get-eventlog exports GUIDs instead of friendly object names/paths
the get-eventlog command apparently exports guids fields (object types, object names, additional info, etc.). there anyway "user friendly" object name replace guids? example, event 566 on windows 2003 server, if makes change organizational unit,
the output get-eventlog looks this:
object type: %{bf967a9c-0de6-11d0-a285-00aa003049e2}
object name: %{e9047ae5-2a37-43a6-81f4-aaca2cd028e6}
but when view same event in eventvwr, looks this:
object type: organizationalunit
object name: ou=computers,ou=staff,ou=testingou,ou=technology,dc=childdomain,dc=domain,dc=net
$desthost = "server1" $destdrive = "d$" $computer = gc env:computername $tmpdate = get-date -format "mm-dd-yyyy-hhmm" $nowrun = get-date -format g $lastrun = gc env:lastrun if ($? -eq $false) {$lastrun = "11/10/2010 09:00 am"} $eventidz = @(566,624,626,629,630,631,632,633,634,635,638,639,641,642,644,647,654,657,658,659,662,685) echo "starting seclog export on $computer @ $nowrun" get-eventlog security -instanceid $eventidz -after "$lastrun" | select -excludeproperty message,data,index,category,categorynumber,replacementstrings -property *,@{n="message";e={$_.message -replace "`r`n", ' : '}} | export-csv "c:\seclogs\$computer-$tmpdate.csv" if ($? -eq $false) {add-content "\\$desthost\$destdrive\seclogs\errors.txt" -value ("error detected on $computer @ $nowrun")} [environment]::setenvironmentvariable("lastrun", "$nowrun", "machine") $nowfin = get-date -format g echo "finishing seclog export on $computer @ $nowfin"
have here
http://social.technet.microsoft.com/forums/en/itcg/thread/728c6aed-a3ef-4b6f-b5bc-28024251d5eb
Windows Server > Windows PowerShell
Comments
Post a Comment