Report log software restriction from all computers in domain

Question

How can I execute in all cpu get-winevent as in the example below using the $computers variable?

Get-WinEvent -FilterHashTable @{LogName= "Application"; ProviderName="Microsoft-Windows-SoftwareRestrictionPolicies";StartTime=$StartTime} -ErrorAction SilentlyContinue 

$Computers = get-adcomputer -SearchBase "OU=Workstations,DC=FQDN,DC=local" -filter * -Properties MemberOf | where-object {[string]$_.memberof -notmatch 'CN=NPS' } | select Name | Format-Table -HideTableHeaders | Out-File C:\Users\user\Desktop\cpu1.txt
gc C:\Users\user\Desktop\cpu1.txt | where {$_ -ne ""} > C:\Users\user\Desktop\cpu2.txt
$cpu = Get-Content C:\Users\user\Desktop\cpu2.txt
$a = New-PSSession -ComputerName $cpu

I try to use enter-pssession -computername $cpu or enter-pssession -session $a but this does not work.

I use invoke-command below:

Invoke-Command -ComputerName $cpu -ScriptBlock {Get-WinEvent -FilterHashTable @{LogName= "Application"; ProviderName="Microsoft-Windows-SoftwareRestrictionPolicies";StartTime=$StartTime}}

But I have this error:

A null value was encountered in the StartTime hash table key. Null values are not permitted.
+ CategoryInfo          : InvalidArgument: (StartTime:String) [Get-WinEvent], Exception
+ FullyQualifiedErrorId : NullNotAllowedInHashtable,Microsoft.PowerShell.Commands.GetWinEventCommand
+ PSComputerName        : computername

I'm trying to copy logs for all cpu to a csv file.

Answer 1

The problem is that $StartTime is not available inside the -ScriptBlock scope. You need to provide it with ArgumentList , like:

Invoke-Command -ComputerName $cpu -ScriptBlock {param($StartTime) Get-WinEvent -FilterHashTable @{LogName= "Application"; ProviderName="Microsoft-Windows-SoftwareRestrictionPolicies";StartTime=$StartTime}} -ArgumentList $StartTime

On the side note, next time please simplify your example to minimum, as we are not really interested in the way you are getting the computers