ADの古いコンピュータを見つけることは正確ではありませんか？

Question

Get-EventLogコマンドで再生する。最初の3つのコマンドは期待通りに機能します。

Get-EventLog Application -Newest 1000 | Select Message 
Get-EventLog System -Newest 1000 | Select Message 
Get-EventLog Security -Newest 1000 | Select Message 

しかし、これは

Get-EventLog Setup -Newest 1000 | Select Message 

機能しないと、これは

Get-EventLog setup 

はどうして動作しませんか？セットアップにはキャプチャしたいWSUSエラーがあります。

Answer 1

申し訳ありませんが、これは少し時間がかかりますが、私はtry/catchステートメントやオーバーコミュニケーションが好きです。

#requires -Version 2.0 
function RemoteEventLog([Parameter(Mandatory=$true)]$LogName, $MaxEvents,[Parameter(Mandatory = $true)]$computers, $LogPath) 
{ 
    <# 
    .SYNOPSIS 
    Gather remote event logs by log name by computer names. 

    .DESCRIPTION 
    Specifiy a log name to narrow down the search. Provide as many computernames as needed. 

    .PARAMETER maxevents 
    -maxevents is all about how many events. 

    .PARAMETER computers 
    The array or list of comma separated computer names to run the script through. 

    .PARAMETER LogPath 
    -LogPath will let you decide the parent folder of the location to store the logs by computer name. 

    .EXAMPLE 
    RemoteEventLog -logname Application -maxevents 1000 -computers ('host1','host2','host3') 
    This will loop through the computers and bring back the log for each computer. 
#> 

$computers = $computers -split (',') 
try 
{ 
    $testLogPath = Test-Path $LogPath 
} 
catch 
{ 
    "Error was $_" 
    $line0 = $_.InvocationInfo.ScriptLineNumber 
    "Error was in Line $line0" 
} 
if(!($testLogPath)) 
{ 
    try 
    { 
    New-Item -Path $LogPath -ItemType Directory -ErrorAction:Stop 
    } 
    catch 
    { 
    "Error was $_" 
    $line1 = $_.InvocationInfo.ScriptLineNumber 
    "Error was in Line $line1" 
    } 
} 

foreach($computer in $computers) 
{ 
    try 
    { 
    $log = Get-WinEvent -LogName $logName -MaxEvents $maxevents -ComputerName $computer -ErrorAction:Stop 
} 
catch 
{ 
    "Error was $_" 
    $line2 = $_.InvocationInfo.ScriptLineNumber 
    "Error was in Line $line2" 
} 

try 
{ 
    New-Item -Path $LogPath -Name ("$computer.evt") -Value $log -Force 
    $log | Out-File -FilePath $LogPath  
} 
catch 
{ 
    "Error was $_" 
    $line3 = $_.InvocationInfo.ScriptLineNumber 
    ('Error was in Line {0}' -f $line3) 
    } 
} 
} 

RemoteEventLog -logname Application -MaxEvents 100 -computers 'localhost,computer2,computer3' -LogPath D:\Desktop\logs