Quantcast
Channel: The Official Scripting Guys Forum! forum
Viewing all articles
Browse latest Browse all 15028

Get-WinEvent script against a list of remote PC's

$
0
0

I'm trying to create a script that will run against a list of PC's, which displays the first and last instance of a specific event ID (in this case, 19). I have the following script working on the local PC:

$FilterXML = '<QueryList><Query Id="0" Path="System"><Select Path="System">*[System[(EventID=19) and TimeCreated[timediff(@SystemTime) &lt;= 2592000000]]]</Select></Query></QueryList>'
$LogonEvents = Get-WinEvent -FilterXml $FilterXML
$LogonEvents | sort -Property TimeCreated | Select-Object -First 1
$LogonEvents | sort -Property TimeCreated | Select-Object -Last 1
$LogonEvents_Count = Get-WinEvent -FilterXml $FilterXML | Measure-Object | select -ExpandProperty Count
Write "Updates count is: $LogonEvents_Count"

However, when I re-wrote it to support several machines, it's not returning anything at all. Any ideas?

$FilterXML = '<QueryList><Query Id="0" Path="System"><Select Path="System">*[System[(EventID=19) and TimeCreated[timediff(@SystemTime) &lt;= 604800000]]]</Select></Query></QueryList>'
$PC_List = "WKFD7SCCM82X86", "WKFD7SCCM8300", "WKFD7SCCMLAB2", "WKFD8VIEWBCH04"
$LogonEvents = ForEach ($PC in $PC_List) 
	{$PC; Get-WinEvent -FilterXml $FilterXML -ComputerName $PC
        $LogonEvents | sort -Property TimeCreated | Select-Object -First 1
        $LogonEvents | sort -Property TimeCreated | Select-Object -Last 1
		$LogonEvents_Count = Get-WinEvent -FilterXml $FilterXML | Measure-Object | select -ExpandProperty Count
		Write "Updates count is: $LogonEvents_Count"
}


Viewing all articles
Browse latest Browse all 15028

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>