I'm trying to create a script that will run against a list of PC's, which displays the first and last instance of a specific event ID (in this case, 19). I have the following script working on the local PC:
$FilterXML = '<QueryList><Query Id="0" Path="System"><Select Path="System">*[System[(EventID=19) and TimeCreated[timediff(@SystemTime) <= 2592000000]]]</Select></Query></QueryList>' $LogonEvents = Get-WinEvent -FilterXml $FilterXML $LogonEvents | sort -Property TimeCreated | Select-Object -First 1 $LogonEvents | sort -Property TimeCreated | Select-Object -Last 1 $LogonEvents_Count = Get-WinEvent -FilterXml $FilterXML | Measure-Object | select -ExpandProperty Count Write "Updates count is: $LogonEvents_Count"
However, when I re-wrote it to support several machines, it's not returning anything at all. Any ideas?
$FilterXML = '<QueryList><Query Id="0" Path="System"><Select Path="System">*[System[(EventID=19) and TimeCreated[timediff(@SystemTime) <= 604800000]]]</Select></Query></QueryList>'
$PC_List = "WKFD7SCCM82X86", "WKFD7SCCM8300", "WKFD7SCCMLAB2", "WKFD8VIEWBCH04"
$LogonEvents = ForEach ($PC in $PC_List)
{$PC; Get-WinEvent -FilterXml $FilterXML -ComputerName $PC
$LogonEvents | sort -Property TimeCreated | Select-Object -First 1
$LogonEvents | sort -Property TimeCreated | Select-Object -Last 1
$LogonEvents_Count = Get-WinEvent -FilterXml $FilterXML | Measure-Object | select -ExpandProperty Count
Write "Updates count is: $LogonEvents_Count"
}