? {$_.log -like 'Security'} 
$security.entries[0]
+3


a source


Have you tried using the -Credential parameter? Also, use filter parameter instead of where-object, it only gets security events (where-object gets ALL events from all logs and only then does the filtering)



gwmi Win32_NTLogEvent -filter "LogFile = 'Security'" -comp1, comp2 -credential domain \ user

+1


a source






More articles:


All Articles