Get-WinEvent | Powershell commands basic

Get-winevent -listlog * | findstr /I "security print"

Both print and security log source provider's name will be displayed. 

Get-winevent -listlog * | findstr /I /C:"security print"

 if it finds "security print" both words together then it will show you that.

get-winevent -listlog security and get-winevent -logname security (what is the difference between -listlog and -logname?)

Assuming security log provider is enabled meaning windows is generating security related events/logs and stores somewhere in the hard disk; and here logname or log provider name is security. If we give  get-winevent -listlog security then it will give us maximumsizeinbytes, recordcount and logname in a single line. You can also type get-winevent -listlog security | format-list -property * to see more field. 

For example, here logname is security, you can imagine security is a group where lots of security logs are grouped together. Recordcount is how many security logs or events are there under the security log group. What is their maximumsizeinbytes, so on. 

And if we give get-winevent -logname security, then this means, we want to see all the security logs/events under that security group. So if there are thousands then thousands will be shown. So we can limit that using -maxevents 1 command. 

get-winevent -logname security -maxevents 1

Now only 1 security events will be shown. 

To see all the log fields or property you can issue the below command.

get-winevent -logname security -maxevents 1 | format-list -property *

Now the main difference is, -logname will only work when log source provider (for example, security or print) is enabled. If not enabled then it will not work. Say if you give get-winevent -logname Microsoft-Windows-PrintService/Operational then it will not give any result if print log source provider is disabled. 

So in order to enable any log source (logname) via powershell script, you first need to select that (print) log source. To do that you can use switch -listlog. -listlog switch accepts log source name (i.e. security or microsoft-windows-printservice/operational) and * parameter.

Lets see how we can enable print log source provider:

$PSEL = Get-WinEvent -ListLog Microsoft-Windows-PrintService/Operational

$PSEL.IsEnabled = $True

$PSEL.LogMode = 'AutoBackup'

$PSEL.MaximumSizeInBytes = 90MB

$PSEL.SaveChanges()

Get-ComputerInfo | Out-Printer -Name 'Microsoft Print to PDF'

here IsEnabled, LogMode, MaximumSizeInBytes those are properties. you can check what are the properties are by typing:

get-winevent -listlog * | get-member

or 

get-winevent -logname security -maxevents 1 | get-member

where-object and comeparison operator in powershell:

In the above script we have also sent a print jobs to the printer. Now lets see that had been logged or not. time to query.

remember print jobs are under task category and task category is under TaskDisplayName.

where-object can help in this regard because where-object works as a filter. it allows you to construct a condition that returns true or false. when you are asked logs are enabled or disabled (here -eq switch is used) , when size is asked then greater than or less than is used, in these cases where-object are very handy.  

-eq, ge these are comparison operator.

Get-WinEvent -LogName Microsoft-Windows-PrintService/Operational | Where-Object -Property TaskDisplayName -in 'Printing a document','Isolating printer drivers and other plug-ins'

Get-WinEvent -ListLog * | Where-Object -Property MaximumSizeInBytes -ge 100MB

 

Get-WinEvent -ListLog * | Where-Object -Property IsEnabled -eq $False

Logical operator:

-filterscript parameter requires curly braces. 

-and, -or -xor, -not, !

-and means both conditions have to be true:

Get-Service | Where-Object -FilterScript { $PSItem.Name -eq 'W32Time' -and  $PSItem.Status -eq 'Running' }

-or means at least one condition has to be true:

Get-Service | Where-Object -FilterScript { $PSItem.Name -eq 'W32Time' -or  $PSItem.Name -eq 'WinRM' }

 -xor means only one condition can be true. if two conditions come true then no result will be outputted. one true another false, then result will be given. 

Get-Process | Where-Object -FilterScript { ($PSItem.ProcessName -eq 'System' -xor  $PSItem.Id -eq '3') }

here process id is incorrect. that is why the above command will give you a result. change the process id as 4 which is correct. then both the condition will be correct. so then it will not give you the result. 

-not or ! operator

!(Get-Service | Where-Object -FilterScript { $PSItem.Name -eq 'W32Time' }) 

get all events that have id's either 1025 or 1027 of microsoft-smbserver/operational.

Get-WinEvent -LogName Microsoft-Windows-SMBServer/Operational | Where-Object -FilterScript { $PSItem.Id -eq 1025 -or $PSItem.Id -eq 1027 }

 

Get-WinEvent -LogName Microsoft-Windows-SMBServer/Operational | Where-Object -FilterScript { $PSItem.Id -eq 1025 -and $PSItem.TimeCreated -gt '06/22/2020 12:00' }

 

 

how to store event log queries in variables and use them in strings. 

double quotes:

(0..2) | ForEach-Object { Write-Output -InputObject "This line no. $PSItem." }

This line no. 0.

This line no. 1.

This line no. 2.

single quotes:

(0..2) | ForEach-Object { Write-Output -InputObject 'This line no. $PSItem.' }

This line no. $PSItem.

This line no. $PSItem.

This line no. $PSItem.

 

another one: 

Input:

Write-Output -InputObject 'Use $Employees variable to interact with the data!' 

Output:

Use $Employees variable to interact with the data!

 

Get the number of events in the event log microsoft-windows-smbserver/operational by using the count property and store the query into a variable named SMBEvents. 

$SMBEvents = (Get-WinEvents -LogName Microsoft-Windows-SMBServer/operational).count

Write-Output -InputObject "Fount $SMBEvents events in Microsoft-Windows-SMBServer/Operational event log."  

output:

Fount 21 events in Microsoft-Windows-SMBServer/Operational event log.

 

FilterXPath Query:

 

Get-WinEvent -ListLog *

Get-WinEvent -ListProvider *  # List the system log providers

Get-WinEvent -LogName Security -MaxEvents 5  # Show the last 5 results for the *Security* provider

Get-WinEvent -LogName Security -FilterXPath '*/System/EventID=4624'

Get-WinEvent -LogName Security -FilterXPath '*/System/EventID=4648' -Oldest -MaxEvents 1

 

Get-WinEvent -LogName 'Security' -FilterXPath '*/*/EventID=4634' -MaxEvents 1 | Format-list -Property *

 

Or

 

Get-WinEvent -LogName 'Security' -FilterXPath '*/System/EventID=4634' -MaxEvents 1 | Format-list -Property *

 

The command still works without quotes. For example, you can type,

Get-WinEvent -LogName Security -FilterXPath */*/EventID=4634 -MaxEvents 1 | Format-list -Property *

 

 

Avi